Repository navigation
Pin current devpi releases and monitor upstream updates - #1
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The image currently resolves floating devpi ranges at build time, so the repository cannot reliably show which versions it validates. Pin devpi-server 6.20.3, devpi-web 5.1.1 and devpi-client 7.3.0, the current stable PyPI releases already allowed by those ranges.
Add a daily and manually runnable version check that maintains one update issue per dependency, ignores prereleases and yanked candidates, flags withdrawn pins or Python compatibility changes, and closes resolved alerts. Pull requests run the monitor tests without issue-writing permissions. Updates and Railway deployments remain manual.
Refresh checkout and Buildx to their current major versions. The container smoke test pulls the Python base and runs pip check before checking the theme, authentication, upload, install and persistence. Document the maintenance workflow and its scope.
Validation: 15 unit tests passed locally; shell syntax, workflow YAML and live PyPI lookups passed. The full container smoke test runs on this PR. This PR also allows GitHub to produce a signed squash commit, as required by the main branch rules.