xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 8 Pull Requests Actions 1 Packages Projects Releases 7 Wiki Activity

ci: 依赖版本全锁定，消除第三方库版本漂移导致的CI不稳定 #692

Merged
auto-approve-bot merged 4 commits from ci/pin-dependencies into develop 2026-07-22 01:07:00 +08:00
Conversation 5 Commits 4 Files Changed 3
+5 -5
xiaoxia commented 2026-07-22 00:58:47 +08:00
Owner
Copy Link
Copy Source

改动

将所有 requirements 文件中的版本号全部精确锁定：

  • requirements-worker.txt: numpy==1.26.4、scipy==1.13.1、opencv-python-headless==4.10.0.84
  • requirements-base.txt: psycopg[binary]==3.2.2
  • requirements-dev.txt: diff-cover==8.0.3

收益

  • 消除第三方库发版导致的CI随机失败（四层防御之4.1）
  • 构建可复现，线上/CI环境一致
  • 配合缓存命中更高，构建更稳定
## 改动 将所有 requirements 文件中的版本号全部精确锁定： - **requirements-worker.txt**: numpy==1.26.4、scipy==1.13.1、opencv-python-headless==4.10.0.84 - **requirements-base.txt**: psycopg[binary]==3.2.2 - **requirements-dev.txt**: diff-cover==8.0.3 ## 收益 - 消除第三方库发版导致的CI随机失败（四层防御之4.1） - 构建可复现，线上/CI环境一致 - 配合缓存命中更高，构建更稳定
xiaoxia added 4 commits 2026-07-22 00:58:47 +08:00
ci: pin opencv-python-headless to 4.10.0.84 494f808d98
ci: pin psycopg[binary] to 3.2.2 e7b960e7d8
ci: pin numpy and scipy versions 279f94c777
ci: pin diff-cover version
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / ACR Image Cleanup (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details
CI/CD Pipeline / Check if frontend-only change (pull_request) Successful in 33s
Details
CI/CD Pipeline / PR Build Web Image (pull_request) Successful in 34s
Details
Preview Deploy / Deploy Preview Environment (pull_request) Successful in 59s
Details
CI/CD Pipeline / Frontend Unit Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Frontend Lint (pull_request) Successful in 1m36s
Details
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Successful in 2m14s
Details
PR Automation / Auto Approve on CI Green (pull_request) Successful in 2m56s
Details
CI/CD Pipeline / Unit Tests (pull_request) Successful in 2m32s
Details
CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m5s
Details
AI Code Review / AI Code Review (pull_request) Successful in 3m54s
Details
CI/CD Pipeline / PR Build API Image (pull_request) Successful in 4m1s
Details
CI/CD Pipeline / PR Build Worker Image (pull_request) Successful in 7m4s
Details
PR Automation / Auto Merge on CI Green + Approved (pull_request) Successful in 8m11s
Details
Preview Cleanup / Cleanup Preview Environment (pull_request) Successful in 35s
Details
2f270f191f
gitea-actions bot commented 2026-07-22 00:59:48 +08:00
Copy Link
Copy Source

🚀 预览环境已部署

项目 详情
PR号 #692
预览链接 https://pr-692.preview.xiaoxiajianji.com
API环境 staging

💡 预览环境使用 staging API 数据，请勿在预览环境中操作重要数据。

🔄 每次提交新代码后预览环境会自动更新。

🗑️ PR 关闭或合并后，预览环境会自动清理。

🚀 **预览环境已部署** | 项目 | 详情 | |------|------| | PR号 | #692 | | 预览链接 | [https://pr-692.preview.xiaoxiajianji.com](https://pr-692.preview.xiaoxiajianji.com) | | API环境 | staging | > 💡 预览环境使用 staging API 数据，请勿在预览环境中操作重要数据。 > > 🔄 每次提交新代码后预览环境会自动更新。 > > 🗑️ PR 关闭或合并后，预览环境会自动清理。
auto-approve-bot approved these changes 2026-07-22 01:01:45 +08:00
auto-approve-bot left a comment
Collaborator
Copy Link
Copy Source

CI全绿，自动审批通过。

CI全绿，自动审批通过。
auto-approve-bot approved these changes 2026-07-22 01:01:45 +08:00
auto-approve-bot left a comment
Collaborator
Copy Link
Copy Source

CI全绿，自动审批通过。

CI全绿，自动审批通过。
auto-approve-bot commented 2026-07-22 01:02:43 +08:00
Collaborator
Copy Link
Copy Source

