🐛 fix(cooled-prek): admit pinned hook versions by gaborbernat · Pull Request #59 · tox-dev/github-workflows

gaborbernat · 2026-11-07T03:09:32Z

A repository that bumps a pre-commit hook to a release younger than seven days fails cooled-hooks.yaml, although the bump is deliberate. bump-deps-index#302 pinned the simplint mirror at v0.7.1, whose package requires simplint==0.7.1, and the hook could not install because uv's seven-day exclude-newer hid that release. 🧹

With this change the cooldown holds back only what nobody chose. Before building hook environments, cooled-prek collects the exact name==version pins of each Python hook, from its additional_dependencies and from the hook repository's install requirements at the pinned rev (install_requires in setup.py or setup.cfg, [project].dependencies in pyproject.toml). For each pin it looks up the pinned release's upload time on PyPI and admits that release up to its upload time while it is younger than the cutoff. Once the release is a week old nothing is written, and the normal cutoff applies again. A newer release of the same package uploaded after the pinned one stays blocked. The pin already limits the hook to that one version; its dependencies, ranges, dev and extra requirements and every unpinned package still install under the cutoff. A pin and a [tool.nab] exception for the same package keep the later date, and a hook repository or PyPI lookup that fails fails the run.

The exclude-newer-package input of cooled-hooks.yaml only ever reached the locked release tools, never the hook environments; its description and the docs now say so.

Hook environments build under the seven-day cutoff, so a repository that bumps a hook to a release younger than that fails cooled-hooks.yaml even though the bump is deliberate. An exact pin in a hook's additional_dependencies, or in its repository's install requirements at rev (install_requires in setup.py or setup.cfg, [project].dependencies in pyproject.toml), now writes the release's upload time plus one second to uv's exclude-newer-package while that release is younger than the cutoff. The pinned release installs, and a newer release of the package uploaded after it stays blocked. Once the release is a week old nothing is written. Its dependencies, ranges, and dev or extra requirements stay cooled. A pin and a [tool.nab] exception for the same package keep the later date. The snippet reads the config with PyYAML from uv under the same cutoff, because the runner's python3 may not have it. It runs under -I, which drops the runner's PYTHONPATH and keeps the repository off sys.path.

A pull request that bumps a pre-commit hook to a release younger than seven days failed the `Hooks under the cooldown` check, although the bump is deliberate. [github-workflows 6.7.2](tox-dev/github-workflows#59) admits each exact hook pin up to its upload time while the release is inside the cooldown window; dependencies, ranges and newer releases stay cooled. This moves the shared workflow pins to it. 🧹 The shared changelog check now requires a `# expires YYYY-MM-DD` comment directly above each Nab cutoff exception, so the existing exception gets one.

A pull request that bumps a pre-commit hook to a release younger than seven days failed the `Hooks under the cooldown` check, although the bump is deliberate. [github-workflows 6.7.2](tox-dev/github-workflows#59) admits each exact hook pin up to its upload time while the release is inside the cooldown window; dependencies, ranges and newer releases stay cooled. This moves the shared workflow pins to it. 🧹