Recorded against #147 so it is
not discovered during the migration.
The shared workflow installs the checkers with uv sync --locked from the docs
repository's own pyproject.toml, then invokes them by console-script name.
uv installs the project itself after its dependencies, so a [project.scripts]
entry in the docs repo named translation-status shadows the pinned one in
.venv/bin.
hatlabs/halpi2 currently carries scripts/translation_status.py — the
advisory-only checker this whole plan replaces. If Unit 9 pins the package but
leaves behind a [project.scripts] shim pointing at that file, CI silently runs
the old code: it reports and never exits non-zero, so the gate goes green while
translations are behind, and --locked says nothing because the manifest and
lock still agree.
Unit 9 already deletes the six scripts. The addition is to check
pyproject.toml for any [project.scripts] entry colliding with the six entry
point names, and to confirm on the first run that
uv run which translation-status resolves inside the installed package.
The general form — a pull request can repoint halos-docs-tools at a fork that
always exits 0, and uv sync --locked accepts it because it checks agreement,
not provenance — is a property of running repo-defined CI on repo-supplied
dependencies and is visible in the diff. Raised by the adversarial reviewer on
halos-org/shared-workflows#39.
The shadowing case is the one that can happen by accident.
Recorded against #147 so it is
not discovered during the migration.
The shared workflow installs the checkers with
uv sync --lockedfrom the docsrepository's own
pyproject.toml, then invokes them by console-script name.uvinstalls the project itself after its dependencies, so a[project.scripts]entry in the docs repo named
translation-statusshadows the pinned one in.venv/bin.hatlabs/halpi2currently carriesscripts/translation_status.py— theadvisory-only checker this whole plan replaces. If Unit 9 pins the package but
leaves behind a
[project.scripts]shim pointing at that file, CI silently runsthe old code: it reports and never exits non-zero, so the gate goes green while
translations are behind, and
--lockedsays nothing because the manifest andlock still agree.
Unit 9 already deletes the six scripts. The addition is to check
pyproject.tomlfor any[project.scripts]entry colliding with the six entrypoint names, and to confirm on the first run that
uv run which translation-statusresolves inside the installed package.The general form — a pull request can repoint
halos-docs-toolsat a fork thatalways exits 0, and
uv sync --lockedaccepts it because it checks agreement,not provenance — is a property of running repo-defined CI on repo-supplied
dependencies and is visible in the diff. Raised by the adversarial reviewer on
halos-org/shared-workflows#39.
The shadowing case is the one that can happen by accident.