From ce4ed695bd2bcdaaebd3067b5cc52eba8d5ba2d7 Mon Sep 17 00:00:00 2001
From: Jac Fitzgerald <jac.fitzgerald@salesforce.com>
Date: Mon, 26 Oct 2026 14:09:07 -0700
Subject: [PATCH] pkg: upgrade PyInstaller 5.13.1 -> 6.22.3, smoke-test
 packaged binaries

Drop the hidden imports PyInstaller 6 no longer needs (requests.packages.urllib3,
pkg_resources), which removes the reason for the setuptools==81 pin. Add a
Package-and-Upload step that runs -v and a failing login against a closed port,
to catch missing bundled modules (requests, urllib3, certifi).

Co-Authored-By: Claude Code <noreply@anthropic.com>
---
 .github/workflows/package.yml | 26 ++++++++++++++++++++++++++
 pyproject.toml                |  2 +-
 tabcmd-linux.spec             |  2 +-
 tabcmd-mac.spec               |  2 +-
 tabcmd-windows.spec           |  2 +-
 5 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index 9413ed6a..db514ca0 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -89,6 +89,32 @@ jobs:
       if: matrix.TARGET == 'macos'
       run: ./dist/${{ matrix.TARGET }}/${{ matrix.OUT_FILE_NAME }}/Contents/MacOS/${{ matrix.APP_BINARY_FILE_NAME }}
 
+    # -v checks the bundled version file. The login probe checks that requests/urllib3/certifi are bundled:
+    # a closed port must fail with a connection error, not an import error.
+    - name: Smoke test package for ${{matrix.TARGET}}
+      shell: bash
+      env:
+        TARGET: ${{ matrix.TARGET }}
+        OUT_FILE_NAME: ${{ matrix.OUT_FILE_NAME }}
+        APP_BINARY_FILE_NAME: ${{ matrix.APP_BINARY_FILE_NAME }}
+      run: |
+        case "$TARGET" in
+          macos) BIN="./dist/macos/$OUT_FILE_NAME/Contents/MacOS/$APP_BINARY_FILE_NAME" ;;
+          *) BIN="./dist/$TARGET/$OUT_FILE_NAME" ;;
+        esac
+        "$BIN" -v
+        if out=$("$BIN" login -s https://localhost:1 -u a -p b --no-certcheck 2>&1); then
+          echo "$out"
+          echo "login to a closed port unexpectedly succeeded"
+          exit 1
+        fi
+        echo "$out"
+        if echo "$out" | grep -Eq "ImportError|ModuleNotFoundError|Unhandled exception"; then
+          echo "packaged binary failed with an import error"
+          exit 1
+        fi
+        echo "$out" | grep -q "Max retries exceeded" || { echo "expected a connection error from requests"; exit 1; }
+
     - name: Tar app bundle for Mac
       if: matrix.TARGET == 'macos'
       run: |
diff --git a/pyproject.toml b/pyproject.toml
index c06f7685..1d7e5ae2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -66,7 +66,7 @@ test = [
     "types-setuptools"
 ]
 localize = ["doit", "ftfy", "click"]
-package = ["doit", "pyinstaller==5.13.1", "setuptools==81"]
+package = ["doit", "pyinstaller==6.22.3", "setuptools==83.0.0"]
 versioning = [
     "doit",
     "pyinstaller_versionfile",
diff --git a/tabcmd-linux.spec b/tabcmd-linux.spec
index 51fa2fd1..4b0397a3 100644
--- a/tabcmd-linux.spec
+++ b/tabcmd-linux.spec
@@ -24,7 +24,7 @@ a = Analysis(
     pathex=[],
     binaries=[],
     datas=localized_strings,
-    hiddenimports=['tableauserverclient', 'requests.packages.urllib3', 'pkg_resources'],
+    hiddenimports=['tableauserverclient'],
     hookspath=[],
     hooksconfig={},
     runtime_hooks=[],
diff --git a/tabcmd-mac.spec b/tabcmd-mac.spec
index 3d93c1b6..46c3ac93 100644
--- a/tabcmd-mac.spec
+++ b/tabcmd-mac.spec
@@ -22,7 +22,7 @@ a = Analysis(
     pathex=[],
     binaries=[],
     datas=localized_strings,
-    hiddenimports=['tableauserverclient', 'requests.packages.urllib3', 'pkg_resources'],
+    hiddenimports=['tableauserverclient'],
     hookspath=[],
     hooksconfig={},
     runtime_hooks=[],
diff --git a/tabcmd-windows.spec b/tabcmd-windows.spec
index 8c08b7b0..e2b427fa 100644
--- a/tabcmd-windows.spec
+++ b/tabcmd-windows.spec
@@ -22,7 +22,7 @@ a = Analysis(
     pathex=[],
     binaries=[],
     datas=localized_strings,
-    hiddenimports=['tableauserverclient', 'requests.packages.urllib3', 'pkg_resources'],
+    hiddenimports=['tableauserverclient'],
     hookspath=[],
     hooksconfig={},
     runtime_hooks=[],