Track dependencies in `pyproject.toml` instead of `Pipfile.lock`

[timobrembeck]

I don't want to force my opinion onto this project (which I'm not part of), but based on my experience with other Django projects in the Digitalfabrik ecosystem (lunes-cms and integreat-cms), I would not recommend to use pipenv for new setups. Migrating the dependency manager in mid-project is a bit cumbersome, so I suggest to debate this in an early stage (though I'm aware that this is not the most urgent topic right now).

My main arguments are:

1. Installing/updating dependencies via pipenv takes longer than with plain pip (couple of mins compared to couple of seconds - in the long term, this really cumulates to a lot of wasted dev time... I think this is not worth the benefits pipenv is offering)
2. Debugging problems with pipenv itself did cost us quite some time when we cumulate this over the past years

Proposed solution

• Follow this guide to specify dependencies in pyproject.toml: https://setuptools.pypa.io/en/stable/userguide/pyproject_config.html

• Use pip install -e . instead of pipenv install to install the dependencies

[julled]

@timoludwig thx for looking into the code, every hint is valuable!

We have (so far) good experience in using pyproject.toml with poetry: https://python-poetry.org/docs/pyproject/ in the searchwing context.

Or do you think this is overkill?

[timobrembeck]

I don't have any experience with poetry, but at the first glance it seems more usable than pipenv. However, it adds one wrapper which isn't really required anymore in my opinion - managing virtual environments with the inbuilt venv + pip has become simple enough we don't really need the extra tool. The only part which is still annoying with pip is the updating process, but for lunes-cms we just use the dependabot for this task. But obviously this is mostly personal preference, so I guess this decision should be made by those who are actively contributing to this project :wink: