Disable Renovate's pip_requirements Manager

[NimJay]

Background

• Renovate Bot created the following PRs:
  • chore(deps): update dependency googleapis-common-protos to v1.55.0 - autoclosed #759
  • chore(deps): update dependency google-cloud-core to v1.7.2 - autoclosed #758
  • chore(deps): update dependency google-auth-httplib2 to v0.1.0 - autoclosed #757
  • chore(deps): update dependency google-auth to v1.35.0 #756
  • chore(deps): update dependency configargparse to v1.5.3 #751
• They all update transitive Python dependencies by modifying only the requirements.txt file, instead of updating the requirements.txt file first.
• This article contains an example of how to disable Renovate Bot for Go. I've copied that configuration.
• This article explains the purpose of the requirements.in file.

Fixes

N/A

Change Summary

• Let's temporarily disable Renovate for Python — until we get through most of the non-Python Renovate Bot pending updates listed in Dependency Dashboard #728.

Additional Notes

• After this PR is merged, my plan is to close the aforementioned Renovate Bot pull-requests.
• I am totally open to exploring other options to this Python Renovate Bot issue, so feel free to reject this PR. 😄
  • For instance, we could just merge all the PRs that only contain requirement.txt bumps, and hope nothing goes wrong. I might be overthinking this.

Testing Procedure

• We'll have to merge this pull-request and

Related PRs or Issues

N/A

[github-actions]

🚲 PR staged at http://34.133.220.217

[xtineskim]

They all update transitive Python dependencies by modifying only the requirements.txt file, instead of updating the requirements.txt file first.

Do you mean "instead of updating the requirements.txt file first"?
I'm good with this, maybe there can be a way for renovate-bot to exclusively look at the modules in the requirements.in file (I wonder why that pip-compile field is not enough to specify that 🤔 )

LGTM!

[github-actions]

🚲 PR staged at http://34.133.220.217

[NimJay]

... maybe there can be a way for renovate-bot to exclusively look at the modules in the requirements.in file
(I wonder why that pip-compile field is not enough to specify that 🤔 )

Good question.

Christine and I just did some digging and decided to keep pip-compile enabled and disable pip_requirements.
I have updated this pull-request accordingly — instead of disabling python, we now only disable pip_requirements.

Background Info

• pip-compile and pip_requirements are Renovate Bot managers.
• pip-compile is considered to be in "alpha" stage, so it's not enabled by default.
• pip-compile targets the requirements.in file.
• pip-compile will still create PRs that only update the requirements.txt file because of lock file maintenance, but these PRs are good.
• pip_requirements doesn't look at or touch requirements.in files and only ever updates the requirements.txt file.

[xtineskim]

Looks like this is not behaving as expected, for example in the PRs opened this morning

• chore(deps): update dependency rsa to v4.8 part2 #771
• chore(deps): update dependency protobuf to v3.20.0 #769
• chore(deps): update dependency opencensus-ext-stackdriver to v0.8.0 #768
• chore(deps): update dependency opencensus to v0.8.0 #767

The requirements.in files are being updated, but now the requirements.txt files are not getting updated

[xtineskim]

I think we should try this renovatebot/renovate#10407 (comment)
and https://docs.renovatebot.com/configuration-options/#lockfilemaintenance
Maybe something like this?

...
  "pip-compile": {
    "enabled": true,
    "fileMatch": ["(^|/)requirements\\.in$"],
    "lockFileMaintenance": {
      "enabled": true
    }
  },
  "pip_requirements": {
    "enabled": false
  }

[NimJay]

The requirements.in files are being updated, but now the requirements.txt files are not getting updated

Oh no. This is a fun game of whack-a-mole. 😄

Thanks for sharing those links and bringing this to our attention, Christine.
From your link:

lockFileMaintenance ... This feature is disabled by default.

I see. Let's try your suggestion of adding:

    "lockFileMaintenance": {
      "enabled": true
    }

🤞

[ca-scribner]

ty folks for these good writeups! I faced the same thing this week and randomly found this very helpful conversation :)