docs+test(mise): guard against disabling lock enforcement in the convergence path#729
Merged
Merged
Conversation
…lock enforcement AGENTS.md: explain why script 06 now regenerates the global mise.lock (mise merges global config into any -C <dir> install, so script 07's locked repo-tools install re-validates global tools too) and make explicit that script 07 must never gain a MISE_LOCKED=0-style bypass -- that's what keeps uv pinned to the committed mise.lock. CI: add a regex guard (mise.toml locked = true, no lock bypass in script 07, uv sync always --frozen/--locked in ci.yml) so an agent-authored PR that "fixes" a locked-install failure by disabling the check fails CI instead of merging quietly, per #728.
…est test Swaps the standalone check-lock-enforcement.yml workflow for tests/integration/test_lock_enforcement.py: it's pure source-tree reading (mise.toml, script 07's template, ci.yml), needs no deployed environment, and already runs for free in the existing integration job's `uv run pytest tests/integration` -- no new CI wiring needed.
… __file__ math chezmoi_source_root previously assumed src/chezmoi lived exactly three parents above the test file; now it asks chezmoi itself via `chezmoi source-path`, which honors .chezmoiroot and matches how chezmoi_dest already resolves via `chezmoi target-path`. Same helper is reused at collection time for the chezmoiscript_path/workflow_path glob-parametrization in pytest_generate_tests, replacing the equivalent __file__-based computation there too. repo_root is now derived from that resolved source root (chezmoi_source_root.parent.parent) rather than its own independent __file__ guess.
CHEZMOI_CONFIG/CHEZMOI_DEST aren't visible to the plain subprocess call inside the integration job's `mise exec -- uv run pytest` step, so _chezmoi_source_path() silently fell back to chezmoi's bare default ($HOME/.local/share/chezmoi) and resolved garbage. Pytest always runs from the repo root, so anchor on that directly via --source instead of depending on config env vars this call doesn't need in the first place.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dot_config/mise/AGENTS.md: documents why script06now regenerates the globalmise.lock(mise merges the global config into anymise install -C <dir>call, so script07's locked repo-tools install re-validates global tools too) and makes explicit that script07must never gain aMISE_LOCKED=0-style bypass.tests/integration/test_lock_enforcement.py: regex-based pytest checks that (1) rootmise.tomlkeepslocked = true, (2) anyrun_onchange_after_*script installing from the repo-trackedmise.tomlhas no lock bypass, (3) everyuv syncin.github/workflows/*.ymlkeeps--frozen/--locked. Dynamically parametrized over the real files on disk viachezmoi source-path/glob, not hardcoded filenames.tests/integration/conftest.py:chezmoi_source_root(and the newrepo_root) now resolve viachezmoi source-pathinstead of__file__parent-walking, matching howchezmoi_destalready resolves viachezmoi target-path.Prompted by #728: an agent-authored PR "fixed" a locked-install CI failure by disabling
lockedmode in the deployment script instead of regenerating the stale lockfile it was validating against. This guard would have caught that at the PR stage.Test plan
uv run pytest tests/integration/test_lock_enforcement.pypasses locallyMISE_LOCKED=0into script07and confirmed the test fails on it, then reverteduv run pytest tests/integration -q— no new failures vs baselineuv run ruff check/ruff format --check/uv run ty checkall pass