[VPEX][3/8] Add local-env constraint fetch with offline cache#5826
Conversation
Integration test reportCommit: 4f83973
8 interesting tests: 4 RECOVERED, 4 SKIP
Top 10 slowest tests (at least 2 minutes):
|
First of a stacked series adding `databricks local-env python sync`, which provisions a local Python environment matched to a Databricks compute target. The feature lands across small, single-concern PRs; each layer is independently reviewable and adds no user-facing surface until the final PR wires the command in. This PR is the foundation the rest of the stack builds on: - result.go: the result types and the --json / E_* error contract that every phase reports through (Result, PipelineError, ErrorCode, PhaseName, PhaseStatus, Mode, TargetInfo, ResolvedInfo, Plan, Warning), plus the command-path constants (local-env / python / sync) defined once. - envkey.go: mapping a compute target to an environment key and parsing the Python minor from a requires-python specifier. Nothing imports this package yet, so the CLI is unchanged. The unexported filesystem/artifact constants and the canonical phase-order slice live with the pipeline that consumes them (a later PR in the stack). Co-authored-by: Isaac
5fdb8b6 to
2092138
Compare
d867d1f to
64d8996
Compare
…pecifiers Review of the foundation layer flagged that PythonMinorFromRequires took the first MAJOR.MINOR in the string via first-match regex. For a multi-clause requires-python where the exclusive upper bound comes first — e.g. "<3.13,>=3.10" — it returned 3.13, the version the "<3.13" clause forbids, because PEP 440 clause order is arbitrary. The result feeds PM.EnsurePython, so the tool could target a Python the constraint excludes. Prefer a lower-bound / pinning clause (>=, >, ==, ~=, ===) and only fall back to the first version when none is present. Adds multi-clause test coverage; the prior tests exercised only single-bound specifiers. Co-authored-by: Isaac
2092138 to
22d1137
Compare
64d8996 to
3fd0bfe
Compare
3fd0bfe to
ce01647
Compare
…dden version Round-2 review of the foundation layer noted that when a requires-python has no lower-bound/pin clause at all (only upper-bound or exclusion, e.g. "<3.13,!=3.12"), PythonMinorFromRequires fell back to the first number and returned 3.13 — a version the specifier forbids. Such a spec has no floor to install from, so it now errors rather than guessing. A bare "3.12" (no operator) is still accepted as a valid floor. Co-authored-by: Isaac
8d309ae to
d9b9c50
Compare
797c4ac to
03b4a2b
Compare
…ower bound
Round-3 review found two edge cases in the regex-based PythonMinorFromRequires:
with multiple lower bounds (">=3.8,>=3.11") it returned the first (3.8) rather
than the effective floor (3.11), and a bare floor alongside an exclusion
("!=3.11,3.12") was wrongly rejected as having no floor.
Replaced the layered regexes with a small clause parser: split on commas,
classify each clause by operator (>=,>,==,~=,=== and bare = floor; <,<=,!=
never a floor), and return the highest floor. A spec with no floor clause
("<3.13", "!=3.12") still errors. Covers multi-lower-bound, bare-floor +
exclusion, ordering, and whitespace.
Co-authored-by: Isaac
d9b9c50 to
77ac2c8
Compare
03b4a2b to
7eaf270
Compare
anton-107
left a comment
There was a problem hiding this comment.
The failure classification here is well thought through — parse-before-cache to avoid poisoning, 404 → E_ENV_UNSUPPORTED (no cache fallback) vs transport → E_FETCH (with fallback), atomic cache writes, and PEP 503 name matching. Nice. Two things to address before this lands: one hosting/ownership blocker and one on the HTTP fetch hardening. Details inline.
| // Constraint files are hosted at: | ||
| // https://github.com/rugpanov/databricks-environments |
There was a problem hiding this comment.
