chore: auto update reproducible requirements when there is a dependency change

[mndeveci]

Which issue(s) does this change fix?

N/A

Why is this change necessary?

Automation for updating pinned dependencies as well as adding pinned dependencies for MSI.

How does it address the issue?

• Adds a new Makefile target for updating reproducible dependencies for Windows MSI.
• Adds a new GHA, which will only run if there is a change in requirements/base.txt, and that GHA will update our pinned dependencies in reproducible-{os}.txt.

What side effects does this change have?

N/A

Mandatory Checklist

PRs will only be reviewed after checklist is complete

• Add input/output type hints to new functions/methods
• Write design document if needed (Do I need to write a design document?)
• Write/update unit tests
• Write/update integration tests
• Write/update functional tests if needed
• make pr passes
• make update-reproducible-reqs if dependencies were changed
• Write documentation

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[moelasmar]

just to make sure, we do not need this GHA to be executed in case of the dependencies got updated, or their dependencies got updated. Dependabot should handle that, right?

[mndeveci]

I wanted to keep our existing flow where we update these reproducibles when we update our requirements (for example when we bump SAMT version). If we run this for every PR there is a chance that we will have updates every day or so (for minor version updates), which might make harder for those PRs getting merged, and I will leave those updates to dependabot as it is been currently handled.

[moelasmar]

are we going to update the PR itself, or update the develop branch, then we need to merge the PR branch from the develop branch?

[mndeveci]

This will update the PR itself (see this commit for example in this PR: 32b350a)

But this GHA will only run if requirements/base.txt is updated (see line 6)

[lucashuy]

Just a general comment, butI think I had the same conversation with a team member about auto generating a JSON schema file, and whether or not this should be a message instead to manually run the generation rules, or something that Github Actions will do for us in the same PR.

The wrench that is thrown here is that Windows repro generation would in theory need to happen on a Windows machine.

[mndeveci]

The reason we put these updates into GHA is purely needing a Windows machine to update reproducibles. If these were not OS specific (like we can generate one and use it for every installer), then I would keep the existing flow where we will have a Makefile target which can be run on any OS so that contributors can run it after they update any dependency that we have.