Check in constraints.txt files generated by constrain_package_deps for reproducibility

[aabmass]

Tox 4.4.0 introduced the constrain_package_deps option to generate and use a constraints.txt file. It seems like it would be useful to check these files in to get reproducible builds across developer's machines and in CI. However, the constraint files are generated under {env_dir}{/}constraints.txt which is generally in the untracked .tox directory.

I'm wondering if anyone is checking the constraints.txt files in to get reproducible builds or if this is a bad idea. I don't see any way to customize the directory where the constraints files live. Thanks!

[gaborbernat]

We could expose a configuration for these, but the idea introducing was more to handle version conflicts between deps and package deps, than reporducible builds.

[aabmass]

Thanks for the quick reply Bernát. Once concern I had was managing updates to the constraints files. Does tox ever update the files or does it expect you to recreate the env when you'd like new deps?

Does tox have any other long term plan for lockfiles, like using pip-compile or uv pip compile?

[gaborbernat]

tox has no plans for lockfiles, we don't plan to create yet another solution. You can roll one with pip/uv compile.