Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/fromager/resolver.py (1)

193-213: ⚠️ Potential issue | 🟠 Major

Normalize find_matches() output here.

Every caller now assumes this helper returns a non-empty highest-first list and immediately reads results[0]. A custom provider can still return a lazy or unsorted iterable, which means iteration-time failures escape the wrapper and the wrong version can be selected. Materialize inside the try, reject empty results, and sort before converting to tuples.

Suggested change

     try:
-        # Bypass resolvelib's resolver to collect all matching candidates rather than
-        # just the single best one. This is safe because get_dependencies() returns []
-        # (no transitive deps to resolve). If get_dependencies() is ever extended,
-        # this must be revisited to use resolvelib's full resolution.
-        candidates = provider.find_matches(
-            identifier=identifier,
-            requirements={identifier: [req]},
-            incompatibilities={},  # Empty - safe only because no transitive deps
-        )
+        # Bypass resolvelib's resolver to collect all matching candidates rather than
+        # just the single best one. This is safe because get_dependencies() returns []
+        # (no transitive deps to resolve). If get_dependencies() is ever extended,
+        # this must be revisited to use resolvelib's full resolution.
+        candidates = list(
+            provider.find_matches(
+                identifier=identifier,
+                requirements={identifier: [req]},
+                incompatibilities={},  # Empty - safe only because no transitive deps
+            )
+        )
     except resolvelib.resolvers.ResolverException as err:
         constraint = provider.constraints.get_constraint(req.name)
         provider_desc = provider.get_provider_description()
         original_msg = str(err)
         raise resolvelib.resolvers.ResolverException(
             f"Unable to resolve requirement specifier {req} with constraint {constraint} using {provider_desc}: {original_msg}"
         ) from err
 
-    # Convert candidates to list of (url, version) tuples
-    # Candidates are already sorted by version (highest first)
+    if not candidates:
+        raise resolvelib.resolvers.ResolverException(
+            f"found no match for {req} using {provider.get_provider_description()}"
+        )
+
+    candidates = sorted(
+        candidates,
+        key=attrgetter("version", "build_tag"),
+        reverse=True,
+    )
+
     return [(candidate.url, candidate.version) for candidate in candidates]

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/fromager/resolver.py` around lines 193 - 213, The provider.find_matches
call returns an iterable that must be materialized and validated inside the try
block: call provider.find_matches(...) and immediately convert to a concrete
list (e.g., candidates = list(...)), raise a ResolverException if the list is
empty (include provider.constraints.get_constraint(req.name),
provider.get_provider_description() and the original exception/message), then
sort candidates by version descending (highest-first) before converting to the
list of (candidate.url, candidate.version) tuples returned by this helper; keep
the existing exception wrapping (resolvelib.resolvers.ResolverException from
err) and ensure all materialization/sorting happens inside the try so
iteration-time errors are caught here.

src/fromager/bootstrap_requirement_resolver.py (1)

166-178: ⚠️ Potential issue | 🟠 Major

Bootstrap resolution should reuse the public resolver wrappers.

These branches reimplement provider lookup directly instead of delegating to the source/wheel resolver APIs. That skips whatever compatibility logic those wrappers carry, so bootstrap can ignore legacy single-result hooks even if the command path still honors them. Route this through the public *_all() wrappers, or share the same fallback logic here.

Also applies to: 192-204

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/fromager/bootstrap_requirement_resolver.py` around lines 166 - 178, The
bootstrap branch currently calls overrides.find_and_invoke(...) and
resolver.find_all_matching_from_provider(...) directly, bypassing the public
resolver wrapper logic; change this to use the public "*_all" wrapper functions
(the same APIs used elsewhere) or the shared fallback helper so
compatibility/legacy single-result hooks are honored: replace the
overrides.find_and_invoke(...) +
resolver.find_all_matching_from_provider(provider, req) sequence with the
corresponding public resolver_all(...) call (or the shared fallback call used by
other paths) that accepts the same parameters
(resolver.default_resolver_provider, ctx=self.ctx, req=req,
include_sdists=False, include_wheels=True, sdist_server_url=url,
req_type=req_type, ignore_platform=False), and make the identical adjustment in
the other branch referenced (lines handling the same logic around 192-204).

src/fromager/sources.py (1)

149-167: ⚠️ Potential issue | 🟠 Major

Legacy resolve_source overrides are bypassed here.

This path only looks for get_resolver_provider, so existing package overrides that still implement the single-result resolve_source hook are never called. get_source_type() still treats resolve_source as a valid override, so the command path and metadata can now disagree. Keep resolve_source() behind a compatibility layer (resolve_source_all() plus legacy-hook fallback) instead of requiring all plugins to migrate at once.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/fromager/sources.py` around lines 149 - 167, This code only calls the
"get_resolver_provider" hook via overrides.find_and_invoke and then
resolver.find_all_matching_from_provider, which bypasses legacy single-result
plugins that implement "resolve_source"; change the logic to fall back to the
legacy hook: after attempting overrides.find_and_invoke(...,
"get_resolver_provider", ...) and calling
resolver.find_all_matching_from_provider(provider, req), if no provider was
returned or results is empty, call overrides.find_and_invoke(req.name,
"resolve_source", None, ctx=ctx, req=req, req_type=req_type) (or a new
compatibility wrapper like "resolve_source_all" that normalizes output) and
convert that single-result response into the (url, version) tuple expected by
the rest of the code before returning; use the same ctx/req/req_type args and
preserve the final return as str(url), version.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/fromager/wheels.py (1)

492-497: Unreachable branch: find_all_matching_from_provider() raises on empty results.

BaseProvider.find_matches() raises ResolverException when no candidates match (resolver.py line 624-626), so results is guaranteed non-empty if no exception was thrown. The else branch at lines 496-497 is dead code.

Either remove the branch or add a comment explaining it's defensive:

Option 1: Remove dead code

             # Get all matching candidates from provider
             results = resolver.find_all_matching_from_provider(provider, req)
-
-            if results:
-                # Return highest version (first in sorted list)
-                wheel_url, version = results[0]
-                return str(wheel_url), version
-            else:
-                excs.append(ValueError(f"no results for {url}: {results=}"))
+            # Return highest version (first in sorted list)
+            wheel_url, version = results[0]
+            return wheel_url, version

Option 2: Add defensive comment

             if results:
                 # Return highest version (first in sorted list)
                 wheel_url, version = results[0]
-                return str(wheel_url), version
+                return wheel_url, version
             else:
+                # Defensive: find_all_matching_from_provider raises if no matches,
+                # but guard against unexpected empty returns from custom providers
                 excs.append(ValueError(f"no results for {url}: {results=}"))

Also, str(wheel_url) is redundant—wheel_url is already str per the return type list[tuple[str, Version]].

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/fromager/wheels.py` around lines 492 - 497, Remove the dead else branch
and the redundant str() conversion: since BaseProvider.find_matches() (and thus
find_all_matching_from_provider()) raises when there are no matches, the "else:
excs.append(...)" branch is unreachable—delete that branch and simplify the
return to return wheel_url, version (drop str(wheel_url)). Update the code in
wheels.py where results is handled (the block that assigns wheel_url, version
from results[0] and appends to excs) to reflect this change; if you prefer to
keep defensive intent instead, replace the else branch with a brief comment
stating it's unreachable due to BaseProvider.find_matches() raising on empty
results and still remove the str() call.