Refactor Python requirements - #4352
Conversation
| # You should always use this script, because dev.txt depends on prod.txt. | ||
|
|
||
| export CUSTOM_COMPILE_COMMAND="./docker/compile_requirements.sh" | ||
| export UV_CUSTOM_COMPILE_COMMAND="./docker/compile_requirements.sh" |
mathjazz
left a comment
mathjazz
left a comment
There was a problem hiding this comment.
Nice work!
Left some comments inline. Adding a couple more here:
-
Note that
bin/post_compilewill install bothpsycopg2flavours on Heroku if"$DJANGO_DEV" = True. Shall we just remove the ability to install development requirements on Heroku? -
Dockerfilestill installslibpq-devwith the comment "required to build psycopg2", but the dev image now installspsycopg2-binary. Shall we droplibpq-dev? And alsobuild-essential?
| -r requirements/dev.txt | ||
| -r requirements/test.txt | ||
| -r requirements/lint.txt | ||
| run: uv pip install -r requirements/dev.txt |
There was a problem hiding this comment.
The license gate below no longer covers production dependencies, so psycopg2 — the one package that is prod-only — is never audited, and any future prod-only dependency would slip past the gate too.
There was a problem hiding this comment.
Right now psycopg2 is covered, since it's also in dev.
Maybe add a note to prod.in in the meantime?
There was a problem hiding this comment.
Thinking more about it, right now prod and dev have a minimal divergence.
If they diverge more in the future, this structure would mean that prod is never fully tested? So, maybe we should try to stop anyone from adding new deps to the prod file.
There was a problem hiding this comment.
I updated the prod.in header comment to this now:
Lines 1 to 3 in ac8fb92
I do not think it's worthwhile to spend time in writing scripting/tools to make adding prod-only dependencies more difficult.
There was a problem hiding this comment.
The psycopg2 dependency also has this comment:
Lines 14 to 15 in ac8fb92
3 participants
Fixes #4349
For development environments, switching from
psycopg2topsycopg2-binarymay require first manually uninstallingpsycopg2, or rebuilding the dev venv from scratch. After not doing that I at least got this error message: