[FIX] Stop tox 4.64's .venv redirect from breaking every CI run - #2297
Merged
Merged
Conversation
CI went red on every branch at once on 2026-09-24, with no commit to blame:
a branch that passed on 09-23 failed on 09-24 with byte-identical errors.
`uv tool install tox --with tox-uv` is unpinned and resolves at job time, so
tox 4.63.0 -> 4.64.1 landed in CI on its release day. tox 4.64.0 ships a PEP
832 `.venv` redirect: after each run it writes a *file* named `.venv` at the
project root, holding the path of a tox env, so editors can find an
interpreter. It skips this when a real `.venv` directory already exists, which
is why no local checkout noticed and only CI, which starts clean, broke.
The repo root is also a uv workspace. uv reads `.venv` as the project
environment and refuses a file:
error: Project virtual environment directory `.../.venv` cannot be used
because expected directory but found a file
That is exactly the three root-workdir invocations: the unit-rig group, the
e2e-smoke group (whose failure then SKIPs the other seven e2e groups), and the
final `uv run --with coverage[toml] coverage combine`. Both tiers exit 2 and
report fails behind them. Every Python test in the unit tier passed throughout.
Disabling the redirect is the fix, not a workaround. Nothing in this repo wants
it: the redirect aims at .tox/<env>, ~97 packages of pytest/testcontainers/
coverage, while the groups pointed at that root need the ~269 package workspace
environment. A uv that honoured PEP 832 would run them in the wrong env
silently, which is worse than today's loud failure.
There is no newer tox to move to instead -- 4.64.1 is the latest release, and
it keeps the feature (4.64.1 only fixes an unrelated override bug). The
version-only alternative is pinning back to 4.63.0, which forfeits fixes and
re-breaks on the next deliberate bump.
tox and tox-uv are now pinned as well, so the next release is a bump we make
rather than one CI makes for us.
Verified locally against the real versions:
* tox 4.64.1 before the change: `.venv` is a 9-byte file containing
`.tox/rig`, and `uv run` at the root reproduces the CI error verbatim
* tox 4.64.1 after: no `.venv` file, and `uv run` at the root succeeds
* tox 4.63.0 after: accepts the key without warning, so the change is safe
either side of the bump
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
 |
Sonar flagged the three `uv tool install` lines this PR touches (C Security Rating on New Code, blocking the quality gate): omitting --no-build permits a source distribution's setup script to execute during install. The lines are older than this PR, but editing them made them new code, so a dormant rule became a gate failure. Worth fixing rather than waiving. A CI runner installing the test toolchain is exactly where an sdist build hook would be cheapest to abuse, and the flag costs nothing here: tox, tox-uv, uv, virtualenv and the rest of the tree all publish wheels. Verified with uv 0.6.14 -- the version setup-uv pins, and so the one that actually runs this command -- that --no-build is supported there, that the resolution is byte-identical (uv==0.12.18, virtualenv==21.12.0, tox-uv==1.36.0), and that the resulting tox 4.64.1 runs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Contributor
Unstract test resultsPer-group results
Critical paths
|
ritwik-g
approved these changes
Sep 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
CI went red on every branch at once on 2026-09-24, with no commit to blame.
perf/executor-registry-importpassed on 09-23 04:11 and failed on 09-24 09:06 with byte-identical errors and no new commits; the same happened onUN-3487,UN-3494,UN-4172andmain. This unblocks all of them.Why it broke
uv tool install tox --with tox-uvis unpinned and resolves at job time, so tox 4.63.0 → 4.64.1 landed in CI on its release day (2026-09-24):tox 4.64.0 ships a PEP 832
.venvredirect: after each run it writes a file named.venvat the project root containing the path of a tox env, so editors can find an interpreter. It skips this when a real.venvdirectory already exists — which is why no local checkout noticed, and only CI, which starts clean, broke.The repo root is also a uv workspace. uv reads
.venvas the project environment and refuses a file:That is exactly the three root-workdir invocations:
unit-riggroup (workdir: .)e2e-smokegroup (no workdir → root), whose failure thenSKIPs the other seven e2e groupsuv run --with coverage[toml] coverage combineBoth tiers exit 2, and
reportfails behind them. Every Python test passed throughout — the unit tier logged970 passed, 1 skippedand the e2e job brought every container upHealthybefore this fired.Why disable the feature rather than move to a fixed version
--overridebug. The version-only option is pinning back to 4.63.0, which forfeits fixes and re-breaks on the next deliberate bump..tox/<env>— ~97 packages of pytest/testcontainers/coverage — while the groups pointed at that root need the ~269-package workspace environment. A uv that honoured PEP 832 would rununit-rigande2e-smokein the wrong environment silently. Today's loud failure is the better outcome..venvdirectory, which tox leaves alone.toxandtox-uvare pinned as well, so the next release is a bump we make rather than one CI makes for us.Testing
Verified locally against the real versions, in a clean worktree with no
.venv:.venvis a 9-byte file containing.tox/rig;uv runat the root reproduces the CI error verbatim.venvfile written;uv runat the root succeedsvenv_redirectwithout warning — safe either side of the bumptox -e rig -- validatepasses on both tox versions (OK — 22 groups, 19 critical paths).Notes
SonarCloud Code Analysisis red on this PR as it is on every commit for the past several days, including the four before the breakage. Separate, pre-existing, out of scope here.npx canceled due to missing packages and no YES option: ["vitest@5.0.1"]in the unit tier is also pre-existing — it is present in the green 09-23 run too, and is non-fatal. Worth its own ticket.🤖 Generated with Claude Code