molecule requirementes should not pinned

[ssbarnea]

Desired Behavior

Molecule is a development/testing tool and it should not have pinned runtime or testing requirements.

Instead we need to use ranges that prevent usage of dependencies what we know are bugged or broken.

This also should avoid possible conflicts between a molecule dependency would come into conflict with the version mentioned by ansible or another dependency.

Sooner or later we will clearly have a different version of foo package when using one version of anasible and another one when using a newer version.

When implementing this we should also use pip check to validate that after installation there are no reported conflicts reported by pip.

[ssbarnea]

@webknjaz @decentral1se @gundalow Please use up/down to confirm the desrcribed behavior.

[webknjaz]

@ssbarnea in general, you're right. I'd even suggest using pyup bot or dependabot to automate keeping things up-to-date.

I'm not sure whether @gundalow or someone recorded this somewhere, but current dependency spec is messed up: it has both runtime and dev deps pinned and mixed in the single unmanageable file. It's one of the caveats of pbr which I hope to solve by removing it.

Projects usually have different types of dependencies:

1. runtime deps, they should be open and have a lower limit + maybe a higher limit to next major if a certain dependency follows semver.
2. env deps, they describe and pin all packages including direct dev/test deps and their transitive dependencies. They can also specify hashes for deps, which makes the thing even more resilient.

These two categories should be dealt with separately. It's fine to pin dev deps versions as long as we have an automated process of bumping them. It's better than keeping them without any limits since automatic bumping triggers PR+CI meaning that we'd have recorded logs of what happens with the project with new deps instead of cryptic bug reports post-factum.
We just need to be more careful with runtime deps and try to not shoot in own legs...

[webknjaz]

Ref: #1710 (comment)

[micheelengronne]

Merge request: #2024

[decentral1se]

I think we largely dealt with the worst of this.