GRN-C006 sdist-wheel-mismatch


Default severity	`warn`
Kind	diff rule: fires only when the trusted version had the property and the new version lost it, or the new version gained a risky property the trusted version lacked.
Status	Specified for 1.0, not yet implemented

What it checks

The selected wheel contains a .py or .pth file with no counterpart in the sdist, when the trusted version had no such file.

Why it matters

A wheel is meant to be built from the sdist and the repository. Source that exists only in the wheel was added outside the normal build, and it is the part reviewers are least likely to see, because they read the repository.

Example finding

Illustrative; not from a real release. The rule is specified but not yet implemented.

examplelib 2.6.1 → 2.6.2: WARN
  WARN  GRN-C006 sdist-wheel-mismatch: the 2.6.2 wheel has 1 Python file that its sdist doesn't
           - examplelib/_hook.py: in examplelib-2.6.2-py3-none-any.whl, not in examplelib-2.6.2.tar.gz

How to resolve it

Check whether the file is generated during the build (version files and compiled templates are common).
If it isn't, find out how it got into the wheel before merging.
If it is expected, merge and add an ignore for this version.

Allowlisting

Once you've reviewed a release, ignore this rule for that package and version range. Every ignore needs a reason and an expiry date; after until it stops applying and the report notes that it expired.

[[garnet.ignore]]
package = "examplelib"
versions = ">=2.6"
rules = ["GRN-C006"]
reason = "_version.py is generated by the build backend"
until = "2027-06-30"

To change the rule's severity for every package instead:

[garnet.rules]
"GRN-C006" = "block"   # "off" | "info" | "warn" | "block"