Skip to content

chore: exclude haystack-core-integrations packages from exclude-newer cutoff#463

Open
julian-risch wants to merge 2 commits into
mainfrom
chore/exclude-newer-core-integrations
Open

chore: exclude haystack-core-integrations packages from exclude-newer cutoff#463
julian-risch wants to merge 2 commits into
mainfrom
chore/exclude-newer-core-integrations

Conversation

@julian-risch

@julian-risch julian-risch commented Jun 15, 2026

Copy link
Copy Markdown
Member

Related Issues / PRs

The global exclude-newer = "P3D" cutoff in uv.toml protects against supply-chain attacks by skipping package versions published within the last 3 days. However, this also blocks freshly released first-party packages.

Proposed Changes

This PR exempts every package maintained in deepset-ai/haystack-core-integrations from that cutoff, and adds automation to keep the list in sync:

  1. uv.toml adds all 79 integration packages to the [exclude-newer-package] table
  2. scripts/generate_uv_excludes.py regenerates the table from the name field of each integrations/*/pyproject.toml
  3. .github/workflows/sync_uv_excludes.yml a scheduled (weekly) + manually dispatchable workflow that sparse-checks-out haystack-core-integrations, runs the script, and opens a PR whenever an integration is added or removed.

How did you test it?

  • Verified the generated uv.toml
  • Ran generate_uv_excludes.py against a local haystack-core-integrations checkout and confirmed it reproduces the table

Notes for the reviewer

🤖 Generated with Claude Code

julian-risch and others added 2 commits June 15, 2026 16:00
… cutoff

Add all packages maintained in deepset-ai/haystack-core-integrations to the
[exclude-newer-package] table in uv.toml so that the global "P3D" (3-day)
exclude-newer cutoff does not apply to our own first-party integration
packages. This lets tutorials install freshly released integration versions
without waiting for the supply-chain safety window.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ions

Add scripts/generate_uv_excludes.py, which regenerates the
[exclude-newer-package] table in uv.toml from the package names declared in a
checkout of deepset-ai/haystack-core-integrations, and a scheduled
"Sync uv excludes" workflow that runs the script weekly and opens a PR when
the set of integration packages changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@julian-risch julian-risch marked this pull request as ready for review June 15, 2026 14:41
@julian-risch julian-risch requested a review from a team as a code owner June 15, 2026 14:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant