Use Case
I would like to run pipenv check as a separate job from the build/test job inside a CI pipeline without rebuilding environment. I discovered that I must actually install all packages to a pipenv environment before using pipenv check. Ideally, I should be able to scan the dependencies inside Pipfile.lock without actually installing the whole environment.
I believe its misleading that right now pipenv is just acting as a "proxy" to safety, and by default checks an environment that may not match Pipfile.lock. By using pipenv check the assumption should be that it is checking the environment specified in Pipfile.lock and if you need to check an environment that deviates, you use safety directly.
I've traced the behavior down to these lines:
|
target_venv_packages = run_command( |
|
_cmd + ["-m", "pip", "list", "--format=freeze"], is_verbose=project.s.is_verbose() |
|
) |
Instead of generating the temp requirements.txt file from the current environment using pip list, can we instead generate the temp requirements.txt from Pipfile.lock? Something like
# this command should also respect the wishes of the --dev argument, if provided. Unsure on specifics of implementation
target_venv_packages = run_command(
_cmd + ["-m", "pipenv", "requirements"], is_verbose=project.s.is_verbose()
)Workaround
I'm currently using the following workaround in my CI job, but would like to go through pipenv directly.
pipenv requirements --dev | safety check --stdin
Use Case
I would like to run
pipenv checkas a separate job from the build/test job inside a CI pipeline without rebuilding environment. I discovered that I must actually install all packages to apipenvenvironment before usingpipenv check. Ideally, I should be able to scan the dependencies insidePipfile.lockwithout actually installing the whole environment.I believe its misleading that right now
pipenvis just acting as a "proxy" tosafety, and by default checks an environment that may not matchPipfile.lock. By usingpipenv checkthe assumption should be that it is checking the environment specified inPipfile.lockand if you need to check an environment that deviates, you usesafetydirectly.I've traced the behavior down to these lines:
pipenv/pipenv/core.py
Lines 2900 to 2902 in 8939c86
Instead of generating the temp
requirements.txtfile from the current environment usingpip list, can we instead generate the temprequirements.txtfromPipfile.lock? Something likeWorkaround
I'm currently using the following workaround in my CI job, but would like to go through
pipenvdirectly.pipenv requirements --dev | safety check --stdin