Add lock file #141
Add lock file #141
Conversation
Vulnerability scanning tooling is using the lock file to look for issues. Without this, the tooling will not be able to produce reliable report.
Pre commit hook helps the developers execute some tasks before committing.
|
You’ll need to update the changelog. Minor release.
|
We are using python 3.11 in github check for requirements lock. Predictable version in the local precommit makes the CI job reliable.
Added. |
CHANGELOG.rst
Outdated
| Version 15.6 | ||
| ============ | ||
|
|
||
| * Added requirements lock file that is automatically generated with tox and pre-commit. |
There was a problem hiding this comment.
requirements.txt seems not used anywhere?
There was a problem hiding this comment.
Or how is the vulnerability scanner configured to use the lockfile? Either way if it's only used by CI and not even included in the published python package I don't think a changelog is needed
There was a problem hiding this comment.
I asked for one to track these changes in case some external dev runs into them. As we often have externals making PRs on this repo.
There was a problem hiding this comment.
The requirements.txt is used by the Aikido app integration and hence will not be visible here. And, the changelog is added as @Aerylia asked for it.
There was a problem hiding this comment.
is requirements.txt part of the published python package?
There was a problem hiding this comment.
Well perhaps it doesn't matter but I'd consider leaving it out to avoid confusion
There was a problem hiding this comment.
Do you think, we should remove the changelog entry? I am positive about it.
There was a problem hiding this comment.
Reverted. We can squash the commits while merging to make it clean.
There was a problem hiding this comment.
I don't see any benefit for having this lockfile if the python package and CI are not using it. I think we should either make the package depend on the lockfile - although for client libraries this wouldn't make much sense and would actually be a big nuisance for runtimes depending on this library - or simply ignore this aikido complaint which I think is correct for client library repos.
This reverts commit bae0a3e.
We cannot guarantee that the lock file remains same in the lifetime. Hence, removing the checks here.
Vulnerability scanning tooling is using the lock file to look for issues. Without this, the tooling will not be able to produce reliable report.