Package: tox-pin-deps
tox-pin-depsRuntoxenvironments withstrictly pinneddependenciesusing simple,
well-maintained tools (you're probably using already) withno project or code changes.This plugin
usesjazzband/pip-tools'pip-compileto freeze test and project dependencies, save a lock file per-testenv, and have
the locked deps installed, in the usual way viapip, on subsequent invocations.This plugin supports both tox 3 and tox 4.UsageInstalltox-pin-depsin the same environment astox.Runtox --pip-compileto pin deps for the defaultenvlist.Commit files under{toxinidir}/requirements/*.txtto version control.Subsequent runs oftoxwill install from the lock file.Runtox --pip-compile --pip-compile-opts \ --upgradeat any time to lock updated dependencies based on:depsnamed intox.inifor the environmentProject ("dist") dependencies named inpyproject.toml,setup.cfg, orsetup.py.Unlessskip_installorskipsdistis trueRuntox --ignore-pinsto use the dependencies named indepswithout
any special behavior.Setpip_compile_opts = --generate-hashesin thetestenvconfig to enable
hash-checking mode.To always use this plugin, specifyrequires = tox-pin-depsin the[tox]section
oftox.iniMotivationThis project is designed to enable reproducible test (and runtime) environments without
changing project structure or requiring the use of non-standard tools.Use thedepsandinstall_requires/[project.dependencies]that the project already specifiesOnly needpip-compileat lock time, not at runtimeUses standard, well-supported tooling:pipandvirtualenvWhy not...?tox-constraintsRequires the user to bring their ownconstraints.txtconstraints.txtis a newer concept in the python packaging, which may be unfamiliar.constraints.txtwith hash checking has
hadserveralissuessince the 2020 pip resolver which make it unsuitable for this use.tox-constraintsdoes not support tox 4poetry/tox-poetrypoetryis a newer tool that most python programmers haven't worked with.poetryis a runtime dependency for developing/testing projects.Requirements are specified in non-standard[tool.poetry]section ofpyproject.toml.If a project isn't already usingpoetry, adopting it for the sole purpose
of controlling and pinning dependencies constitutes a significant change to
development and packaging workflows.tox-poetrydoes not support tox 4pipenv/tox-pipenvpipenvis slow, non-standard, anddoes NOT work for dist projectspipenvis older, but still a tool that most python programmers haven't worked with.pipenvis a runtime dependency for developing/testing projects.Requirements are specified in a non-standardPipfileandPipfile.lock.If a project isn't already usingpipenv, adopting it for the sole purpose
of controlling and pinning dependencies constitutes a significant change to
development and packaging workflows.tox-pipenvhas behavioral edge cases that make it uncomfortable to work with.tox-pipenvdoes not support tox 4pip-compile(directly)Need scripts to handle updating / re-locking deps for multiple python versionsMissing toxdepsintegration for locking test environmentspip-compile-multitox-pin-depsdoes essentially the same thing aspip-compile-multi, except using the
environmentdepssection as the layer on top of the project'ssetup.pyorpyproject.toml, instead of a separate text file.If a project didn't want to usetoxfor managing test environments,
thenpip-compile-multiis a great choice for achieving similar ends.