Repository navigation
build: prepare Pillow 13.0.0 manylinux2014 wheels - #122
Conversation
|
head_sha: 变更摘要本 PR 针对 主要改动
|
|
head_sha: 代码审查审查结论逐文件审查确认
问题统计
整体风险判断:构建路径(依赖钉住、哈希校验、manifest 比对、glibc 下限检查)改动稳健,风险集中在新增的发布路径。第 1 条问题一旦成立,会让
💬 仅评论 |
| fi | ||
| sha256=$(sha256sum -- "$wheel" | cut -d ' ' -f 1) | ||
| echo "pillow ${PILLOW_VERSION} ${machine} ${sha256} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/download/${tag}/${wheel}" | ||
| done > offline_wheel_overrides.txt |
There was a problem hiding this comment.
head_sha: 9197ba33cf090b693f64a0a749720abf65a95fe2
🟡 Medium Priority
改动行(289)把期望的 wheel 文件名写死为 pillow-${PILLOW_VERSION}-cp314-cp314-manylinux2014_<arch>.manylinux_2_17_<arch>.whl,即把 manylinux2014 这个旧别名放在 PEP 600 标签 manylinux_2_17_<arch> 之前。
证据链:auditwheel/cibuildwheel 生成 manylinux2014 wheel 时,平台标签来自 packaging 的 manylinux 标签序列(先 PEP 600 精确标签,再旧别名),实际产物形如 pillow-13.0.0-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl;PyPI 上大量 manylinux2014 wheel 均为 manylinux_2_17_<arch>.manylinux2014_<arch> 顺序。本行给出的顺序与之相反。
失败模式:紧邻的 wheels=(*.whl) 已经保证恰好存在两个 wheel,所以 [ ! -f "$wheel" ] 唯一现实的触发条件就是文件名不匹配——此时该步打印 missing expected wheel ... 后 exit 1,整个 publish 作业在完成两次完整构建之后失败,release 不会创建,PR 中 Rollout 第 1 步(用 publish=true、build=1 手工运行)直接无法完成;旧版本此处直接用 "${wheels[@]}" 通配结果,不存在该脆弱点。此外,即使当前顺序凑巧匹配,任何上游标签集合/顺序变化(auditwheel 版本、--plat 参数、新增别名)都会让这行硬编码字符串与实际产物不一致,与 286 行注释所说的“from the actual wheels”自相矛盾。
建议:把 for 循环体改成按架构从已收集的 ${wheels[@]} 中筛选实际 wheel(后缀 _<arch>.whl),校验恰好一个,再对其计算 sha256;错误信息里同时打印实际的 wheel 文件名,便于诊断。
| done > offline_wheel_overrides.txt | |
| for machine in x86_64 aarch64; do | |
| matches=() | |
| for candidate in "${wheels[@]}"; do | |
| case $candidate in | |
| *"${machine}.whl") matches+=("$candidate") ;; | |
| esac | |
| done | |
| if [ "${#matches[@]}" -ne 1 ]; then | |
| echo "::error::expected exactly one ${machine} wheel, found ${#matches[@]} of: ${wheels[*]}" | |
| exit 1 | |
| fi | |
| wheel=${matches[0]} | |
| sha256=$(sha256sum -- "$wheel" | cut -d ' ' -f 1) | |
| echo "pillow ${PILLOW_VERSION} ${machine} ${sha256} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/download/${tag}/${wheel}" | |
| done > offline_wheel_overrides.txt |
|
head_sha:
|
Build Pillow 13.0.0 for CPython 3.14 at the glibc 2.17 floor using immutable upstream source, cibuildwheel and patched manylinux image pins. Check the complete native source manifest before and after compilation, record SBOM provenance, and validate real wheel names, hashes and override URLs before publishing. Reject reused tags and leftover draft releases. Vendor the upstream libjpeg-turbo libspng compatibility patch in its applied -p0 form, check it out at the workflow revision, and verify its SHA-256. This avoids rebuilding from GitHub's dynamically generated patch response. Also stabilize the hook-indicator threshold tests reported by macOS CI: control only the indicator's clock while preserving real Textual timers so GC pauses cannot advance a hook past its one-second display threshold. Runtime Pillow/pypdf pins and offline wheel references follow in a separate PR after the rebuilt wheels are published and their GitCode tag is synced.
