fix: ensure deterministic and reproducible workflow behavior by Abhijeet2409 · Pull Request #2102 · hiero-ledger/hiero-sdk-python

Abhijeet2409 · 2026-04-11T14:12:36Z

This PR ensures deterministic and reproducible CI workflows by introducing uv.lock and aligning dependency installation across workflows.

Changes

1. Enable reproducible environments

Removed uv.lock from .gitignore
Generated uv.lock and committed it to the repository to ensure it locks exact dependency versions.

2. Enforce frozen installs in CI

Added --frozen to uv sync in:

pr-check-codecov.yml
pr-check-examples.yml
pr-check-secondary-unit-integration-test.yml
tck-test.yml

Ensures workflows install dependencies from the lockfile (uv.lock) using --frozen.

3. deps-check workflow

During debugging of the minimum-dependency test setup, added --no-editable to avoid SCM version mismatch during editable installs.
Ensures standard build installation while validating compatibility with minimum dependency versions.

4. Stabilize publish workflow

Kept pip (did not switch to uv to avoid introducing potential issues).
Pinned build dependencies:
- build==1.5
- pdm-backend==2.4.8
- grpcio-tools==1.76.0

5. pyproject.toml adjustments

Ensured dependency version ranges are compatible with lockfile resolution.
Minor adjustments during debugging to support reproducible builds.

Testing

1. Dependency Compatibility Check workflow

Successfully validated via fork
https://github.com/Abhijeet2409/hiero-sdk-python/actions/runs/24361544442

2. Publish to PyPI workflow

Validated via local build (pinned dependencies confirmed working)

Fixes #2057

codacy-production · 2026-04-11T14:14:00Z

Not up to standards ⛔

🔴 Issues 1 critical · 2 medium · 1 minor

Alerts:
⚠ 4 issues (≤ 0 issues of at least minor severity)

Results:
4 new issues

Category Results

Security 2 medium
1 minor

Complexity 1 critical

View in Codacy

🟢 Metrics 0 complexity

Metric Results

Complexity 0

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

codecov · 2026-04-11T14:14:55Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@           Coverage Diff           @@
##             main    #2102   +/-   ##
=======================================
  Coverage   93.68%   93.68%           
=======================================
  Files         145      145           
  Lines        9426     9426           
=======================================
  Hits         8831     8831           
  Misses        595      595

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

coderabbitai · 2026-04-11T19:30:14Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

Removed uv.lock from .gitignore, pinned build-system requirements in pyproject.toml, added --frozen (and in one job --no-editable) to several uv sync commands across workflows, enabled full git history in one workflow, and pinned build tool versions in the publish workflow.

Changes

Cohort / File(s)	Summary
Lock file management `/.gitignore`	Deleted the `uv.lock` ignore entry so the repository can commit and track the uv lockfile.
Build system configuration `pyproject.toml`	Pinned entries in `[build-system].requires` to explicit versions and moved PDM SCM version config to a `[tool.pdm.version]` table.
Frozen sync enforcement (CI jobs) `.github/workflows/pr-check-secondary-unit-integration-test.yml`, `.github/workflows/pr-check-primary-codecov.yml`, `.github/workflows/pr-check-secondary-examples.yml`, `.github/workflows/pr-check-secondary-tck-test.yml`	Changed `uv sync` invocations to include `--frozen` to enforce using the lockfile; no other job logic altered.
Deps test workflow adjustments `.github/workflows/pr-check-secondary-deps-test.yml`	Set `actions/checkout` to `fetch-depth: 0` and changed `uv sync` to add `--no-editable` for minimum-deps compatibility checks; minor whitespace/indentation tweaks and an explanatory comment added.
Publish workflow tool pinning `.github/workflows/publish.yml`	Pinned build tooling to explicit versions (`build==1.4.2`, `pdm-backend==2.4.8`, `grpcio-tools==1.76.0`) and added comments noting reproducible builds.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix: ensure deterministic and reproducible workflow behavior' accurately reflects the main objective of the PR: making CI workflows deterministic and reproducible by committing uv.lock and using frozen installs.
Linked Issues check	✅ Passed	The PR addresses all primary objectives from issue `#2057`: removed uv.lock from .gitignore, committed uv.lock to source control, added --frozen to uv sync commands, pinned build dependencies in publish workflow, standardized on uv with lockfile, and provided testing evidence.
Out of Scope Changes check	✅ Passed	All changes directly support the linked issue objectives: workflow YAML updates enforce frozen installs, .gitignore modification enables lockfile tracking, pyproject.toml adjustments support reproducible builds, and publish workflow stabilization pins dependencies. No unrelated changes detected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The pull request description clearly outlines the changes made to ensure deterministic and reproducible CI workflows, including specific file modifications, workflow adjustments, and testing validation.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

