Update not working for dependecy installed from GIT hidden ref if ref comes from a fork

[lmignon]

Github allows you to reference a pull request as a hidden ref you can fetch. This feature is useful to keep a log of you open PR required by your project.

In order to declare a dependency to a new patched version of one of my project's dependencies, I've added into my requirements.txt.in the following line:

odoo10-addon-account-banking-mandate @ git+https://github.com/oca/bank-payment.git@refs/pull/727/head#subdirectory=setup/account_banking_mandate

and used the update command to install and freeze this new version of my dependency
pip-df sync --update odoo10-addon-account-banking-mandate

(PR from acsone/bank-payment to oca/bank-payment)

At the end of the process, the dependency is correctly installed however the updated entry into my requirements.txt file is not right. Indeed, even if the sha is the right one, the ORG into the github url is the one on which the pr has been made not the one from which the changes are submitted....

odoo10-addon-account-banking-mandate @ git+https://github.com/oca/bank-payment.git@84d5fd2cc8c9bbca6b036ad5f8d87776d1b3fdad#subdirectory=setup/account_banking_mandate

Is-it a know limitation or a bug?

[sbidoul]

Indeed

$ pip install "odoo10-addon-account-banking-mandate @ git+https://github.com/oca/bank-payment.git@84d5fd2cc8c9bbca6b036ad5f8d87776d1b3fdad#subdirectory=setup/account_banking_mandate"
Collecting odoo10-addon-account-banking-mandate@ git+https://github.com/oca/bank-payment.git@84d5fd2cc8c9bbca6b036ad5f8d87776d1b3fdad#subdirectory=setup/account_banking_mandate
  Cloning https://github.com/oca/bank-payment.git (to revision 84d5fd2cc8c9bbca6b036ad5f8d87776d1b3fdad) to /tmp/pip-install-vN6Ygs/odoo10-addon-account-banking-mandate
  Running command git clone -q https://github.com/oca/bank-payment.git /tmp/pip-install-vN6Ygs/odoo10-addon-account-banking-mandate
  Running command git checkout -q 84d5fd2cc8c9bbca6b036ad5f8d87776d1b3fdad
  fatal: reference is not a tree: 84d5fd2cc8c9bbca6b036ad5f8d87776d1b3fdad
ERROR: Command errored out with exit status 128: git checkout -q 84d5fd2cc8c9bbca6b036ad5f8d87776d1b3fdad Check the logs for full command output.

The issue is that the commit is not directly reachable after a git clone.

One possibility could be to do something around here (in pip), such as a git ls-remote to see if the commit exists when the first checkout attempt has failed.

[lmignon]

I share this thought. The correct use is therefore to avoid using hidden ref. We must always use a reference that remain reachable..

[sbidoul]

@lmignon it is true that one must make sure that the commits referenced in requirements.txt remain reachable.

However in the case you mention, the commit is reachable via a git fetch.

So I think this is worth fixing in pip. I created an issue (pypa/pip#8815) and I'll come up with a PR.

[sbidoul]

@lmignon This should work fine with pypa/pip#8817.

Now the last missing piece of the puzzle is the tool that places tags on all commits referenced in requirements.txt, and to do that automatically pushes them to an org where the user has right to create tags. I'm not sure this should be part of pip-deepfreeze. It would probably be best as a standalone tool.

[lmignon]

@lmignon This should work fine with pypa/pip#8817.

great! 🍾

Now the last missing piece of the puzzle is the tool that places tags on all commits referenced in requirements.txt, and to do that automatically pushes them to an org where the user has right to create tags. I'm not sure this should be part of pip-deepfreeze. It would probably be best as a standalone tool.

+1 to place this part into a standalone tool

[sbidoul]

This will be part of the upcoming pip release, so closing this issue.

[lmignon]

OK thank you for the follow up.