python - 如何在 pipenv 环境中处理 `pip install` (未反射(reflect)在 Pipfile 中，仅反射(reflect)在 `pipenv graph` 中)？

Question

如果有人不小心使用 pip install而不是 pipenv install在 pipenv 环境中，该包不会反射(reflect)在 Pipfile 上的包列表中，也不会反射(reflect)在 Pipfile.lock 中。
问题是您可能会使用这个 Pipfile.lock 进行部署，认为您拥有所需的一切，而实际上您缺少一个包。
我正在浏览文档 https://pipenv.pypa.io/找出运行时实际发生的情况 pip install而不是 pipenv install (即使是错误的)，我找不到对此的解释。
如果您运行 pipenv graph它实际上向您展示了通过 pip 安装的软件包!所以我知道 pipenv 以某种方式知道这些包。但是我需要做什么才能使这些反射(reflect)在 Pipfile 中？

Answer 1

首先，让我们澄清一下 pipenv install命令只是 pip 的包装器.如果您使用 --verbose 安装，你会看到它也只是使用 pip install并将包放在同一个激活的虚拟环境中。所以答案是

I was looking through the documentation https://pipenv.pypa.io/ to find out what actually happens when you run pip install instead of pipenv install (even by mistake)

就是 pipenv - 不会进行特定的操作。这包括更新 Pipfile 和 Pipfile.lock(这是首先使用 pipenv 的主要原因之一)以进行确定性构建。您可以手动更新自己的 Pipfile，但对于 Pipfile.lock...你不能。

If you run pipenv graph it actually shows you the packages installed via pip!

是的，因为正如我所说，他们都只使用 pip .这两种方法都将在相同的虚拟环境中安装软件包， pipenv graph只是检查相同的环境。软件包将存储在 lib/pythonX.Y/site-packages 下的文件夹中。 ，是否与 pipenv或普通 pip .
现在开始你的实际问题:

But what do I need to do to make those reflect in the Pipfile?

D Malan's comment of using pipenv clean 是一个很好的方法。从文档:

$ pipenv clean --help
Usage: pipenv clean [OPTIONS]

  Uninstalls all packages not specified in Pipfile.lock.

Options:
  --bare           Minimal output.
  --dry-run        Just output unneeded packages.
  ...

如上所述，您只需要运行该命令来检查不一致。添加 --dry-run命令，以便它只报告，而不是实际卸载它们。
然后你可以为此编写一个脚本，就像这个 Bash 脚本:

#!/usr/local/bin/bash

echo "Checking if there are packages in venv not in Pipfile.lock"

# Get packages pipenv did not find in Pipfile.lock
# NOTE:
#   Here, mapfile requires Bash 4.x syntax
#   For alternatives: https://stackoverflow.com/a/32931403/2745495
mapfile -t packages < <(pipenv clean --dry-run)

if [ ${#packages[@]} -eq 0 ]; then
    echo "All good!"
else
    echo "Found ${#packages[@]} not in Pipfile.lock!"
    for pkg in "${packages[@]}"; do
        echo "  ${pkg}"
    done
    echo ""
    echo "Check if they need to be 'pipenv install'-ed or deleted with 'pipenv clean'"

    # Make sure script exits with a non-zero code here
    exit 1
fi

在带有 pip install 的测试环境中运行它-ed 包(例如 mypy)和一个 pipenv install -ed 包(例如 flake8):

(my-test-repo) $ pipenv graph
flake8==3.8.4
  - mccabe [required: >=0.6.0,<0.7.0, installed: 0.6.1]
  - pycodestyle [required: >=2.6.0a1,<2.7.0, installed: 2.6.0]
  - pyflakes [required: >=2.2.0,<2.3.0, installed: 2.2.0]
mypy==0.790
  - mypy-extensions [required: >=0.4.3,<0.5.0, installed: 0.4.3]
  - typed-ast [required: >=1.4.0,<1.5.0, installed: 1.4.1]
  - typing-extensions [required: >=3.7.4, installed: 3.7.4.3]

(my-test-repo) $ cat Pipfile.lock | grep mypy

(my-test-repo) $ ./check.sh 
Checking if there are packages in venv not in Pipfile.lock
Found 4 not in Pipfile.lock!
  typing-extensions
  typed-ast
  mypy
  mypy-extensions

Check if they need to be 'pipenv install'-ed or deleted with 'pipenv clean'

(my-test-repo) $ pipenv install mypy
...
✔ Success! 
Updated Pipfile.lock (e60379)!
Installing dependencies from Pipfile.lock (e60379)...
  🐍   ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ 0/0 — 00:

(my-test-repo) $ ./check.sh 
Checking if there are packages in venv not in Pipfile.lock
All good!

为了解决问题

you might go to deployment with this Pipfile.lock thinking you have everything you need when actually you have a missing package.

如果您使用 Git，请将脚本作为您的 git pre-commit hook 的一部分。 .

The pre-commit hook is run first, before you even type in a commit message. It’s used to inspect the snapshot that’s about to be committed, to see if you’ve forgotten something, to make sure tests run, or to examine whatever you need to inspect in the code. Exiting non-zero from this hook aborts the commit, although you can bypass it with git commit --no-verify.

(my-test-repo) $ cp check.sh .git/hooks/pre-commit
(my-test-repo) $ chmod +x .git/hooks/pre-commit

(my-test-repo) $ git add .
(my-test-repo) $ git commit
Checking if there are packages in venv not in Pipfile.lock
Found 4 not in Pipfile.lock!
  typing-extensions
  mypy
  mypy-extensions
  typed-ast

Check if they need to be 'pipenv install'-ed or deleted with 'pipenv clean'
(my-test-repo) $

当发现不一致时提交将中止，从而防止您提交可能不完整的 Pipfile.lock。