Python module setup.py (pip_setup) dependency updates by Renovate combined with GitLab Package Registry

[pgmgb]

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us what version of Renovate you run.

If you're self-hosting Renovate, select which platform you are using.

GitLab self-hosted

What is your question?

We have Python modules, which were referencing other Python modules from an internal GitLab Package Registry (no authentication needed for downloading packages). The setup.py looks like the following:

import setuptools

setuptools.setup(
    name="dummy-module",
    version="0.1.0",
    author="Dummy User",
    author_email="dummy.user@local.com",
    description="Dumm module.",
    packages=setuptools.find_packages(),
    classifiers=[
        "Programming Language :: Python :: 3",
        "License :: OSI Approved :: MIT License",
        "Operating System :: OS Independent",
    ],
    python_requires='>=3.6',
    install_requires=[
        "other-internal-module @ https://gitlab.local.com/api/v4/projects/1/packages/pypi/files/0635d9dc9b32911047c19d2814b0b574be7c91756de2283f5217d9e098f79bab/other-internal-module-0.1.0-py3-none-any.whl",
        "python-ldap==3.4.4"]
)

Our goal is to install all dependencies directly when installing the Python module dummy-module. This works so far by using the setup.py with install_requires, as shown above.

Renovate is configured and also able to detect and update python-ldap inside the setup.py. However, the other-internal-module will not be updated. Might it's because of the "direct reference" (-> @ https://gitlab.local.com/api/v4/projects/1/packages/pypi/files/0635d9dc9b32911047c19d2814b0b574be7c91756de2283f5217d9e098f79bab/other-internal-module-0.1.0-py3-none-any.whl) or Renovate is not able to handle this kind of references.

So my question would be:

• Does anyone have a hint, how it would be possible to get dependency updates by Renovate for other-internal-module in this kind of construct?

Logs (if relevant)

Logs

Copy/paste the relevant log(s) here, between the starting and ending backticks

[rarkins]

You could do either of these things:

1. Create your own custom regex manager config to find and update any dependencies not detected by Renovate, or
2. Contribute a PR to Renovate to add awareness of this type of pip_setup dependency

However it's not clear to me what you'd like such a dependency updated to or the logic Renovate should use. The presence of a git SHA in the path instead of a versioned tag makes it difficult

[pgmgb]

@rarkins

(...)However it's not clear to me what you'd like such a dependency updated to or the logic Renovate should use.
The presence of a git SHA in the path instead of a versioned tag makes it difficult(...)

Our use case is to link Python modules hosted in a GitLab Package Registry inside a setup.py.
We would love to use the syntax other-internal-module==0.1.0, but this does not work.
When installing the module dummy-module with the following command, pip would search other-internal-module on https://pypi.org/, which will fail (-> it's self-hosted).

pip install dummy-module --index-url https://gitlab.local.com/api/v4/projects/5379/packages/pypi/simple

The only way we figured out (so far) to be able to install Python modules defined inside the setup.py from our self-hosted GitLab Package Registry is by using the direct download URL of the .whl file. This will result in the URL https://gitlab.local.com/api/v4/projects/1/packages/pypi/files/0635d9dc9b32911047c19d2814b0b574be7c91756de2283f5217d9e098f79bab/other-internal-module-0.1.0-py3-none-any.whl with the SHA inside (-> GitLab related).

In our use case, the logic should simply be to replace the current URL with the URL of the newest package.
If okay, I could try your suggested option 2 for our use case?