Update frozen upstream requirements #96
Conversation
Generated using: tox -e freeze-upstream-requirements-py27 tox -e freeze-upstream-requirements-py37 tox -e test-upstream-requirements-py27 tox -e test-upstream-requirements-py37
Document how to freeze and test upstream requirements.
|
@johnwalker That's a good point; I think it's currently "documented" in a combination of code and commit comments. The backstory here is that pyca/cryptography runs downstream tests as part of their CI to make sure that their changes do not break certain important downstream dependencies. This client and the AWS Encryption SDK for Python are among those that they test. We had multiple cases where their CI broke because their downstream tests of our clients were broken because of new versions of one of our dependencies. This is something that we want to be aware of (and our CI is set up to catch this), but it is not something that we want an upstream dependency like pyca/cryptography to break on. To address this issue, I set up these frozen upstream dependency definitions to freeze the versions of our dependencies that will be used in any tests run by upstream dependencies[1]. We also run these isolated tests in our own CI to make sure that changes to the frozen dependencies do not break those upstream tests. [1] https://github.com/pyca/cryptography/blob/master/.travis/downstream.d/dynamodb-encryption-sdk.sh |
These were already documented through commits and code. It adds a few sentences of explanation for why the upstream requirements exists to the README, so that people know what they are updating.
|
Thank you! I updated the readme to include explanation. |
test/README.rst
Outdated
| ============================== | ||
|
|
||
| The purpose of the upstream requirements files is to provide a stable list of | ||
| packages for pyca/cryptography's downstream test of the DynamoDB Encryption |
There was a problem hiding this comment.
I deliberately generalized this when I was building the infrastructure, and I think this should be reflected in the description. These are for any upstream dependency that wants to test their downstream consumers. It just so happens that currently pyca/cryptography is the only instance of this.
These requirements files aren't just for pyca/cryptography, they're also for anyone that wants to run downstream tests.
2 participants
Issue #, if available:
Description of changes:
This updates the upstream requirements and documents how to do it.
I wanted to document how the upstream requirements are used, but I didn't know. What are they used for?
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.