pin dependencies for deterministic CI / dev builds

.travis.yml

@@ -4,18 +4,28 @@ dist: bionic
 git:
   depth: 1
 
-matrix:
+jobs:
   include:
     - python: 3.5
+      env: REQUIREMENTS=requirements-dev-3.5.txt
     - python: 3.6
+      env: REQUIREMENTS=requirements-dev.txt
     - python: 3.7
+      env: REQUIREMENTS=requirements-dev.txt
     - python: 3.8
+      env: REQUIREMENTS=requirements-dev.txt
     - python: 3.9
+      env: REQUIREMENTS=requirements-dev.txt
     - python: pypy3
+      env: REQUIREMENTS=requirements-dev.txt
+    - name: "latest deps"
+      python: 3.9
+      env: REQUIREMENTS=requirements-dev.txt UPGRADE="pip install --upgrade trio wsproto"
 
 install:
+  - pip install -r $REQUIREMENTS
+  - $UPGRADE
   - pip install -e .
-  - pip install -r requirements-dev.txt
 
 script:
   - make test

Makefile

@@ -17,3 +17,10 @@ publish:
 	rm -fr build dist .egg trio_websocket.egg-info
 	$(PYTHON) setup.py sdist
 	twine upload dist/*
+
+# upgrade all deps:
+#   make -W requirements-dev.{in,txt} PIP_COMPILE_ARGS="-U"
+# upgrade specific deps:
+#   make -W requirements-dev.{in,txt} PIP_COMPILE_ARGS="-P foo"
+requirements-dev.txt: setup.py requirements-dev.in
+	pip-compile -q $(PIP_COMPILE_ARGS) --output-file $@ $^

docs/contributing.rst

@@ -15,14 +15,16 @@ environment, and install the developer dependencies::
     $ cd trio-websocket
     $ python3 -m venv venv
     $ source venv/bin/activate
-    (venv) $ pip install -e .
     (venv) $ pip install -r requirements-dev.txt
+    (venv) $ pip install -e .
 
 This example uses Python's built-in ``venv`` package, but you can of course use
 other virtual environment tools such as ``virtualenvwrapper``.
 
-The ``requirements-dev.txt`` file contains extra dependencies only needed for
-development, such as PyTest, Sphinx, etc.
+The ``requirements-dev.in`` file contains extra dependencies only needed for
+development, such as PyTest, Sphinx, etc.  Then ``requirements-dev.txt`` is
+generated from ``setup.py`` and ``requirements-dev.in`` so that dependencies
+used in development and CI builds do not change arbitrarily over time.
 
 Unit Tests
 ----------

requirements-dev-3.5.txt

@@ -0,0 +1,69 @@
+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    pip-compile --output-file=requirements-dev.txt requirements-dev.in setup.py
+#
+alabaster==0.7.12         # via sphinx
+async-generator==1.10     # via pytest-trio, trio, trio-websocket (setup.py)
+attrs==20.3.0             # via -r requirements-dev.in, outcome, pytest, trio
+babel==2.9.0              # via sphinx
+bleach==3.2.1             # via readme-renderer
+certifi==2020.11.8        # via requests
+cffi==1.14.3              # via cryptography
+chardet==3.0.4            # via requests
+contextvars==2.4          # via sniffio, trio
+coverage==5.3             # via coveralls, pytest-cov
+coveralls==2.1.2          # via -r requirements-dev.in
+cryptography==3.2.1       # via trustme
+docopt==0.6.2             # via coveralls
+docutils==0.16            # via readme-renderer, sphinx
+h11==0.11.0               # via wsproto
+idna==2.10                # via requests, trio, trustme
+imagesize==1.2.0          # via sphinx
+immutables==0.14          # via contextvars
+importlib-metadata==2.0.0  # via pluggy, pytest
+iniconfig==1.1.1          # via pytest
+jinja2==2.11.2            # via sphinx
+markupsafe==1.1.1         # via jinja2
+outcome==1.0.1            # via trio
+packaging==20.4           # via bleach, pytest, sphinx
+pathlib2==2.3.5           # via pytest
+pkginfo==1.6.1            # via twine
+pluggy==0.13.1            # via pytest
+py==1.9.0                 # via pytest
+pycparser==2.20           # via cffi
+pygments==2.7.2           # via readme-renderer, sphinx
+pyparsing==2.4.7          # via packaging
+pytest-cov==2.10.1        # via -r requirements-dev.in
+pytest-trio==0.5.2        # via -r requirements-dev.in
+pytest==6.1.2             # via -r requirements-dev.in, pytest-cov, pytest-trio
+pytz==2020.4              # via babel
+readme-renderer==28.0     # via twine
+requests-toolbelt==0.9.1  # via twine
+requests==2.25.0          # via coveralls, requests-toolbelt, sphinx, twine
+six==1.15.0               # via bleach, cryptography, packaging, pathlib2, readme-renderer
+sniffio==1.2.0            # via trio
+snowballstemmer==2.0.0    # via sphinx
+sortedcontainers==2.3.0   # via trio
+sphinx-rtd-theme==0.5.0   # via -r requirements-dev.in
+sphinx==3.3.1             # via -r requirements-dev.in, sphinx-rtd-theme, sphinxcontrib-trio
+sphinxcontrib-applehelp==1.0.2  # via sphinx
+sphinxcontrib-devhelp==1.0.2  # via sphinx
+sphinxcontrib-htmlhelp==1.0.3  # via sphinx
+sphinxcontrib-jsmath==1.0.1  # via sphinx
+sphinxcontrib-qthelp==1.0.3  # via sphinx
+sphinxcontrib-serializinghtml==1.1.4  # via sphinx
+sphinxcontrib-trio==1.1.2  # via -r requirements-dev.in
+toml==0.10.2              # via pytest
+tqdm==4.51.0              # via twine
+trio==0.14.0              # via -r requirements-dev.in, pytest-trio, trio-websocket (setup.py)
+trustme==0.6.0            # via -r requirements-dev.in
+twine==1.15.0             # via -r requirements-dev.in
+urllib3==1.26.2           # via requests
+webencodings==0.5.1       # via bleach
+wsproto==0.14.1           # via trio-websocket (setup.py)
+zipp==1.2.0               # via importlib-metadata
+
+# The following packages are considered to be unsafe in a requirements file:
+# setuptools

