🐛 dependency_hash

[juftin]

Resolves #47

Changes

dependency_hash

This PR implements dependency_hash function on the plugin which is required for hatch >= 1.8.0. Before this fix the new dependency_hash behavior allows for lockfiles to be out of date without getting updated because their dependency_hash still matches.

Currently, dependency_hash calls run_pip_compile which regenerates the lockfile when needed, it then hashes super().dependency_hash() + the hash of the lockfile contents.

def dependency_hash(self) -> str:
    """
    Get the dependency hash
    """
    self.run_pip_compile()
    hatch_hash = super().dependency_hash()
    if not self.dependencies:
        return hatch_hash
    else:
        lockfile_hash = self.piptools_lock.get_hash()
        return hashlib.sha256(f"{hatch_hash}-{lockfile_hash}".encode()).hexdigest()

Testing

Integration Tests

• New tests including the click CliRunner which allows for testing hatch CLI command with the plugin
• More test cases for existing integration tests

Testing Environements

The project now includes a testing matrix where hatch 1.7.x, 1.8.x, and 1.9.x are all tested in addition to Python 3.8 though 3.12.

Version Pinning

After the latest tests, this plugin is found to be compatible with hatch>=1.7.0

Lock Files

Due to above mentioned version pinning all lockfiles were regenerated - I used macOS to generate these lockfiles so some linux specific dependencies will be removed.

plugin_check_command

Wrapped with safe_activation to ensure it does the right thing wherever it's used

[juftin]

I don't like calling lockfile_up_to_date / sync_dependencies here, but I'm not sure there's a way around it

[juftin]

https://github.com/pypa/hatch/blob/d3246e957584d292319e7b93301598cdf611e902/src/hatch/cli/application.py#L107-L117

Hatch's workflow:

1. Check current dependency_hash
2. Compare it to stored hash
3. If they don't match then run dependencies_in_sync / sync_dependencies
4. Update the stored hash with hash from step 1

This is problematic because even though the dependency_hash can be the same the lockfile can be completely missing.

[juftin]

This eliminates the need for dependencies_in_sync / sync_dependencies to be called after dependency_hash

I've opened pypa/hatch#1168 which I think would make all of this a lot cleaner

[juftin]

Hey @oprypin could I get you to take a look at this and let me know your thoughts?

EDIT: after much commit editing I've come to a conclusion that the following is the best solution.

def dependency_hash(self) -> str:
    """
    Get the dependency hash
    """
    self.run_pip_compile()
    hatch_hash = super().dependency_hash()
    if not self.dependencies:
        return hatch_hash
    else:
        lockfile_hash = self.piptools_lock.get_hash()
        return hashlib.sha256(f"{hatch_hash}-{lockfile_hash}".encode()).hexdigest()

The lockfile is always checked whether it's out of date - the final hash takes a SHA256 of the lockfile alongside super().dependency_hash()

[oprypin]

I haven't looked too carefully, but all solutions applied here make sense

[juftin]

🎉 This PR is included in version 1.8.3 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