Dependabot-core: Python: parse conda.env in addition to requirements.txt

[RXminuS]

Right now Depandabot can only deal with requirement.txt files from PyPy but a lot of our repositories use Anaconda yaml files because of the performance increase with the Tensorflow installation. Thus, adding Conda yaml support would be essential for us!

[greysteil]

Interesting - are there any open source repos you can point me to that use that setup (that I can use as fixtures when I write this)?

[RXminuS]

https://github.com/fastai/fastai the environment.yml (or environment.yaml) It's fairly popular in ML/AI communities to do it like this

[gr33ndata]

I second that, it would be useful to update both requirements.txt and environment.yml

[palfrey]

I'm using Conda requirement files (https://github.com/palfrey/waveform-necklace/blob/master/conda-requirements.txt) and hitting issues (see https://github.com/palfrey/waveform-necklace/issues/19)

[oji]

We use conda as well, with the environment.yml variant. Is there any plan to add support for this? Thanks!

[rebelagentm]

@palfrey @oji Thank you! We think this will be useful and agree on supporting it, but the team is stretched thin right now as we work to integrate and scale Dependabot into GitHub. :octocat:

If you're keen to help us add support, we would be happy to review any pull requests for it on dependabot-core.

[alexvicegrab]

Would be useful to have.

[epruesse]

This would be very interesting and useful to have.

Some notes:

• conda is a general purpose package manager not limited to Python
• anaconda cloud is the default service for hosting packages
• miniconda is the minimal distribution including the package manager
• channels are collections/distributions of packages. Anyone can create one, by default hosted at anaconda cloud, but not necessarily so.
• Common channels besides the basic defaults it comes with conda-forge for general purpose software and bioconda for life science specific packages.
• There is (currently) no standard for placing the environment.yaml. The file format really just describes an arbitrary selection of packages one might have in a conda "virtual environment".
• A more specific file would be recipe/meta.yaml, which contains be the package build instructions (different format), including dependencies split into build, host and run (where build vs host separates the build system from development libraries in the case of cross compilation).