Automate a pipenv update run before merging

Question

My team has decided they want to enforce installing the latest version of packages before merging to master so that they don’t become too out of date. So someone set up a pre-commit hook to call pipenv update to update the lock file and then install new versions of dependencies.

However, this has caused a major slow down in my development cycle. The update command can take almost 5 minutes to run each time I commit, and if it actually updates anything the hook fails and must run again for another 5 minutes.

Is there a best practice for keeping the lock file up-to-date? If this is it, can it be sped up?

Asked By: ScoobyDrew18

||

Source

Answer 1

Enforcing the latest version of packages before merging to master can be beneficial to keep your project up-to-date. However, running pipenv update on every commit can indeed be time-consuming and slow down your development process.

Here are some best practices and alternatives to consider:

Schedule updates: Instead of updating dependencies on every commit, schedule a regular update. You can create a script that runs pipenv update and commit the changes to the lockfile. This script can be set up as a cron job or using a CI/CD pipeline (e.g., using GitHub Actions or GitLab CI/CD) to run at a specific interval (e.g., daily or weekly).
Use Dependabot or similar tools: Dependabot is a tool provided by GitHub that checks for outdated dependencies and automatically opens pull requests to update them. This way, you can review the updates and merge them when it’s convenient. Other platforms like GitLab also offer similar dependency update features, such as GitLab’s Dependency Scanning.
Pre-commit hook optimization: If you still want to use a pre-commit hook, you can optimize it by only running pipenv update when the Pipfile is changed. This will save time when committing changes unrelated to dependencies. Here’s an example of a pre-commit hook script:

#!/bin/sh

# Check if Pipfile has been modified
if git diff --cached --name-only --diff-filter=M | grep --quiet 'Pipfile'; then
    echo "Pipfile has been modified, updating dependencies..."
    pipenv update
    git add Pipfile.lock
    echo "Pipfile.lock has been updated and staged."
else
    echo "Pipfile has not been modified, skipping dependency update."
fi

Answered By: Matteo Bianchi

Automate a pipenv update run before merging

Question:

Answers: