From 62433021b0b33d80774c9af38c00156f10a4e382 Mon Sep 17 00:00:00 2001 From: Chisanan232 Date: Mon, 15 Jun 2026 09:39:02 +0800 Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=90=9B=20(release-python):=20Add=20pi?= =?UTF-8?q?n-ffi-to-tag.sh=20to=20pin=20aa-ffi=20to=20a=20release=20tag's?= =?UTF-8?q?=20core=20commit?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resolves an agent-assembly release tag to its full commit SHA (dereferencing annotated tags via the peeled ^{} ref, falling back to the lightweight ref) and rewrites the aa-core/aa-proto/aa-sdk-client `rev` pins in native/aa-ffi-python/Cargo.toml to that SHA. Portable Python rewrite (GNU + BSD sed parity); verifies all 3 deps were repinned; idempotent. Ephemeral CI edit, not committed back. Refs AAASM-2959 Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/scripts/pin-ffi-to-tag.sh | 100 ++++++++++++++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100755 .github/scripts/pin-ffi-to-tag.sh diff --git a/.github/scripts/pin-ffi-to-tag.sh b/.github/scripts/pin-ffi-to-tag.sh new file mode 100755 index 00000000..11bb4b7a --- /dev/null +++ b/.github/scripts/pin-ffi-to-tag.sh @@ -0,0 +1,100 @@ +#!/usr/bin/env bash +# +# Pin the aa-ffi-python git deps to the agent-assembly commit a release tag +# points at, so the maturin-built wheel always compiles against the SAME core +# release whose aasm-* binaries it bundles (binary_source_tag). +# +# Background (AAASM-2959): release-python.yml builds the PyPI wheel with maturin, +# which compiles aa-ffi-python (PyO3) from source against the git-SHA `rev` +# pins in native/aa-ffi-python/Cargo.toml (aa-core, aa-proto, aa-sdk-client). +# Those pins are only bumped to the just-released core commit by a SEPARATE PR +# that lands AFTER publish, so without this rewrite the published wheel would +# pin the PREVIOUS core release (one-cycle source-pin lag). This script makes +# the wheel self-consistent by rewriting the pins to binary_source_tag's commit +# in the CI working tree before each maturin build. It is an ephemeral edit — +# CI must NOT commit it back (the update-python-sdk-ffi-pin PR keeps master +# synced separately). +# +# Usage: +# .github/scripts/pin-ffi-to-tag.sh [cargo_toml_path] +# +# agent-assembly release tag, e.g. v0.0.1-alpha.8 +# [cargo_toml_path] defaults to native/aa-ffi-python/Cargo.toml +# +# Resolves the tag to a full 40-hex commit SHA on +# ai-agent-assembly/agent-assembly, dereferencing annotated tags (the peeled +# `^{}` ref), and falling back to the lightweight tag ref if peeling yields +# nothing. Then rewrites every `rev = ""` on the aa-core / aa-proto / +# aa-sdk-client git dep lines to that SHA. Idempotent: re-running with the same +# tag is a no-op. + +set -euo pipefail + +TAG="${1:?usage: pin-ffi-to-tag.sh [cargo_toml_path]}" +CARGO_TOML="${2:-native/aa-ffi-python/Cargo.toml}" +REPO_URL="https://github.com/ai-agent-assembly/agent-assembly.git" + +if [[ ! -f "$CARGO_TOML" ]]; then + echo "::error::Cargo.toml not found at '$CARGO_TOML'" >&2 + exit 1 +fi + +# Resolve tag -> full commit SHA. Prefer the peeled (`^{}`) ref so annotated +# tags resolve to the commit they point at, not the tag object's own SHA. +# Fall back to the lightweight ref when the peeled form is empty. +sha="$(git ls-remote "$REPO_URL" "refs/tags/${TAG}^{}" | awk '{print $1}' | head -n1)" +if [[ -z "$sha" ]]; then + sha="$(git ls-remote "$REPO_URL" "refs/tags/${TAG}" | awk '{print $1}' | head -n1)" +fi + +if [[ ! "$sha" =~ ^[0-9a-f]{40}$ ]]; then + echo "::error::could not resolve tag '${TAG}' to a 40-hex commit SHA on ${REPO_URL} (got '${sha}')" >&2 + exit 1 +fi + +echo "::notice::Pinning aa-ffi git deps to ${TAG} -> ${sha}" + +# Rewrite the `rev = "..."