Repository navigation
Modernise for Python 3.10–3.14, fix fresh installs, publish SBOMs - #157
Merged
Merged
Conversation
- Pin marshmallow below 4: a fresh install with marshmallow 4 failed to import (cannot import name 'RAISE' from 'marshmallow.utils'). - Require Python 3.10+, test 3.10-3.14 (tox only mapped up to 3.10, so the 3.11/3.12 CI jobs ran no tests). - Replace ast.Str/Num/NameConstant (removed in Python 3.14) with ast.Constant in the testing predicates; fix an invalid escape sequence. - Update freezegun (1.2.0 broke on Python 3.13), pytest and pytest-cov; give the token auto-refresh test a margin past its 1s expiry. - Workflows: pin all actions, least-privilege permissions, persist-credentials: false; add pinact and zizmor checks (from #156). - Release: publish with gh-action-pypi-publish v1.14.2, generate a runtime SBOM from the built wheel, attach SPDX and CycloneDX to the release, and upload to DependencyTrack (oss/python/commercetools) from a separate job that runs no repo code. - Version 2026.10.12.
- CHANGES.md: breaking changes at the top of 26.10.12, folding in the unreleased 24.4.6 entries; Python 3.10+ is marked breaking too. - coverage paths: map .tox/*/lib/python*/site-packages back to src. Now that tests run on every Python version, coverage combine/xml failed with "No source for code".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
commercetoolsis broken today.install_requiresallows anymarshmallow>=3.10.0; with marshmallow 4 the package fails to import (cannot import name 'RAISE' from 'marshmallow.utils'). This affects the published 2023.6.29 too, for anyone who doesn't pin marshmallow.Changes
marshmallow>=3.10.0,<4.python_requires=">=3.10", classifiers and CI for 3.10–3.14.tox.inionly mapped up to 3.10, so the 3.11/3.12 CI jobs ran no tests.testing/predicates.py:ast.Str/ast.Num/ast.NameConstant(removed in Python 3.14) →ast.Constant.testing/products.py: invalid escape sequence in a route regex.test_auto_refreshsleeps 1.5s instead of exactly its 1s expiry (was flaky).persist-credentials: false. Addspinact.yamlandzizmor.yamlfrom @demeyerthom's Add pinact and zizmor workflow checks #156.pypa/gh-action-pypi-publishv1.14.2 (twine 7).commercetools.spdx.jsonandcommercetools.cdx.json(CycloneDX 1.6) to the release.dependencytrackjob uploads the CycloneDX SBOM as version<version>ofoss/python/commercetools(isLatest=true). It holdsDEPENDENCYTRACK_OSS_APIKEY, does no checkout and runs no repo code.2026.10.12.Breaking changes
Listed first under 26.10.12 in
CHANGES.md: methods returnNoneinstead of raising on not-found,scoperequired onClient,commercetools.services.*removed (prepared as 24.4.6, never released), and Python 3.10+.Checks
pinact run --check --verify-comment, zizmor (only the trusted-publishing note).'**:**'pull_request branch filter is flagged by actionlint; left as is.Supersedes #153, #155 and #156.