fix: Pillow in deploy requirements so CLS dimension injection works in prod - #76
Merged
Conversation
…ks in prod PR #74's width/height injection needs Pillow, but it was only a dev dep; deploy installs requirements.txt with --no-deps so 'from PIL import Image' failed on the runner -> dims silently skipped -> #74 inert in production. Pillow has no required runtime deps, so --no-deps stays safe. Compiled with --no-emit-index-url to keep private index URLs out of the lockfile.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
PR #74 (inline-image width/height for CLS) is inert in production. img_hygiene needs Pillow to read dimensions, but Pillow was only a dev-time dep. deploy.yml installs requirements.txt with
--no-deps, so on the runnerfrom PIL import Imagefails, theImage = Noneguard trips, and dimensions are silently skipped (only loading/decoding, which don't need Pillow, survived). Verified live: the leap-second inline img had loading/decoding but no width/height. Found while verifying batch-2 after a cache purge; CI was green because no guard asserts dimension presence.Fix
pillow==12.2.0added to requirements.in; requirements.txt regenerated with hashes. Pillow has no required runtime deps (all extras), so--no-depsstays correct. Compiled with--no-emit-index-url(see note).Verified
SECURITY NOTE (separate, needs your attention)
While regenerating the lockfile,
pip-compilepulled an--extra-index-urlfrom ~/.config/pip/pip.conf that embeds a live Primer Azure DevOps PAT, and wrote it into requirements.txt. GitHub push-protection blocked it and I recompiled with--no-emit-index-url, so nothing leaked (main was and is clean). But that PAT sits in your pip.conf and anypip-compilewithout--no-emit-index-urlwill re-embed it. Recommend: always use--no-emit-index-urlfor this repo, and consider whether that ADO PAT should be rotated / moved to a keyring.