requirements-dev.in

@@ -0,0 +1,11 @@
+attrs>=19.2.0
+coveralls
+pytest>=4.6
+pytest-cov
+pytest-trio>=0.5.0
+sphinx
+sphinxcontrib-trio
+sphinx_rtd_theme
+trio>=0.14.0
+trustme
+twine

requirements-dev.txt

@@ -1,11 +1,67 @@
-attrs>=19.2.0
-coveralls
-pytest>=4.6
-pytest-cov
-pytest-trio>=0.5.0,<0.6.0
-sphinx
-sphinxcontrib-trio
-sphinx_rtd_theme
-trio>=0.14.0
-trustme
-twine
+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    pip-compile --output-file=requirements-dev.txt requirements-dev.in setup.py
+#
+alabaster==0.7.12         # via sphinx
+async-generator==1.10     # via pytest-trio, trio, trio-websocket (setup.py)
+attrs==20.3.0             # via -r requirements-dev.in, outcome, pytest, trio
+babel==2.9.0              # via sphinx
+bleach==3.2.1             # via readme-renderer
+certifi==2020.11.8        # via requests
+cffi==1.14.3              # via cryptography
+chardet==3.0.4            # via requests
+colorama==0.4.4           # via twine
+coverage==5.3             # via coveralls, pytest-cov
+coveralls==2.1.2          # via -r requirements-dev.in
+cryptography==3.2.1       # via trustme
+docopt==0.6.2             # via coveralls
+docutils==0.16            # via readme-renderer, sphinx
+h11==0.11.0               # via wsproto
+idna==2.10                # via requests, trio, trustme
+imagesize==1.2.0          # via sphinx
+iniconfig==1.1.1          # via pytest
+jinja2==2.11.2            # via sphinx
+keyring==21.5.0           # via twine
+markupsafe==1.1.1         # via jinja2
+outcome==1.0.1            # via pytest-trio, trio
+packaging==20.4           # via bleach, pytest, sphinx
+pkginfo==1.6.1            # via twine
+pluggy==0.13.1            # via pytest
+py==1.9.0                 # via pytest
+pycparser==2.20           # via cffi
+pygments==2.7.2           # via readme-renderer, sphinx
+pyparsing==2.4.7          # via packaging
+pytest-cov==2.10.1        # via -r requirements-dev.in
+pytest-trio==0.7.0        # via -r requirements-dev.in
+pytest==6.1.2             # via -r requirements-dev.in, pytest-cov, pytest-trio
+pytz==2020.4              # via babel
+readme-renderer==28.0     # via twine
+requests-toolbelt==0.9.1  # via twine
+requests==2.25.0          # via coveralls, requests-toolbelt, sphinx, twine
+rfc3986==1.4.0            # via twine
+six==1.15.0               # via bleach, cryptography, packaging, readme-renderer
+sniffio==1.2.0            # via trio
+snowballstemmer==2.0.0    # via sphinx
+sortedcontainers==2.3.0   # via trio
+sphinx-rtd-theme==0.5.0   # via -r requirements-dev.in
+sphinx==3.3.1             # via -r requirements-dev.in, sphinx-rtd-theme, sphinxcontrib-trio
+sphinxcontrib-applehelp==1.0.2  # via sphinx
+sphinxcontrib-devhelp==1.0.2  # via sphinx
+sphinxcontrib-htmlhelp==1.0.3  # via sphinx
+sphinxcontrib-jsmath==1.0.1  # via sphinx
+sphinxcontrib-qthelp==1.0.3  # via sphinx
+sphinxcontrib-serializinghtml==1.1.4  # via sphinx
+sphinxcontrib-trio==1.1.2  # via -r requirements-dev.in
+toml==0.10.2              # via pytest
+tqdm==4.51.0              # via twine
+trio==0.17.0              # via -r requirements-dev.in, pytest-trio, trio-websocket (setup.py)
+trustme==0.6.0            # via -r requirements-dev.in
+twine==3.2.0              # via -r requirements-dev.in
+urllib3==1.26.2           # via requests
+webencodings==0.5.1       # via bleach
+wsproto==0.15.0           # via trio-websocket (setup.py)
+
+# The following packages are considered to be unsafe in a requirements file:
+# setuptools