Scope repoclosure's persistent-repo exclude to the package's own binary names - #442
Merged
Odilhao merged 1 commit intoAug 4, 2026
Conversation
…ry names
--newest --best (obal#436) resolves Requires against the newest package
across all repos while still checking every repo's own newest package in
isolation. A subpackage that self-pins via
"Requires: %{name} = %{version}-%{release}" (e.g. a "-doc"/"-cockpit"
sibling) then false-positives the instant a newer build of the same SRPM
lands anywhere else in the checked set, since the persistent staging
repo's stale copy has nothing left to satisfy its exact pin against.
Exclude the package under test from the persistent staging repos it's
checked against, since the PR's own freshly-built repo is authoritative
for it. Scoped with dnf's per-repo --setopt=<repo>.excludepkgs=, and
resolved to the package's exact binary names via rpmspec (never a glob)
so bumping e.g. "foreman" or "rubygem-hammer_cli" can't also exclude an
unrelated package that happens to share a name prefix and silently mask
a real cross-package regression - the exact failure mode theforeman#436 exists to
catch (theforeman/foreman-packaging#13647/#13661/#13688).
Reproduced against the real theforeman/foreman-packaging#13921/#13922
CI failures and the live el9-foreman-plugins-nightly-staging repo.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Odilhao
approved these changes
Aug 4, 2026
Odilhao
left a comment
Member
There was a problem hiding this comment.
Approved, tested locally and it worked against the PRs that are broken atm on foreman-packaging
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--newest --best(#436) resolvesRequiresagainst the newest package across all reposcombined, while still checking every repo's own newest package in isolation. A subpackage that
self-pins via
Requires: %{name} = %{version}-%{release}(e.g. a-doc/-cockpitsibling)then false-positives the instant a newer build of the same SRPM lands anywhere else in the
checked set — the persistent staging repo's stale copy has nothing left to satisfy its exact
pin against.
Reproduced against the real
theforeman/foreman-packaging#13921and#13922CI failures(
rubygem-foreman_remote_executionandrubygem-foreman_leappbumps), using the liveel9-foreman-plugins-nightly-stagingrepo and the realrepoclosure/yum.conf.Fix
Exclude the package under test from the persistent staging repos it's checked against, since
the PR's own freshly-built repo (
repo0/downloaded_rpms) is authoritative for it. Scopedwith dnf's per-repo
--setopt=<repo>.excludepkgs=, never applied to the fresh repo itself.Exclude list is resolved to the package's exact binary names via
rpmspec, never aname-prefix glob — a glob would also match unrelated packages sharing a name prefix (e.g.
foreman*also matchingforeman-proxy,rubygem-hammer_cli*also matchingrubygem-hammer_cli_foreman), silently masking a real cross-package regression on thosepackages — exactly the failure mode
--best(#436) exists to catch(
theforeman/foreman-packaging#13647/#13661/#13688). Falls back to the exact hostname(never a glob) if the spec fails to parse; resolves to no exclusion at all for repoclosure-only
hosts with no package directory.
Testing
repoclosure.py's extractedbuild_command().downloaded_rpmsrelease flow, repoclosure-only (spec-less) hosts, and a package with anintentionally unparseable spec (exercises the exact-hostname fallback branch).
pylint: 10.00/10.live-repo reproductions of both the original false positive and the cross-package regression
--bestmust keep catching.🤖 Generated with Claude Code