📊 审查概览

  • 整体评价：通过
  • 严重问题数量：0 个
  • 一般建议数量：2 个

❌ 需修改的问题（严重）

无

💡 改进建议（一般）

  1. [requirements-base.txt] 依赖包冗余检查

    • 具体内容：文件中同时存在 psycopg2-binary==2.9.10 (PostgreSQL adapter v2) 和 psycopg[binary]==3.2.2 (PostgreSQL adapter v3)。虽然两者可以共存，但通常项目只会使用其中一个进行数据库连接。如果项目正在从 v2 迁移到 v3，建议确认是否仍需保留 v2；如果是全新项目，建议移除旧版依赖以减少依赖树体积和潜在冲突。

  2. [requirements-*.txt] 版本锁定带来的维护风险

    • 具体内容：本次变更将所有依赖从范围版本（>=）修改为固定版本（==）。虽然这提高了部署环境的一致性，但也意味着系统将无法自动获取这些依赖的安全补丁（除非手动修改文件并重新部署）。建议建立定期的依赖安全审计流程，或使用 pip-audit 等工具定期检查这些固定版本是否存在已知漏洞。

✅ 良好实践

  • 将依赖版本锁定为具体版本号（==），有助于确保 CI/CD 流程及不同环境部署的一致性，避免因上游包非破坏性更新导致的意外故障。

🤖 由 AI 代码审查机器人自动生成 | 2026-07-22 01:02:43 | 模型:

### 📊 审查概览 - **整体评价**：通过 - **严重问题数量**：0 个 - **一般建议数量**：2 个 ### ❌ 需修改的问题（严重） 无 ### 💡 改进建议（一般） 1. **[requirements-base.txt] 依赖包冗余检查** - **具体内容**：文件中同时存在 `psycopg2-binary==2.9.10` (PostgreSQL adapter v2) 和 `psycopg[binary]==3.2.2` (PostgreSQL adapter v3)。虽然两者可以共存，但通常项目只会使用其中一个进行数据库连接。如果项目正在从 v2 迁移到 v3，建议确认是否仍需保留 v2；如果是全新项目，建议移除旧版依赖以减少依赖树体积和潜在冲突。 2. **[requirements-*.txt] 版本锁定带来的维护风险** - **具体内容**：本次变更将所有依赖从范围版本（`>=`）修改为固定版本（`==`）。虽然这提高了部署环境的一致性，但也意味着系统将无法自动获取这些依赖的安全补丁（除非手动修改文件并重新部署）。建议建立定期的依赖安全审计流程，或使用 `pip-audit` 等工具定期检查这些固定版本是否存在已知漏洞。 ### ✅ 良好实践 - 将依赖版本锁定为具体版本号（`==`），有助于确保 CI/CD 流程及不同环境部署的一致性，避免因上游包非破坏性更新导致的意外故障。 --- <sub>🤖 由 AI 代码审查机器人自动生成 | 2026-07-22 01:02:43 | 模型: </sub> <!-- AI_CODE_REVIEW_AUTO_COMMENT -->
auto-approve-bot merged commit baf6a4143c into develop 2026-07-22 01:07:00 +08:00
auto-approve-bot deleted branch ci/pin-dependencies 2026-07-22 01:07:00 +08:00
gitea-actions bot commented 2026-07-22 01:07:43 +08:00
Copy Link
Copy Source

🗑️ 预览环境已清理

PR #692 已关闭或合并，对应的预览环境已被清理。

如有需要，可以重新打开 PR 来重新生成预览环境。

🗑️ **预览环境已清理** PR #692 已关闭或合并，对应的预览环境已被清理。 > 如有需要，可以重新打开 PR 来重新生成预览环境。
Sign in to join this conversation.
Reviewers
No Reviewers
auto-approve-bot
Labels
Clear labels
P0
阻塞性，必须立即处理
 P1
高优先级
 P2
中优先级
 P3
低优先级/后考虑
 architecture
架构设计
 backend
后端相关
 blocked
阻塞中
 bug
Bug修复
 ci-bug
CI本身的bug
 ci-optimization
CI优化类任务
 ci-pipeline
CI流水线/workflow相关
 cleanup
代码清理
 devops
运维/部署/CI
 documentation
文档相关
 feature
新功能
 frontend
前端相关
 question
需要讨论确认
 ready
PR CI通过，可合并
 refactor
代码重构
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
auto-approve-bot xiaoxia
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: xiaoxia/xiaoxia-saas#692
Delete Branch "ci/pin-dependencies"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?