pin CI build dependencies

[belm0]

currently the dev / CI build does not have pinned dependencies, so the build might use different package versions over time

suggested:

• create a dev-dependencies.in
• use pip-compile (from pip-tools) to generate dev-dependencies.txt from setup.py and dev-dependencies.in

from there, pip-compile can be used as needed to upgrade dev build dependencies

[bluetech]

👍 on pinning dev dependencies like pytest, sphinx and such.

Pinning trio/wsproto has some tradeoffs however - it keeps things stable but can cause bugs and breaking changes in the dependencies to be missed, unless regularly updated. My opinion is that it's better not to pin them.

[belm0]

Pinning trio/wsproto has some tradeoffs however - it keeps things stable but can cause bugs and breaking changes in the dependencies to be missed, unless regularly updated. My opinion is that it's better not to pin them.

Noted. So the distinction is regarding direct package dependencies-- you don't want incompatibilities or runtime errors to be hidden until your users hit them.

On the other hand I've found having pinning in place for everything to be useful-- for example in other projects there is a build variant against older versions of Trio. It wouldn't be hard to add another variant for the latest package dependencies (via pip-compile -P).

[belm0]

It wouldn't be hard to add another variant for the latest package dependencies

this is done