From d25072292770dda73d4d09b761656822d38ffc00 Mon Sep 17 00:00:00 2001
From: Rohan McGovern <rmcgover@redhat.com>
Date: Wed, 22 Jul 2020 15:59:13 +1000
Subject: [PATCH] Refactor dependency pinning to use requirements.in and
 pip-compile

It makes sense to pin dependencies in requirements.txt, but the
naive method of parsing that file from setup.py meant that it was
not possible to use continuation lines (ending with backslash).
This breaks tools such as pip-compile which make it easier to deal
with pinned dependencies.

Refactor it slightly so that:

- top-level requirements, unpinned, can be listed in requirements.in
- all requirements, pinned, are listed in requirements.txt which can
  be generated/updated using pip-compile
- setup.py uses requirements.in
- CI uses requirements.txt (so tests are repeatable)

Later, container image building would also be expected to use
requirements.txt.
---
 MANIFEST.in      |  1 +
 requirements.in  |  3 +++
 requirements.txt | 36 +++++++++++++++++++++++++++++++++---
 setup.py         |  2 +-
 4 files changed, 38 insertions(+), 4 deletions(-)
 create mode 100644 requirements.in

diff --git a/MANIFEST.in b/MANIFEST.in
index 34daa4d2..a8ad1799 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -2,3 +2,4 @@ include README.md
 include CHANGELOG.md
 include LICENSE
 include requirements.txt
+include requirements.in
diff --git a/requirements.in b/requirements.in
new file mode 100644
index 00000000..4d56688f
--- /dev/null
+++ b/requirements.in
@@ -0,0 +1,3 @@
+fastapi
+pydantic
+starlette
diff --git a/requirements.txt b/requirements.txt
index 9d2d6c9e..442eb1f5 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,3 +1,33 @@
-fastapi==0.59.0 --hash=sha256:50b58aa3e7d5bcb4a4404ac7e550cc53f0cf7ca0fd13c7fd515693dc23c9caef --hash=sha256:c04dacd3deed0fd0ffdcdb116b5a04ffa257656885be7fae7234f4f62ec4a0a9
-pydantic==1.6 --hash=sha256:390844ede21e29e762c0017e46b4105edee9dcdc0119ce1aa8ab6fe58448bd2f --hash=sha256:1998e5f783c37853c6dfc1e6ba3a0cc486798b26920822b569ea883b38fd39eb
-starlette==0.13.4 --hash=sha256:0fb4b38d22945b46acb880fedee7ee143fd6c0542992501be8c45c0ed737dd1a
+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    pip-compile --generate-hashes requirements.in
+#
+fastapi==0.60.0 \
+    --hash=sha256:0676191f7822da4499783c22a2355d0d25442b62a47273de518e8ea51567a12b \
+    --hash=sha256:89eb70159b211a4d3861acfb238d066f6660b6435ec99650bbea2f8ef02526fa \
+    # via -r requirements.in
+pydantic==1.6.1 \
+    --hash=sha256:1783c1d927f9e1366e0e0609ae324039b2479a1a282a98ed6a6836c9ed02002c \
+    --hash=sha256:2dc946b07cf24bee4737ced0ae77e2ea6bc97489ba5a035b603bd1b40ad81f7e \
+    --hash=sha256:2de562a456c4ecdc80cf1a8c3e70c666625f7d02d89a6174ecf63754c734592e \
+    --hash=sha256:36dbf6f1be212ab37b5fda07667461a9219c956181aa5570a00edfb0acdfe4a1 \
+    --hash=sha256:3fa799f3cfff3e5f536cbd389368fc96a44bb30308f258c94ee76b73bd60531d \
+    --hash=sha256:40d765fa2d31d5be8e29c1794657ad46f5ee583a565c83cea56630d3ae5878b9 \
+    --hash=sha256:418b84654b60e44c0cdd5384294b0e4bc1ebf42d6e873819424f3b78b8690614 \
+    --hash=sha256:4900b8820b687c9a3ed753684337979574df20e6ebe4227381d04b3c3c628f99 \
+    --hash=sha256:530d7222a2786a97bc59ee0e0ebbe23728f82974b1f1ad9a11cd966143410633 \
+    --hash=sha256:54122a8ed6b75fe1dd80797f8251ad2063ea348a03b77218d73ea9fe19bd4e73 \
+    --hash=sha256:6c3f162ba175678218629f446a947e3356415b6b09122dcb364e58c442c645a7 \
+    --hash=sha256:b49c86aecde15cde33835d5d6360e55f5e0067bb7143a8303bf03b872935c75b \
+    --hash=sha256:b5b3489cb303d0f41ad4a7390cf606a5f2c7a94dcba20c051cd1c653694cb14d \
+    --hash=sha256:cf3933c98cb5e808b62fae509f74f209730b180b1e3c3954ee3f7949e083a7df \
+    --hash=sha256:eb75dc1809875d5738df14b6566ccf9fd9c0bcde4f36b72870f318f16b9f5c20 \
+    --hash=sha256:f769141ab0abfadf3305d4fcf36660e5cf568a666dd3efab7c3d4782f70946b1 \
+    --hash=sha256:f8af9b840a9074e08c0e6dc93101de84ba95df89b267bf7151d74c553d66833b \
+    # via -r requirements.in, fastapi
+starlette==0.13.4 \
+    --hash=sha256:04fe51d86fd9a594d9b71356ed322ccde5c9b448fc716ac74155e5821a922f8d \
+    --hash=sha256:0fb4b38d22945b46acb880fedee7ee143fd6c0542992501be8c45c0ed737dd1a \
+    # via -r requirements.in, fastapi
diff --git a/setup.py b/setup.py
index be1350a0..7bd22507 100644
--- a/setup.py
+++ b/setup.py
@@ -15,7 +15,7 @@ def get_long_description():
 
 
 def get_requirements():
-    with open("requirements.txt") as reqs:
+    with open("requirements.in") as reqs:
         return [line.split()[0] for line in reqs.read().splitlines()]