Blocking — ownership / supply chain. These constraint artifacts decide what gets installed into a user's local Python environment (the Python version, the databricks-connect pin, and the constraint deps). Sourcing them from a personal GitHub repo means whoever controls that repo controls what the CLI installs on every user's machine — that's a supply-chain and bus-factor risk, not just a placeholder concern.
baseURL is a parameter here, so I realize the production default is wired later in the stack (#5832). But I'd like to settle it before anything ships to users: where will the production baseURL point? It needs to be a Databricks-owned, access-controlled, stable location. Please confirm the plan here (and update this comment to point at the real host) — at the latest this must be resolved before the unveil PR (#5835).
There was a problem hiding this comment.
Proposing we proceed with this PR and address the host move as a follow-up. The switch to a Databricks-owned constraint host is blocked on that corporate repo (GitHub Actions are currently disabled there, so it can't build/publish the artifacts yet). In the meantime the base URL stays overridable (flag / DATABRICKS_LOCALENV_CONSTRAINT_SOURCE) and the default is a placeholder. The user-facing risk is contained regardless: the command is hidden until the unveil PR (#5835), so nothing ships to users until then — and we can gate that unveil on the owned host being ready. OK to merge this layer with the follow-up tracked?
There was a problem hiding this comment.
Thanks — the code-level items on this PR (#3: timeout + size cap) are resolved, and I agree the user-facing risk is contained since the command stays hidden until #5835. The one thing I'm not comfortable unilaterally signing off on is landing a default that points at a personal GitHub repo, even as an overridable placeholder.
@pietern — could you weigh in as a CLI maintainer? Summary: this layer fetches per-environment constraint artifacts (Python version, databricks-connect pin, constraint deps) that determine what gets installed into a user's local env. The production host is meant to be a Databricks-owned repo, but that repo can't publish yet (GH Actions disabled there), so the current default is a placeholder personal repo (github.com/rugpanov/databricks-environments); the base URL is overridable via --flag / DATABRICKS_LOCALENV_CONSTRAINT_SOURCE. Grigory proposes merging this unwired layer now and gating the unveil PR (#5835) on the owned host being ready.
Is that acceptable to you — merge now with the host move tracked and gated on #5835 — or would you rather hold this PR until the default points at a Databricks-owned location? Happy to approve as soon as you're OK with the plan.
There was a problem hiding this comment.
Implemented per @pietern's guidance (parameterize the host, use a temporary env var until we can hardcode databricks/environments):
- The personal repo is gone from the code — the built-in default is now empty (
defaultConstraintRepo = ""), and the doc comment no longer points at any personal repo. - The host is supplied via a temporary env var,
DATABRICKS_LOCALENV_CONSTRAINT_REPO(owner/name), whichRepoConstraintBaseURLturns into araw.githubusercontent.com/<repo>/mainURL.--constraint-source/DATABRICKS_LOCALENV_CONSTRAINT_SOURCEstill work as a full-URL override, mainly for tests. - When nothing is configured,
RepoConstraintBaseURLreturns""andFetchConstraintsreports it as a fetch-phase error (E_FETCH, "setDATABRICKS_LOCALENV_CONSTRAINT_REPO...") — so there is no untrusted default deciding what gets installed, and the failure still flows through the normal phase/JSON reporting. - Once
databricks/environmentscan publish (its GitHub Actions are enabled),defaultConstraintRepobecomes that constant and the env var is no longer required. The command stays hidden until the unveil PR ([VPEX][8/8] Unveil local-env: make the command visible, add help + changelog #5835) regardless, so this is tracked as the follow-up gating that unveil.
Added TestRepoConstraintBaseURL and TestFetchConstraintsNoSourceConfigured. (commit 4f83973)
| resp, err := http.DefaultClient.Do(req) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("GET %s: %w", url, err) | ||
| } | ||
| defer resp.Body.Close() | ||
| if resp.StatusCode == http.StatusNotFound { | ||
| return nil, fmt.Errorf("GET %s: %w", url, errEnvKeyNotFound) | ||
| } | ||
| if resp.StatusCode < 200 || resp.StatusCode >= 300 { | ||
| return nil, fmt.Errorf("GET %s: unexpected status %s", url, resp.Status) | ||
| } | ||
| data, err := io.ReadAll(resp.Body) |
There was a problem hiding this comment.
