Skip to content

Conversation

@jku
Copy link
Member

@jku jku commented Oct 14, 2025

This way we only need to install one requirements/*.txt at any one time so the version numbers in the two cannot clash.

Dependabot does not seem to handle "-r main.in" or "-r main.txt" very well so that was not used here.


I'll take improve suggestions but based on my quick tests in a fork, dependabot doesn't cope with "requirements files in requirements files" well.

This should let dependabot unbreak #220

This way we only need to install one requirements/*.txt so the version numbers in the two cannot clash. Dependabot does not seem to handle "-r main.in" or "-r main.txt" very well so that was not used here. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Copy link
Member

@woodruffw woodruffw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Grumble, Dependabot 🙂

Seems fine to me, but I think long term we should maybe use a pylock.toml or even just uv's lockfile format to express these kinds of composite environments. But Dependabot will probably have similar issues there...

@woodruffw woodruffw merged commit 5ce4031 into sigstore:main Oct 14, 2025
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

2 participants