streamline requirements

[beliaev-maksim]

currently project has more than 8 places where you define requirements for the python.

Can you streamline and push all of them into pyproject.toml file?

then you proceed with pin installations like pip install .[testenv]

[da1910]

I think at least some duplication is inevitable at this point:

• Dependabot is unable to parse dependencies listed within setup.cfg (see Parse dependencies from Python setup.cfg files dependabot/dependabot-core#2281 (comment))
• Setuptools is unable to parse dependencies within pyproject.toml files (see Discussion: support for pyproject.toml configuration pypa/setuptools#1688)

I have removed requirements_style.txt in PR # , but I think the others are necessary, at least at the moment:

• setup.cfg lists the packages that will be installed when installing the package, as well as the named extras
• pyproject.toml lists packages required for each tox environment, and does not affect package installation for users
• requires/*_requirements.txt list the contents of setup.cfg in a format that dependabot is able to parse, these are automatically generated by a pre-commit hook

[beliaev-maksim]

switch to flit as build engine

also, I think streamlined code will be more important than dependabot

@akaszynski
your thoughts on the issue?

UDP:
looks like dependabot has support of poetry, this could be used as well as builder

[Andy-Grigg]

Just to add some background: we added dependabot support to address some software security enhancements. The idea is to flag any dependencies we have with vulnerabilities automatically so we aren't as dependent on manual verification.

If there's a way of getting flit/poetry, tox, and dependabot to all work off the same list though, then we should definitely do it. No one wants duplication and git hooks if there's any alternative.

[da1910]

Switching to flit was mostly painless, no real changes were required.

I will prepare a PR this afternoon, I have yet to decide how to organise the PRs to address this and the other related issues.

[beliaev-maksim]

@da1910
great news!