Two hardening asks on the fetch of untrusted network input:
- No timeout.
http.DefaultClienthas no timeout, so bounding this call depends entirely on the caller always passing a context with a deadline. It's consistent with existing repo usage (libs/versioncheck,cmd/labs/github), so a dedicated client with an explicit timeout would be cleaner — or, if you'd rather rely on the context, please guarantee in the pipeline ([VPEX][5/8] Add local-env pipeline, detection, and package-manager interface #5828) that a deadline is always set and note it here. - Unbounded read.
io.ReadAll(resp.Body)will read an arbitrarily large body into memory. Since this is untrusted remote content, wrap it in anio.LimitReaderwith a sane cap (a pyproject.toml is small) so a misbehaving/hostile host can't OOM the CLI.
Neither is a big change; #2 in particular is cheap insurance.
There was a problem hiding this comment.
Both done. Added a dedicated http.Client with a 30s timeout (no longer http.DefaultClient), so the fetch is bounded even without a context deadline. And wrapped the body read in io.LimitReader at 1 MiB (far above any real pyproject.toml) — an over-cap body is rejected rather than read unbounded. Added TestFetchConstraintsRejectsOversizedBody. (commit 0ef2220)
…json arrays
Two items from review of the foundation layer:
- PythonMinorFromRequires bumped the minor for any strict ">" bound, but a
patch-qualified bound like ">3.10.5" is still satisfied by 3.10.6, so the
floor should stay 3.10 (only a bare ">3.10" excludes the whole 3.10.x
series). clauseRe now captures the patch component and the minor is bumped
only when it is absent. Adds >3.10.5 / >=3.10.2 test cases.
- Result.Phases and Result.Warnings are non-omitempty slices, so a bare
Result{} would marshal them as "null" rather than "[]", an ambiguity in the
--json contract. Added NewResult() which seeds both to empty slices, a doc
note on the invariant, and a test asserting the JSON emits [] not null. The
pipeline (later in the stack) constructs its Result through this.
Co-authored-by: Isaac
Second in the stacked local-env series (builds on the foundation types). target.go resolves a compute target to a TargetInfo (and its environment key) using ordered precedence: --cluster flag → --serverless flag → --job flag → bundle target. Compute lookups go through the narrow ComputeClient seam so the resolver is unit-tested against a stub with no SDK dependency. ValidateTargetFlags guards the library path against more than one target flag being set. The classic-compute job branch reads the Spark version from the first return of GetJobSparkVersion, per that method's documented contract, rather than the recorded-version third return. Depends on the foundation PR for NewError, the E_RESOLVE / E_NO_TARGET codes, TargetInfo, and the EnvKeyFor* helpers. Still dormant. Co-authored-by: Isaac
Review of the target layer noted that ResolveTarget accepted incompatible
flags on the library path: called directly with e.g.
TargetFlags{Cluster: "c", Serverless: "v4"} it silently took the first
precedence branch and ignored the rest, resolving a different target than
requested. Cobra and the cmd layer already reject this, but ResolveTarget is
exported and ValidateTargetFlags exists specifically to guard callers that
bypass Cobra, so the resolver now runs that check first and returns
E_RESOLVE on conflicting flags.
