Other: dependency management is inconsistent

[lukpueh]

What do you want to share with us?

The rstuf cli dependency management is a mix of

• pipenv/Pipfile: used for dependency management and development environment,
• and pip/requirements.txt: used for CI environment and also for development (editable) environment

Currently these are synced using make requirements, which developers must run explicitly. Additionally, given that cli is a distributable package, runtime dependencies must also be managed in pyproject.toml.

All of this makes dependency management harder then necessary and prone to get out of sync (which is already the case).

I suggest the following measures to consolidate dependency management in the cli.

• Manage (add/remove/constrain) runtime dependencies manually in pyproject.toml. These are not pinned, but only constrained to exclude versions that are known to not work.
• Manage development dependencies manually in Pipfile and add an editable install entry in the [dev-packages] section (a [packages] section is not needed).
• Use pipenv to
  • update Pipfile.lock, if dependencies change above (pipenv lock)
  • manage dev environment (pipenv install --dev)
  • manage ci environment (pipenv install --dev --deploy && pipenv run pytest ... )
• Use dependabot to auto-update pyproject.toml, Pipfile, Pipfile.lock

References

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[lukpueh]

manage ci environment (pipenv install --dev --deploy && pipenv run pytest ... )

Maybe we should use named categories here so that we don't install all the dev dependencies when we only need the pinned runtime dependencies.