[smoparth]

What

• Pass the downloaded artifact kind through source preparation. Archives
  are unpacked; clean Git checkouts are prepared in place.
• Keep existing prepare_source override arguments and path-only callers
  compatible. Build metadata is written but is not used to decide
  whether preparation runs.
• Add --source-kind to step prepare-source and optional JSON output
  to step download-source-archive. Existing path-only output remains
  the default.
• Replace an existing checkout when cleanup is enabled. Without cleanup,
  an existing destination raises FileExistsError.

Why

Git resolvers return checkout directories, but preparation previously
tried to unpack those directories as archives.

Closes: #1205

The related build_sdist strategy remains in #1206 / #1385. The current
default tar builder can include .git, so Git source builds are not yet
production-ready. Prebuilt routing remains in #1208.

Testing

• Focused tests in test_sources.py, test_packagesettings_resolver.py,
  test_bootstrapper.py, and test_commands.py: 244 passed.

• File-scoped Ruff and mypy checks passed; git diff --check passed.

• Full and end-to-end suites were not run.

• PR follows CONTRIBUTING.md guidelines

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: python-wheel-build/fromager
• Branch: new-resolver-config
• File: .coderabbit.yaml
• Commit: f1ee225
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 964a1f13-a8cf-4e2c-b114-7f1878ea12ff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[rd4398]

Thanks, this looks overall good. The tests and docs are thorough too. I have left some comments

[mergify]

This pull request has merge conflicts that must be resolved before it can be merged.
@smoparth please rebase your branch.

[rd4398]

Thanks for addressing the feedback. This looks good now!

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

[LalatenduMohanty]

--source-path can cause Fromager to delete the input archive. For example, passing work-dir/demo-1.0/demo-1.0.tar.gz makes unpack_source() delete its containing directory before opening the archive. The command then fails with FileNotFoundError, and the archive is gone.

The cleanup code already exists, but this PR exposes it through the new option. Please reject this location before cleanup and add a test confirming that the archive survives.

Proposed diff in src/fromager/sources.py

@@ -308,5 +308,16 @@
     unpack_dir = ctx.work_dir / expected_name
+    resolved_unpack_dir = unpack_dir.resolve()
+    source_paths = (source_filename, *source_filename.parents)
+    if any(
+        path.resolve().is_relative_to(resolved_unpack_dir)
+        for path in source_paths
+    ):
+        raise ValueError(
+            f"source archive {source_filename} overlaps {unpack_dir}; "
+            "move it outside the package work directory before preparing"
+        )
+
     if unpack_dir.exists():
         if ctx.cleanup:
             logger.debug("cleaning up %s", unpack_dir)
             shutil.rmtree(unpack_dir)

The dangerous line is shutil.rmtree(unpack_dir): it deletes the folder and everything inside it.

The added check runs before deletion. It checks the archive and its parent folders, resolving symlinks, and stops with a clear error if they overlap the folder being cleaned.

The proposed guard passed eight focused path checks. It still needs a regression test in the PR.