` on each aa-core / aa-proto / aa-sdk-client git dep +# line, keyed on the dep name at line start so unrelated `rev`s are untouched. +# Done in Python (not sed) for portable, identical behaviour across the GNU-sed +# (ubuntu) and BSD-sed (macOS) build runners. Verifies exactly 3 deps were +# repinned so a silent no-op (e.g. a Cargo.toml refactor that broke the match) +# cannot let a stale-pinned wheel slip through. +SHA="$sha" CARGO_TOML="$CARGO_TOML" python3 - <<'PY' +import os +import re +import sys + +sha = os.environ["SHA"] +path = os.environ["CARGO_TOML"] +deps = ("aa-core", "aa-proto", "aa-sdk-client") +# Match ` = { ... rev = "<40-hex>" ... }` at line start. +line_re = re.compile(r'^(aa-(?:core|proto|sdk-client))\s*=.*$') +rev_re = re.compile(r'(rev\s*=\s*")[0-9a-fA-F]{40}(")') + +with open(path, encoding="utf-8") as fh: + lines = fh.readlines() + +repinned = set() +for i, line in enumerate(lines): + m = line_re.match(line) + if not m: + continue + new_line, n = rev_re.subn(rf'\g<1>{sha}\g<2>', line) + if n: + lines[i] = new_line + repinned.add(m.group(1)) + +if repinned != set(deps): + missing = set(deps) - repinned + sys.stderr.write( + f"::error::expected to repin {sorted(deps)}, missing {sorted(missing)} in {path}\n" + ) + sys.exit(1) + +with open(path, "w", encoding="utf-8") as fh: + fh.writelines(lines) +PY + +echo "aa-ffi git deps pinned to ${sha}:" +grep -nE '^aa-(core|proto|sdk-client)[[:space:]]*=' "$CARGO_TOML" From 8bc0c2375f9101dd041cbcf0bb503583929ecc90 Mon Sep 17 00:00:00 2001 From: Chisanan232 Date: Mon, 15 Jun 2026 09:39:11 +0800 Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=90=9B=20(release-python):=20Pin=20aa?= =?UTF-8?q?-ffi=20to=20binary=5Fsource=5Ftag=20commit=20before=20each=20ma?= =?UTF-8?q?turin=20build?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Insert a "Pin aa-ffi git deps to released core" step before the maturin step in all five build jobs (sdist + 4 wheel matrix jobs) so the wheel always compiles against the SAME core release whose aasm-* binaries it bundles. master's pins lag by one cycle (bumped only by the post-publish update-python-sdk-ffi-pin PR), so without this the published wheel pinned the PREVIOUS core release. Runs for real and dry-run builds alike; resolve/version/publish logic unchanged. Closes AAASM-2959 Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release-python.yml | 45 ++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml index 4c62d385..4e16fc36 100644 --- a/.github/workflows/release-python.yml +++ b/.github/workflows/release-python.yml @@ -162,6 +162,15 @@ jobs: - uses: actions/setup-python@v6 with: python-version: ${{ env.PYTHON_VERSION }} + - name: Pin aa-ffi git deps to released core (binary_source_tag) + # Rewrite native/aa-ffi-python/Cargo.toml so the wheel compiles against + # the SAME core release whose aasm-* binaries it bundles. master's pins + # lag by one cycle (bumped only