4200959 to
59612e6
Compare
|
🤖 This pull request has been merged, and the target branch is up to date. |
[mirror] #123: build: bump Pillow to 13.0.0 and pypdf to 6.21.2 Created-by: openjiuwen-sync Commit-by: Jiaqi (0x7c13) Liu Merged-by: Ox7c13 Description: Paired: [GitHub #123](#123) ↔ [GitCode !90](https://gitcode.com/openJiuwen/iCode/merge_requests/90) <!-- bot1-mirror-meta --> github_pr: 123 head_repo: 0x7c13/iCode head_ref: 0x7c13/pillow-13-pin head_sha: dbbef11 base_repo: openJiuwen-ai/iCode base_ref: main github_repo: openJiuwen-ai/iCode base_branch: main base_sha: d8d5f24 github_user: 0x7c13 <!-- /bot1-mirror-meta --> GitHub PR mirror for CodeArts CI. <!-- bot1-source-body --> Upgrade Pillow from 12.3.0 to 13.0.0 and pypdf from 6.21.1 to 6.21.2, and regenerate `uv.lock`. The same commit updates both Linux offline overrides to the published `pillow-13.0.0-manylinux2014.1` wheels built by #122. Only the two requested dependency versions change in the lockfile. The release tag resolves to `d8d5f24fa69037d3b24af83a6284ca602c0a5a78`. Both public wheel downloads and both manifest downloads were verified against their release SHA-256 digests; the committed override rows exactly match the published manifest. The release is a pre-release and is not a draft. Compatibility review against the [Pillow 13 release notes](https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html) and [pypdf 6.21.2 changelog](https://pypdf.readthedocs.io/en/6.21.2/meta/CHANGELOG.html): - No removed Pillow APIs are used by `src/`. `Image.open(formats=...)` still accepts the existing allowlists, and pypdf still decodes through the `PIL.Image` module wrapped by the document parser. Its explicitly named image formats remain within the reviewed set. - Pillow no longer saves mode I directly as PNG; the clipboard path already converts unsupported modes to RGBA, and document/attachment compression converts to RGB before JPEG encoding. - Pillow now applies `reducing_gap` when thumbnailing RGBA/LA images. This can change chat-preview sampling pixels; it requires no API adaptation. Document/attachment downscaling operates on RGB. Existing image preview, clipboard, document-image and PDF decoder restriction tests exercise these paths. Validation: - `uv lock --check`: passed. - Ruff checks and formatting: passed. - `uv build` and `uv run python scripts/check_wheel.py dist/icode_tui-0.31.0-py3-none-any.whl`: passed, including fresh-index dependency resolution, all CLI help commands, TUI/document imports, bundled docs and ripgrep. - Smart Test with exactly `pyproject.toml uv.lock scripts/offline_wheel_overrides.txt` automatically escalated to the full non-integration suite: **33,163 tests passed, 60 skipped; 1,241 architecture checks passed, 1 deselected**. This includes `test_offline_wheel_overrides_match_the_lock` and the image/PDF restriction tests. - Installed-version probes decoded and normalized all seven allowed document formats, verified pypdf's named-format subset and confirmed the decoder wrapper still installs. Both published Linux wheels contain 26 ELF objects with a maximum requirement of GLIBC_2.17. - [PR CI on dbbef11](https://github.com/openJiuwen-ai/iCode/actions/runs/40254598242): all jobs passed on the first attempt across Linux, macOS and Windows, including lint, architecture, test shards, type checks, builds and wheel installation. Follow-up: recheck that the release remains published after the next GitCode-to-GitHub sync. No merge or new release is requested by this PR. <!-- /bot1-source-body --> See merge request: openJiuwen/iCode!90
[mirror] #124: chore(release): bump version to 0.32.0 Created-by: openjiuwen-sync Commit-by: Jiaqi (0x7c13) Liu Merged-by: Ox7c13 Description: Paired: [GitHub #124](#124) ↔ [GitCode !91](https://gitcode.com/openJiuwen/iCode/merge_requests/91) <!-- bot1-mirror-meta --> github_pr: 124 head_repo: 0x7c13/iCode head_ref: dev/release-0.32.0 head_sha: c9d1882 base_repo: openJiuwen-ai/iCode base_ref: main github_repo: openJiuwen-ai/iCode base_branch: main base_sha: e225cb1 github_user: 0x7c13 <!-- /bot1-mirror-meta --> GitHub PR mirror for CodeArts CI. <!-- bot1-source-body --> Bump iCode to 0.32.0 so a release is cut from current `main`. ## Changes - `pyproject.toml` and `uv.lock`: the package version moves from 0.31.0 to 0.32.0. - i18n catalogs (`locales/chrys.pot`, `locales/zh-Hans/LC_MESSAGES/chrys.po`, the compiled `chrys.mo`): the `Project-Id-Version` header now says 0.32.0. No message changes. ## Release Merging this changes the version in `pyproject.toml` on `main`, so `tag-release.yml` creates the `v0.32.0` tag and starts `cd.yml` for that tag. This is the first release whose Linux offline binaries bundle Pillow 13.0.0, from the glibc 2.17 wheels published as `pillow-13.0.0-manylinux2014.1` (#122, #123). ## Included since 0.31.0 - #123 Pillow 13.0.0 and pypdf 6.21.2 (pypdf security fixes); the Linux offline binaries take the matching glibc 2.17 Pillow wheels - #122 the manylinux2014 Pillow wheel workflow builds 13.0.0 on patched build images, with every source archive pinned by SHA-256 (build-only); hook indicator tests stabilized - #121 completed turns fold into activity sections; the docs show how to request readable Claude thinking summaries - #120 the prompt editor asks for confirmation before its Discard button closes it - #111 a sidebar Hooks tab lists every hook run, and each run is recorded once - GitCode !85 the main chat shows the model's thinking as it streams; a resumed session replays it folded, and `/fold` folds it too - GitCode !84 the chat follows new content only while you are at the bottom - GitCode !83 a hook run log cut to size keeps file paths that are not valid UTF-8 intact - GitCode !82 faster startup: a loading screen with the logo paints before the main screen and agent load, and F12 works again once the agent is ready ## Verification - `uv lock --check` passes. - `scripts/i18n.py extract/update/compile/check` runs clean, and a second run changes nothing. - Tests were not run locally; CI covers them. <!-- /bot1-source-body --> See merge request: openJiuwen/iCode!91
Paired: GitHub #122 ↔ GitCode !89
Prepare Pillow 13.0.0 wheels for CPython 3.14 on x86_64 and aarch64 at the Linux offline binaries' glibc 2.17 floor. Pillow, pillow-depends, test-images and cibuildwheel remain pinned to immutable commits; runtime dependency pins are deferred until the rebuilt wheels are published.
.github/patches/libjpeg-turbo-3.2.0.tar.gz.patchin the exact-p0form Pillow applies. Check out the patch at this workflow run's immutable revision, verify its SHA-256, and copy it into Pillow's existing archive patch hook. No generated GitHub.patchdownload or runtime transformation is required. This fixes the__fpclassifyflink error in both manylinux2014 builds while retaining the upstream native build and tests. Record the applied patch in the wheel SBOM and release notes.python -I) Python snapshot implementation before and after building, with consistent symlink, directory and special-file handling and JSON filename encoding. Reuse the pre-build hashes for the explicit pins; reject changes to the source directory after dependency compilation and annotate missing or corrupt baselines.This PR also fixes the macOS CI failure in the hook-indicator threshold test, as documented in the single squash commit. The failure came from a 0.6-second GC pause advancing the real clock past the one-second display threshold. Three threshold tests now control only the indicator's clock while preserving real Textual timer callbacks and rendered-frame assertions. The pre-threshold observation deliberately exceeds one real second, and completion is applied before advancing the short-lived hook's age.
Upstream wheel tests, SBOM embedding and glibc floor checks remain in the workflow.
Rollout:
publish=trueand an unused build number (initially1).pillow-13.0.0-manylinux2014.<build>tag on GitCode at the workflow run's commit so synchronization preserves the GitHub release.uv.lock, and copy the published references intoscripts/offline_wheel_overrides.txt. Dry-run hashes must not be reused for a separate rebuild.Validation:
publish=false. Both builds checked out the committed patch at the run's exact revision and verified its hash. Each architecture passed 5679 Pillow tests (110 skipped, 3 xfailed), plus 3 wheel checks. Each wheel contains 26 ELF objects with a maximum requirement of GLIBC_2.17. SBOM generation, checksums, override generation and uploads passed; publishing was skipped.59612e6f. The actual artifacts passed the workflow's isolated publication-time filename/tag/hash validation locally, stopping before any GitHub writes.-p0convention.No release or tag was created. This PR remains open for maintainer review and merge.