📋 Issue Planner

Built with CodeRabbit's Coding Plans for faster development and fewer bugs.

View plan used: #2057

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e9809a5e-f84e-4629-9a97-5f3ec1736765

📥 Commits

Reviewing files that changed from the base of the PR and between 9360ad4 and 348127c.

⛔ Files ignored due to path filters (1)

uv.lock is excluded by !**/*.lock

📒 Files selected for processing (9)

.github/workflows/deps-check.yml
.github/workflows/pr-check-codecov.yml
.github/workflows/pr-check-examples.yml
.github/workflows/pr-check-secondary-unit-integration-test.yml
.github/workflows/publish.yml
.github/workflows/tck-test.yml
.gitignore
CHANGELOG.md
pyproject.toml

💤 Files with no reviewable changes (1)

.gitignore

exploreriii

Hi @Abhijeet2409
This is looking pretty good, I left a question.

Could you please rebase, fetching all new content from upstream main.
We have changed some of these workflow names (sorry for the inconvenience) and also deleted the changelog, do you'll no longer need and entry.
Thanks!

Abhijeet2409 · 2026-04-13T20:12:25Z

Hey @exploreriii, thanks for the review. I’ve successfully rebased my commits, resolved conflicts, and updated things accordingly. Happy to make any further changes if needed :)

exploreriii

Hi @Abhijeet2409 note your DCO+GPG key signing got mixed up here, please check your signing and try again

Abhijeet2409 · 2026-05-08T05:24:14Z

@Abhijeet2409 sorry about this, you also lost your verified sign status

No issue, I’ll fix that. I’ve been busy traveling lately.

Signed-off-by: Abhijeet Saharan <abhijeetsaharan2236@gmail.com>

aceppaluni · 2026-05-13T18:09:15Z

@Abhijeet2409 Please update the branch

aceppaluni

@Abhijeet2409 Thank you for this.

The reason the workflow fails is the use of --no-editable

This flag needs to exist in each workflow, not jsut pr-check-secondary-deps-test.yml.

So sections where you see something like

- name: Install dependencies
        run: |
          uv sync --all-extras --dev --frozen

Need to inclide this flag. So it changes to

- name: Install dependencies
        run: |
          uv sync --all-extras --dev --frozen --no-editable

What are your thoughts on this change?

Abhijeet2409 · 2026-05-14T08:11:04Z

@aceppaluni I agree with your suggestion. I checked the related workflows/tests to see if switching all uv sync installs to --no-editable could introduce any issues, but I did not find any workflow that appears to depend on editable-install behavior.

Using --no-editable consistently across the workflows will also help avoid the SCM/editable metadata path that caused the earlier failures.

Since publish.yml already follows a standard non-editable build flow, this should also make the CI workflows more consistent overall.

I’ll proceed with adding --no-editable in the remaining workflows.

Signed-off-by: Abhijeet <abhijeetsaharan2236@gmail.com>

Signed-off-by: Abhijeet Saharan <abhijeetsaharan2236@gmail.com>

Signed-off-by: Abhijeet <abhijeetsaharan2236@gmail.com>

Abhijeet2409 · 2026-05-14T09:13:11Z

After applying --no-editable across the remaining uv sync workflows, the failures now seem to consistently point to package version metadata mismatches.
I’m trying to resolve the failures and will update shortly.

aceppaluni · 2026-05-14T14:49:07Z

After applying --no-editable across the remaining uv sync workflows, the failures now seem to consistently point to package version metadata mismatches. I’m trying to resolve the failures and will update shortly.