by the post-publish update PR), so + # without this the wheel would pin the PREVIOUS core. Ephemeral CI edit + # — not committed back. See AAASM-2959. + env: + BINARY_SOURCE_TAG: ${{ needs.resolve.outputs.binary_source_tag }} + run: .github/scripts/pin-ffi-to-tag.sh "$BINARY_SOURCE_TAG" - name: Sync version uses: ./.github/actions/sync-version with: @@ -208,6 +217,15 @@ jobs: rm -f agent_assembly/bin/aasm-x86_64-unknown-linux-gnu.tar.gz chmod +x agent_assembly/bin/aasm echo "Bundled aasm binary into wheel" + - name: Pin aa-ffi git deps to released core (binary_source_tag) + # Rewrite native/aa-ffi-python/Cargo.toml so the wheel compiles against + # the SAME core release whose aasm-* binaries it bundles. master's pins + # lag by one cycle (bumped only by the post-publish update PR), so + # without this the wheel would pin the PREVIOUS core. Ephemeral CI edit + # — not committed back. See AAASM-2959. + env: + BINARY_SOURCE_TAG: ${{ needs.resolve.outputs.binary_source_tag }} + run: .github/scripts/pin-ffi-to-tag.sh "$BINARY_SOURCE_TAG" - name: Sync version uses: ./.github/actions/sync-version with: @@ -279,6 +297,15 @@ jobs: rm -f agent_assembly/bin/aasm-aarch64-unknown-linux-gnu.tar.gz chmod +x agent_assembly/bin/aasm echo "Bundled aasm binary into wheel" + - name: Pin aa-ffi git deps to released core (binary_source_tag) + # Rewrite native/aa-ffi-python/Cargo.toml so the wheel compiles against + # the SAME core release whose aasm-* binaries it bundles. master's pins + # lag by one cycle (bumped only by the post-publish update PR), so + # without this the wheel would pin the PREVIOUS core. Ephemeral CI edit + # — not committed back. See AAASM-2959. + env: + BINARY_SOURCE_TAG: ${{ needs.resolve.outputs.binary_source_tag }} + run: .github/scripts/pin-ffi-to-tag.sh "$BINARY_SOURCE_TAG" - name: Sync version uses: ./.github/actions/sync-version with: @@ -344,6 +371,15 @@ jobs: echo "Bundled aasm binary into wheel" - name: Install protoc (macOS) run: brew install protobuf + - name: Pin aa-ffi git deps to released core (binary_source_tag) + # Rewrite native/aa-ffi-python/Cargo.toml so the wheel compiles against + # the SAME core release whose aasm-* binaries it bundles. master's pins + # lag by one cycle (bumped only by the post-publish update PR), so + # without this the wheel would pin the PREVIOUS core. Ephemeral CI edit + # — not committed back. See AAASM-2959. + env: + BINARY_SOURCE_TAG: ${{ needs.resolve.outputs.binary_source_tag }} + run: .github/scripts/pin-ffi-to-tag.sh "$BINARY_SOURCE_TAG" - name: Sync version uses: ./.github/actions/sync-version with: @@ -390,6 +426,15 @@ jobs: echo "Bundled aasm binary into wheel" - name: Install protoc (macOS) run: brew install protobuf + - name: Pin aa-ffi git deps to released core (binary_source_tag) + # Rewrite native/aa-ffi-python/Cargo.toml so the wheel compiles against + # the SAME core release whose aasm-* binaries it bundles. master's pins + # lag by one cycle (bumped only by the post-publish update PR), so + # without this the wheel would pin the PREVIOUS core. Ephemeral CI edit + # — not committed back. See AAASM-2959. + env: + BINARY_SOURCE_TAG: ${{ needs.resolve.outputs.binary_source_tag }} + run: .github/scripts/pin-ffi-to-tag.sh "$BINARY_SOURCE_TAG" - name: Sync version uses: ./.github/actions/sync-version with: