← All tasks
pythontemporalio/sdk-python #1659Not a task: not reproduced

[Bug] Published wheels contain stray submodule gitfile temporalio/bridge/sdk-core/.git

envgap__temporalio__sdk-python-1659

01 / FAILURE SIGNATURE

As reported upstream

The dangling `gitdir:` pointer makes git repo discovery fail (`fatal: not a git repository`, exit 128) for anything run with cwd inside `site-packages/temporalio/bridge/sdk-core`, and artifact scanners flag the VCS metadata.
Not a benchmark task.
  • In a clean container the reported failure did not reproduce, or the known fix did not make the project run.

02 / ENVIRONMENT RECIPE

Base commit
29e0c51b0f832e0c9148f28ebba4000ab183d42f
Manifest
pyproject.toml
Reproduce
Awaiting issue-specific recipe
Run under trace
Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

temporalio/sdk-python #1659 · read the original issue
### What are you really trying to do?

Install `temporalio` from a published wheel without git metadata ending up in `site-packages`.

### Describe the bug

Published wheels contain a stray git submodule pointer file, listed in RECORD and therefore installed by every installer:

```
temporalio/bridge/sdk-core/.git   ->   gitdir: ../../../.git/modules/sdk-core
```

`temporalio/bridge/sdk-core` is a git submodule, and the release build checks it out recursively, leaving this gitfile in the tree; `[tool.maturin] exclude` only covers `temporalio/bridge/target/**/*`, so it gets packaged. The sdist is not affected.

The dangling `gitdir:` pointer makes git repo discovery fail (`fatal: not a git repository`, exit 128) for anything run with cwd inside `site-packages/temporalio/bridge/sdk-core`, and artifact scanners flag the VCS metadata.

Fix appears to be one line:

```toml
[tool.maturin]
exclude = ["temporalio/bridge/target/**/*", "temporalio/bridge/sdk-core/.git"]
```

Happy to open a PR.

### Minimal Reproduction

```
$ curl -sSLO https://files.pythonhosted.org/packages/40/f3/a2237d5265eb29de591abeac7610a48616b590a1b923b4919f60ee81adfa/temporalio-1.30.0-cp310-abi3-macosx_11_0_arm64.whl
$ unzip -p temporalio-1.30.0-cp310-abi3-macosx_11_0_arm64.whl temporalio/bridge/sdk-core/.git
gitdir: ../../../.git/modules/sdk-core
```

### Environment/Versions

- OS and processor: any (verified in macosx_arm64, manylinux_x86_64, and win_amd64 wheels)
- SDK version: 1.30.0 (current latest); present at least since 1.20.0
- Installer-independent (file is in wheel RECORD; reproduced with pip 26.1.2 and uv 0.11.29)

### Additional context

Same mechanism as the sdk-core `Dockerfile` previously shipped in wheels: https://community.temporal.io/t/would-it-be-possible-to-exclude-build-files-from-the-python-sdk/12307
Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched
[]