fix: tag pipenv version to install

[javulticat]

Changes:

Installs a known working pipenv release to avoid Renovate breaking when a pipenv release is bugged or includes breaking changes.

Context:

As maintainers of a tool to help with dependency management, I'm sure you can appreciate the importance of reproducible builds. Unfortunately, the build being used by Renovate to run pipenv lock is not reproducible, because it is always installing the latest version of pipenv. As of last week with the 2020.11.4 release of pipenv, pipenv lock has been broken, which has prevented Renovate from working on projects that use pipenv. By tagging a specific pipenv release, we can ensure that Renovate's pipenv build is reproducible and will not be blocked by upstream changes in pipenv.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please tick one)

I have verified these changes via:

• Code inspection only, or
• Newly added unit tests, or
• Unit tests + ran on a real repository

[viceice]

constraints should be read in extraction phase too, see poetry

renovate/lib/manager/poetry/extract.ts

Lines 115 to 132 in 905cef7

	const constraints: Record<string, any> = {};
	// https://python-poetry.org/docs/pyproject/#poetry-and-pep-517
	if (
	pyprojectfile['build-system']?.['build-backend'] === 'poetry.masonry.api'
	) {
	constraints.poetry = pyprojectfile['build-system']?.requires.join(' ');
	}
	if (is.nonEmptyString(pyprojectfile.tool?.poetry?.dependencies?.python)) {
	constraints.python = pyprojectfile.tool?.poetry?.dependencies?.python;
	}
	return {
	deps,
	registryUrls: extractRegistries(pyprojectfile),
	constraints,
	};

[javulticat]

constraints should be read in extraction phase too, see poetry

renovate/lib/manager/poetry/extract.ts

Lines 115 to 132 in 905cef7

	const constraints: Record<string, any> = {};
	// https://python-poetry.org/docs/pyproject/#poetry-and-pep-517
	if (
	pyprojectfile['build-system']?.['build-backend'] === 'poetry.masonry.api'
	) {
	constraints.poetry = pyprojectfile['build-system']?.requires.join(' ');
	}
	if (is.nonEmptyString(pyprojectfile.tool?.poetry?.dependencies?.python)) {
	constraints.python = pyprojectfile.tool?.poetry?.dependencies?.python;
	}
	return {
	deps,
	registryUrls: extractRegistries(pyprojectfile),
	constraints,
	};

@viceice I'm not sure I understand how the constraints defined here are then being used. For example, in poetry/artifact.ts, there is still this code to determine the Python constraint that doesn't seem to use the data extracted in the place you highlighted.

renovate/lib/manager/poetry/artifacts.ts

Lines 20 to 40 in 905cef7

	function getPythonConstraint(
	existingLockFileContent: string,
	config: UpdateArtifactsConfig
	): string | undefined | null {
	const { constraints = {} } = config;
	const { python } = constraints;
	if (python) {
	logger.debug('Using python constraint from config');
	return python;
	}
	try {
	const data = parse(existingLockFileContent);
	if (data?.metadata?.['python-versions']) {
	return data?.metadata?.['python-versions'];
	}
	} catch (err) {
	// Do nothing
	}
	return undefined;
	}

[viceice]

constraints should be read in extraction phase too, see poetry

renovate/lib/manager/poetry/extract.ts

Lines 115 to 132 in 905cef7

	const constraints: Record<string, any> = {};
	// https://python-poetry.org/docs/pyproject/#poetry-and-pep-517
	if (
	pyprojectfile['build-system']?.['build-backend'] === 'poetry.masonry.api'
	) {
	constraints.poetry = pyprojectfile['build-system']?.requires.join(' ');
	}
	if (is.nonEmptyString(pyprojectfile.tool?.poetry?.dependencies?.python)) {
	constraints.python = pyprojectfile.tool?.poetry?.dependencies?.python;
	}
	return {
	deps,
	registryUrls: extractRegistries(pyprojectfile),
	constraints,
	};

@viceice I'm not sure I understand how the constraints defined here are then being used. For example, in poetry/artifact.ts, there is still this code to determine the Python constraint that doesn't seem to use the data extracted in the place you highlighted.

renovate/lib/manager/poetry/artifacts.ts

Lines 20 to 40 in 905cef7

	function getPythonConstraint(
	existingLockFileContent: string,
	config: UpdateArtifactsConfig
	): string | undefined | null {
	const { constraints = {} } = config;
	const { python } = constraints;
	if (python) {
	logger.debug('Using python constraint from config');
	return python;
	}
	try {
	const data = parse(existingLockFileContent);
	if (data?.metadata?.['python-versions']) {
	return data?.metadata?.['python-versions'];
	}
	} catch (err) {
	// Do nothing
	}
	return undefined;
	}

Poetry constraint is currently not used but we can add pipenv version from project file (if added) to constraints, so your new add function will automatically use it. You've already added the check in the first if condition. 😉

[javulticat]

@viceice I took a shot at adding the requested changes around constraint extraction, let me know if it is what you were looking for!

cc @rarkins

[renovate-release]

🎉 This PR is included in version 23.82.1 🎉

The release is available on:

• GitHub release
• 23.82.1

Your semantic-release bot 📦🚀