Skip to content

Conversation

@jku
Copy link
Member

@jku jku commented Oct 14, 2025

We are badly behind in Python dependency updates, need to do something about this.

  • Add dependabot config to handle Python: I think this works mostly like we want:
    • requirements/*.txt will get updates at least seemingly generated by the right tools
    • versions in requirements/*.in will also get updated
    • major versions get their own PRs, everything else is bundled
  • Remove the requirements-building in Makefile: it was not working and dependabot should now handle it
  • Fix the references to the virtual env in the Makefile: .venv is the environment uv venv uses.

This does nothing to fix #216 (but it does remove one use of uv from Makefile so fixing should be a little easier)

Fixes #175. The resulting dependency updates should fix #213

jku added 2 commits October 14, 2025 11:26
* Remove the requirements compiling: it's not working right now and we
  want dependandabot to handle this
* Make sure we don't play with two separate venvs ("./.venv/" and "./env")

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Assumption is that it manages to find the requirements/*.in files and
produces requirements files.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@jku jku requested a review from woodruffw October 14, 2025 08:55
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@woodruffw woodruffw merged commit daf3cb0 into sigstore:main Oct 14, 2025
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

dev dependency on uv is not great Upgrade to sigstore-python 4.x python dependency updates should be automated

2 participants