This is an automated email from the ASF dual-hosted git repository.
vatsrahul1001 pushed a commit to branch v3-4-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
commit 273f477693404fba1bd276d0a08b1521a6b615fa
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Fri Oct 30 12:15:05 2026 +0530
[v3-4-test] Refuse to publish constraints when the branch moved during
generation (#75989) (#75990)
A regular constraints refresh resolves its pins against the constraints
branch as it is when the run starts, then commits them on top of the
branch as it is when the run ends. When Release constraints commits a
release candidate's pins in between, the refresh overwrote them with
pins resolved against the older baseline, and the push still succeeded
because it was an ordinary fast-forward.
The two workflows run in different concurrency groups, so nothing
serialised them. The publish now fails instead and asks for a re-run,
which then starts from the candidate's constraints.
(cherry picked from commit 92bbf67c3629d6baf9ef738e8217da78dead950d)
Generated-by: Claude Opus 5
Co-authored-by: Jarek Potiuk <[email protected]>
---
.github/workflows/update-constraints-on-push.yml | 28 ++++++++++++++++++++++
...UALLY_GENERATING_IMAGE_CACHE_AND_CONSTRAINTS.md | 6 +++++
2 files changed, 34 insertions(+)
diff --git a/.github/workflows/update-constraints-on-push.yml
b/.github/workflows/update-constraints-on-push.yml
index ba55e09d9eb..4c84567e23d 100644
--- a/.github/workflows/update-constraints-on-push.yml
+++ b/.github/workflows/update-constraints-on-push.yml
@@ -99,6 +99,7 @@ jobs:
default-python-version: ${{
steps.selective-checks.outputs.default-python-version }}
python-versions: ${{ steps.selective-checks.outputs.python-versions }}
python-versions-list-as-string: ${{
steps.selective-checks.outputs.python-versions-list-as-string }}
+ constraints-baseline-sha: ${{ steps.constraints-baseline.outputs.sha }}
steps:
- name: "Cleanup repo"
shell: bash
@@ -129,6 +130,19 @@ jobs:
VERBOSE: "false"
GITHUB_CONTEXT_INPUT: "${{ runner.temp }}/github_context.json"
run: breeze ci selective-check 2>> ${GITHUB_OUTPUT}
+ # Recorded before the constraints are generated, so any commit landing
on the branch while
+ # this run works - a release candidate's constraints above all - stops
the publish below
+ # instead of being overwritten by pins resolved against the older
baseline.
+ - name: "Record the constraints baseline"
+ id: constraints-baseline
+ shell: bash
+ env:
+ CONSTRAINTS_BRANCH: ${{
steps.selective-checks.outputs.default-constraints-branch }}
+ run: |
+ sha="$(git ls-remote "https://github.com/${GITHUB_REPOSITORY}"; \
+ "refs/heads/${CONSTRAINTS_BRANCH}" | cut -f1)"
+ echo "sha=${sha}" >> "${GITHUB_OUTPUT}"
+ echo "Constraints baseline: ${CONSTRAINTS_BRANCH} @ ${sha:-<branch
does not exist yet>}"
- name: "Parameters summary"
shell: bash
env:
@@ -217,6 +231,20 @@ jobs:
ref: ${{ env.CONSTRAINTS_BRANCH }}
persist-credentials: true
fetch-depth: 0
+ - name: "Check ${{ env.CONSTRAINTS_BRANCH }} did not move while the
constraints were generated"
+ working-directory: "constraints"
+ env:
+ BASELINE_SHA: ${{ needs.build-info.outputs.constraints-baseline-sha
}}
+ run: |
+ current_sha="$(git rev-parse HEAD)"
+ if [[ -n "${BASELINE_SHA}" && "${current_sha}" != "${BASELINE_SHA}"
]]; then
+ echo "::error::${CONSTRAINTS_BRANCH} moved from ${BASELINE_SHA} to
${current_sha}" \
+ "while this run generated its constraints. Publishing would
overwrite those commits" \
+ "with pins resolved against the older baseline. Re-run the
workflow so it starts" \
+ "from the current branch."
+ git log --oneline "${BASELINE_SHA}..${current_sha}" || true
+ exit 1
+ fi
- name: "Download constraints from the generate-constraints job"
uses:
actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with:
diff --git a/dev/MANUALLY_GENERATING_IMAGE_CACHE_AND_CONSTRAINTS.md
b/dev/MANUALLY_GENERATING_IMAGE_CACHE_AND_CONSTRAINTS.md
index cd07deec80b..b40f1f59c1d 100644
--- a/dev/MANUALLY_GENERATING_IMAGE_CACHE_AND_CONSTRAINTS.md
+++ b/dev/MANUALLY_GENERATING_IMAGE_CACHE_AND_CONSTRAINTS.md
@@ -284,6 +284,12 @@ To run it:
https://github.com/apache/airflow/commits/constraints-<major>-<minor>/
+ If the run instead fails with "moved ... while this run generated its
constraints", something
+ else committed to that branch while it was working - typically the `Release
constraints`
+ workflow pinning a release candidate. The run refuses to overwrite that
commit with pins
+ resolved against the older baseline; run it again so it starts from the
current branch.
+ Automatic `uv.lock`-push runs behave the same way.
+
> [!NOTE]
> Because `v3-3-test` and `v3-3-stable` can diverge while RCs are being voted
> on (fixes are
> cherry-picked to `v3-3-test`), be deliberate about which `ref` you refresh
> from. Refresh from
