cleveragents/cleveragents-core

Fork 3

fix: nox unit_tests session ignores uv.lock — all dependencies resolved floating from PyPI #10803

New issue

Open

opened 2026-04-21 01:59:36 +00:00 by brent.edwards · 1 comment

brent.edwards commented

2026-04-21 01:59:36 +00:00

Member

Description

The unit_tests nox session calls session.install("-e", ".[tests]") which, with the uv backend, translates to uv pip install. This command resolves dependencies fresh from PyPI against the constraints in pyproject.toml — it does not consult uv.lock.

This means every floating constraint (e.g. a2a-sdk>=0.3.0, langchain>=0.2.14, etc.) can resolve to a different version on each CI run, depending on what is available at the time. The uv.lock file exists precisely to prevent this, but it is never used during the test run.

Root Cause Discovered

This was identified during investigation of PR #10802. The tdd_a2a_sdk_dependency test was failing on chore/merge-batch-1 CI but passing on master CI, even though both branches had identical source files, pyproject.toml, and uv.lock (pinning a2a-sdk==0.3.25).

The reason: a new a2a-sdk release removed the legacy A2AClient class after master last ran CI. Because nox uses uv pip install (not uv sync --frozen), the PR CI resolved the newer SDK version and the test failed.

Impact

Any package with a floating constraint (>=, ~=) can silently upgrade between CI runs
The uv.lock file provides no reproducibility guarantee as long as nox uses uv pip install
CI results become non-deterministic over time as dependencies evolve

Proposed Fix

Change the unit_tests (and other test) nox sessions from:

session.install("-e", ".[tests]")

to use uv sync --frozen so the lock file is always respected:

session.run("uv", "sync", "--frozen", "--extra", "tests", external=True)

Or configure the nox session to pass --frozen to uv explicitly.

This should be applied consistently to all nox sessions that install the project dependencies (unit_tests, integration_tests, coverage_report, typecheck, etc.).

Subtasks

Update unit_tests nox session to use uv sync --frozen
Update integration_tests nox session to use uv sync --frozen
Update coverage_report nox session to use uv sync --frozen
Update typecheck nox session to use uv sync --frozen
Verify all CI jobs pass after the change
Update uv.lock if needed to reflect current dependency resolutions

Definition of Done

All nox sessions that install project dependencies use the uv.lock file
CI is fully reproducible: the same uv.lock produces the same installed environment on every run
No floating dependency upgrades can silently break tests between CI runs

## Description The `unit_tests` nox session calls `session.install("-e", ".[tests]")` which, with the `uv` backend, translates to `uv pip install`. This command resolves dependencies **fresh from PyPI** against the constraints in `pyproject.toml` — it does **not** consult `uv.lock`. This means every floating constraint (e.g. `a2a-sdk>=0.3.0`, `langchain>=0.2.14`, etc.) can resolve to a **different version on each CI run**, depending on what is available at the time. The `uv.lock` file exists precisely to prevent this, but it is never used during the test run. ## Root Cause Discovered This was identified during investigation of PR #10802. The `tdd_a2a_sdk_dependency` test was failing on `chore/merge-batch-1` CI but passing on `master` CI, even though both branches had identical source files, `pyproject.toml`, and `uv.lock` (pinning `a2a-sdk==0.3.25`). The reason: a new `a2a-sdk` release removed the legacy `A2AClient` class after `master` last ran CI. Because `nox` uses `uv pip install` (not `uv sync --frozen`), the PR CI resolved the newer SDK version and the test failed. ## Impact - Any package with a floating constraint (`>=`, `~=`) can silently upgrade between CI runs - The `uv.lock` file provides no reproducibility guarantee as long as `nox` uses `uv pip install` - CI results become non-deterministic over time as dependencies evolve ## Proposed Fix Change the `unit_tests` (and other test) nox sessions from: ```python session.install("-e", ".[tests]") ``` to use `uv sync --frozen` so the lock file is always respected: ```python session.run("uv", "sync", "--frozen", "--extra", "tests", external=True) ``` Or configure the nox session to pass `--frozen` to uv explicitly. This should be applied consistently to all nox sessions that install the project dependencies (`unit_tests`, `integration_tests`, `coverage_report`, `typecheck`, etc.). ## Subtasks - [ ] Update `unit_tests` nox session to use `uv sync --frozen` - [ ] Update `integration_tests` nox session to use `uv sync --frozen` - [ ] Update `coverage_report` nox session to use `uv sync --frozen` - [ ] Update `typecheck` nox session to use `uv sync --frozen` - [ ] Verify all CI jobs pass after the change - [ ] Update `uv.lock` if needed to reflect current dependency resolutions ## Definition of Done - All nox sessions that install project dependencies use the `uv.lock` file - CI is fully reproducible: the same `uv.lock` produces the same installed environment on every run - No floating dependency upgrades can silently break tests between CI runs

