Levandor

Arrow Consumer Wheel-Lock Deploy Script — BE-1595

3 min read

How the BESS Python consumers (optimization / forecast / trader-dashboard) get locked to a specific py-mando wheel for the Arrow Flight dev deploy, and the gotchas that silently break it. The mechanism is a PowerShell script (deploy-arrow-consumers.ps1) plus a base64 iex one-liner.

For Agents

Runs on Windows on the corp network — Nexus must resolve (the wheel comes from the internal package registry). It clones the consumer repos, rewrites their dependency lock to the target wheel, and pushes feature/arrow branches that build dev ECR images. See be-1595-flight-wire-type-version-skew-2026-06-24 for why the wheel must match the server.

Gotcha 1 — GitLab credential popup hangs the run

A bare git clone of the GitLab consumer repos pops the GitLab credential manager dialog and the script hangs forever waiting on it.

Fix: clone via the token URL and disable interactive credential prompts:

git clone "https://oauth2:$Token@gitlab.com/.../bess-optimization.git"
# with environment:
$env:GIT_TERMINAL_PROMPT = "0"
$env:GCM_INTERACTIVE      = "Never"
  • https://oauth2:$Token@… — auth inline, no prompt.
  • GIT_TERMINAL_PROMPT=0 — git won’t prompt on the terminal.
  • GCM_INTERACTIVE=Never — the Git Credential Manager popup never appears.

Gotcha 2 — the base64 iex one-liner is a frozen snapshot

The convenience one-liner is a base64-encoded snapshot of the script + the target wheel pin. A stale clipboard silently re-locks the WRONG wheel — you get a successful-looking run that pins an old/wrong wheel.

Always re-copy fresh from the file

Never reuse a one-liner sitting in your clipboard / scrollback. Re-copy it fresh from the source file every time, and verify the commit line echoes the intended wheel before letting it push. The script echoes the wheel it’s locking — read that line, confirm it’s the wheel you meant.

This ties directly to be-1595-flight-wire-type-version-skew-2026-06-24: locking the wrong wheel = version skew = send() got an unexpected keyword argument or deserialization breaks.

Gotcha 3 — dev images gated behind python-docker-publish

The consumer dev images are built by the python-docker-publish CI component, whose Publish Docker Dev job only runs on develop / rc branches by default. The feature/arrow deploy branches are neither.

Fix: the script appends a local rules-override so feature/* also builds the dev image.

Related CI gotcha

Enabling Publish Docker Dev on feature/* separately requires optional: true on the .Publish → Test job dependency, or the pipeline won’t even start. See be-1595-publish-docker-dev-feature-branch-test-need-2026-06-16. (bess-trader-dashboard’s .Publish has no Test need and doesn’t hit that one.)

Quick checklist

Before running the consumer lock

  1. On Windows, on the corp network, Nexus resolves.
  2. $Token is a valid GitLab token (clone uses oauth2:$Token@…).
  3. GIT_TERMINAL_PROMPT=0 + GCM_INTERACTIVE=Never are set.
  4. The one-liner / wheel pin is freshly copied from the file, not the clipboard.
  5. Watch the echoed commit/wheel line — confirm it’s the wheel matching the deployed mando server.

Graph View

Backlinks