Repository navigation
MAINT: locking with uv, remove requirements.txt - #69
Conversation
|
Before CI runs on this PR two actions need to be whitelisted:
|
|
|
||
| - name: Install micromamba | ||
| uses: mamba-org/setup-micromamba@ce51e99f4bb8a82ab7158c4dc59ef4634c59c4f9 # v3.1.0 | ||
| - name: Upload nightly wheel |
There was a problem hiding this comment.
Easier to use a bespoke action that's designed specifically to upload to nightly wheels.
| fi | ||
|
|
||
| # cibuildwheel doesn't install delvewheel by default | ||
| if [[ $RUNNER_OS == "Windows" ]]; then |
There was a problem hiding this comment.
delvewheel is taken care of by cibuildwheel now.
| @@ -0,0 +1,69 @@ | |||
| """Generate this repository's pyproject.toml from numpy's dependency groups. | |||
There was a problem hiding this comment.
copied directly from the scipy-release repo and amended for numpy's dependency groups.
| @@ -0,0 +1,18 @@ | |||
| set -xe | |||
|
|
|||
There was a problem hiding this comment.
copied from the scipy-release repo.
mattip
left a comment
mattip
left a comment
There was a problem hiding this comment.
Some minor nits, but overall looks great and is a massive improvement.
|
I thought I searched for every occurrence |
Added now. We can remove the |
|
Looks great from a quick browse. And great to see that |
|
Thanks @andyfaff |
|
Actually probably can't remove whitelisted actions until there are no more releases on the 2.5 branch., since this PR won't be backported |
|
Good point. I didn't change anything yet. |
3 participants
This PR introduces locking of dependencies during the build, which is a component of supply chain security. This project's pyproject.toml and uv.lock file are generated from the numpy/numpy pyproject.toml file using a couple of scripts. The build fails if the two repositories go out of sync.
This process means that we can retire all the requirements files, and a need to hand sync them with the numpy/numpy repository. Since an unsynchronised state is a hard fail it's obvious when the update script needs to be run. This is done by running the update script locally and submitting a PR.
The release process is unchanged.