ci: record why ecosystem-test's dependencies stay unpinned

[Ravenwater]

Resolves #90.

#90 framed this as a genuine tradeoff — early warning of ecosystem drift, versus a PR queue that an upstream release can block — and named the deciding fact: is ecosystem-test a required check?

It is not, and checking it dissolved the dilemma rather than settling it.

$ gh api repos/stillwater-sc/mtl5-python/rulesets/14750461
name: protect-main | enforcement: active
rule: deletion {}
rule: non_fast_forward {}

No required status checks at all. And nothing depends on the job either — wheels.yml's release chain gates on validate-wheels, in a different workflow, so a red ecosystem-test cannot stop a release any more than it can stop a merge.

So the objection that motivated pinning — "a torch release turns every PR red and blocks the queue" — is not a thing that can happen in this repo. A failure here is loud (a red check on the PR, a failed run) and cheap (blocks nothing), which is exactly what an early-warning lane should be.

The resolution is that floating was already right

That makes this the rare audit finding where the status quo wins. Pinning would trade the job's entire value — telling us when a torch or jax release breaks interop — for protection against a failure mode this configuration cannot produce.

What was actually missing was the reasoning. The unpinned installs sat next to six dependencies pinned earlier today for good reasons, with nothing to distinguish deliberate from overlooked. The next person auditing would reasonably have "fixed" them.

So this adds the comment, covering three things:

• why these differ from cibuildwheel/build/scikit-build-core — those build or publish an artifact, so an upstream release retroactively changes what ships; this job's value is moving with upstream
• the two facts that make floating safe, so a future reader can re-verify rather than re-derive
• the one condition that flips it — adding required status checks to the ruleset would make this a queue-blocker, and at that point either pin and bump deliberately, or move the floating sweep to a scheduled run that opens an issue instead of gating a PR

No behaviour change. Lands as ci:, not in patch_tags, so it cuts no release.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{On-demand reviews are free for the next 23 days. After that, they cost $0.25 per reviewed file.}

Or wait 24 minutes for your next included review.

View limit details

Limit details: You’ve used the included review currently available. Your 73 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: aa846a6a-c09b-4bf1-a44d-68f07d5bff3b

📥 Commits

Reviewing files that changed from the base of the PR and between 91ee57c and 94a17a6.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

---

_{Comment @coderabbitai help to get the list of available commands.}