chore: require ucp-php-sdk 0.0.5 - #167
Conversation
0.0.5 is published, and this plugin depends on what it contains. #165 passes an explicit `order.permalink_url` into `OrderConfirmation`, which 0.0.5 makes a required constructor argument — a plugin on core 0.0.4 keeps working, but the guarantee the model now enforces only exists from 0.0.5, and the response-schema failure that motivated #165 is only diagnosable with 0.0.5's oneOf messages. All five declarations move together, because a version this repository states in more than one file is a version it can disagree with itself about — the trap AGENTS.md records after `ci.yml` and `bin/ci-smoke.sh` each kept their own copy, and after a bump to `ci.yml` alone turned `shopware-matrix (trunk)` red: composer.json >=0.0.4 <0.1.0 -> >=0.0.5 <0.1.0 .github/workflows/ci.yml two forced path-repo versions bin/ci-smoke.sh two more, for the deployed smoke stack Verified from the registry rather than assumed, since CI resolves path repos and would not have noticed a missing tag: ucp-php-sdk/core 0.0.5 php ^8.1, ext-filter, ext-iconv, ext-mbstring, ext-openssl ucp-php-sdk/symfony-bundle 0.0.5 ext-openssl, core >=0.0.5 <0.1.0 and by resolving the new constraint against Packagist in a scratch project, which installs core 0.0.5 alongside the bundle. On a trunk lane at 0.0.5: 567 plugin tests green, `cs` clean, and the MCP evals store suite at 34 passed / 1 failed (the one failure is agentic-commerce#163, asserted deliberately).
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c2f4cff205
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
Codex caught this on #167, and it is the trap that PR is about, one level up: `README.md` and `AGENTS.md` both stated the requirement as `>=0.0.2 <0.1.0` — the floor from #157, three bumps ago. My sweep for other declarations looked for `0.0.4` and so walked straight past the two places that were even more wrong. Naming a current value in prose is the defect, not the specific stale digits: a maintainer following the release guidance could conclude 0.0.2 is still supported, or use the obsolete bound during the next coordinated bump. So rather than editing the number and leaving the next reader the same trap, both places now say `composer.json` is the authority on the lower bound and quote the current value as a reference point. `composer.json`, `ci.yml` and `bin/ci-smoke.sh` still have to move together — those are declarations Composer reads, and no prose can replace them. The caret illustration stays, since the whole rule was learned from it, but as history: "the plugin's *original* `^0.0.2` never picked up 0.0.3".
|
Codex is right, and it caught the exact failure mode this PR is about — one level up from where I was looking.
Fixed in The Worth noting for the count: this repo family has now been bitten by a version stated in more than one place four separate times, and this is the first instance where the second place was documentation rather than a config file. |
2 participants
ucp-php-sdk0.0.5 is tagged and published. This raises the floor.Why the floor and not just the pins
#165 passes an explicit
order.permalink_urlintoOrderConfirmation, and 0.0.5 makes that a required constructor argument. A plugin resolved against core 0.0.4 keeps working — but the guarantee the model now enforces only exists from 0.0.5, and the opaque$ must match exactly one allowed schemathat sent us looking for #165 in the first place is only diagnosable with 0.0.5'soneOfmessages, which name the branch and the missing field.0.0.5 also carries the dependency fixes: the bundle finally requires
symfony/consoleand three more packages itssrc/uses, and both packages declare the PHP extensions they call.All five declarations move together
Because a version this repository states in more than one file is a version it can disagree with itself about — the trap
AGENTS.mdrecords afterci.ymlandbin/ci-smoke.sheach kept their own copy, and after bumpingci.ymlalone turnedshopware-matrix (trunk)red:composer.json>=0.0.4 <0.1.0→>=0.0.5 <0.1.0.github/workflows/ci.ymlversionsbin/ci-smoke.shAnd two more the sweep missed, which is the point
I originally wrote here that a repo-wide sweep found nothing else. It didn't — I swept for
0.0.4and walked straight pastREADME.md:225andAGENTS.md:355-356, which both stated the requirement as>=0.0.2 <0.1.0: the floor from #157, three bumps ago. Codex caught it. This PR's own thesis, one level up.Fixed in
ba794e7d, and not by editing the digits. Stating a current value in prose is the defect — it rots by construction and re-arms the trap at the next bump. Both places now namecomposer.jsonas the authority on the lower bound and quote the value as a reference point. The^0.0.2illustration stays, since the range rule was learned from it, but framed as history.Verified from the registry, not from the path repos
CI resolves the SDK through path repositories, so it would not have noticed a missing or mis-tagged release. Read from Packagist instead:
and by resolving this PR's exact constraint in a scratch project, which installs
core 0.0.5alongside the bundle — the check that catches the caret trap (^0.0.4never resolving0.0.5) that #157 existed for.Measured on a trunk lane at 0.0.5
567 plugin tests green,
csclean, and the MCP evals store suite at 34 passed / 1 failed / 0 skipped — bothorder-getsteps passing, and the single failure being #163's second-order check, which is asserted on purpose.The evals CI run on shopware/shopware-mcp-evals#7 now reports the same 34 / 1 / 0, with
ucp-php-sdk 0.0.5 installedin its lane annotation. It used to report 30 / 3 / 2, and the entire difference was #165: no permalink, so bothcheckout-completecases failed schema validation and bothorder-getcases skipped for want of an order id. The lane and CI finally agree.