Co-authored-by: Isaac
Third in the stacked local-env series. constraints.go fetches the per-environment pyproject.toml for a resolved env key and parses out requires-python, the databricks-connect pin, and the [tool.uv] constraint-dependencies. It caches each fetch on disk and classifies failures: a 404 is E_ENV_UNSUPPORTED (a resolvable target with no published environment, no cache fallback), while a transport or non-404 HTTP failure is E_FETCH and falls back to the last-good cached copy. The fetched body is validated by parseConstraints before it is written to the cache, so a malformed 2xx response cannot poison the cache and break a later transport-failure run that would otherwise serve the bad copy. Depends on the foundation PR for NewError and the E_FETCH / E_ENV_UNSUPPORTED codes. Still dormant. Co-authored-by: Isaac
…ache, exact dep match Review of the constraint-fetch layer surfaced several defects, all fixed here: - parseConstraints accepted valid-but-empty TOML: a 200 body with no [project].requires-python returned an empty result that would be cached and only fail confusingly later. It now errors when requires-python is absent. - The cache write assumed cacheDir already existed. On a fresh machine the first fetch succeeded but os.WriteFile failed (no such directory), so the cache never populated and offline runs got E_FETCH. writeCacheAtomic now MkdirAll's the parent. - The cache write was non-atomic (os.WriteFile truncates in place), so a concurrent transport-failure reader could observe a partial file. writeCacheAtomic writes a temp file and renames it into place. - databricks-connect detection used a bare string prefix, so a sibling like "databricks-connectors==1.0" matched first and was returned instead of the real pin. isDatabricksConnectDep now requires a package-name boundary. - sanitizeEnvKey collapsed only "/", leaving a Windows "\" to be treated as a separator by filepath.Join; it now collapses both. Co-authored-by: Isaac
Round-2 review noted that mapping an env key to a cache filename by replacing "/" with "__" was not injective: distinct keys like "a/b" and "a__b" collided on the same file, so a cached copy for one environment could be served for another on a transport-failure fallback. cacheFileName now appends a short sha256 of the raw env key to the readable slug, guaranteeing distinct keys get distinct files (env keys are internally generated and never actually collide today, but the cache should not depend on that). Co-authored-by: Isaac
Round-3 review noted isDatabricksConnectDep was case-sensitive, but Python package names are case-insensitive (PEP 503): a valid entry like "Databricks-Connect==16.4.0" went undetected, leaving the pin empty. The match now lowercases the entry before comparing; the caller still stores the original casing. Co-authored-by: Isaac
Round-4 review found isDatabricksConnectDep matched only case, missing PEP 503 name equivalence: "databricks_connect" and "databricks.connect" (and other whitespace) were not recognized. The check now extracts the leading package name up to the first PEP 508 delimiter and compares it under PEP 503 normalization (lowercase, collapse runs of -, _, . to a single -), so all spellings match while a distinct package like databricks-connectors does not. Co-authored-by: Isaac
Hardening the fetch of untrusted remote constraint artifacts, per review: - Use a dedicated http.Client with a 30s timeout instead of http.DefaultClient (which has none), so the request is bounded even if the caller's context carries no deadline. - Cap the response body with io.LimitReader (1 MiB, far above any real pyproject.toml) so a misbehaving or hostile host can't read an unbounded body into memory; an over-cap body is rejected. Adds a test for the oversized-body rejection. Note: the separate (blocking) review point about the production artifact host being a personal GitHub repo is tracked on the PR and gated on the unveil PR; it is a hosting/ownership decision, not a code change here. Co-authored-by: Isaac
436dabf to
42a7988
Compare
79890ca to
0ef2220
Compare
|
@anton-107 HTTP hardening done in |
…al-repo default
Per review, the constraint artifacts must not be sourced from a hardcoded
personal GitHub repo. This parameterizes the host: RepoConstraintBaseURL reads
the hosting repo ("owner/name") from the DATABRICKS_LOCALENV_CONSTRAINT_REPO
environment variable and builds a raw.githubusercontent.com main-branch URL.
The built-in default is intentionally empty and resolution errors when no repo
is configured, so no untrusted default controls what the CLI installs. This is
temporary: once the Databricks-owned databricks/environments repo can publish
the artifacts (its GitHub Actions are currently disabled), defaultConstraintRepo
becomes that constant and the env var is no longer required. Tracked as a
follow-up; the command stays hidden until the unveil PR regardless.
