Pin dependencies to exact versions

CONTRIBUTING.md

@@ -77,13 +77,17 @@ single function live in that function's `function/` package alongside `fn.py`.
 
 The Pydantic models in `schemas/python/` are generated from the XRDs under
 `apis/` and the project's dependency CRDs. They're committed to git so tests and
-type checking don't need to run the Crossplane CLI first. Regenerate them after
-changing an XRD or bumping a dependency:
+type checking don't need to run the Crossplane CLI first. Building the project
+regenerates them, so regenerate them by building after changing an XRD or
+bumping a dependency:
 
 ```bash
-nix run .#generate
+nix run .#build-crossplane
 ```
 
+The build deletes and recreates the whole `schemas/python/` tree, so models for
+XRDs or dependencies you've removed don't linger.
+
 ### Tests
 
 Every function has tests under `functions/<name>/tests/test_fn.py`. Tests are

crossplane-project.yaml

@@ -74,52 +74,52 @@ spec:
       apiVersion: pkg.crossplane.io/v1
       kind: Provider
       package: xpkg.upbound.io/upbound/provider-gcp-container
-      version: v2.5.0
+      version: v2.6.0
   - type: xpkg
     xpkg:
       apiVersion: pkg.crossplane.io/v1
       kind: Provider
       package: xpkg.upbound.io/upbound/provider-gcp-compute
-      version: v2.5.0
+      version: v2.6.0
   - type: xpkg
     xpkg:
       apiVersion: pkg.crossplane.io/v1
       kind: Provider
       package: xpkg.upbound.io/upbound/provider-gcp-cloudplatform
-      version: v2.5.0
+      version: v2.6.0
   - type: xpkg
     xpkg:
       apiVersion: pkg.crossplane.io/v1
       kind: Provider
       package: xpkg.upbound.io/upbound/provider-aws-eks
-      version: v2.5.0
+      version: v2.6.0
   - type: xpkg
     xpkg:
       apiVersion: pkg.crossplane.io/v1
       kind: Provider
       package: xpkg.upbound.io/upbound/provider-aws-ec2
-      version: v2.5.0
+      version: v2.6.0
   - type: xpkg
     xpkg:
       apiVersion: pkg.crossplane.io/v1
       kind: Provider
       package: xpkg.upbound.io/upbound/provider-aws-iam
-      version: v2.5.0
+      version: v2.6.0
   - type: xpkg
     xpkg:
       apiVersion: pkg.crossplane.io/v1
       kind: Provider
       package: xpkg.upbound.io/upbound/provider-aws-efs
-      version: v2.5.0
+      version: v2.6.0
   - type: xpkg
     xpkg:
       apiVersion: pkg.crossplane.io/v1
       kind: Provider
       package: xpkg.upbound.io/upbound/provider-helm
-      version: ">=v1.2.0"
+      version: v1.2.0
   - type: xpkg
     xpkg:
       apiVersion: pkg.crossplane.io/v1
       kind: Provider
       package: xpkg.upbound.io/upbound/provider-kubernetes
-      version: ">=v1.2.0"
+      version: v1.2.1

flake.nix

@@ -171,7 +171,6 @@
         in
         {
           fix = apps.fix { };
-          generate = apps.generate { inherit crossplane pkgs; };
           build-crossplane = apps.buildCrossplane {
             inherit crossplane functionsPkg;
             dockerCredentialUp = pkgs.upbound;
@@ -220,9 +219,8 @@
               echo "Modelplane development shell"
               echo ""
               echo "  nix flake check               nix run .#fix"
-              echo "  nix run .#generate            nix run .#build-crossplane"
-              echo "  nix run .#push-crossplane     nix run .#docs-serve"
-              echo "  nix run .#docs-generate"
+              echo "  nix run .#build-crossplane    nix run .#push-crossplane"
+              echo "  nix run .#docs-serve          nix run .#docs-generate"
               echo ""
             '';
           };

nix/apps.nix

@@ -48,38 +48,26 @@
     );
   };
 
-  # Regenerate schemas from XRDs and dependencies. The Crossplane CLI writes
-  # language bindings to schemas/; only schemas/python/ is committed to git.
-  generate =
-    { crossplane, pkgs }:
-    {
-      type = "app";
-      meta.description = "Regenerate schemas from XRDs and dependencies";
-      program = pkgs.lib.getExe (
-        pkgs.writeShellApplication {
-          name = "modelplane-generate";
-          runtimeInputs = [
-            crossplane
-            pkgs.upbound
-            pkgs.findutils
-          ];
-          inheritPath = false;
-          text = ''
-            crossplane dependency update-cache
-            find schemas/python/models -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true
-            echo "Done. Review changes with 'git diff schemas/python/'."
-          '';
-        }
-      );
-    };
-
   # Build the Crossplane project. On Linux, materialises Nix-built function
   # runtime images into _output/functions/ before invoking the CLI. The CLI
   # loads them via the Tarball function source in crossplane-project.yaml.
   #
-  # docker-credential-up is needed because `crossplane project build` calls
-  # `crossplane dependency update-cache` to resolve providers and CRDs from
-  # xpkg.upbound.io, which requires authentication.
+  # This is also the schema generation entrypoint. crossplane project build
+  # generates the Pydantic models under schemas/python/ from both the XRDs in
+  # apis/ and the project's dependency CRDs, and writes schemas/.lock.json.
+  # (crossplane dependency update-cache, which the build calls internally, only
+  # regenerates the dependency half; the XRD-derived models are written by the
+  # build itself.)
+  #
+  # Schema generation is additive: it overwrites the files it generates but
+  # never removes models or lock entries for XRDs or dependencies that have been
+  # dropped or renamed. We delete schemas/ first so the result reflects only the
+  # current XRDs and dependencies. Everything under schemas/ is generated (the
+  # per-language bindings and the language-agnostic .lock.json), so it's safe to
+  # remove wholesale and let the build recreate it.
+  #
+  # docker-credential-up remains available for resolving any dependencies that
+  # require registry authentication.
   buildCrossplane =
     {
       crossplane,
@@ -88,7 +76,7 @@
     }:
     {
       type = "app";
-      meta.description = "Build the Crossplane project";
+      meta.description = "Build the Crossplane project and regenerate schemas";
       program = pkgs.lib.getExe (
         pkgs.writeShellApplication {
           name = "modelplane-build-crossplane";
@@ -112,6 +100,7 @@
                 ''
             )
             + ''
+              rm -rf schemas
               crossplane project build "$@"
             '';
         }

