fix: simplify external package check to version+checksum only - #174
Conversation
…ependency-edge comparison)
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7ee928ea20
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for k, before_by_version in before_ext.items(): | ||
| after_by_version = after_ext.get(k, {}) | ||
| for version, checksum in before_by_version.items(): | ||
| if version in after_by_version and after_by_version[version] != checksum: |
There was a problem hiding this comment.
When the unlocked cargo fetch in .github/workflows/external-build-android-aarch64.yml replaces any non-rama registry version or Git revision, the old (name, source, version) is absent from after_by_version and the newly introduced identity is never examined, so this loop returns success. For example, replacing serde 1.0.1 with 1.0.2—or changing a Git source hash—passes even though the checksum/source and resolved code changed, allowing the Android artifact to silently ship an unintended dependency re-resolution; additions/removals should be validated or narrowly allowlisted rather than ignored whenever the identities do not intersect.
Useful? React with 👍 / 👎.
1 participant
Follow-up to PR#173. The dependency-edge comparison for external packages caused a false-positive CI failure (hyper-util losing system-configuration/windows-registry edges due to the reqwest feature change, verified by Claude Opus 5 to be a feature-graph effect unrelated to Android target pruning). Simplifies external package verification to version+checksum only; rama-* keeps an explicit full-set assertion as a belt-and-suspenders check; local workspace member rules are unchanged.