[BUG] Git-semver subdirectory dep: --frozen redeploys the older release, repeat install drops constraint/resolved_tag #3382

Activity

1. github-project-automation

   added this to APM Roadmapon Oct 24, 2026
2. dajiaohuang commented on Oct 25, 2026

   

   Wu Shuwen (dajiaohuang)

   on Oct 25, 2026

   Contributor

   More actions

   I reviewed current main at 2920043 without modifying or checking out the repository. The closest existing test, TestPositionalVirtualSubdirectorySemver.test_positional_git_semver_uses_real_bare_remote_and_replays_lockfile, uses a different tag arrangement; it checks the initial semver lock fields and byte-identical lock after a subsequent ordinary install, but does not run --frozen or assert the deployed file contents after replay:

   apm/tests/integration/test_git_semver_install_e2e.py

   Lines 381 to 487 in 2920043

   	@pytest.mark.parametrize(
   	("constraint", "expected_tag", "expected_version"),
   	[
   	(">=1.0.0", "pkg-v1.2.0", "1.2.0"),
   	("~1.0.0", "pkg-v1.0.0", "1.0.0"),
   	("^1.0.0", "pkg-v1.2.0", "1.2.0"),
   	],
   	)
   	def test_positional_git_semver_uses_real_bare_remote_and_replays_lockfile(
   	self,
   	tmp_path: Path,
   	constraint: str,
   	expected_tag: str,
   	expected_version: str,
   	) -> None:
   	"""Positional virtual ranges resolve a local bare remote before preflight."""
   	isolated = IsolatedApmEnvironment.create(tmp_path / "isolated", base_env=dict(os.environ))
   	environment = isolated.subprocess_env()
   	source = isolated.package_root / "mono"
   	package = source / "packages" / "pkg"
   	package.mkdir(parents=True)
   	(package / "apm.yml").write_text(
   	"name: pkg\nversion: 1.0.0\ndescription: fixture package\n",
   	encoding="utf-8",
   	)
   	instructions = package / ".apm" / "instructions"
   	instructions.mkdir(parents=True)
   	(instructions / "fixture.instructions.md").write_text(
   	"# Fixture\n",
   	encoding="utf-8",
   	)
   	repositories = LocalGitRepositoryFactory(isolated.repository_root, env=environment)
   	repository = repositories.create("mono", source_tree=source)
   	first_commit = repositories.commit(repository, message="pkg v1.0.0")
   	repositories.tag(repository, "pkg-v1.0.0", first_commit)
   	(repository.worktree / "packages" / "pkg" / "README.md").write_text(
   	"# pkg 1.2.0\n",
   	encoding="utf-8",
   	)
   	second_commit = repositories.commit(repository, message="pkg v1.2.0")
   	repositories.tag(repository, "pkg-v1.2.0", second_commit)
   	child_env = _source_cli_environment(
   	repositories.url_rewrite_subprocess_env(
   	repository,
   	"https://github.com/acme/mono.git",
   	)
   	)
   	trace_path = isolated.work_root / "git-trace.log"
   	child_env["GIT_TRACE"] = str(trace_path)
   	project = isolated.work_root / "consumer"
   	_write_apm_yml(project, [])
   	raw_reference = f"acme/mono/packages/pkg#{constraint}"
   	command = _source_cli_command(
   	"install",
   	"--no-policy",
   	"--https",
   	"--parallel-downloads",
   	"0",
   	raw_reference,
   	)
   	first = subprocess.run(
   	command,
   	cwd=project,
   	env=child_env,
   	capture_output=True,
   	text=True,
   	timeout=120,
   	)
   	assert first.returncode == 0, f"stdout={first.stdout!r}\nstderr={first.stderr!r}"
   	assert raw_reference in first.stdout
   	trace = trace_path.read_text(encoding="utf-8")
   	assert "git ls-remote --tags --heads" in trace
   	parsed_trace_urls = [
   	urlparse(token.strip("'\"")) for token in trace.split() if "://" in token
   	]
   	assert ("https", "github.com", "/acme/mono.git") in [
   	(parsed.scheme, parsed.hostname, parsed.path) for parsed in parsed_trace_urls
   	]
   	lock_path = project / "apm.lock.yaml"
   	first_lock = lock_path.read_bytes()
   	locked = _find_locked(_read_lockfile(project), "acme/mono")
   	assert locked is not None
   	assert locked["constraint"] == constraint
   	assert locked["resolved_tag"] == expected_tag
   	assert locked["resolved_commit"] == (
   	first_commit.sha if expected_tag == "pkg-v1.0.0" else second_commit.sha
   	)
   	assert locked["version"] == expected_version
   	installed = project / ".github" / "instructions" / "fixture.instructions.md"
   	assert installed.exists(), "the resolved virtual subdirectory was not installed"
   	second = subprocess.run(
   	command[:-1],
   	cwd=project,
   	env=child_env,
   	capture_output=True,
   	text=True,
   	timeout=120,
   	)
   	assert second.returncode == 0, f"stdout={second.stdout!r}\nstderr={second.stderr!r}"
   	assert lock_path.read_bytes() == first_lock
   	@pytest.mark.parametrize(

   .

   PR #3381 also says it observed these exact frozen/reinstall behaviors on unmodified main and kept them out of #3224's accepted scope; that PR is therefore not a fix for this issue: #3381.

   I did not rerun the provided reproduction, so this is a source/test-coverage observation, not independent runtime validation or a root-cause claim. I found no human scope-approval comment on #3382; under current GOVERNANCE.md/CONTRIBUTING.md, I have not started an implementation.