fix(python): use lockfile URL for precompiled installs

[hehaoqian]

When installing precompiled Python, install_precompiled would always recompute the download URL from the remote version index, ignoring any URL already recorded in mise.lock. This broke reproducibility for locked installs.

Now checks lock_platforms for an existing URL before fetching remote versions. If found, uses it directly.

Fixes #8749

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a bug where the Python plugin in mise would recompute the download URL for Python installations, even when a URL was already present in the mise.lock file. This behavior could lead to inconsistent or non-reproducible builds. The changes ensure that if a URL is specified in the lockfile for a given platform, it is used directly, enhancing the reliability of locked Python environments.

Highlights

• Lockfile URL Obedience: Implemented logic to ensure that Python installations respect the URL specified in the mise.lock file, preventing recomputation of download URLs.
• New E2E Test: Added an end-to-end test case to test_lockfile_python that deliberately corrupts the lockfile URL to confirm that mise install fails, proving the lockfile URL is honored.
• Helper Function: Introduced a new utility function lockfile_url_for_platform in python.rs to safely retrieve URLs from platform-specific lockfile entries.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[greptile-apps]

Greptile Summary

This PR fixes a bug where mise install for Python was ignoring the URL recorded in the lockfile and instead recomputing it fresh from the remote API. The fix adds an early check at the top of install_precompiled that reads the URL directly from tv.lock_platforms (if present) and skips the remote fetch entirely, ensuring the lockfile's recorded URL is authoritative. An accompanying e2e test validates this by injecting a deliberately wrong URL into the lockfile and confirming that mise install fails while attempting to download from that URL.

Key changes:

• src/plugins/core/python.rs: install_precompiled now reads the URL from tv.lock_platforms[platform_key].url first, falling back to the remote version-lookup path only when no URL is stored
• e2e/lockfile/test_lockfile_python: New test section that corrupts the lockfile URL with a fake value and asserts the install fails with that URL in the error output, confirming lockfile URL obedience
• The platform_key binding is hoisted to the top of install_precompiled so it's shared by the early-exit path and the existing recording-after-download path

Confidence Score: 5/5

Safe to merge — the fix is a minimal, well-targeted change with a concrete regression test

The core logic change is correct: checking tv.lock_platforms[platform_key].url before doing the remote fetch ensures the lockfile URL is authoritative. The platform_key hoist is clean. The redundant URL re-assignment after download is a harmless no-op. The test harness's quiet_assert_fail already redirects stderr so the new assertion works correctly. No P0/P1 findings remain.

No files require special attention

Important Files Changed

Filename	Overview
src/plugins/core/python.rs	Correctly prioritises the lockfile URL over a freshly-computed one; hoisted platform_key is used consistently; the redundant re-assignment of url after download (when it came from the lockfile) is a benign no-op since entry().or_default() returns the already-existing PlatformInfo
e2e/lockfile/test_lockfile_python	New test section correctly validates the lockfile URL is obeyed; quiet_assert_fail in assert.sh already injects 2>&1 internally so stderr capture is handled even without an explicit redirect in the command string

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[install_precompiled called] --> B[get_platform_key]
    B --> C{tv.lock_platforms\nhas URL for key?}
    C -- Yes --> D[Use lockfile URL directly\nskip remote fetch]
    C -- No --> E[fetch_precompiled_remote_versions]
    E --> F{Match found\nfor tv.version?}
    F -- Yes --> G[Build URL from tag + filename\nShow precompiled hint]
    F -- No --> H{windows or\ncompile=false?}
    H -- Yes --> I[bail! no precompiled found]
    H -- No --> J[install_compiled fallback]
    D --> K[download tarball from URL]
    G --> K
    K --> L[Record URL in lock_platforms]
    L --> M[verify_checksum\nread/write checksum+size]
    M --> N[verify_github_artifact_attestations]
    N --> O{provenance\ndowngrade check}
    O -- Pass --> P[untar + patch sysconfig]
    O -- Fail --> Q[bail! downgrade attack]

Loading

_{Greploops — Automatically fix all review issues by running /greploops in Claude Code. It iterates: fix, push, re-review, repeat until 5/5 confidence.
Use the Greptile plugin for Claude Code to query reviews, search comments, and manage custom context directly from your terminal.}

_{Reviews (2): Last reviewed commit: "test(python): add e2e test verifying loc..." | Re-trigger Greptile}

[hehaoqian]

Not really ready. Fully AI generated. Better look at the bug manually when I have time.

[gemini-code-assist]

Code Review

This pull request enhances the Python plugin's lockfile handling by ensuring that mise prioritizes the download URL specified in the lockfile for a given platform over recomputing it. A new end-to-end test was added to validate this behavior by verifying that mise attempts to download from a deliberately corrupted lockfile URL, leading to a failure. Additionally, a new helper function lockfile_url_for_platform with comprehensive unit tests was introduced to facilitate this logic. There is no feedback to provide.

[Copilot]

Pull request overview

This PR fixes an issue where the core Python plugin could recompute the python-build-standalone download URL during install instead of using the URL already recorded in mise.lock, improving reproducibility and aligning installs with locked artifacts.

Changes:

• Prefer an existing per-platform URL from tv.lock_platforms when installing precompiled Python, falling back to computing the URL only when absent.
• Add unit tests for the lockfile URL lookup helper.
• Extend the Python lockfile E2E test to ensure installs obey the lockfile URL (and fail when it’s deliberately corrupted).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/plugins/core/python.rs	Uses lockfile-stored platform URL as the source of truth for precompiled Python downloads; adds helper + unit tests.
e2e/lockfile/test_lockfile_python	Adds an E2E regression check that a tampered lockfile URL is actually used during install.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jonathan-guihard]

Any update on this one?