Co-authored-by: Isaac
anton-107
left a comment
There was a problem hiding this comment.
Approving — the blocking hosting concern is resolved in 4f83973fd, and per @pietern's guidance.
#1 (personal-repo hosting) — fixed:
- The personal repo is gone from the code.
defaultConstraintRepois empty (""), and the doc comment no longer names any personal repo. - The host now comes from a temporary env var
DATABRICKS_LOCALENV_CONSTRAINT_REPO(owner/name), whichRepoConstraintBaseURLresolves to araw.githubusercontent.com/<repo>/mainURL;--constraint-sourceremains a full-URL override for tests. - When nothing is configured,
RepoConstraintBaseURLreturns""andFetchConstraintsreports it asE_FETCHwith an actionable message naming the env var — so there is no untrusted default deciding what gets installed, and the failure flows through the normal phase/JSON reporting instead of aborting early. Good call routing it through the fetch phase rather than a hard abort. - Follow-up correctly tracked: once
databricks/environmentscan publish,defaultConstraintRepobecomes that constant; the command stays hidden until #5835 regardless, so nothing ships to users before the owned host is ready.
#3 (fetch hardening) was already resolved (dedicated 30s-timeout client + 1 MiB io.LimitReader cap + over-cap rejection test).
Tests added for both the URL resolution and the no-source-configured path. LGTM.
One minor, non-blocking note for whoever wires the eventual default: /main is a mutable branch ref, so the fetched constraints can change under a pinned CLI version. Fine for now given the cache + hidden-command posture, but worth considering a tag/immutable ref before GA. Not blocking this PR.
Integration test reportCommit: f3f18e1
41 interesting tests: 28 flaky, 8 FAIL, 2 RECOVERED, 2 SKIP, 1 KNOWN
Top 50 slowest tests (at least 2 minutes):
|
databricks#5823) ## Why - The `local-env` feature needs a shared vocabulary before any behavior can be built: the result shape, the error taxonomy, and how a compute target maps to an environment key. - Landing these contract types first lets every later layer (resolve / fetch / merge / pipeline / command) depend on stable, reviewed definitions. - Kept deliberately minimal and dependency-free so it reviews on its own and stays `unused`/`deadcode`-clean with no consumers yet. ## What - **`result.go`** — the `--json` / `E_*` output contract: `Result`, `PipelineError`, `ErrorCode`, `PhaseName`, `PhaseStatus`, `Mode`, `TargetInfo`, `ResolvedInfo`, `Plan`, `Warning`; plus the command-path constants (`local-env` / `python` / `sync`) defined in one place. - **`envkey.go`** — `EnvKeyForServerless` / `EnvKeyForSparkVersion` / `NormalizeServerless`, and `PythonMinorFromRequires` (clause-aware: returns the effective highest lower bound of a `requires-python`). - No wiring into `cmd/`, so the CLI is unchanged. Filesystem/artifact constants and the phase-order slice deliberately live with their consumer (PR 5). ## Testing strategy - Unit tests for the error/type contract (`result_test.go`) and env-key mapping incl. multi-clause / strict-`>` / no-floor `requires-python` cases (`envkey_test.go`). - Gates: `go build`, `go test`, `golangci-lint`, `deadcode`, `gofmt` — all green. - Reviewed with codex across several rounds to convergence (all findings fixed or explicitly rejected as speculative). --- ## About this stack This is one of a series of small, stacked PRs that together add the `databricks local-env python sync` command — it provisions a local Python environment (Python version, `databricks-connect` pin, and dependency constraints) matched to a selected Databricks compute target. The work was split from one large branch into single-concern layers so each is independently reviewable; the command is kept hidden until the final PR so nothing is user-visible mid-stack. **Review bottom-up.** Each PR targets the previous one as its base branch, so its diff shows only that layer. | # | PR | What | |---|----|------| | 1 | **databricks#5823 ← you are here** | foundation: result types + env-key mapping | | 2 | databricks#5824 | compute-target resolution | | 3 | databricks#5826 | constraint fetch + offline cache | | 4 | databricks#5827 | formatting-preserving pyproject.toml merge | | 5 | databricks#5828 | six-phase pipeline + detection + package-manager interface | | 6 | databricks#5832 | uv backend + CLI command (registered hidden) | | 7 | databricks#5833 | acceptance tests | | 8 | databricks#5835 | unveil (unhide + help + changelog) | This pull request and its description were written by Isaac.