Thank you for the update

exploreriii

Hi I think this is pretty good, just have a couple questions

exploreriii · 2026-05-17T09:52:01Z

+      # These should be periodically reviewed and updated for ensuring smooth execution.
      - name: Install build, pdm-backend, and grpcio-tools
-        run: pip install build pdm-backend "grpcio-tools==1.76.0"
+        run: pip install build==1.4.2 pdm-backend==2.4.8 grpcio-tools==1.76.0


i think this is now 1.5?
https://github.com/pypa/build/releases

Yes, build version is 1.5 now, so updating accordingly.

exploreriii · 2026-05-17T10:00:08Z

-requires = ["pdm-backend", "setuptools", "setuptools_scm", "grpcio-tools"]
+requires = [
+    "pdm-backend>=2.4.8,<3",
+    "setuptools>=82,<83",


i know we had these in build, but unsure if they all need to be here? have you tested, as you are now narrowing the windows?
maybe grpcio-tools & setuptools (are we usin gthis?) can be moved to dependencies
cc @manishdait

setuptools is needed we do use them because pdm-backend relies on it to resolve to dynamic = ["version"], for grpcio-tools, I'll verify if the build passes without it and drop a comment

Signed-off-by: Abhijeet <abhijeetsaharan2236@gmail.com>

manishdait · 2026-05-21T13:27:05Z


      - name: Install dependencies
-        run: uv sync --all-extras --dev
+        run: uv sync --all-extras --dev --frozen --no-editable


Hi @Abhijeet2409, can you update this to uv sync --frozen --all-groups --all-packages --all-extras same for rest

Signed-off-by: Abhijeet Saharan <abhijeetsaharan2236@gmail.com>

Abhijeet2409 force-pushed the fix/refactor-workflows-deterministic branch 3 times, most recently from ad0c26e to a75c8b7 Compare April 11, 2026 18:47

github-actions Bot added scope: CI/CD involves continuous integration or delivery skill: intermediate requires some knowledge of the codebase with some defined steps to implement or examples labels Apr 11, 2026

Abhijeet2409 force-pushed the fix/refactor-workflows-deterministic branch 2 times, most recently from 0504e01 to 595016e Compare April 11, 2026 19:21

Abhijeet2409 marked this pull request as ready for review April 11, 2026 19:25

Abhijeet2409 requested review from a team as code owners April 11, 2026 19:26

Abhijeet2409 requested review from PavelSBorisov, manishdait and stoqnkpL April 11, 2026 19:26

coderabbitai Bot reviewed Apr 11, 2026

View reviewed changes

Comment thread pyproject.toml

exploreriii added the reviewer: maintainer PR needs a review from the maintainer team label Apr 12, 2026

exploreriii requested changes Apr 13, 2026

View reviewed changes

Comment thread pyproject.toml Outdated

exploreriii added status: needs developer revision and removed reviewer: maintainer PR needs a review from the maintainer team labels Apr 13, 2026

exploreriii marked this pull request as draft April 13, 2026 13:45

exploreriii added this to the v0.2.5 milestone Apr 13, 2026

Abhijeet2409 force-pushed the fix/refactor-workflows-deterministic branch from 0274282 to 16991d2 Compare April 13, 2026 19:58

Abhijeet2409 marked this pull request as ready for review April 13, 2026 20:12

exploreriii requested changes Apr 14, 2026

View reviewed changes

exploreriii added feedback: fix workflow labels Apr 14, 2026

github-actions Bot added the queue:maintainers PR awaiting maintainer final review label May 8, 2026

exploreriii removed reviewer: maintainer PR needs a review from the maintainer team step: 2nd second stage of the review approval process labels May 8, 2026

github-actions Bot added open to community review PR is open for community review and feedback queue:junior-committer PR awaiting initial quality review and removed queue:maintainers PR awaiting maintainer final review labels May 9, 2026

chore: apply pre-commit fixes

f642513

Signed-off-by: Abhijeet Saharan <abhijeetsaharan2236@gmail.com>

Abhijeet2409 dismissed aceppaluni’s stale review via f642513 May 11, 2026 18:09

Abhijeet2409 force-pushed the fix/refactor-workflows-deterministic branch from ac742a9 to f642513 Compare May 11, 2026 18:09

