Pin dependencies

.dockerignore

@@ -1,7 +1,8 @@
 *
+!.git
 !src/isar_robot
-!setup.py
-!setup.cfg
 !pyproject.toml
-!README.md
+!requirements.txt
 !LICENSE
+!README.md
+!SECURITY.md

.github/workflows/pythonpackage.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install -e .[dev]
+          pip install -r requirements.txt -e .[dev]
 
       - name: Lint
         run: |

.github/workflows/snyk_check.yml

@@ -0,0 +1,16 @@
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - name: Run Snyk to check for vulnerabilities
+        uses: snyk/actions/python-3.10@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          command: monitor

.gitignore

@@ -26,6 +26,7 @@ share/python-wheels/
 .installed.cfg
 *.egg
 MANIFEST
+src/isar_robot/version.py
 
 # PyInstaller
 #  Usually these files are written by a python script from a template

Dockerfile

@@ -4,7 +4,8 @@ RUN python -m venv --copies /opt/venv
 ENV PATH="/opt/venv/bin:$PATH"
 
 COPY . .
-RUN pip install .
+RUN apt-get update && apt-get install -y git
+RUN pip install -r requirements.txt .
 
 FROM ghcr.io/equinor/isar:v1.16.10
 COPY --from=builder /opt/venv /opt/venv

README.md

@@ -14,14 +14,28 @@ After installing isar-robot, it can be used through [ISAR](https://github.com/eq
 
 # Development
 
-For local development, please fork the repository. Then, clone and install in the repository root folder:
+For local development, create a fork of the repository and clone the fork to your machine:
 
 ```bash
-git clone https://github.com/equinor/isar-robot
+git clone https://github.com/<your-username>/isar-robot
 cd isar-robot
-pip install -e .[dev]
 ```
 
+It is recommended to create a virtual environment, see a guide for this here: https://docs.python.org/3/library/venv.html.
+
+Then install the requirements and the package:
+
+```bash
+pip install -r requirements.txt -e .[dev]
+```
+
+# Dependencies
+
+The dependencies used for this package are listed in `pyproject.toml` and pinned in `requirements.txt`,
+using `pip-compile` (from [`pip-tools`](https://github.com/jazzband/pip-tools)).
+This ensures our builds are predictable and deterministic.
+To update the requirements to the newest versions, delete the `requirements.txt` file and run `pip-compile` again.
+
 # Contributing
 
 We welcome all kinds of contributions, including code, bug reports, issues, feature requests, and documentation. The preferred way of submitting a contribution is to either make an [issue on github](https://github.com/equinor/isar-robot/issues) or by forking the project on github and making a pull request.

pyproject.toml

@@ -1,3 +1,46 @@
 [build-system]
-requires = ["setuptools>=61.0"]
+requires = ["setuptools>=64.0", "setuptools_scm>=8"]
 build-backend = "setuptools.build_meta"
+
+[project]
+name = "isar_robot"
+authors = [{ name = "Equinor ASA", email = "[email protected]" }]
+description = "Integration and Supervisory control of Autonomous Robots - Open source robot implementation"
+readme = "README.md"
+requires-python = ">=3.10"
+license = { file = "LICENSE" }
+classifiers = [
+    "Intended Audience :: Developers",
+    "Intended Audience :: Science/Research",
+    "License :: OSI Approved :: Eclipse Public License 2.0 (EPL-2.0)",
+    "Natural Language :: English",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Scientific/Engineering",
+    "Topic :: Scientific/Engineering :: Physics",
+    "Topic :: Software Development :: Libraries",
+]
+dependencies = ["alitra", "isar"]
+dynamic = ["version"]
+
+[project.urls]
+repository = "https://github.com/equinor/isar-robot.git"
+
+[project.optional-dependencies]
+dev = ["black", "mypy", "pip-tools", "pre-commit", "pytest"]
+
+[tool.setuptools_scm]
+version_file = "src/isar_robot/version.py"
+
+[tool.mypy]
+no_strict_optional = true
+no_site_packages = true
+ignore_missing_imports = true
+exclude = ["build"]
+files = ["src", "tests"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+log_cli = true

