Skip to content

Conversation

@jku
Copy link
Member

@jku jku commented Oct 14, 2025

This way we only need to install one requirements/*.txt at any one time so the version numbers in the two cannot clash.

Dependabot does not seem to handle "-r main.in" or "-r main.txt" very well so that was not used here.


I'll take improve suggestions but based on my quick tests in a fork, dependabot doesn't cope with "requirements files in requirements files" well.

This should let dependabot unbreak #220

This way we only need to install one requirements/*.txt so the version
numbers in the two cannot clash.

Dependabot does not seem to handle "-r main.in" or "-r main.txt" very well so that was
not used here.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Copy link
Member

@woodruffw woodruffw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Grumble, Dependabot 🙂

Seems fine to me, but I think long term we should maybe use a pylock.toml or even just uv's lockfile format to express these kinds of composite environments. But Dependabot will probably have similar issues there...

@woodruffw woodruffw merged commit 5ce4031 into sigstore:main Oct 14, 2025
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants