Feature/check package versions

[pchorus]

As discussed @zyv and I created a GitHub Action to check package versions configured in pyproject.toml.

We want to avoid pinned versions and also lax configuration like using ^ or >=.

All we want to allow is * as general solution which is always the preferred version config.
If we need to pin version, we should use ~ which allows updates to minor or patch versions (depending on the version number that follows the ~), but never updates major versions which can contain breaking changes.

We have tested this action in django-insurance-api-v2 by using the feature branch of this repository here.
I run it with current pyproject.toml (https://github.com/moneymeets/django-insurance-api-v2/actions/runs/8632210966/job/23664358558) containing some errors and also with a fixed pyproject.toml (https://github.com/moneymeets/django-insurance-api-v2/actions/runs/8632335916/job/23662773927).

Please share your thoughts.
Is this what we are aiming for?

[zyv]

Our code is gold! :)

[mm-matthias]

I've suggest a naming change and some minor typing, but that's it.

What you write in the PR description seems to make sense to me. I guess we need to see if this works with our repositories or whether we have any repositories that break the implemented rule.
If we ever need a different rule for whatever reason we can still discuss it as it comes up and possibly modify this versioning rule here.

[marns93]

@pchorus In our daily I understood that we will forbid ^, now we will forbid >= as well which is fine for me. Before this PR will be merged, we should notify everybody, because this pattern is used in some repositories and the pipeline will fail.

[zyv]

@pchorus In our daily I understood that we will forbid ^, now we will forbid >= as well which is fine for me. Before this PR will be merged, we should notify everybody, because this pattern is used in some repositories and the pipeline will fail.

Yes, we decided that there is also no need for >=, because we can pin to ~1.2.3 if we need to, and we want to unpin as soon as possible anyways, so restriction on only minor updates does not matter. We prepared example changes for insurance API.

[marns93]

@pchorus In our daily I understood that we will forbid ^, now we will forbid >= as well which is fine for me. Before this PR will be merged, we should notify everybody, because this pattern is used in some repositories and the pipeline will fail.

Yes, we decided that there is also no need for >=, because we can pin to ~1.2.3 if we need to, and we want to unpin as soon as possible anyways, so restriction on only minor updates does not matter. We prepared example changes for insurance API.

What about boto3?

boto3 = ">=1.26.148"  # Needed for dependency resolution. See also https://github.com/python-poetry/poetry/issues/5896.

Changing this to ~1.26.148 is not the same as >=. The issue is still open and we can't unpin.
Result would be >=1.26.148 <1.27.0. But we could use versions greater than 1.27.0.

So I wonder if we really should remove >=.

[zyv]

@pchorus In our daily I understood that we will forbid ^, now we will forbid >= as well which is fine for me. Before this PR will be merged, we should notify everybody, because this pattern is used in some repositories and the pipeline will fail.

Yes, we decided that there is also no need for >=, because we can pin to ~1.2.3 if we need to, and we want to unpin as soon as possible anyways, so restriction on only minor updates does not matter. We prepared example changes for insurance API.

What about boto3?

boto3 = ">=1.26.148"  # Needed for dependency resolution. See also https://github.com/python-poetry/poetry/issues/5896.

Changing this to ~1.26.148 is not the same as >=. The issue is still open and we can't unpin. Result would be >=1.26.148 <1.27.0. But we could use versions greater than 1.27.0.

So I wonder if we really should remove >=.

Argh, stupid Poetry slow resolution :( Maybe we can allow ">" as a hack to make sure that this was added manually?

[mm-matthias]

One could also add boto3 as an explicit exception to the checker.

[mm-matthias]

Did not test, but LGTM in general. I still need to talk to you guys about the "*" stuff.

[catcombo]

I like the idea. Thank you for implementing this! However, I agree with @marns93 regarding pinning the problematic boto3 versions. There is also another problem with poetry: it downloads all boto3 versions to resolve dependencies if you use * which takes hours every time one run poetry update. We should either exclude boto3 from check or allow >=.

[pchorus]

I added a IGNORE_PACKAGES containing a tuple of package names that should be ignored. Currently, it only contains "boto3".

[catcombo]

👍

[marns93]

Thanks for adding the tests.
LGTM. :)