Skip to content

reflex-web CI uses local reflex version#6298

Merged
adhami3310 merged 1 commit intomainfrom
masenf/fix-reflex-web-ci
Apr 7, 2026
Merged

reflex-web CI uses local reflex version#6298
adhami3310 merged 1 commit intomainfrom
masenf/fix-reflex-web-ci

Conversation

@masenf
Copy link
Copy Markdown
Collaborator

@masenf masenf commented Apr 7, 2026

Remove version spec from reflex-dev/reflex git URLs in reflex-web pyproject.toml

Remove version spec from reflex-dev/reflex git URLs in reflex-web
pyproject.toml
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq bot commented Apr 7, 2026

Merging this PR will not alter performance

✅ 9 untouched benchmarks


Comparing masenf/fix-reflex-web-ci (11f95e7) with main (7f07b6d)

Open in CodSpeed

@adhami3310 adhami3310 merged commit db61392 into main Apr 7, 2026
40 checks passed
@adhami3310 adhami3310 deleted the masenf/fix-reflex-web-ci branch April 7, 2026 20:53
@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps bot commented Apr 7, 2026

Greptile Summary

This PR updates the reflex-web integration CI job to ensure that the locally-checked-out version of reflex (from the PR branch) is used when testing against the reflex-web website repo, rather than whatever version is pinned in reflex-web's pyproject.toml. It does this by using sed to strip reflex-dev/reflex git-URL constraints from reflex-web's pyproject.toml before compiling requirements, and adds an explicit SHA-based verification step to confirm the correct local version is installed.

Key changes:

  • Adds a sed one-liner to replace "pkg @ git+https://github.com/reflex-dev/reflex@<ref>" entries with just "pkg" in reflex-web's pyproject.toml, ensuring uv pip compile won't try to install a pinned reflex version
  • Adds a "Verify installed reflex version matches this checkout" step that checks the installed version string ends with +<8-char-SHA> of HEAD
  • The reflex-web-macos job (runs on push to main only) does not receive the same sed strip or SHA-verification treatment, creating a minor inconsistency between the two jobs
  • The sed capture group [a-zA-Z0-9_-]+ for package names does not include dots, which are valid in PEP 508 distribution names — though no current reflex-dev/reflex packages use them

Confidence Score: 5/5

Safe to merge — the primary Ubuntu CI path is correctly implemented and all remaining findings are P2 style suggestions.

Both findings are P2: one is a forward-compatibility gap in a regex (no current packages affected) and the other is a missing verification step in a secondary job that only runs post-merge on main. Neither blocks the intended behavior of this PR.

No files require special attention; .github/workflows/integration_tests.yml changes are clean and well-commented.

Important Files Changed

Filename Overview
.github/workflows/integration_tests.yml Adds sed-based git URL stripping and SHA verification to the reflex-web Ubuntu job; macOS job lacks equivalent steps but only runs on push to main

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Actions
    participant UV as uv (local reflex)
    participant SFW as Socket.dev Firewall
    participant RW as reflex-web pyproject.toml

    GH->>UV: uv sync (installs local PR reflex)
    GH->>RW: Clone reflex-dev/reflex-web
    GH->>RW: sed strip reflex-dev/reflex git URLs
    Note over RW: "pkg @ git+https://.../reflex@ref" → "pkg"
    GH->>SFW: sfw uv pip compile pyproject.toml
    SFW-->>GH: requirements.txt (all direct deps)
    GH->>GH: Filter already-installed packages
    Note over GH: grep -ivf installed_patterns.txt
    GH->>SFW: sfw uv pip install -r requirements.txt
    GH->>UV: Verify installed version ends with +HEAD_SHA
    UV-->>GH: ✅ version matches checkout
Loading

Comments Outside Diff (1)

  1. .github/workflows/integration_tests.yml, line 279-288 (link)

    P2 macOS job missing sed strip and SHA verification

    The reflex-web Ubuntu job (lines 176–204) applies two important protections that this job does not:

    1. A sed step to replace reflex-dev/reflex git-URL dependencies in pyproject.toml with plain package names, so uv pip compile does not try to resolve and potentially download a different reflex commit.
    2. A Verify installed reflex version matches this checkout step to assert that the installed version string ends with +<HEAD_SHA>.

    Although this job is gated to push on main only (line 255) and the existing grep -ivf installed_patterns.txt filter will still exclude the already-installed reflex from re-installation (because reflex @ git+... starts with reflex , which matches ^reflex[ =]), uv pip compile at line 282 may still attempt to fetch the git URL before filtering happens. More importantly, there is no explicit check confirming that the version being tested is the current checkout. Consider adding the equivalent sed substitution and SHA verification steps to keep the two jobs consistent.

Reviews (1): Last reviewed commit: "reflex-web CI uses local reflex version" | Re-trigger Greptile

working-directory: ./reflex-web
run: |
# Replace reflex-dev/reflex git deps with plain package names (PR version is pre-installed)
sed -i -E 's|"([a-zA-Z0-9_-]+)\s*@\s*git\+https://github\.com/reflex-dev/reflex@[^"]*"|"\1"|g' pyproject.toml
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 sed regex excludes dots from package name character class

The capture group [a-zA-Z0-9_-]+ does not include ., which is a valid character in Python distribution names per PEP 508. No reflex-dev/reflex packages currently use dots in their names, but if one ever does (e.g. a namespaced package), this substitution would silently fail to strip the git URL, causing uv pip compile to resolve the pinned remote version instead of the locally-installed PR version.

Consider widening the character class to [a-zA-Z0-9_.-]+:

Suggested change
sed -i -E 's|"([a-zA-Z0-9_-]+)\s*@\s*git\+https://github\.com/reflex-dev/reflex@[^"]*"|"\1"|g' pyproject.toml
sed -i -E 's|"([a-zA-Z0-9_.-]+)\s*@\s*git\+https://github\.com/reflex-dev/reflex@[^"]*"|"\1"|g' pyproject.toml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants