sonatype-nexus-community / jake

Check your Python environments for vulnerable Open Source packages with OSS Index or Sonatype Nexus Lifecycle.
https://jake.readthedocs.io/
Apache License 2.0
111 stars 24 forks source link

Update pyproject.toml - allow higher rich version #147

Closed cshaley closed 9 months ago

cshaley commented 10 months ago

This pull request makes the following changes:

(If there are changes to user behavior in general, please make sure to update the docs, as well)

It relates to the following issue #s:

sonarcloud[bot] commented 10 months ago

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

cshaley commented 10 months ago

cc @bhamail / @DarthHater please review / merge if appropriate

rxm7706 commented 9 months ago

Hi @bhamail cc. @madpah @bollwyvl @maarre @gregegg

Could you consider reviewing and merging this PR please. A new release will enable all of us again with jake ! Thanks & Regards.

rxm7706 commented 9 months ago

Thank you @bhamail - It looks like we need an approval to release & publish to pypi. https://app.circleci.com/pipelines/github/sonatype-nexus-community/jake/1339/workflows/26dbe621-5002-4e92-b56f-8d56795f2767

bhamail commented 9 months ago

Thank you @bhamail - It looks like we need an approval to release & publish to pypi. https://app.circleci.com/pipelines/github/sonatype-nexus-community/jake/1339/workflows/26dbe621-5002-4e92-b56f-8d56795f2767

Doh! Yes indeed. Button mashed. Fingers crossed.

cshaley commented 9 months ago

@bhamail As I understand, versioning of jake is automated. It looks like the build tried to publish 3.0.1 again, and it failed.

What's the right next step to get jake updated with the new dependency specification?

bhamail commented 9 months ago

@cshaley I tried manually incrementing the version and doing a manual release. I don't see errors in the build, but I don't see the new release in pypi either. Please ping again if nothing shows up by tomorrow.

rxm7706 commented 9 months ago

@bhamail - looks like no release published on PyPi - https://pypi.org/project/jake/#history or even on github https://github.com/sonatype-nexus-community/jake/releases - the semantic release step - shows no log - but on the prior step - i do see a warning on poetry-lock being out of date. That shouldn't have prevented the release..

https://app.circleci.com/pipelines/github/sonatype-nexus-community/jake/1341/workflows/26a9d3dc-29e4-4a23-9e23-e15f72674a21/jobs/3061

cshaley commented 9 months ago

@bhamail https://app.circleci.com/pipelines/github/sonatype-nexus-community/jake/1342/workflows/fbc35697-a32c-4121-a5e4-7a9049b46ac6/jobs/3072 It looks like it's working, but not showing up in pypi!

I'm thinking the semantic-release publish step is failing silently. It looks like it also failed (not silently) for all attempts to publish jake 3.0.1 - at least the ones in the publish history that I can see eg 1335 and 1340. So I'm not too sure how 3.0.1 got published to pypi unless it was before the visible history on circleci.

@bhamail thoughts on next steps? It looks like we could do semantic-release -v publish or semantic-release -vv publish to get it to output more information.

cshaley commented 9 months ago

@bhamail thanks for taking the next step.

I think I diagnosed it. python-semantic-release has breaking changes in v8.

So two options:

  1. Revert to `pip install "python-semantic-release<8"
  2. Update commands to
    semantic-release version
    twine upload dist/* 
    semantic-release publish

From reading the python-semantic-release docs linked above, I think jake's current process automatically handles version updates (i.e. v7 of semantic-release updates jake's version in github as part of the publish command). So I think we need all three lines above. Note: this probably means adding twine to the pip install line too. I'll raise a PR with approach 2.

gregegg commented 8 months ago

Hi @bhamail cc. @madpah @bollwyvl @maarre @gregegg

Could you consider reviewing and merging this PR please. A new release will enable all of us again with jake ! Thanks & Regards.

Thanks everyone!