chore: port to pdm

.dockerignore

@@ -1,9 +1,9 @@
 **
 .*
 
-!Pipfile*
+!pdm.lock
 !ggshield
 !README.md
 !LICENSE
-!setup*
+!pyproject.toml
 !docker

.github/workflows/build_release_assets.yml

@@ -111,12 +111,9 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           python -m pip install --upgrade \
-            pipenv==2023.12.1 \
+            pdm \
             pyinstaller==6.7.0
-          pipenv install --system --dev
-        env:
-          # Disable lock otherwise Windows-only dependencies like colorama are not installed
-          PIPENV_SKIP_LOCK: 1
+          pdm sync --global --project . --dev
 
       - name: Install Linux specific dependencies
         if: matrix.os == 'ubuntu-22.04'

.github/workflows/ci.yml

@@ -34,8 +34,8 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install pipenv==2023.12.1 pre-commit
-          pipenv install --dev --skip-lock
+          python -m pip install --upgrade pdm pre-commit
+          pdm sync --dev
 
       - uses: actions/cache@v3
         with:
@@ -72,15 +72,11 @@ jobs:
   build:
     name: Build and Test
     runs-on: ${{ matrix.os }}
-    env:
-      # We skip pipenv lockfile by default, because a Pipfile.lock should only
-      # be used for the Python version it was generated for.
-      PIPENV_SKIP_LOCK: 1
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-22.04, macos-13, windows-2022]
-        python-version: ['3.8', '3.9', '3.10', '3.11']
+        python-version: ['3.9', '3.10', '3.11']
     steps:
       - uses: actions/checkout@v4
         with:
@@ -92,22 +88,11 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Use Pipfile.lock on locked version of Python
-        # Keep version in sync with scripts/update-pipfile-lock/Dockerfile
-        if: matrix.python-version == '3.10'
-        run: |
-          echo "PIPENV_SKIP_LOCK=0" >> $GITHUB_ENV
-
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install --upgrade pipenv==2023.12.1
-          pipenv install --system --dev
-      - name: Install Windows dev dependencies
-        if: matrix.os == 'windows-2022'
-        run: |
-          # Those are win32-only dependencies from pytest
-          python -m pip install atomicwrites colorama
+          python -m pip install --upgrade pdm
+          pdm sync --global --project . --dev
 
       - name: Override base Docker image used for functional tests on Windows
         if: matrix.os == 'windows-2022'

.github/workflows/perfbench.yml

@@ -36,8 +36,8 @@ jobs:
         run: |
           python --version
           python -m pip install --upgrade pip
-          python -m pip install pipenv==2023.12.1
-          pipenv install --system --skip-lock
+          python -m pip install --upgrade pdm
+          pdm sync --global --project . --prod
 
       - name: Setup benchmark
         run: |

.gitignore

@@ -130,3 +130,6 @@ test-secret-files.json
 # cache
 .cache_ggshield
 *.msi
+
+# pdm
+.pdm-python

.pre-commit-config.yaml

@@ -56,7 +56,7 @@ repos:
     hooks:
       - id: pyright
         name: pyright
-        entry: 'pipenv run pyright'
+        entry: 'pdm run pyright'
         language: system
         types: [python]
         # do not pass filenames, otherwise Pyright might scan files we don't want it to scan
@@ -66,15 +66,15 @@ repos:
     hooks:
       - id: ggshield-local
         name: GitGuardian Shield
-        entry: pipenv run ggshield secret scan pre-commit
+        entry: pdm run ggshield secret scan pre-commit
         language: system
         stages: [commit]
 
   - repo: local
     hooks:
       - id: ggshield-local
         name: GitGuardian Shield
-        entry: pipenv run ggshield secret scan pre-push
+        entry: pdm run ggshield secret scan pre-push
         language: system
         pass_filenames: false
         stages: [push]
@@ -90,15 +90,15 @@ repos:
     hooks:
       - id: import-linter-config
         name: Import Linter Config Check
-        entry: pipenv run ./scripts/check-import-linter-config.sh
+        entry: pdm run ./scripts/check-import-linter-config.sh
         language: system
         pass_filenames: false
         types: [python]
         stages: [commit]
 
       - id: import-linter
         name: Import Linter
-        entry: pipenv run lint-imports
+        entry: pdm run lint-imports
         language: system
         pass_filenames: false
         types: [python]

Dockerfile

@@ -1,11 +1,9 @@
-# Keep image in sync with scripts/update-pipfile-lock/Dockerfile
 FROM python:3.10-slim as build
 
 LABEL maintainer="GitGuardian SRE Team <support@gitguardian.com>"
 
 ENV LC_ALL C.UTF-8
 ENV LANG C.UTF-8
-ENV PIPENV_VENV_IN_PROJECT true
 ENV PYTHONDONTWRITEBYTECODE 1
 ENV PYTHONFAULTHANDLER 1
 ENV PATH /app/.venv/bin:$PATH
@@ -19,11 +17,11 @@ RUN \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
-RUN pip3 install pipenv==2023.12.1
+RUN pip3 install --upgrade pdm
 
 COPY . .
 
-RUN pipenv install --ignore-pipfile --deploy
+RUN pdm sync --prod --no-editable
 
 WORKDIR /data
 VOLUME [ "/data" ]

Makefile

@@ -1,5 +1,5 @@
 SHELL :=/bin/bash
-.PHONY: all test unittest functest coverage black flake8 isort lint update-pipfile-lock
+.PHONY: all test unittest functest coverage black flake8 isort lint lock
 .SILENT:
 
 all:
@@ -16,32 +16,32 @@ all:
 	echo "  isort                Run isort linter"
 	echo ""
 	echo "Other targets:"
-	echo "  update-pipfile-lock  Update the Pipfile.lock"
+	echo "  lock                 Update pdm.lock"
 
 test: unittest functest
 
 unittest:
-	pipenv run pytest --disable-pytest-warnings -vvv tests/unit
+	pdm run pytest --disable-pytest-warnings -vvv tests/unit
 
 functest:
 	scripts/run-functional-tests
 
 coverage:
-	pipenv run coverage run --source ggshield -m pytest --disable-pytest-warnings tests/unit
-	pipenv run coverage report --fail-under=80
-	pipenv run coverage xml
-	pipenv run coverage html
+	pdm run coverage run --source ggshield -m pytest --disable-pytest-warnings tests/unit
+	pdm run coverage report --fail-under=80
+	pdm run coverage xml
+	pdm run coverage html
 
 black:
-	pipenv run black .
+	pdm run black .
 
 flake8:
-	pipenv run flake8
+	pdm run flake8
 
 isort:
-	pipenv run isort **/*.py
+	pdm run isort **/*.py
 
 lint: isort black flake8
 
-update-pipfile-lock:
-	scripts/update-pipfile-lock/update-pipfile-lock
+lock:
+	pdm lock --dev