Merge branch 'main' into fix/refactor-workflows-deterministic

2556674

Merge branch 'main' into fix/refactor-workflows-deterministic

4eef7fe

aceppaluni requested changes May 13, 2026

View reviewed changes

Abhijeet2409 added 4 commits May 14, 2026 13:45

fix: use non-editable installs in codecov workflow

607b142

Signed-off-by: Abhijeet <abhijeetsaharan2236@gmail.com>

fix: use non-editable installs in uv workflows

e427a00

Signed-off-by: Abhijeet Saharan <abhijeetsaharan2236@gmail.com>

fix: ensure non-editable installs

72b03b4

Signed-off-by: Abhijeet <abhijeetsaharan2236@gmail.com>

Merge branch 'main' into fix/refactor-workflows-deterministic

ac00687

Abhijeet2409 force-pushed the fix/refactor-workflows-deterministic branch from d3844a8 to ac00687 Compare May 14, 2026 09:35

Merge branch 'main' into fix/refactor-workflows-deterministic

562d391

Merge branch 'main' into fix/refactor-workflows-deterministic

da8a859

exploreriii reviewed May 17, 2026

View reviewed changes

exploreriii added the help needed label May 17, 2026

fix: update build version

b923a12

Signed-off-by: Abhijeet <abhijeetsaharan2236@gmail.com>

manishdait reviewed May 21, 2026

View reviewed changes

Abhijeet2409 added 2 commits May 22, 2026 14:16

Merge branch 'main' into fix/refactor-workflows-deterministic

fe9b542

fix: update workflows to use consistent flags

9dbd3cc

Signed-off-by: Abhijeet Saharan <abhijeetsaharan2236@gmail.com>

Conversation

Abhijeet2409 commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

1. Enable reproducible environments

2. Enforce frozen installs in CI

3. deps-check workflow

4. Stabilize publish workflow

5. pyproject.toml adjustments

Testing

1. Dependency Compatibility Check workflow

2. Publish to PyPI workflow

3. Run Examples workflow

4. Secondary PR Check – Hiero Solo Integration & Unit Tests workflow

5. TCK Unit Test workflow

6. Code Coverage workflow

Uh oh!

codacy-production Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Not up to standards ⛔

Uh oh!

codecov Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Estimated code review effort

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

exploreriii left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Abhijeet2409 commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

exploreriii left a comment

Choose a reason for hiding this comment

Uh oh!

Abhijeet2409 commented May 8, 2026

Uh oh!

aceppaluni commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aceppaluni left a comment

Choose a reason for hiding this comment

Uh oh!

Abhijeet2409 commented May 14, 2026

Uh oh!

Abhijeet2409 commented May 14, 2026

Uh oh!

aceppaluni commented May 14, 2026

Uh oh!

exploreriii left a comment

Choose a reason for hiding this comment

Uh oh!

exploreriii May 17, 2026

Choose a reason for hiding this comment

Uh oh!

Abhijeet2409 May 17, 2026

Choose a reason for hiding this comment

Uh oh!

exploreriii May 17, 2026

Choose a reason for hiding this comment

Uh oh!

manishdait May 17, 2026

Choose a reason for hiding this comment

Uh oh!

manishdait May 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Abhijeet2409 commented Apr 11, 2026 •

edited

Loading

codacy-production Bot commented Apr 11, 2026 •

edited

Loading

codecov Bot commented Apr 11, 2026 •

edited

Loading

coderabbitai Bot commented Apr 11, 2026 •

edited

Loading

Abhijeet2409 commented Apr 13, 2026 •

edited

Loading

aceppaluni commented May 13, 2026 •

edited

Loading