From ae179be764b63623a6e6ee4ca300539c94eff5dc Mon Sep 17 00:00:00 2001 From: Tim van der Meij Date: Sun, 12 Jul 2026 16:27:31 +0200 Subject: [PATCH] Pin the full dependency trees of the font/Fluent linter test requirements The `requirements.txt` files of the two Python-based builds only listed the top-level dependency, and thus not the full dependency tree, and only limited it via a version range. This means that the actual versions we use for the builds are determined at runtime, and can thus easily change if a new version gets published. This causes the builds to not be deterministic, and it's in contrast to the JavaScript-based builds where `package-lock.json` pins the full dependency tree with fixed versions. This commit changes the `requirements.txt` files to follow the same approach as `package-lock.json` and thus pin the full dependency tree to fixed versions. This ensures deterministic builds, improves consistency and provides better protection against e.g. supply chain attacks by not automatically pulling in new versions as they are published (but rather make updating versions a conscious and verifiable/auditable action). To simplify the update process, and make it repeatable, we document the full one-line generation commands inline. --- .github/fluent_linter_requirements.txt | 8 +++++++- .github/font_tests_requirements.txt | 4 +++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/fluent_linter_requirements.txt b/.github/fluent_linter_requirements.txt index 5f8b68c5b..564666d96 100644 --- a/.github/fluent_linter_requirements.txt +++ b/.github/fluent_linter_requirements.txt @@ -1 +1,7 @@ -moz-fluent-linter==0.4.* +# The requirements below can be regenerated with the following one-liner: +# `python3 -m venv venv; source venv/bin/activate; pip install -q moz-fluent-linter; pip freeze; deactivate; rm -rf venv` +fluent.syntax==0.19.0 +moz-fluent-linter==0.4.10 +PyYAML==6.0.3 +six==1.17.0 +typing_extensions==4.16.0 diff --git a/.github/font_tests_requirements.txt b/.github/font_tests_requirements.txt index e8ce6dfc4..e11be43ea 100644 --- a/.github/font_tests_requirements.txt +++ b/.github/font_tests_requirements.txt @@ -1 +1,3 @@ -fonttools==4.* +# The requirements below can be regenerated with the following one-liner: +# `python3 -m venv venv; source venv/bin/activate; pip install -q fonttools; pip freeze; deactivate; rm -rf venv` +fonttools==4.63.0