requirements.txt

@@ -0,0 +1,212 @@
+#
+# This file is autogenerated by pip-compile with Python 3.10
+# by the following command:
+#
+#    pip-compile --output-file=requirements.txt pyproject.toml
+#
+alitra==1.1.0
+    # via
+    #   isar
+    #   isar-robot (pyproject.toml)
+annotated-types==0.6.0
+    # via pydantic
+anyio==3.7.1
+    # via
+    #   azure-core
+    #   fastapi
+    #   httpx
+    #   starlette
+azure-common==1.1.28
+    # via azure-keyvault-secrets
+azure-core==1.29.6
+    # via
+    #   azure-identity
+    #   azure-keyvault-secrets
+    #   azure-storage-blob
+    #   opencensus-ext-azure
+azure-identity==1.15.0
+    # via
+    #   isar
+    #   opencensus-ext-azure
+azure-keyvault-secrets==4.7.0
+    # via isar
+azure-storage-blob==12.19.0
+    # via isar
+backoff==2.2.1
+    # via isar
+cachetools==5.3.2
+    # via google-auth
+certifi==2023.11.17
+    # via
+    #   httpcore
+    #   httpx
+    #   requests
+cffi==1.16.0
+    # via cryptography
+charset-normalizer==3.3.2
+    # via requests
+click==8.1.7
+    # via
+    #   isar
+    #   uvicorn
+cryptography==41.0.7
+    # via
+    #   azure-identity
+    #   azure-storage-blob
+    #   fastapi-azure-auth
+    #   msal
+    #   pyjwt
+    #   python-jose
+dacite==1.8.1
+    # via
+    #   alitra
+    #   isar
+ecdsa==0.18.0
+    # via python-jose
+exceptiongroup==1.2.0
+    # via anyio
+fastapi==0.105.0
+    # via
+    #   fastapi-azure-auth
+    #   isar
+fastapi-azure-auth==4.3.0
+    # via isar
+google-api-core==2.15.0
+    # via opencensus
+google-auth==2.25.2
+    # via google-api-core
+googleapis-common-protos==1.62.0
+    # via google-api-core
+h11==0.14.0
+    # via
+    #   httpcore
+    #   uvicorn
+httpcore==1.0.2
+    # via httpx
+httpx==0.26.0
+    # via fastapi-azure-auth
+idna==3.6
+    # via
+    #   anyio
+    #   httpx
+    #   requests
+injector==0.21.0
+    # via isar
+isar==1.16.10
+    # via isar-robot (pyproject.toml)
+isodate==0.6.1
+    # via
+    #   azure-keyvault-secrets
+    #   azure-storage-blob
+msal==1.26.0
+    # via
+    #   azure-identity
+    #   msal-extensions
+msal-extensions==1.1.0
+    # via azure-identity
+numpy==1.26.2
+    # via
+    #   alitra
+    #   isar
+    #   scipy
+opencensus==0.11.3
+    # via
+    #   opencensus-ext-azure
+    #   opencensus-ext-logging
+    #   opencensus-ext-requests
+opencensus-context==0.1.3
+    # via opencensus
+opencensus-ext-azure==1.1.12
+    # via isar
+opencensus-ext-logging==0.1.1
+    # via isar
+opencensus-ext-requests==0.8.0
+    # via isar
+packaging==23.2
+    # via msal-extensions
+paho-mqtt==1.6.1
+    # via isar
+portalocker==2.8.2
+    # via msal-extensions
+protobuf==4.25.1
+    # via
+    #   google-api-core
+    #   googleapis-common-protos
+psutil==5.9.7
+    # via opencensus-ext-azure
+pyasn1==0.5.1
+    # via
+    #   pyasn1-modules
+    #   python-jose
+    #   rsa
+pyasn1-modules==0.3.0
+    # via google-auth
+pycparser==2.21
+    # via cffi
+pydantic==2.5.2
+    # via
+    #   fastapi
+    #   isar
+    #   pydantic-settings
+pydantic-core==2.14.5
+    # via pydantic
+pydantic-settings==2.1.0
+    # via isar
+pyjwt[crypto]==2.8.0
+    # via
+    #   isar
+    #   msal
+python-dotenv==1.0.0
+    # via
+    #   isar
+    #   pydantic-settings
+python-jose[cryptography]==3.3.0
+    # via fastapi-azure-auth
+pyyaml==6.0.1
+    # via isar
+requests==2.31.0
+    # via
+    #   azure-core
+    #   google-api-core
+    #   isar
+    #   msal
+    #   opencensus-ext-azure
+    #   opencensus-ext-requests
+    #   requests-toolbelt
+requests-toolbelt==1.0.0
+    # via isar
+rsa==4.9
+    # via
+    #   google-auth
+    #   python-jose
+scipy==1.11.4
+    # via alitra
+six==1.16.0
+    # via
+    #   azure-core
+    #   ecdsa
+    #   isodate
+    #   transitions
+sniffio==1.3.0
+    # via
+    #   anyio
+    #   httpx
+starlette==0.27.0
+    # via fastapi
+transitions==0.9.0
+    # via isar
+typing-extensions==4.9.0
+    # via
+    #   azure-core
+    #   azure-keyvault-secrets
+    #   azure-storage-blob
+    #   fastapi
+    #   pydantic
+    #   pydantic-core
+    #   uvicorn
+urllib3==2.1.0
+    # via requests
+uvicorn==0.24.0.post1
+    # via isar
+wrapt==1.16.0
+    # via opencensus-ext-requests