pythontests: keep uv virtualenv outside the checkout - #93
Conversation
nltk 3.10.1 added an import-time guard against CWD module hijacking that misfires whenever the venv lives inside the project directory (uv's default), blocking nltk's own internal imports and breaking test collection for every consuming repo. Moving the environment to $RUNNER_TEMP sidesteps this and any future package doing the same kind of check. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
I chalk this up to a docassemble versioning issue rather than anything else, and shouldn't be fixed like this up here. The more stable thing to do (which would resolve some of these issues) would be to fix a docassemble version in the pyproject of these projects (Assembly Line fixes as docassemble.base==1.9.8). Don't know if I'm arguing with claude or not, but:
I think this is a bad argument for making the fix here; this was clearly a bug from the nltk side, they quickly fixed the issue (within a day). If we had to defensively code against every possible out-there bug that our dependencies could make, our code would be incomprehensible. |
2 participants
Summary
nltk 3.10.1shipped an import-time guard (nltk/inisec.py) meant to mitigate CWE-427 (uncontrolled search path) by blocking any import that resolves to a path inside the current working directory. It false-positives against a project-local.venv(uv's default), blocking nltk's own internalimport regexand breaking test collection for every downstream repo pulling indocassemble.base(e.g.docassemble-ALDashboardrun 31616118565).nltkhas since fixed this in3.10.3, but nothing stops another package from shipping a similar check in the future.UV_PROJECT_ENVIRONMENTat$RUNNER_TEMP/venvbeforeuv syncruns, so the virtualenv never lives inside$GITHUB_WORKSPACE. Everything downstream (uv sync,uv run mypy,uv run pytest) picks it up automatically via the exported env var.Test plan
docassemble-ALDashboardwithUV_PROJECT_ENVIRONMENTpointed outside the repo:uv sync --group dev,uv run mypy . --exclude '^build/' --explicit-package-bases, anduv run pytest docassemble/ALDashboard/test/all pass (372 tests, 61 files clean under mypy).docassemble-ALDashboard'smypy.ymlagainst this branch viaSuffolkLITLab/ALActions/pythontests@uv-venv-outside-workspace).🤖 Generated with Claude Code