Make "pipx run" use the exact versions in the lock file

[noamraph]

I want to write a utility script with some dependencies, and allow users to run it with pipx run --spec <git repo> <name>.

However, I see that this runs the script with the latest packages compatible with pyproject.toml, rather than the locked versions. I want everyone running the utility from a given commit to get the exact same versions.

Is it possible?

(I found #707, which refers to a PEP which was rejected. I wondered if there's some way to make it work. Perhaps a different build-system, which would use the lock file?)

Thanks,
Noam

[pawamoy]

Wait for support for PEP 723 in pipx 🙂
You'll be able to pin dependencies in the script itself.

[noamraph]

I don't think this is related to PEP 723 - I don't need the versions to be in the same file.

[pawamoy]

Ah, sorry, I got confused by "utility script". Adding an other answer then.

[pawamoy]

Even if you bundle the lock file in your package distributions, tools like pipx won't be able to use it. The only way is to pin dependencies in pyproject.toml, so that these exact versions are encoded in the distributions metadata. Or maybe there's a way to write a PDM plugin that modifies the dependencies metadata when building, to use the pins from the lock file.

[noamraph]

Actually, I now saw that this plugin was already written, and is mentioned in the "curated list of plugins" page! https://github.com/sigma67/pdm-build-locked

[noamraph]

Although it uses a different approach - it modifies the build to add the group to the package dependencies, instead of modifying pyproject.toml.

[pawamoy]

Amazing!

Well, I think it's the right approach: you just set it up and never have to worry about updating pyproject.toml anymore.
Users installing your tool with the git+https protocol will benefit from it too, as long as you list the plugin in the build requirements, and you track pdm.lock:

[build-system]
requires = ["pdm-backend", "pdm-build-locked"]
build-backend = "pdm.backend"

[frostming]

I am going to make such plugin on top of the new cross platform export in the coming 2.11.0

[noamraph]

@frostming great! Thanks! Would it mean that you won't have to specify pdm-build-locked as an additional requirement for build-system? It actually makes me a bit nervous to put a project with 3 github stars (one of them mine) as a critical dependency.

@pawamoy after thinking about this a bit, I agree, I prefer this approach, of adding the locked group during build. It feels a bit surprising to have an optional dependency group not listed in pyproject.toml, which I don't really like, but I think that the advantage of not having the same data duplicated in two committed files outweighs it. At the end, I think the intent of installing mytool[locked] is pretty obvious, and I can live with the actual mechanism that makes it work being a bit obscure.