From 59856f46f687ba23d541252a654cd6194d974d30 Mon Sep 17 00:00:00 2001 From: Nikolay Petrov Date: Wed, 21 Oct 2026 16:32:17 -0700 Subject: [PATCH] fix(ci): install the hashed lock before dokimi in repo-eval Since #135 the main lock carries hashes, so pip enters hash-checking mode for the whole install and refuses the git URL of dokimi itself ("Can't verify hashes ... version control repositories"). Install the lock with --require-hashes, then dokimi with --no-deps. Signed-off-by: Nikolay Petrov --- .github/workflows/repo-eval.yml | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/.github/workflows/repo-eval.yml b/.github/workflows/repo-eval.yml index 61972036..b0c62f7c 100644 --- a/.github/workflows/repo-eval.yml +++ b/.github/workflows/repo-eval.yml @@ -143,8 +143,9 @@ jobs: SHA: ${{ steps.ref.outputs.sha }} DOKIMI_REPO: ${{ inputs.dokimi-repository }} run: | - pip install -c "https://raw.githubusercontent.com/$DOKIMI_REPO/$SHA/dokimi/requirements.lock.txt" \ - "dokimi @ git+https://github.com/$DOKIMI_REPO@$SHA#subdirectory=dokimi" + # The lock is hashed, and pip cannot hash a git URL: install the lock, then dokimi without deps. + pip install --require-hashes -r "https://raw.githubusercontent.com/$DOKIMI_REPO/$SHA/dokimi/requirements.lock.txt" + pip install --no-deps "dokimi @ git+https://github.com/$DOKIMI_REPO@$SHA#subdirectory=dokimi" - name: repo validate env: MANIFEST: ${{ inputs.manifest }} @@ -294,8 +295,9 @@ jobs: SHA: ${{ needs.validate.outputs.dokimi-sha }} DOKIMI_REPO: ${{ inputs.dokimi-repository }} run: | - pip install -c "https://raw.githubusercontent.com/$DOKIMI_REPO/$SHA/dokimi/requirements.lock.txt" \ - "dokimi @ git+https://github.com/$DOKIMI_REPO@$SHA#subdirectory=dokimi" + # The lock is hashed, and pip cannot hash a git URL: install the lock, then dokimi without deps. + pip install --require-hashes -r "https://raw.githubusercontent.com/$DOKIMI_REPO/$SHA/dokimi/requirements.lock.txt" + pip install --no-deps "dokimi @ git+https://github.com/$DOKIMI_REPO@$SHA#subdirectory=dokimi" # Report only: a failing claim does not fail the job (an unreadable # manifest still does). The table lists the failing claims. - name: repo scan @@ -361,8 +363,9 @@ jobs: SHA: ${{ needs.validate.outputs.dokimi-sha }} DOKIMI_REPO: ${{ inputs.dokimi-repository }} run: | - pip install -c "https://raw.githubusercontent.com/$DOKIMI_REPO/$SHA/dokimi/requirements.lock.txt" \ - "dokimi @ git+https://github.com/$DOKIMI_REPO@$SHA#subdirectory=dokimi" + # The lock is hashed, and pip cannot hash a git URL: install the lock, then dokimi without deps. + pip install --require-hashes -r "https://raw.githubusercontent.com/$DOKIMI_REPO/$SHA/dokimi/requirements.lock.txt" + pip install --no-deps "dokimi @ git+https://github.com/$DOKIMI_REPO@$SHA#subdirectory=dokimi" # Builds the image from the manifest's Dockerfile (the tree without its # tasks), then grades the null and the oracle workspace in it. - name: repo tasks check