Repository navigation
Stop extras from installing other people's packages - #18
Coding-Dev-Tools wants to merge 2 commits into
Conversation
None of the DevForge tools is on public PyPI, so bare extras like "deadcode", "envault" and "json2sql" resolved to unrelated packages by other authors (deadcode 2.4.1, envault 0.4.6, json2sql 1.0.0rc1), and [all] failed outright. Each extra now points at its real distribution in its GitHub repo. Also fix the README's recommended command, which pip parsed as a git URL ending in "[all]" and failed to clone. Verified: pip install --dry-run "./devforge-cli[all]" resolves all ten tools to Coding-Dev-Tools repos. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0111byzLrKKTCJ23uTT6PyZq
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e2e355bef3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # These tools are not on public PyPI yet, so each extra points at its GitHub repo. | ||
| # Bare names (e.g. "deadcode", "envault", "json2sql") resolve to unrelated | ||
| # packages owned by other people. Switch to version pins once each tool is published. | ||
| guard = ["api-contract-guardian @ git+https://github.com/Coding-Dev-Tools/api-contract-guardian.git"] |
There was a problem hiding this comment.
When a GitHub Release triggers .github/workflows/publish.yml, these optional dependencies are emitted as Requires-Dist direct URLs and PyPI rejects the upload, so the release workflow cannot publish this project while the Git URLs remain here. Setuptools documents this PyPI restriction.
Useful? React with 👍 / 👎.
… PEP 508 git extras
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Why
No DevForge tool is on public PyPI, so the bare extras in
pyproject.tomlresolved to other people's packages:[deadcode]installed deadcode 2.4.1 (Albertas Gimbutas),[envault]envault 0.4.6 (pratishshr),[sql]json2sql 1.0.0rc1 (fridex).[all]failed outright, and the unregistered names could be claimed by anyone. The README's recommended command also failed, because pip parsed...devforge-cli.git[all]as the git URL.What changes
deadcode-cli @ git+https://github.com/Coding-Dev-Tools/deadcode.git.pip install "devforge-tools[all] @ git+https://github.com/Coding-Dev-Tools/devforge-cli.git".Verified
pip install --dry-run "./devforge-cli[all]"resolves all ten tools to Coding-Dev-Tools repos: api-contract-guardian, apiauth, apighost, click-to-mcp, configdrift, deadcode-cli, deploydiff, json2sql-cli, rh-envault, schemaforge-cli.Later
PyPI rejects direct references in uploaded packages. Once the tools are published (Trusted Publishing), switch these back to version pins on the real names.
Independent 2-Agent Review Status
e2e355bef37089966579b9846ae30e07a3f7f6f8(2 fresh Command Codedeepseek/deepseek-v4.1-flash --effort maxcontexts).REQUEST_CHANGES· Reviewer 2REQUEST_CHANGES.SUCCESS;pytest tests/ -q32 passed;ruff check&ruff format --checkpass;pip install --dry-run ".[all]"resolves all 10Coding-Dev-Toolsdistributions.devforge versionsfalse negative for 4 of 10 tools (src/devforge/__init__.py:16,56,64,80,src/devforge/cli.py:144):_pip_version(info["package"])queries import names (json2sql,envault,schemaforge,deadcode) instead of distribution names (json2sql-cli,rh-envault,schemaforge-cli,deadcode-cli). Add"dist"toTOOLSand passinfo["dist"]to_pip_version.git+...[extra]install string still emitted in CLI (src/devforge/cli.py:104,202,tests/test_cli.py:61,141,189):devforge installand the not-installed hint still constructf"git+{repo_url}[{extras}]", which fails pip git cloning; switch to PEP 508f"devforge-tools[{extras}] @ git+{repo_url}".pyproject.toml:34-54,README.md:31) & missing packaging policy test: pin the 10 tool git URLs to@<40-hex-sha>(and note PyPIpublish.ymldirect-URL limitation) and add an offlinetomllibtest verifying extras/dist parity.e2e355battribution: authored byClaudewith trailers; must land via canonical squash after code blockers are fixed.