CodeVetter · Repo Unpack · Contributor handoff
pydantic/pydantic-settings
Begin changes at the source boundary responsible for the behavior and read its matching tests. Precedence, aliases, decoding, source-construction timing, and shared-state lifetime are the main cross-module contracts. Tests and CI were inspected, not executed; the suggested commands are future checks requiring execution authorization. This brief is bounded source inspection and supplies no passing results or confirmed vulnerabilities.
- Read main.py source orchestration, sources/base.py contracts, and providers/env.py preparation before modifying settings resolution; changes there affect every environment-derived provider and final model construction.
- Preserve highest-first source order and deep_update(source_state, state); use precedence and alias regressions to assess changes rather than assuming later sources overwrite earlier ones.
- Distinguish configuring a file source from enabling it: setting json_file/toml_file/yaml_file alone does not insert the source, and _settings_warn_unused_config_keys warns when the corresponding source is absent.
- Preserve ENV_FILE_SENTINEL versus None, platform-specific environment case handling, and explicit UTF-8 reads; these encode observable configuration and portability contracts.
- For CLI changes, inspect main.py and providers/cli.py together with dispatch and round-trip tests; root handlers are optional in code, child handlers are required, and unknown serialized arguments must remain last.
- Keep source initialization timing explicit: environment loading occurs in its constructor, AWS reads during inherited initialization, and GCP deliberately waits for __call__ so previous sources can provide its project.
- Tests and CI were inspected, not executed. When authorized, start with focused pytest cases in the affected test file, then use repository make lint, make mypy, and make test; CI's combined coverage gates are configuration evidence rather than current results.
- Maintain Ruff's Python 3.10 target, 120-character lines and single-quote formatting, strict mypy checks, and shared InitState warning deduplication; unresolved field definitions direct users to model_rebuild rather than silently assuming annotations are complete.