Use constraints for testing depedendencies (#4184)

.config/constraints.txt

@@ -0,0 +1,113 @@
+#
+# This file is autogenerated by pip-compile with Python 3.10
+# by the following command:
+#
+#    pip-compile --all-extras --no-annotate --output-file=.config/constraints.txt --strip-extras --unsafe-package=resolvelib --unsafe-package=ruamel-yaml-clib --unsafe-package=wcmatch pyproject.toml
+#
+ansi2html==1.9.1
+ansible-compat==24.5.1
+ansible-core==2.17.0
+ansible-lint==24.5.0
+attrs==23.2.0
+babel==2.15.0
+beautifulsoup4==4.12.3
+black==24.4.2
+bracex==2.4
+cairocffi==1.7.0
+cairosvg==2.7.1
+certifi==2024.2.2
+cffi==1.16.0
+charset-normalizer==3.3.2
+check-jsonschema==0.28.4
+click==8.1.7
+click-help-colors==0.9.4
+colorama==0.4.6
+coverage==7.5.1
+cryptography==42.0.7
+csscompressor==0.9.5
+cssselect2==0.7.0
+defusedxml==0.7.1
+dnspython==2.6.1
+enrich==1.2.7
+exceptiongroup==1.2.1
+execnet==2.1.1
+filelock==3.14.0
+ghp-import==2.1.0
+griffe==0.45.1
+htmlmin2==0.1.13
+idna==3.7
+importlib-metadata==7.1.0
+iniconfig==2.0.0
+jinja2==3.1.4
+jsmin==3.0.1
+jsonschema==4.22.0
+jsonschema-specifications==2023.12.1
+linkchecker==10.4.0
+markdown==3.6
+markdown-exec==1.8.2
+markdown-include==0.8.1
+markdown-it-py==3.0.0
+markupsafe==2.1.5
+mdurl==0.1.2
+mergedeep==1.3.4
+mkdocs==1.6.0
+mkdocs-ansible==24.3.1
+mkdocs-autorefs==1.0.1
+mkdocs-gen-files==0.5.0
+mkdocs-get-deps==0.2.0
+mkdocs-htmlproofer-plugin==1.2.1
+mkdocs-macros-plugin==1.0.5
+mkdocs-material==9.5.24
+mkdocs-material-extensions==1.3.1
+mkdocs-minify-plugin==0.8.0
+mkdocs-monorepo-plugin==1.1.0
+mkdocstrings==0.25.1
+mkdocstrings-python==1.10.2
+mypy-extensions==1.0.0
+packaging==24.0
+paginate==0.5.6
+pathspec==0.12.1
+pexpect==4.9.0
+pillow==10.3.0
+pip==24.0
+pipdeptree==2.21.0
+platformdirs==4.2.2
+pluggy==1.5.0
+ptyprocess==0.7.0
+pycparser==2.22
+pygments==2.18.0
+pymdown-extensions==10.8.1
+pytest==8.2.1
+pytest-mock==3.14.0
+pytest-plus==0.7.0
+pytest-testinfra==10.1.0
+pytest-xdist==3.6.1
+python-dateutil==2.9.0.post0
+python-slugify==8.0.4
+pyyaml==6.0.1
+pyyaml-env-tag==0.1
+referencing==0.35.1
+regex==2024.5.15
+regress==0.4.5
+requests==2.32.2
+rich==13.7.1
+rpds-py==0.18.1
+ruamel-yaml==0.18.6
+six==1.16.0
+soupsieve==2.5
+subprocess-tee==0.4.1
+termcolor==2.4.0
+text-unidecode==1.3
+tinycss2==1.3.0
+tomli==2.0.1
+typing-extensions==4.11.0
+urllib3==2.2.1
+watchdog==4.0.0
+webencodings==0.5.1
+yamllint==1.35.1
+zipp==3.18.2
+
+# The following packages are considered to be unsafe in a requirements file:
+# resolvelib
+# ruamel-yaml-clib
+# wcmatch

.pre-commit-config.yaml

@@ -2,6 +2,8 @@
 ci:
   skip:
     - ansible-lint
+    - deps
+    - lock
 default_language_version:
   python: python3.10
 repos:
@@ -97,3 +99,29 @@ repos:
     rev: v24.5.0
     hooks:
       - id: ansible-lint
+  - repo: https://github.com/jazzband/pip-tools
+    rev: 7.4.1
+    hooks:
+      - id: pip-compile
+        name: lock
+        alias: lock
+        always_run: true
+        entry: pip-compile --upgrade --no-annotate --output-file=.config/constraints.txt pyproject.toml --all-extras --strip-extras --unsafe-package wcmatch --unsafe-package ruamel-yaml-clib --unsafe-package resolvelib
+        files: ^.config\/.*requirements.*$
+        language: python
+        language_version: "3.10" # minimal we support officially
+        pass_filenames: false
+        stages: [manual]
+        additional_dependencies:
+          - pip>=22.3.1
+      - id: pip-compile
+        name: deps
+        alias: deps
+        always_run: true
+        entry: pip-compile --no-annotate --output-file=.config/constraints.txt pyproject.toml --all-extras --strip-extras --unsafe-package wcmatch --unsafe-package ruamel-yaml-clib --unsafe-package resolvelib
+        files: ^.config\/.*requirements.*$
+        language: python
+        language_version: "3.10" # minimal we support officially
+        pass_filenames: false
+        additional_dependencies:
+          - pip>=22.3.1

molecule/docker/requirements.yml

@@ -1,2 +1,3 @@
 collections:
-  - community.docker
+  - name: community.docker
+    version: ">=3.10.2"

requirements.yml

@@ -1,7 +1,8 @@
 # This file is only used for testing purposes as it helps ansible-lint to
 # install dependencies when these are missing.
 collections:
-  - community.crypto
-  - community.docker
-  - containers.podman
-  - kubernetes.core
+  - name: community.crypto
+  - name: community.docker
+    version: ">=3.10.2"
+  - name: containers.podman
+  - name: kubernetes.core

tox.ini

@@ -49,6 +49,8 @@ setenv =
   COVERAGE_FILE = {env:COVERAGE_FILE:{envdir}/.coverage.{envname}}
   COVERAGE_PROCESS_START={toxinidir}/pyproject.toml
   MOLECULE_NO_LOG=0
+  PIP_CONSTRAINT = {toxinidir}/.config/constraints.txt
+  lint,devel,deps,pkg,pre,ansibledevel: PIP_CONSTRAINT = /dev/null
   PIP_DISABLE_PIP_VERSION_CHECK=1
   PYTHONDONTWRITEBYTECODE=1
   PYTHONUNBUFFERED=1
@@ -66,6 +68,26 @@ allowlist_externals =
     rm
     sh
 
+[testenv:deps]
+description = Bump all test dependencies
+# we reuse the lint environment
+envdir = {toxworkdir}/lint
+skip_install = true
+basepython = python3.10
+deps =
+  {[testenv:lint]deps}
+setenv =
+  # without his upgrade would likely not do anything
+  PIP_CONSTRAINT = /dev/null
+commands_pre =
+commands =
+  -pre-commit run --all-files --show-diff-on-failure --hook-stage manual lock
+  -pre-commit run --all-files --show-diff-on-failure --hook-stage manual up
+  # Update pre-commit hooks
+  -pre-commit autoupdate
+  # We fail if files are modified at the end
+  git diff --exit-code
+
 [testenv:lint]
 description = Runs all linting tasks
 # python pinned in order to have pip-compile output reproducible