[AAASM-2959] 🐛 (release-python): Build wheel against the released core pin

[Chisanan232]

Description

release-python.yml builds the PyPI wheel with maturin, which compiles aa-ffi-python (PyO3) from source against the git-SHA rev pins in native/aa-ffi-python/Cargo.toml (aa-core, aa-proto, aa-sdk-client). Those pins are only bumped to the just-released core commit by a separate PR (update-python-sdk-ffi-pin) that lands after publish — so the published wheel pinned the previous core release (one-cycle source-pin lag).

This makes the wheel self-consistent: a new "Pin aa-ffi git deps to released core" step runs before each maturin build in all five build jobs (build-sdist + the four wheel-matrix jobs). It rewrites the three rev = "…" pins in the CI working tree to the commit SHA that binary_source_tag points at on ai-agent-assembly/agent-assembly, so the wheel always compiles against the same core release whose aasm-* binaries it bundles. The rewrite is an ephemeral CI-only edit and is not committed back — master stays synced by the existing pin-bump PR.

The tag→SHA resolution lives in .github/scripts/pin-ffi-to-tag.sh, mirroring the repo's existing tag-to-pep440.sh helper-script convention.

Type of Change

• 🔧 Bug fix

Breaking Changes

• No

Related Issues

• Related JIRA ticket: AAASM-2959

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No tests required (explain why)

Validated locally:

• pin-ffi-to-tag.sh v0.0.1-alpha.4 resolves the annotated tag to its peeled commit SHA (47675422…) via git ls-remote refs/tags/<tag>^{} and rewrites all three pins; a bogus tag fails loudly (exit 1).
• Rewrite is idempotent (re-run with the same SHA is a no-op) and verifies exactly 3 deps were repinned.
• actionlint .github/workflows/release-python.yml — clean.
• shellcheck .github/scripts/pin-ffi-to-tag.sh — clean.
• python3 -c "import yaml; yaml.safe_load(...)" — parses; 5 pin steps present.

How to verify

The pin step runs for both real and dry-run builds. Dispatch release-python.yml with dry-run: true and a binary_source_tag; the run log shows the ::notice::Pinning aa-ffi git deps to <tag> -> <sha> line and the rewritten Cargo.toml dep lines before maturin compiles.

Checklist

• Code follows project style guidelines
• Self-review completed
• Comments added for complex logic
• Documentation updated if needed
• All tests passing

Closes AAASM-2959

🤖 Generated with Claude Code

[Chisanan232]

Claude Code review — AAASM-2959 (python wheel builds against the released core pin)

CI state

Green: Analyze (python) + tag → PEP 440 fixture suite pass. (Main ci.yaml path-skips workflow/script-only PRs by design.) MERGEABLE; BLOCKED = required-review only. No CI to fix.

Scope vs. acceptance criteria

AC (AAASM-2959 structural fix)	Status
Wheel compiles against the binary_source_tag core, not master's drifting pin	✅ new "Pin aa-ffi git deps to released core" step rewrites the 3 pins before maturin
Applied to every maturin build	✅ inserted in all 5 build jobs (build-sdist + 4 wheel platforms), each before the PyO3/maturin-action step
Robust tag → commit SHA	✅ git ls-remote … refs/tags/<tag>^{} (peeled/annotated) with lightweight fallback
Rewrites exactly the 3 core pins	✅ aa-core/aa-proto/aa-sdk-client; guard fails loudly if ≠3 repinned; idempotent
Ephemeral (not committed back); existing pin-bump PR keeps master synced	✅
Resolve/version/publish gating untouched	✅
Via PR, base master, granular commits	✅ 2 commits

Reviewer notes: Python rewrite (not sed) chosen for GNU/BSD parity across ubuntu + macOS runners — correct call. binary_source_tag passed via env: (no ${{ }} in run:) and is semver-validated upstream in resolve. actionlint + shellcheck + YAML parse all clean. node/go correctly need no change (their published artifacts don't bake in the pin). One optional follow-up: a unit-test fixture for pin-ffi-to-tag.sh (the rewrite is inline Python, so it'd need a small refactor to be sourceable) — non-blocking.

Verdict

Ready for approval and merge. CI green; the structural fix is correctly scoped, well-guarded, and validated. Merging this makes the next python publish self-consistent — and lets the upcoming beta.2 re-release exercise it end-to-end.

— Claude Code