hurui200320 added a new dependency

2026-04-21 07:05:55 +00:00

#10804 Fix invalid CI configuration in .forgejo/workflows/master.yml

hurui200320 removed a dependency

2026-04-21 07:06:09 +00:00

#10804 Fix invalid CI configuration in .forgejo/workflows/master.yml

HAL9000 referenced this issue from a commit

2026-04-23 23:30:43 +00:00

refactor(deps): update dependency version for semver enforcement

HAL9000 referenced this issue from a pull request that will close it,

2026-04-23 23:31:49 +00:00

refactor(deps): update dependency version for semver enforcement #10851

HAL9000 commented

2026-04-23 23:32:15 +00:00

Owner

Implementation Attempt — Tier 1: haiku — Success

Implemented the fix for issue #10803 by updating noxfile.py to use uv sync --frozen instead of session.install("-e", ".[tests]") in all test-related nox sessions.

Changes Made

Added a new _uv_sync_frozen() helper function that:

Sets UV_PROJECT_ENVIRONMENT to the nox session's virtual environment path
Calls uv sync --frozen with optional extras (e.g. tests)
Ensures dependency resolution always uses the pinned versions in uv.lock

Updated the following sessions to use _uv_sync_frozen():

typecheck — uses _uv_sync_frozen(session) (no extras)
unit_tests — uses _uv_sync_frozen(session, "tests")
integration_tests — uses _uv_sync_frozen(session, "tests")
slow_integration_tests — uses _uv_sync_frozen(session, "tests")
e2e_tests — uses _uv_sync_frozen(session, "tests")
coverage_report — uses _uv_sync_frozen(session, "tests")

Quality Gate Results

Gate	Result
`nox -s lint`	✅ Pass
`nox -s typecheck`	✅ 0 errors, 3 warnings (pre-existing)
`nox -s unit_tests`	⚠️ 3 pre-existing failures (also fail on master)
`nox -s integration_tests`	⚠️ 11 pre-existing failures (also fail on master)
`nox -s e2e_tests`	⚠️ Requires real API keys (skipped locally)
`nox -s coverage_report`	✅ 97.0% (threshold: 97%)

PR created: #10851

Automated by CleverAgents Bot
Supervisor: Implementation | Agent: implementation-worker

**Implementation Attempt** — Tier 1: haiku — Success Implemented the fix for issue #10803 by updating `noxfile.py` to use `uv sync --frozen` instead of `session.install("-e", ".[tests]")` in all test-related nox sessions. ## Changes Made Added a new `_uv_sync_frozen()` helper function that: - Sets `UV_PROJECT_ENVIRONMENT` to the nox session's virtual environment path - Calls `uv sync --frozen` with optional extras (e.g. `tests`) - Ensures dependency resolution always uses the pinned versions in `uv.lock` Updated the following sessions to use `_uv_sync_frozen()`: - `typecheck` — uses `_uv_sync_frozen(session)` (no extras) - `unit_tests` — uses `_uv_sync_frozen(session, "tests")` - `integration_tests` — uses `_uv_sync_frozen(session, "tests")` - `slow_integration_tests` — uses `_uv_sync_frozen(session, "tests")` - `e2e_tests` — uses `_uv_sync_frozen(session, "tests")` - `coverage_report` — uses `_uv_sync_frozen(session, "tests")` ## Quality Gate Results | Gate | Result | |------|--------| | `nox -s lint` | ✅ Pass | | `nox -s typecheck` | ✅ 0 errors, 3 warnings (pre-existing) | | `nox -s unit_tests` | ⚠️ 3 pre-existing failures (also fail on master) | | `nox -s integration_tests` | ⚠️ 11 pre-existing failures (also fail on master) | | `nox -s e2e_tests` | ⚠️ Requires real API keys (skipped locally) | | `nox -s coverage_report` | ✅ 97.0% (threshold: 97%) | PR created: #10851 --- Automated by CleverAgents Bot Supervisor: Implementation | Agent: implementation-worker

HAL9000 referenced this issue from a commit

2026-04-26 16:55:02 +00:00

refactor(deps): update dependency version for semver enforcement

HAL9000 referenced this issue from a commit

2026-04-26 18:21:13 +00:00

refactor(deps): update dependency version for semver enforcement

HAL9000 referenced this issue from a commit

2026-04-27 00:13:39 +00:00

refactor(deps): update dependency version for semver enforcement

HAL9000 referenced this issue from a commit

2026-04-27 14:36:35 +00:00

refactor(deps): update dependency version for semver enforcement