schemas/.lock.json

@@ -1 +1 @@
-{"packages":{"fs://apis":"2ae71201216b607f83812a557225a1eb96669150ac5a4d820410b0f7c92008e9","git://https://github.com/crossplane/crossplane/cluster/crds":"90d8b72ad8b829f0bcd7d7d5a98eaa0d579f244a","xpkg://xpkg.upbound.io/upbound/provider-aws-ec2:v2.5.0":"sha256:956e2688224c7b42fca94864991478b4ecfec9c9cf52f1cdc42300c1110cece8","xpkg://xpkg.upbound.io/upbound/provider-aws-efs:v2.5.0":"sha256:c6145e1aea3f482647d43aef44165b8315d9f134c2bd97822fc1e1cd92b34e16","xpkg://xpkg.upbound.io/upbound/provider-aws-eks:v2.5.0":"sha256:c51761a15be10295b2c95581448b180889653c20296ebac646624a04f3bf634e","xpkg://xpkg.upbound.io/upbound/provider-aws-iam:v2.5.0":"sha256:854fa2fe081872032cd528d29be58c47e7468744eba7da24b1214aa09610f836","xpkg://xpkg.upbound.io/upbound/provider-gcp-cloudplatform:v2.5.0":"sha256:c84812c0e07576ae1c14103a6f1e69cd1a77b341c5b7939e29c269dd8dc30e03","xpkg://xpkg.upbound.io/upbound/provider-gcp-compute:v2.5.0":"sha256:324c89628bad85f27202dd4322caf969e7d354c9d9895695984301533c939799","xpkg://xpkg.upbound.io/upbound/provider-gcp-container:v2.5.0":"sha256:6e3bb9a041cc1c06b2940904b9c865fe0ea0dd7229e7017dd768e7a55eb18669","xpkg://xpkg.upbound.io/upbound/provider-helm:v1.2.3":"sha256:d81cbe87c15c8555c8388bbb372387084ce8fefdf9a08d0a540a6b4d228a0049","xpkg://xpkg.upbound.io/upbound/provider-helm:v1.2.4":"sha256:e5896e93156845d4f3005abbffa5f1d9468b79944be54203c675f8b61ea54e19","xpkg://xpkg.upbound.io/upbound/provider-helm:v1.2.5":"sha256:00756c2ac9af9d5addf32bc5ce61c7e99c222ff6286d284a419ee9fa48317f17","xpkg://xpkg.upbound.io/upbound/provider-kubernetes:v1.2.4":"sha256:b32140022ee86530424da210ed8544f561592a350dc3467365719ffde8c124e1","xpkg://xpkg.upbound.io/upbound/provider-kubernetes:v1.2.5":"sha256:8c9788629608066abc5ba8ae7039214aeaa89619d810a0bfc337102c4f4a897d","xpkg://xpkg.upbound.io/upbound/provider-kubernetes:v1.2.6":"sha256:4c9c004f2f1e938b419ce620018075a057da25c7edcbeaa4b7488c8bf7b7e961"}}
+{"packages":{"fs://apis":"01888e652ff5a13939cd92793d067022d22351138a3674373116cdb1e70d1ad1","git://https://github.com/crossplane/crossplane/cluster/crds":"90d8b72ad8b829f0bcd7d7d5a98eaa0d579f244a","xpkg://xpkg.upbound.io/upbound/provider-aws-ec2:v2.6.0":"sha256:acc26c8d2710e0306185b6c626a2f8c8fe0fdf89874e85efe7944a3668322865","xpkg://xpkg.upbound.io/upbound/provider-aws-efs:v2.6.0":"sha256:00f1bbbb3c0f1948b6dd45c841a083d63e41850f5a559a15580915311f404911","xpkg://xpkg.upbound.io/upbound/provider-aws-eks:v2.6.0":"sha256:5d144b19e188cb96c918aa7e4ccbc6759b8733ff09bd8ce412723c669aa3f763","xpkg://xpkg.upbound.io/upbound/provider-aws-iam:v2.6.0":"sha256:dbc5288589ccb302d527565680477f08477c280fc5c616dda95dfd558108a038","xpkg://xpkg.upbound.io/upbound/provider-gcp-cloudplatform:v2.6.0":"sha256:f1fe8bc55c474464642303e6fa8608c83e369b42ff12bb8a60a3e2d77339a52b","xpkg://xpkg.upbound.io/upbound/provider-gcp-compute:v2.6.0":"sha256:c7417c461d403f0d59a2dd83f242cebd5d738f9ad328e03ffe0c7b99ea251635","xpkg://xpkg.upbound.io/upbound/provider-gcp-container:v2.6.0":"sha256:b3f68d01ab2529026f1a5dd6d6215a2f499710fad4edd4850546bf6c756befb6","xpkg://xpkg.upbound.io/upbound/provider-helm:v1.2.0":"sha256:4e2bada791af5550195ce0a7b3031273e005c55ff74807d0955b5f38061f7dc9","xpkg://xpkg.upbound.io/upbound/provider-kubernetes:v1.2.1":"sha256:87e2ce59b20bc7f516ad5b53f3214862f42352aabc713e342d33659fb1135564"}}

schemas/python/models/ai/modelplane/infrastructure/servingstack/v1alpha1.py

@@ -122,7 +122,7 @@ class Spec(BaseModel):
     """
     Configuration for the cluster's inference traffic gateway.
     """
-    secrets: list[Secret] = Field(..., min_length=1)
+    secrets: list[Secret] = Field(..., max_length=8, min_length=1)
     """
     Secrets used to authenticate to the target cluster. Typically sourced from a GKECluster's status.secrets. All secrets must be in the same namespace as this ServingStack. A Kubeconfig secret is required. If a cloud-specific credential secret is present (e.g. GCPServiceAccountKey), the ProviderConfigs will use it for identity-based authentication instead of relying on the kubeconfig's embedded credentials.
     """