dev, ci: Remove pipenv

in light of: pypa/pipenv#4058
freedomofpress · Feb 11, 2020 · 16df81f · 16df81f
1 parent 22cb3d8
commit 16df81f
Show file tree

Hide file tree

Showing 7 changed files with 409 additions and 29 deletions.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -3,37 +3,34 @@ jobs:
   test-run:
     working_directory: ~/sdclientapi
     docker:
-      - image: circleci/python:3.5.3
-        environment:
-          PIPENV_VENV_IN_PROJECT: true
+      - image: circleci/python:3.7
     steps:
       - checkout
       - run: sudo chown -R circleci:circleci /usr/local/bin
-      - run: sudo chown -R circleci:circleci /usr/local/lib/python3.5/site-packages
+      - run: sudo chown -R circleci:circleci /usr/local/lib/python3.7/site-packages
       - restore_cache:
-          key: deps9-{{ .Branch }}-{{ checksum "Pipfile.lock" }}
+          key: deps9-{{ .Branch }}-{{ checksum "dev-requirements.txt" }}
       - run:
           name: Install dependencies
           command: |
-            set -e
-            pip3 install pipenv
-            pipenv install --dev --skip-lock
-            pipenv run pip3 freeze
+            virtualenv --python=python3 .venv
+            source .venv/bin/activate
+            pip install --require-hashes -r dev-requirements.txt
       - save_cache:
-          key: deps9-{{ .Branch }}-{{ checksum "Pipfile.lock" }}
+          key: deps9-{{ .Branch }}-{{ checksum "dev-requirements.txt" }}
           paths:
             - ".venv"
             - "/usr/local/bin"
-            - "/usr/local/lib/python3.5/site-packages"
+            - "/usr/local/lib/python3.7/site-packages"
       - run:
           name: Run linters
-          command: pipenv run make lint mypy
+          command: make lint mypy
       - run:
           name: Run tests
-          command: pipenv run make test
+          command: make test
       - run:
           name: Check for known CVEs
-          command: pipenv check
+          command: make safety
 
   test-against-latest-api:
     working_directory: ~/project
@@ -46,10 +43,9 @@ jobs:
       - run:
           name: Install dependencies
           command: |
-            pyenv global 3.5.2
-            pip3 install pipenv
-            pipenv install --dev --skip-lock
-            pipenv run pip freeze
+            virtualenv --python=python3 .venv
+            source .venv/bin/activate
+            pip install --require-hashes -r dev-requirements.txt
       - run:
           name: Download SecureDrop server code
           command: git clone https://github.com/freedomofpress/securedrop.git
@@ -76,7 +72,8 @@ jobs:
           name: Remove VCR cassettes and run tests against latest API
           command: |
             rm data/*.yml  # Removing VCR cassettes
-            pipenv run make test
+            make test
+
 workflows:
   version: 2
   securedrop_ci:

diff --git a/Makefile b/Makefile
@@ -20,7 +20,22 @@ mypy: ## Run the mypy typechecker
 	@mypy sdclientapi
 
 .PHONY: check
-check: lint mypy test ## Run all checks and tests
+check: lint mypy test safety ## Run all checks and tests
+
+.PHONY: safety
+safety: ## Runs `safety check` to check python dependencies for vulnerabilities
+	pip install --upgrade safety && \
+		for req_file in `find . -type f -name '*requirements.txt'`; do \
+			echo "Checking file $$req_file" \
+			&& safety check --full-report -r $$req_file \
+			&& echo -e '\n' \
+			|| exit 1; \
+		done
+
+.PHONY: update-pip-requirements
+update-pip-requirements: ## Updates all Python requirements files via pip-compile.
+	pip-compile --generate-hashes --output-file dev-requirements.txt requirements.in dev-requirements.in
+	pip-compile --generate-hashes --output-file requirements.txt requirements.in
 
 .PHONY: open-coverage-report
 open-coverage-report: ## Open the coverage report in your browser

diff --git a/README.md b/README.md
@@ -13,23 +13,19 @@ The SDK is currently used by the [SecureDrop Client](https://github.com/freedomo
 ## Quick Start
 
 ```bash
-pip install -U pipenv
-pipenv sync --dev
-pipenv shell
+virtualenv --python=python3 .venv
+source .venv/bin/activate
+pip install --require-hashes -r dev-requirements.txt
 make test
 ```
 
-This project uses [pipenv](https://docs.pipenv.org) to manage all dependencies.
-This is a Python 3 project. When using ``pipenv`` locally, ensure you used the ``--keep-outdated``
-flag to prevent dependencies from being unnecessarily upgraded during normal development.
-
 We cover all the API calls supported by the SecureDrop Journalist Interface API.
 
 ## Testing
 
 The tests are located in the `tests` directory. This project uses [vcrpy](http://vcrpy.readthedocs.io/en/latest/) to record and then reply the API calls so that
 developers will have repeatable results so that they may work offline. `vcrpy` stores YAML
-recordings of the API calls in the `data` directory. 
+recordings of the API calls in the `data` directory.
 
 To run all the test cases, use the following command.
 
@@ -118,7 +114,7 @@ Please read [CONTRIBUTING.md](https://github.com/freedomofpress/securedrop-sdk/b
 
 # Versioning
 
-We use [SemVer](http://semver.org/) for versioning. For the versions available, see the [tags on this repository](https://github.com/freedomofpress/securedrop-sdk/tags). 
+We use [SemVer](http://semver.org/) for versioning. For the versions available, see the [tags on this repository](https://github.com/freedomofpress/securedrop-sdk/tags).
 
 # License
 

diff --git a/dev-requirements.in b/dev-requirements.in
@@ -0,0 +1,11 @@
+coverage
+flake8
+mypy
+pyotp
+pytest
+pytest-cov
+sphinx
+vcrpy
+pyyaml>=5.1,<6
+pytest-mock
+pip-tools