## Why - `local-env` must turn the user's compute selection into a single environment key before it can fetch anything, and the selection can come from several places with a defined precedence. - Isolating resolution behind a narrow seam keeps it testable without a live workspace and keeps SDK details out of the engine. ## What - **`target.go`** — `ResolveTarget` with ordered precedence `--cluster` → `--serverless` → `--job` → bundle target, producing a `TargetInfo` + env key. - Compute lookups go through the narrow `ComputeClient` interface (stubbable in tests). - `ValidateTargetFlags` rejects more than one target flag; `ResolveTarget` runs it up front so a non-Cobra caller can't silently resolve the wrong target. - Classic-compute jobs read the Spark version from the documented first return of `GetJobSparkVersion` (not the recorded-version third return). ## Testing strategy - Unit tests against a stub `ComputeClient` covering each precedence branch, the mutually-exclusive-flags error, and the job classic-compute contract (`target_test.go`). - Gates: `go build`, `go test`, `golangci-lint`, `deadcode`, `gofmt` — all green. - Reviewed with codex to a clean pass. --- ## About this stack This is one of a series of small, stacked PRs that together add the `databricks local-env python sync` command — it provisions a local Python environment (Python version, `databricks-connect` pin, and dependency constraints) matched to a selected Databricks compute target. The work was split from one large branch into single-concern layers so each is independently reviewable; the command is kept hidden until the final PR so nothing is user-visible mid-stack. **Review bottom-up.** Each PR targets the previous one as its base branch, so its diff shows only that layer. | # | PR | What | |---|----|------| | 1 | databricks#5823 | foundation: result types + env-key mapping | | 2 | **databricks#5824 ← you are here** | compute-target resolution | | 3 | databricks#5826 | constraint fetch + offline cache | | 4 | databricks#5827 | formatting-preserving pyproject.toml merge | | 5 | databricks#5828 | six-phase pipeline + detection + package-manager interface | | 6 | databricks#5832 | uv backend + CLI command (registered hidden) | | 7 | databricks#5833 | acceptance tests | | 8 | databricks#5835 | unveil (unhide + help + changelog) | This pull request and its description were written by Isaac.
