commit 38c569b51b909c0b14f07b972a4a4783dbf7868c
author Kevin Liu <kevinjqliu@users.noreply.github.com> Mon Sep 01 12:47:01 2025 -0700
committer GitHub <noreply@github.com> Mon Sep 01 21:47:01 2025 +0200
tree a062a93540e9765a3666b1a3c759bbe452883dc3
parent e4849edbbb79df2ebeeb8f4c6ef1cfab8213355a

Release: Add `poetry.lock` to `sdist` (#2405)

<!--
Thanks for opening a pull request!
-->

<!-- In the case this PR will resolve an issue, please replace
${GITHUB_ISSUE_ID} below with the actual Github issue id. -->
<!-- Closes #${GITHUB_ISSUE_ID} -->

# Rationale for this change
This PR explicitly add `poetry.lock` to the source distribution artifact
so that we can build and test RCs with pinned dependencies.

We want to pin dependencies because we verify a release candidate (RC)
by re-building the project from source distribution. We [unzip the
artifact](https://py.iceberg.apache.org/verify-release/#verifying-license-documentation),
[install the dependencies with `make install`, and then run
tests](https://py.iceberg.apache.org/verify-release/#testing).

Since `poetry.lock` is not automatically added to the source
distribution, `make install` will install packages only based on
`pyproject.toml`. The resolver will pull in the latest version by
default, which can lead to compatibility issues.
For example, in 0.10 RC2, we see that this pulled in the latest
datafusion which caused an compatibility issue with pyiceberg-core. This
is due to the breaking change in the FFI boundary, see
https://github.com/apache/datafusion-python/issues/1217

Alternatively, we can restrict the upperbound of the dependencies, but
that since these are optional dependencies, we want to give users the
freedom to choose.

## Are these changes tested?

## Are there any user-facing changes?

<!-- In the case of user-facing changes, please add the changelog label.
-->