installation: upper boundaries of dependencies

[tiborsimko]

Now that reana-commons and reana-db are released on PyPI, let us put an upper boundary in our setup.py dependencies so that REANA v0.3.0 will be re-buildable and re-installable even in several months when we start working on and releasing REANA 0.4.0 or later versions.

(1) We should set upper boundaries for our own shared packages, for example:

 'reana-commons>=0.3.0,<0.4.0',

This needs to be done in many repositories:

$ grep 0.3.0 r*/setup.py | grep reana-
reana-client/setup.py:    'reana-commons>=0.3.0',
reana-cluster/setup.py:    'reana-commons>=0.3.0',
reana-job-controller/setup.py:        'sphinxcontrib-openapi>=0.3.0'
reana-job-controller/setup.py:    'reana-commons>=0.3.0',
reana-job-controller/setup.py:    'reana-db>=0.3.0',
reana-server/setup.py:        'sphinxcontrib-openapi>=0.3.0'
reana-server/setup.py:    'reana-commons>=0.3.0',
reana-server/setup.py:    'reana-db>=0.3.0',
reana-workflow-controller/setup.py:        'sphinxcontrib-openapi>=0.3.0',
reana-workflow-controller/setup.py:    'reana-commons>=0.3.0',
reana-workflow-controller/setup.py:    'reana-db>=0.3.0',
reana-workflow-engine-cwl/setup.py:        'sphinxcontrib-openapi>=0.3.0'
reana-workflow-engine-cwl/setup.py:    'reana-commons>=0.3.0',
reana-workflow-engine-serial/setup.py:    'reana-commons>=0.3.0'
reana-workflow-engine-yadage/setup.py:    'reana-commons>=0.3.0',

(2) We should consider pinning all important dependencies, for example here is how we depend on Celery:

$ grep -i celery r*/setup.py
reana-workflow-controller/setup.py:    'celery==3.1.17',
reana-workflow-engine-cwl/setup.py:    'celery==4.1.0',
reana-workflow-engine-serial/setup.py:    'celery>=4.1.0',
reana-workflow-engine-yadage/setup.py:    'celery>=4.2.1',
reana-workflow-monitor/setup.py:    'celery==3.1.17',

If Celery 4.3 is released in a few months and if the way how we use it is changed, we use it, then REANA v0.3.0 may not be installable then.

We may want to pin fully (celery==4.1.0) or we may rather pin for a reasonable interval (celery>=4.1.0,<4.2.0). The best pinning philosophy will depend on each concrete dependency.

(3) Sometimes we don't even indicate any version, e.g. only zmq. We should also add versions that are known to work at this v0.3.0 release time.

[tiborsimko]

Internal REANA dependencies done.

We may still want to limit some external dependencies, especially some "critical" ones that may break things, such as Celery or Bravado.

[tiborsimko]

All done WRT Bravado and Celery. Did not touch Flask or SQLAlchemy.

[tiborsimko]

Everything done in respective repositories.