From ff09703fede2acff5e4d4bc94f3ffe77b27598a2 Mon Sep 17 00:00:00 2001 From: Marco Nenciarini Date: Wed, 2 Sep 2026 11:19:27 +0200 Subject: [PATCH 1/2] build(deps): pin pip-compile to the sidecar's Python version via dagger The lockfile was regenerated with whatever python3 happened to be on the contributor's machine (3.12), drifting from the python3.13 venv the sidecar image actually ships. Add a task that runs pip-compile inside a debian:trixie-slim dagger container, the same base image family the sidecar build uses, so regeneration always targets the right Python version regardless of the local machine. Signed-off-by: Marco Nenciarini --- Taskfile.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/Taskfile.yml b/Taskfile.yml index 9d72314d..6564f5a0 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -67,6 +67,26 @@ tasks: GITHUB_REF= dagger -s call -m github.com/cloudnative-pg/daggerverse/commitlint@${DAGGER_COMMITLINT_SHA} lint --source . --args "--from=origin/main" stdout + pip-compile-sidecar: + desc: Regenerate containers/sidecar-requirements.txt with the same Python version as the sidecar image + cmds: + - > + GITHUB_REF= dagger call --no-mod + container from --address=debian:trixie-slim + with-env-variable --name=DEBIAN_FRONTEND --value=noninteractive + with-exec --args="apt-get,update,-qq" + with-exec --args="apt-get,install,-y,-qq,python3,python3-venv,python3-pip,gcc,libpq-dev" + with-exec --args="pip,install,--quiet,--break-system-packages,pip-tools" + with-directory --path=/work --source=containers + with-workdir --path=/work + with-exec --args="pip-compile,--allow-unsafe,--generate-hashes,--output-file=sidecar-requirements.txt,--strip-extras,sidecar-requirements.in" + file --path=/work/sidecar-requirements.txt + export --path=containers/sidecar-requirements.txt + sources: + - containers/sidecar-requirements.in + generates: + - containers/sidecar-requirements.txt + uncommitted: desc: Check for uncommitted changes deps: From 4a66d24dc7b6837b146c81a0f0062ebc7abe13dd Mon Sep 17 00:00:00 2001 From: Marco Nenciarini Date: Wed, 2 Sep 2026 16:39:02 +0200 Subject: [PATCH 2/2] fix: pin click below 8.5.0 to avoid bogus --no-index in pip-compile Click 8.5.0 leaves is_flag options without an explicit default as an internal sentinel instead of False. pip-tools 7.6.1 compares that sentinel against the option's value to decide whether to record it in the regenerated file's header, and for a flag with no negative counterpart (like --no-index) it falls back to always emitting the flag name regardless of the actual value. Every fresh install of pip-tools pulls in the latest click and hits this, poisoning the lockfile header with a --no-index that was never requested. Signed-off-by: Marco Nenciarini --- Taskfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index 6564f5a0..eaff88b8 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -76,7 +76,7 @@ tasks: with-env-variable --name=DEBIAN_FRONTEND --value=noninteractive with-exec --args="apt-get,update,-qq" with-exec --args="apt-get,install,-y,-qq,python3,python3-venv,python3-pip,gcc,libpq-dev" - with-exec --args="pip,install,--quiet,--break-system-packages,pip-tools" + with-exec --args="pip,install,--quiet,--break-system-packages,pip-tools,click<8.5.0" with-directory --path=/work --source=containers with-workdir --path=/work with-exec --args="pip-compile,--allow-unsafe,--generate-hashes,--output-file=sidecar-requirements.txt,--strip-extras,sidecar-requirements.in"