Skip to content

Fixing Detection of Unpinned Dependencies for DDEV Validate DEP #23584

Open
ddog-nasirthomas wants to merge 13 commits intomasterfrom
nasir.thomas/unpinned-dependencies-extras-and-market
Open

Fixing Detection of Unpinned Dependencies for DDEV Validate DEP #23584
ddog-nasirthomas wants to merge 13 commits intomasterfrom
nasir.thomas/unpinned-dependencies-extras-and-market

Conversation

@ddog-nasirthomas
Copy link
Copy Markdown
Contributor

@ddog-nasirthomas ddog-nasirthomas commented May 4, 2026

What does this PR do?

Fixes ddev validate dep so unpinned dependencies are not flagged for integrations-extras and marketplace repos as errors. Unpinned dependencies should only be flagged for integrations-core.

An example of a dependency that got flagged before as unpinned for the marketplace repo:

Unpinned version found for dependency `boto3`: crest_data_systems_integration_backup_and_restore_tool
Dependency boto3 found in the crest_data_systems_integration_backup_and_restore_tool integration requirements but not in the agent requirements, run `ddev dep freeze` to sync them.

[project.optional-dependencies]
deps = [
"azure-storage-blob>=12.14.1",
"google-cloud-storage>=2.7.0",
"boto3",
"botocore",
"paramiko",
"PySocks",
]

In integrations-extras and marketplace, integrations are distributed/managed differently, and many deps (especially optional ones) are not expected to be frozen into Agent requirements.

Motivation

AI-6341

Review checklist (to be filled by reviewers)

  • Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
  • Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
  • If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

@datadog-datadog-prod-us1
Copy link
Copy Markdown
Contributor

datadog-datadog-prod-us1 Bot commented May 4, 2026

Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 78.51% (-8.66%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: efa826b | Docs | Datadog PR Page | Give us feedback!

@codecov
Copy link
Copy Markdown

codecov Bot commented May 4, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.94%. Comparing base (fd79c30) to head (efa826b).
⚠️ Report is 28 commits behind head on master.

Additional details and impacted files
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ddog-nasirthomas ddog-nasirthomas marked this pull request as ready for review May 5, 2026 14:13
@ddog-nasirthomas ddog-nasirthomas requested a review from a team as a code owner May 5, 2026 14:13
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 009ff5a2da

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

agent_dependencies_file = get_agent_requirements()
annotate_errors(agent_dependencies_file, agent_errors)
ctx = click.get_current_context()
repo_core = ctx.obj.repo.name == 'core'
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Detect core mode from CLI repo choice, not repo object name

Compute repo_core from ctx.obj.repo.name misclassifies ddev -x runs inside integrations-core as non-core, because Application.set_repo(..., here=True) sets the repo name to local; this silently disables pinning and agent-sync validations that should still run for core checkouts. It can also break the legacy standalone CLI path where ctx.obj is a dict (tooling/cli.py), not an object with .repo, causing an attribute error instead of validating dependencies.

Useful? React with 👍 / 👎.

@dd-octo-sts
Copy link
Copy Markdown
Contributor

dd-octo-sts Bot commented May 5, 2026

⚠️ Recommendation: Add qa/skip-qa label

This PR does not modify any files shipped with the agent.

To help streamline the release process, please consider adding the qa/skip-qa label if these changes do not require QA testing.

Copy link
Copy Markdown
Contributor

@sarah-witt sarah-witt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice!

Comment on lines +201 to +209
ctx = click.get_current_context()
obj = ctx.obj
repo_choice = None

if hasattr(obj, 'get'):
repo_choice = obj.get('repo_choice') or obj.get('repo')
if not repo_choice and hasattr(obj, 'repo'):
repo_choice = getattr(obj.repo, 'name', None)
repo_core = repo_choice == 'core'
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason we can't use ctx.obj['repo_choice'] == core here?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We technically could do that. The longer block is defensive for cases where repo_choice is never written on the legacy config object. For example, initialize_root returns immediately when check_root() is true, so it never runs the code that sets config['repo_choice']

def initialize_root(config, agent=False, core=False, extras=False, marketplace=False, here=False, **kwargs):
    """Initialize root directory based on config and options"""
    if check_root():
        return

In this case, the repo name still exists when the application is started. I fallback to what the repo name is set to. code
self.__config['repo'] = self.repo.name

Let me know if my understanding is correct.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree there is a valid path where config['repo_choice'] is not set, but most ddev commands use this approach with the same limitation. I think it's ok to leave it as is since check_root is rarely true and it follows the pattern of other ddev commands. What about instead making a PR to always initialize config['repo_choice'], even if check_root is true? Let me know what you think!

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, I think that's a great idea. I'll create the PR for that and use ctx.obj['repo_choice'] == core for determining the repo in this PR.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay I updated how repo_core is defined. Also I had to update two tests test_multiple_invalid_third_party_integrations and test_one_valid_one_invalid_integration since they called ddev validate dep twice. On the second call the repo_choice did not initalize because the global integrations root was already set after the first run, so initialize_root hit the check_root() guard and returned before it could set repo_choice on the new config.

Working on the other pr to always set repo_choice

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR for setting repo_choice is here: #23649

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commands are always run through ddev and the context object is the Application from ddev. Use Application.repo properties instead of update a legacy soon to be removed process. I added a comment on the other PR.

I am also unsure about whether we want to do this fix here or migrate the command driectly to ddev. We are in the middle of migrating everything at the moment. Maybe we can hold on on this and do the fix when we are not including new logic in the legacy checks dev commands? What do you think? How imperative is it to fix this now?

Comment thread ddev/tests/cli/validate/test_dep.py
Comment thread ddev/tests/cli/validate/test_dep.py Outdated
Comment thread ddev/tests/cli/validate/test_dep.py Outdated
@dd-octo-sts
Copy link
Copy Markdown
Contributor

dd-octo-sts Bot commented May 8, 2026

Validation Report

All 20 validations passed.

Show details
Validation Description Status
agent-reqs Verify check versions match the Agent requirements file
ci Validate CI configuration and Codecov settings
codeowners Validate every integration has a CODEOWNERS entry
config Validate default configuration files against spec.yaml
dep Verify dependency pins are consistent and Agent-compatible
http Validate integrations use the HTTP wrapper correctly
imports Validate check imports do not use deprecated modules
integration-style Validate check code style conventions
jmx-metrics Validate JMX metrics definition files and config
labeler Validate PR labeler config matches integration directories
legacy-signature Validate no integration uses the legacy Agent check signature
license-headers Validate Python files have proper license headers
licenses Validate third-party license attribution list
metadata Validate metadata.csv metric definitions
models Validate configuration data models match spec.yaml
openmetrics Validate OpenMetrics integrations disable the metric limit
package Validate Python package metadata and naming
readmes Validate README files have required sections
saved-views Validate saved view JSON file structure and fields
version Validate version consistency between package and changelog

View full run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants