Use a constraints file in this repo.

3rdparty/python/constraints.txt

@@ -0,0 +1,34 @@
+# Generated by build-support/bin/generate_lockfile.sh on Sun Aug  9 18:14:47 EDT 2020
+ansicolors==1.1.8
+beautifulsoup4==4.6.3
+certifi==2020.6.20
+cffi==1.14.1
+chardet==3.0.4
+cryptography==3.0
+dataclasses==0.6
+fasteners==0.15
+idna==2.10
+monotonic==1.5
+mypy==0.782
+mypy-extensions==0.4.3
+packaging==20.4
+pathspec==0.8.0
+pex==2.1.14
+pip==20.1
+psutil==5.7.0
+pycparser==2.20
+pyOpenSSL==19.1.0
+pyparsing==2.4.7
+pystache==0.5.4
+python-Levenshtein==0.12.0
+PyYAML==5.3.1
+requests==2.24.0
+setproctitle==1.1.10
+setuptools==49.2.0
+six==1.15.0
+toml==0.10.1
+typed-ast==1.4.1
+typing-extensions==3.7.4.2
+urllib3==1.25.10
+wheel==0.34.2
+www-authenticate==0.9.2

build-support/bin/generate_lockfile.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+requirements_file=3rdparty/python/requirements.txt
+constraints_file=3rdparty/python/constraints.txt
+
+VENV=$(mktemp -d -t pants_lockfile_venv.XXXXX)
+virtualenv "${VENV}"
+"${VENV}/bin/pip" install -r "${requirements_file}"
+echo "# Generated by build-support/bin/generate_lockfile.sh on $(date)" > "${constraints_file}"
+"${VENV}/bin/pip" freeze --all >> "${constraints_file}"

pants.toml

@@ -52,9 +52,8 @@ root_patterns = [
 ]
 
 [python-setup]
-# TODO: Set up an actual lockfile. For now we just "lock" our requirements.txt to itself,
-#  so we can use --python-setup-resolve-all-constraints (which requires a lockfile).
-requirement_constraints = "3rdparty/python/requirements.txt"
+requirement_constraints = "3rdparty/python/constraints.txt"
+resolve_all_constraints = true
 
 [black]
 config = "pyproject.toml"