Skip to content

Conversation

@clarktr1
Copy link

Dependabot needs a .lock file to determine dependency versions. There are other types of .lock files supported, but Pipfile.lock was the easiest to create as it supports requirements.txt. Seeing if Dependabot will the newly added files and suggestion upgrades.

@clarktr1
Copy link
Author

@ldko @somexpert Sorry for all of the commits.

Dependabot needs a .lock file to determine and make version changes. I couldn't get dependabot to review the dev branch so most of the commits were me adjusting either tox configs or dependencies that clashed until all the tests passed. The current iteration passed in docker as well as through Github Action.

Would we prefer a Pipfile.lock? Or a pyproject.toml / pyproject.lock instead?

@clarktr1 clarktr1 changed the title [draft] add pipfile.lock so that dependabot can detect versions add pipfile.lock so that dependabot can detect versions Jan 6, 2026
@clarktr1
Copy link
Author

clarktr1 commented Jan 6, 2026

@ldko @somexpert Hi! This is ready for review.

I’ve added a pyproject.toml to manage dependencies and environments and integrated Poetry. Poetry now handles dependency installation and uses poetry.lock for locking versions. Also it is Dependabot readable!

Several redundant files have been removed and their configuration consolidated into pyproject.toml:

  • requirements files (base, codestyle, dev, and test)
  • MANIFEST.in
  • setup.py
  • tox.ini

I’ve also updated Docker Compose to install and use Poetry inside the container. There should be no changes required to the existing workflow for installation or running tests.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants