Commit Pipfile.lock to the repo?

[inducer]

At least as far as I am aware, it's a best practice to commit the lock file generated by pipenv to the repository, to ensure that users get the same deterministic combination of packages that was tested during development.

[cdubz]

There is some history here dealing with package locks not being compatible between architectures. I would reference the issue but on mobile right now.

Anyway it’s worth investigating if the situation is any different now. A few years back there was just no way to have a Pipfile cover multiple architectures. Maybe that has changed? Or maybe other tools have cropped up that can do this?

[inducer]

I'm not sure about pipenv, but I know poetry is capable. It keeps a list of all wheels of a version (i.e. for all available architectures) in its lockfile and, seemingly, is able to choose between them at install time.

[cdubz]

Definitely worth a look. Poetry wasn’t a thing back when I started this project. Switching out will be a bit of a chore but shouldn’t be crazy.

[cdubz]

Relatedly just had to commit 6ae01d6 after discovering an issue with a new major release of a dependency 🙃