feat: add pinned Python CLI delivery - #143
Merged
Merged
Conversation
Introduce a shared Python tool catalog, a shell-based Bazel runner backed by pinned uvx, and container installer support backed by pinned uv. Document and test the delivery contracts without requiring Python on Bazel hosts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
|
AI review completed with no major findings. Independent full-PR reviews of PRs #143 and #144 were performed by:
The reviews focused on correctness, regressions, semantics, architecture, security, compatibility, and other merge-blocking issues. Minor/nit-level findings were intentionally ignored. |
lurtz
approved these changes
Aug 14, 2026
lurtz
left a comment
lurtz
left a comment
Contributor
There was a problem hiding this comment.
I am a bit underwhelmed by the added complexity. That complexity was meant to be avoided by using a devcontainer and now we have both.
| before the command can run. Its restricted literal form is also valid Python | ||
| syntax. The privileged DevContainer installer parses it with | ||
| `ast.literal_eval`, preserving a data-only privilege boundary. This shared | ||
| format keeps the package, console entrypoint, version, and description in one |
Contributor
There was a problem hiding this comment.
What does privileged mean here?
|
|
||
| # The explicit assertion verifies the requested release. Subsequent checks use | ||
| # the parsed value to keep every expected uv argument aligned with the catalog. | ||
| catalog_version="$(python3 "${installer}" version pre-commit)" |
Contributor
There was a problem hiding this comment.
There is a shebang
Suggested change
| catalog_version="$(python3 "${installer}" version pre-commit)" | |
| catalog_version="$("${installer}" version pre-commit)" |
| # whichever home directory uv would otherwise infer during image creation. | ||
| environment_output="${TEST_TMPDIR}/uvx.env" | ||
| OUTPUT_FILE="${output}" ENV_OUTPUT="${environment_output}" \ | ||
| python3 "${installer}" install-python pre-commit \ |
Contributor
There was a problem hiding this comment.
Suggested change
| python3 "${installer}" install-python pre-commit \ | |
| "${installer}" install-python pre-commit \ |
| # Validate all names before invoking uv. Including a valid name first proves an | ||
| # error cannot leave behind a partially installed tool set. | ||
| rm -f "${output}" | ||
| if OUTPUT_FILE="${output}" python3 "${installer}" install-python \ |
Contributor
There was a problem hiding this comment.
Suggested change
| if OUTPUT_FILE="${output}" python3 "${installer}" install-python \ | |
| if OUTPUT_FILE="${output}" "${installer}" install-python \ |
etas-contrib-automation Bot
pushed a commit
to etas-contrib/score_devcontainer
that referenced
this pull request
Aug 14, 2026
## Summary - install `pre-commit` 4.5.1 from the shared Python tool catalog with pinned `uv` - remove the separate DevContainer feature and its generated lock entries - route REUSE helper commands through the catalogued `uvx` runner - verify the installed command against the catalogued version ## Rationale The DevContainer PATH and Bazel target now consume one package pin while retaining delivery mechanisms suited to their environments. The REUSE workflow uses uvx directly and no longer relies on environment setup from another feature. ## Scope This is the DevContainer integration layer of stack #145 and depends on PR eclipse-score#143. It contains the container wiring and the directly coupled migration of existing pipx-based REUSE commands. ## Validation - full pre-commit suite - isolated `uv tool install` using the catalogued package - complete local `scripts/test.sh` DevContainer build and feature test --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
🎉 This PR is included in version 1.11.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
etas-contrib-automation Bot
pushed a commit
to etas-contrib/score_devcontainer
that referenced
this pull request
Aug 17, 2026
Clarify why the DevContainer installer runs with root privileges and how literal-only catalog parsing prevents executing catalog code with those privileges. Also invoke the executable installer directly in its contract test, consistently using its Python 3 shebang and matching production callers. Addresses the unresolved review comments from eclipse-score#143.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
uvxbinary and a shell launcheruv tool installsupport for DevContainer feature installersRationale
Python distributions need different delivery mechanics from native release binaries. The shared catalog keeps package versions aligned while Bazel executes tools on demand without requiring host Python.
Scope
This is the foundation layer of stack #145. The existing DevContainer installation remains unchanged here; PR #144 adopts this catalog for
pre-commit.Validation
//tools:pre-commit//tools:python_tool_runner_test