Repository navigation
fix(ci): fail the certify gate closed when an app's dependencies do not install - #4738
Merged
Merged
Conversation
…ot install The certify job passed with only a "Certification incomplete" warning when `uv sync` failed, so an app whose install always failed published without contract-drift or unit-test certification. - certify.py verdict blocks publish when the app install fails, in certify or in any certify-unit leg. An app with no tests/unit still passes. - certify_unit_shards.py reports install_failed separately from skipped, so the verdict can tell "could not run" from "nothing to run". - Both certify jobs pin UV_PYTHON to the app image's Python (the SDK Dockerfile's golden tag, via container_python_version.py). Unpinned, they used the runner's system 3.14 while images ship 3.13, and apps with no .python-version built wheel-less deps (pyarrow 20, pandas, numpy) from source and failed. - New apt_packages input installs native build headers (hive's pykerberos needs libkrb5-dev) before uv sync, behind the same allowlist guard as tests-reusable.yaml's apt-packages, pinned byte-identical by a test.
cmgrote
requested review from
Aryamanz29,
OnkarVO7,
atlan-ci and
vaibhavatlan
as code owners
November 4, 2026 10:08
This was referenced Nov 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #4731. The base is
christophergrote/fnd-4244; retarget tomainonce #4731 merges.Fixes FND-4538.
Why
When
uv syncfailed in the certify job, contract drift and unit tests were skipped and the verdict still passed, with only a "Certification incomplete" warning. An app whose install always failed therefore published uncertified.Before the gate could fail closed, the installs that fail for reasons outside the app had to be fixed:
python3, now 3.14. App images ship 3.13, from the golden base in the SDKDockerfilethatapp-runtime-baseis built from. Apps with no.python-versionbuilt wheel-less pins from source on 3.14:pyarrow==20.0.0failed in cmake, and pandas, numpy and duckdb ran past the 30-minute cap.pykerberosneedslibkrb5-dev. tests-reusable already takes anapt-packagesinput for this, but build-and-publish-app had no equivalent.What
certify.py verdictblocks publish when the app install fails, whether incertifyitself or in anycertify-unitleg. An app with notests/unitstill passes.certify_unit_shards.py verdictnow reportsinstall_failedinstead of folding it intoskipped.certifyandcertify-unitsetUV_PYTHONfromcontainer_python_version.py print-version. This is the same source of truth the SDK's own test workflows use, and it overrides an app's.python-version.certify-unit's sparse SDK checkout now includes/Dockerfile.apt_packagesinput (default empty), installed beforeuv syncin both jobs. The guard is byte-identical to tests-reusable's.docs/standards/app-certification.mdis updated.Tests
test_build_and_publish_certify_wiring.py(new) asserts step order and env routing. It also executes the pin step against an SDK laid out as the job checks it out, including the case with no golden tag, where the step must fail rather than export an empty value. It executes the apt guard as well.tests/unitpasses.x86_64-manylinux_2_28,pyarrow==20.0.0,pandas==2.3.0,numpy==2.3.1andduckdb==1.3.1all resolve to wheels on 3.13.pyarrow==20.0.0has no wheel on 3.14.Rollout
Callers use
@main, so this takes effect for every app on merge. hive must passapt_packages: "libkrb5-dev gcc python3-dev"; a companion PR in that repo is ready to merge straight after this one. publish and discovery are fixed by the Python pin alone. The earlier intermittent install failures in two other apps were not reproduced in their recent runs.🤖 Generated with Claude Code
https://claude.ai/code/session_01AbKqGawV8xf6jHvYupy2hA