Pin test dependencies

[Czaki]

Description

In this PR I add constraints files for napari test dependencies and workflow to perform every week update of dependencies.

The motivation for this PR is to avoid regular failures not related to PR context but caused by some dependency release.

Also, this PR will provide dependency versions on which napari works during release time.

This PR is inspired by workflow from PartSeg that example output could be found here 4DNucleome/PartSeg#932 (but here is not listening all updated dependencies)

This PR will require adding GHA_TOKEN to repository secrets with the following permissions:

References

Type of change

• Bug-fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How has this been tested?

• example: the test suite for my feature covers cases x, y, and z
• example: all tests pass with my change
• example: I check if my changes works with both PySide and PyQt backends
  as there are small differences between the two Qt bindings.

Final checklist:

• My PR is the minimum possible work for the desired functionality
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• If I included new strings, I have used trans. to make them localizable.
  For more information see our translations guide.

[codecov]

Codecov Report

Merging #5715 (3db1b59) into main (95356e4) will increase coverage by 0.00%.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #5715   +/-   ##
=======================================
  Coverage   89.83%   89.84%           
=======================================
  Files         608      608           
  Lines       51881    51881           
=======================================
+ Hits        46608    46611    +3     
+ Misses       5273     5270    -3     

see 4 files with indirect coverage changes

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[jaimergp]

I like this! I recently learnt about the Dependency submissions API, which might be related to this in terms of purpose. Having the constraints already there should make it super easy to integrate!

[jni]

@Czaki can you elaborate on what kind of token I need to create? Is this a personal access token or something else? Detailed instructions appreciated. 😊

[jni]

@Czaki thanks for this! Almost ready I think!

[jni]

@Czaki could you add a long comment here to explain what these lines and each of the options do? They are very long and scary. 😅

[Czaki]

• python3.8 -m piptools compile - call pip-compile but ensure proper intepretter
• --upgrade upgrade to the latest possible version. Without this pip-compile will take a look to output files and reuse versions (so will ad something on when adding dependency.
• -o resources/constraints/constraints_py3.8.txt - output file
• setup.cfg resources/constraints/version_denylist.txt - source files. the resources/constraints/version_denylist.txt - contains our test specific constraints like pytes-cov`
• --extra pyqt5 etc - names of extra sections from setup.cfg that should be checked for the dependencies list (maybe we could create a super extra section to collect them all in)
• --allow-unsafe - allow to put in constraints things like setuptools (look at the end of one of the generated files). It will be the default behavior in the future.
• --strip-extras - pip constrains format does not allow to specify extras (like dask[array]) so we need to use this option
• --resolver=backtracking - future default resolver. It fasters. Lower probability of long CI run.

Did you want to put this comment in yml file?

[jni]

It sounds kind of ridiculous, yes, but kind of yes? I wonder if it would work with a multiline string with trailing yaml comments?

[Czaki]

@Czaki can you elaborate on what kind of token I need to create? Is this a personal access token or something else? Detailed instructions appreciated. blush

Go to napari Settings > Third-party Access > Personal access tokens > Settings

Then allow Fine-grained personal access tokens but keep "Require administrator approval"

Go to personal Settings > Developer Settings > Personal access tokens > Fine-grained tokens

Generate new Token

Set resource owner to napari. Set long lime of expiration. Use "Only select repositories"

Here is an example of the configuration for PartSeg, as the napari repository do not allow currently for these tokens:

Then in repository permissions, set Pull request permissions to Read and Write:

Click "generate token".

Such toke could also solve the problem of not starting CI on updating vendor dependency PR.

[kephale]

@Czaki out of curiosity, why are the pip install and examples tests using 3.9 instead of 3.10?

[kephale]

@Czaki is tools/constraints/version_blacklist.txt missing?

[Czaki]

@Czaki is tools/constraints/version_blacklist.txt missing?

Was renamed to version_denylist. I do not regenerate files to simpler check if its working good after merge.

@Czaki out of curiosity, why are the pip install and examples tests using 3.9 instead of 3.10?

At some moment there was the decision to not use the latest supported, but one before. When we enable python 3.11 test then we should switch it to python 3.10

[kephale]

Awesome, thank you @Czaki !

[Czaki]

@Carreau This PR may conflict with parts of your work. What did you think about it?

[alisterburt]

Love this - going to merge because we have two approving reviews but we can always revert if @Carreau has issues