From 187991ffc4fadcb66b1eb750e44f7c425d5331f1 Mon Sep 17 00:00:00 2001 From: Brett Heap <1513478+brettheap@users.noreply.github.com> Date: Sun, 8 Nov 2026 12:20:01 +0000 Subject: [PATCH 1/2] Pin openRepoShape at v1.1.1, 5017830 on its main: four of the eight mounted files moved; no test expectation moved Brett Heap ruled openRepoShape v1.1.1 on 2026-10-22 (opensoft/openRepoTools#186). This is the code leg's pin, the one the suite mounts. The assembly root then points its `code` gitlink at the commit this change leaves on main. What moves, and nothing else: contracts/openreposhape-pin.yaml commit: 190133d5e704e380c430f87ca9c4e31746de0012 -> 50178305e4229275d18e71c2152403b4e9d3004e tree_sha256: 7a66972c7de193c050f77f97bffa13d8543c28d74f61ea210644e65aa3f37912 -> 204d73aabf2379554600234d4b36dc08d3c3a1da422395dec44637b5ca7a5184 upstream/openRepoShape (gitlink, 160000) 190133d5e704 -> 50178305e422 tests/test_install_payload_source.py (one docstring line) openRepoShape:547 at 190133d -> openRepoShape:745 at 5017830 v1.1.1 is an annotated tag, dereferenced locally: git rev-parse v1.1.1 'v1.1.1^{commit}' -> fd9316bb8e4f99d13a678b4bfc3846b4759ecbb7 (tag) -> 50178305e4229275d18e71c2152403b4e9d3004e On openRepoShape's main, as the pinned standard's rule 2 requires: git merge-base --is-ancestor 50178305e422 origin/main # exit 0 main is bd3e9c1485d3, 121 commits past it; v1.1.0..v1.1.1 is 70 commits. Bump run as contracts/openreposhape-pin.yaml states, the edit before the add: git -C upstream/openRepoShape fetch origin 50178305e4229275d18e71c2152403b4e9d3004e git -C upstream/openRepoShape checkout 50178305e4229275d18e71c2152403b4e9d3004e python3 -c "...from repo_shape import tree_digest; print(tree_digest('upstream/openRepoShape', 'HEAD'))" -> 204d73aabf2379554600234d4b36dc08d3c3a1da422395dec44637b5ca7a5184 git add contracts/openreposhape-pin.yaml upstream/openRepoShape The digest is recomputed, not adjusted, with the pinned checkout's own scripts/repo_shape.py. 190133d's helper and 5017830's helper print the same two numbers on both trees (7a66972c... for 190133d, 204d73aa... for 5017830, 366 records), so sorted-ls-tree-r-v1 means the same on both sides, and v1.1.1's change to repo_shape.py touches no tree_digest line. A reading of the forge's recursive tree listing on 2026-11-02 gave the same 204d73aa... independently. Only `commit:` and `digests.tree_sha256` change in the pin file. Nothing under upstream/openRepoShape was edited. Four of the eight files the suite mounts change at v1.1.1: scripts/repo_shape.py templates/assembly-root/scripts/bootstrap.py templates/family-root/scripts/bootstrap.py templates/family-root/scripts/siblings.py The two Makefiles and the two .gitignore files are byte-identical at both commits, and so is every file under templates/workspace-root/. The docstring of test_r01_composed_the_documented_one_liners_resolve_through_the_root_entry_point cited openRepoShape's --install pointer as openRepoShape:547 at 190133d. At the pinned 5017830 the same line is 745, and its bytes are unchanged: cmp <(git show 190133d:openRepoShape | sed -n 547p) \ <(git show 5017830:openRepoShape | sed -n 745p) # equal So only the citation moves with the pin, in the form opensoft/openRepoTools#233 used for 280 -> 547; the test's pipeline string is untouched. Every line that names 190133d or v1.1.0 as dated provenance (release.yml, the two release requirement locks, test_release_workflow.py, and the notes on v1.1.0's parse_yaml and layout) stays as it is. Part of opensoft/openRepoTools#186. Lane: openRepoTools-1 Co-Authored-By: Claude Opus 5.5 --- contracts/openreposhape-pin.yaml | 4 ++-- tests/test_install_payload_source.py | 2 +- upstream/openRepoShape | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/contracts/openreposhape-pin.yaml b/contracts/openreposhape-pin.yaml index eea57fb..b114f2c 100644 --- a/contracts/openreposhape-pin.yaml +++ b/contracts/openreposhape-pin.yaml @@ -51,12 +51,12 @@ source_repository: opensoft/openRepoShape submodule_path: upstream/openRepoShape materialization: mounted -commit: "190133d5e704e380c430f87ca9c4e31746de0012" +commit: "50178305e4229275d18e71c2152403b4e9d3004e" revision_kind: commit digest_algorithm: sha256 digest_definition: sorted-ls-tree-r-v1 digests: - tree_sha256: "7a66972c7de193c050f77f97bffa13d8543c28d74f61ea210644e65aa3f37912" + tree_sha256: "204d73aabf2379554600234d4b36dc08d3c3a1da422395dec44637b5ca7a5184" verify_pin: tests/test_upstream_pin.py diff --git a/tests/test_install_payload_source.py b/tests/test_install_payload_source.py index 0347e1b..2867fd9 100644 --- a/tests/test_install_payload_source.py +++ b/tests/test_install_payload_source.py @@ -919,7 +919,7 @@ def test_r01_a_single_repository_by_gh_asks_for_files_and_nothing_else(tmp_path) @pytest.mark.parametrize("line", ["openRepoShape", "gh"]) def test_r01_composed_the_documented_one_liners_resolve_through_the_root_entry_point( tmp_path, line): - """openRepoShape's own `--install` pointer (openRepoShape:547 at 190133d) + """openRepoShape's own `--install` pointer (openRepoShape:745 at 5017830) and README's `gh api` line, BYTE FOR BYTE, against an assembly whose root carries the real entry point: the root resolves `main` ONCE, reads the code pin there and hands every argument to the pinned implementation, which diff --git a/upstream/openRepoShape b/upstream/openRepoShape index 190133d..5017830 160000 --- a/upstream/openRepoShape +++ b/upstream/openRepoShape @@ -1 +1 @@ -Subproject commit 190133d5e704e380c430f87ca9c4e31746de0012 +Subproject commit 50178305e4229275d18e71c2152403b4e9d3004e From 7e1df87e06387ef160a693adfb7651c965bb77a8 Mon Sep 17 00:00:00 2001 From: Brett Heap <1513478+brettheap@users.noreply.github.com> Date: Sun, 8 Nov 2026 13:36:20 +0000 Subject: [PATCH 2/2] release.yml and its test say the pin moved to 5017830 (v1.1.1); the header keeps its v1.1.0 provenance Review finding S2, in opensoft/openRepoTools-code#15 comment 6722132903: two comments still said, in the present tense, that `upstream/openRepoShape` is pinned at 190133d (v1.1.0), which stopped being true when this PR moved the pin to 50178305 (v1.1.1). Comments only. .github/workflows/release.yml, the header's first paragraph. The header was adapted from openRepoShape v1.1.0's own release.yml at 190133d, and that stays as dated provenance in the past tense: the commit `upstream/openRepoShape` "was pinned at when this was adapted". It now adds, as a dated fact, that the pin moved to 5017830, v1.1.1, whose release.yml differs from 190133d's in comment lines only. "190133d" and "openRepoShape v1.1.0" stay in the header, where HEADER_SECTIONS and HEADER_CARRIES in tests/test_release_workflow.py require them, the first one before every other section. tests/test_release_workflow.py, the comment above MODEL. It now says what the test reads: openRepoShape's own release.yml, in the pinned submodule, at whatever commit contracts/openreposhape-pin.yaml names. 5017830 (v1.1.1) is named as the commit the pin moved to from 190133d (v1.1.0), a dated fact that needs no edit at the next bump. The claim that the two upstream workflows differ in comment lines only was checked, not assumed: git -C upstream/openRepoShape diff 190133d 50178305 -- .github/workflows/release.yml shows 40 changed lines, every one a comment, and the file parses to the same data at both commits. Nothing else moves. In both files every changed line starts with `#` after its indent; the Python module's AST, docstrings included, is equal before and after; release.yml parses to the same data before and after. Part of opensoft/openRepoTools#186. Lane: openRepoTools-1 Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/release.yml | 6 ++++-- tests/test_release_workflow.py | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 092ddc0..1b41058 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,8 +4,10 @@ name: release # PUBLISH THE openrepotools WHEEL (#228): TestPyPI, AN INSTALL CHECK ON THREE # LEGS, THEN PyPI, IN ONE DISPATCHED RUN. Adapted step for step from # openRepoShape v1.1.0's own release.yml (`190133d`, the commit -# `upstream/openRepoShape` is pinned at), whose checks are taken over as they -# are (FR-028) except where design.md Decision 10 names a difference: +# `upstream/openRepoShape` was pinned at when this was adapted; the pin moved +# to `5017830`, v1.1.1, whose release.yml differs from `190133d`'s in comment +# lines only), whose checks are taken over as they are (FR-028) except where +# design.md Decision 10 names a difference: # - a pre-release `X.Y.ZrcN` is accepted, for TestPyPI alone; PyPI takes a # final `X.Y.Z` and nothing else; # - the repository guard (FR-048, WHERE RELEASES COME FROM below) is new diff --git a/tests/test_release_workflow.py b/tests/test_release_workflow.py index 34ae79a..706a089 100644 --- a/tests/test_release_workflow.py +++ b/tests/test_release_workflow.py @@ -141,8 +141,10 @@ PIN = REPO / "contracts" / "openreposhape-pin.yaml" STAMP = layout.STAMP_SOURCE -#: THE MODEL: openRepoShape v1.1.0's own workflow, in the pinned submodule -#: (`190133d`). Its artifact actions' pins are this workflow's. +#: THE MODEL: openRepoShape's own release.yml, in the pinned submodule, at +#: whatever commit `contracts/openreposhape-pin.yaml` names (`5017830`, v1.1.1, +#: when the pin moved to it from `190133d`, v1.1.0; the two workflows differ in +#: comment lines only). Its artifact actions' pins are this workflow's. MODEL = UPSTREAM / ".github" / "workflows" / "release.yml" STANDARD_SCRIPTS = UPSTREAM / "scripts"