…atabricks#5827) ## Why - `local-env` must apply the resolved Python version and constraints to the user's `pyproject.toml` without disturbing their own content — comments, ordering, formatting, and unrelated config must survive untouched. - Re-running must be safe and idempotent, and a greenfield project needs a sensible file created from scratch. - This is the most intricate logic in the feature, so it lands in its own PR for focused review. ## What - **`merge.go`** — a formatting-preserving merge that rewrites only the env-owned regions (`requires-python`, the `databricks-connect` entry in `[dependency-groups].dev`, and a marker-bracketed managed `[tool.uv]` block) and preserves every other byte incl. CRLF; idempotent. `RenderFreshPyproject` builds a complete managed file for a greenfield project. - Scoping/robustness: managed `constraint-dependencies` nests header-less inside an existing user `[tool.uv]` (never a duplicate header); single- vs multi-line array detection tracks real bracket depth outside strings/comments; the `databricks-connect` rewrite is confined to `dev` and leaves trailing comments alone; `requires-python`'s inline comment is preserved; table-header parsing tolerates inline comments and recognizes `[[array.of.tables]]`. ## Testing strategy - Unit tests that parse the merged output as TOML (not just substring checks), covering idempotency, CRLF preservation, user-key preservation, the duplicate-`[tool.uv]` case, bracket-in-element arrays, sibling-group/comment non-clobbering, and `[[tool.uv.index]]` children (`merge_test.go`). - Gates: `go build`, `go test`, `golangci-lint`, `deadcode`, `gofmt` — all green. - Reviewed with codex to a clean pass (multiple TOML-corruption edge cases were caught and fixed). --- ## About this stack This is one of a series of small, stacked PRs that together add the `databricks local-env python sync` command — it provisions a local Python environment (Python version, `databricks-connect` pin, and dependency constraints) matched to a selected Databricks compute target. The work was split from one large branch into single-concern layers so each is independently reviewable; the command is kept hidden until the final PR so nothing is user-visible mid-stack. **Review bottom-up.** Each PR targets the previous one as its base branch, so its diff shows only that layer. | # | PR | What | |---|----|------| | 1 | databricks#5823 | foundation: result types + env-key mapping | | 2 | databricks#5824 | compute-target resolution | | 3 | databricks#5826 | constraint fetch + offline cache | | 4 | **databricks#5827 ← you are here** | formatting-preserving pyproject.toml merge | | 5 | databricks#5828 | six-phase pipeline + detection + package-manager interface | | 6 | databricks#5832 | uv backend + CLI command (registered hidden) | | 7 | databricks#5833 | acceptance tests | | 8 | databricks#5835 | unveil (unhide + help + changelog) | This pull request and its description were written by Isaac.
Why
local-envneeds the pinned Python version,databricks-connectversion, and dependency constraints published for that key.What
constraints.go— fetches the per-environmentpyproject.toml, parsesrequires-python, thedatabricks-connectpin, and[tool.uv]constraint-dependencies, and caches it on disk.RepoConstraintBaseURLreads the repo (owner/name) from the temporaryDATABRICKS_LOCALENV_CONSTRAINT_REPOenv var and builds araw.githubusercontent.com/<repo>/mainURL; the built-in default is empty. When unset it returns""andFetchConstraintsreports the missing source as a fetch-phaseE_FETCHerror (so there is no untrusted default, and the failure flows through the normal phase/JSON reporting). Oncedatabricks/environmentscan publish, that becomes the hardcoded default and the env var is no longer required.E_ENV_UNSUPPORTED(no cache fallback — a distinct non-transient condition); transport / non-404 →E_FETCHwith fallback to the last-good cached copy.requires-python) before caching so a bad 2xx can't poison the cache; atomic cache write (mkdir + temp-file + rename); dedicatedhttp.Clientwith a 30s timeout; body read bounded byio.LimitReaderat 1 MiB;databricks-connectmatched by leading package name under PEP 503 normalization (soDatabricks_Connectmatches,databricks-connectorsdoes not); cache filename = readable slug + sha256 suffix to prevent collisions.Testing strategy
httptestserver: 200-parse, 404 →E_ENV_UNSUPPORTED, transport failure + cache fallback, missing-requires-pythonrejection, PEP 503 name matching, cache-dir creation, collision-free filenames, oversized-body rejection (constraints_test.go).TestRepoConstraintBaseURL(env var → URL, unset →"", whitespace treated as unset) andTestFetchConstraintsNoSourceConfigured(empty host →E_FETCHnaming the env var).go build,go test,golangci-lint,deadcode,gofmt— all green.About this stack
This is one of a series of small, stacked PRs that together add the
databricks local-env python synccommand — it provisions a local Python environment (Python version,databricks-connectpin, and dependency constraints) matched to a selected Databricks compute target. The work was split from one large branch into single-concern layers so each is independently reviewable; the command is kept hidden until the final PR so nothing is user-visible mid-stack.Review bottom-up. Each PR targets the previous one as its base branch, so its diff shows only that layer.
This pull request and its description were written by Isaac.