All CI/CD build environments must be reproducible and based on reliable dependency sources.
Standards:
1) Prefer official published packages/artifacts
- In build files (Dockerfiles, pipelines), install dependencies from the official package index/SDK rather than custom/local wheel (.whl) files.
- Only allow custom wheels/artifacts when there is a clear, documented reason (e.g., temporary feature/variant or missing optional dependency), and include a time-bounded plan to replace them with the official SDK.
2) Always pin dependency versions in CI/CD
- Commit and use the project’s lockfile (e.g., uv.lock) so both direct and transitive dependencies are locked for the exact commit.
- Avoid strategies that implicitly pull “latest” versions during builds.
Example (Dockerfile pattern)
FROM --platform=linux/arm64 python:3.12-slim
WORKDIR /app
# Install deterministic dependencies
COPY uv.lock ./
# (Use your project’s standard lock-based install command; e.g.,)
# RUN uv sync --frozen
# Prefer the official SDK package instead of a custom wheel
# RUN pip install strands-<version>[bidi]
How to apply:
- If you’re tempted to install from a custom .whl, first check whether the official SDK already supports your needed configuration; if not, require a documented exception and an explicit “replace with official” follow-up.
- If a lockfile is proposed for removal, verify the pipeline can still guarantee pinned transitive dependencies; typically it cannot, so keep it and use it in the build.