[Build] Use pip constraints to pin dependency versions #30197
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a robust mechanism for pinning dependency versions using pip constraints, which is a significant step towards ensuring reproducible builds. The implementation across the various Dockerfiles is well-executed, and the addition of the compile_constraints.sh script and the detailed README.md is commendable. I have identified one critical issue in the constraint generation script for ROCm builds that could lead to incorrect dependencies being installed. The fix is straightforward and detailed in the review comment.
njhill
force-pushed
the
pin-dependencies
branch
from
c3a2fe3 to
f37585f
Compare
njhill
force-pushed
the
pin-dependencies
branch
from
f37585f to
b7b2022
Compare
Signed-off-by: Nick Hill <[email protected]> Co-authored-by: Claude Code Signed-off-by: Nick Hill <[email protected]>
njhill
force-pushed
the
pin-dependencies
branch
from
b7b2022 to
bbb974e
Compare
For ROCm Docker builds Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Signed-off-by: Nick Hill <[email protected]>
| ./compile_constraints.sh | ||
| ``` | ||
|
|
||
| This will resolve all dependencies to their latest compatible versions available on PyPI. |
There was a problem hiding this comment.
Given that we're trying to insulate ourselves from package versions that break us, we are expecting this updated package set to break with some regularity ... and yet we do want to update to the latest version of dependencies as quickly as possible
In #28071 you're suggesting (I guess) running compile_constraints.sh in an updated job that will submit a PR.
When that fails, someone will narrow down which package broke us, and submit a separate PR with a version block in requirements/*.txt e.g. requests!=2.16.1,>= 2.26.0 ?
There was a problem hiding this comment.
@markmc yes exactly, or adjust code accordingly. But as also discussed in that issue, perhaps dependabot can be used to automate opening the PRs rather than a job that runs the script.
2 participants
Used claude code for this.
I think an alternative option could be to use
.infiles like we already do for the test dependencies.Resolves #28071.