airship/promenade
Code Issues Proposed changes

Avoid directly installing non-frozen dependencies

Browse Source 
Currently the Dockerfile specifies running `pip install -e ...`, which
will indirectly install dependencies from `requirements.txt`.  This is
generally safe, but should be avoided, since we are exclusively using
frozen dependencies.

Change-Id: Ie368ddb9f1229cc248c8d8804c71889c4339aa85
This commit is contained in:
Mark Burnett 2017-10-20 10:54:10 -05:00
parent 045e7b72b1
commit ecbe862a24
3 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
requirements-direct.txt Normal file
View File

@ -0,0 +1,7 @@
click==6.7
jinja2==2.9.6
jsonpath-ng==1.4.3
jsonschema==2.6.0
pbr==3.0.1
pyyaml==3.12
requests==2.18.4

9
requirements.txt
View File

@ -1,7 +1,2 @@
click==6.7 # Warning: This file should be empty.
jinja2==2.9.6 # Specify direct dependencies in requirements-direct.txt instead.
jsonpath-ng==1.4.3
jsonschema==2.6.0
pbr==3.0.1
pyyaml==3.12
requests==2.18.4

2
tox.ini
View File

@ -17,7 +17,7 @@ commands =
python setup.py build_sphinx {posargs} python setup.py build_sphinx {posargs}
[testenv:freeze] [testenv:freeze]
deps = -r{toxinidir}/requirements.txt deps = -r{toxinidir}/requirements-direct.txt
whitelist_externals=sh whitelist_externals=sh
commands= commands=
sh -c "pip freeze | grep -v '^promenade' > {toxinidir}/requirements-frozen.txt" sh -c "pip freeze | grep -v '^promenade' > {toxinidir}/requirements-frozen.txt"