Evaluate pip-tools

[woodruffw]

We're probably going to need pip-tools to fully resolve any requirements files that we're passed, since we'll need to both resolve the entire dependency tree and concretize each dependency down to a specific version.

Link: https://pypi.org/project/pip-tools/

Link: https://github.com/jazzband/pip-tools/

[woodruffw]

In particular, we want one or more APIs that:

• Take a requirements file as input, and return:
  • The fully resolved dependency tree
  • A concrete version for each dependency

[woodruffw]

Hmm, looks like pip-tools doesn't include a public Python API (it's completely geared as a set of CLI tools).

Here's the core dependency resolution logic: https://github.com/jazzband/pip-tools/blob/master/piptools/resolver.py

[di]

One option would be that we could temporarily vendor it into this project (with vendy) and then eventually work with the pip-api team on creating an importable API, once we know what we need.

[woodruffw]

Yeah, vendoring seems like a good initial approach. I can also reach out and see whether an importable API is on their radar/whether they'd accept work towards one/how difficult they think it'd be.

[woodruffw]

Opened upstream discussion: jazzband/pip-tools#1484

[woodruffw]

I'm going to close this for now, since we haven't heard from the pip-tools upstream and #31 seems like a more promising approach.