Unpin tox<4

[bjlittle]

📰 Custom Issue

Unfortunately we've had to pin tox<4 in the GHAs due to our use of the tox-conda plugin not being fully compatible with tox 4.x.

However, there is movement on this, see tox-dev/tox-conda#156

Require to unpin tox in the .github/workflows:

• ci-locks.yml
• ci-tests.yml
• ci-wheels.yml

[bjlittle]

See #154

[github-actions]

In order to maintain a backlog of relevant issues, we automatically label them as stale after 180 days of inactivity.

If this issue is still important to you, then please comment on this issue and the stale label will be removed.

Otherwise this issue will be automatically closed in 28 days time.

[trexfeathers]

How concerned are we about tox-conda's lack of resource? The PR for v4 compatibility - tox-dev/tox-conda#163 - has not moved for several months, and includes discussion about lack of maintainers.

Obviously right now we can keep using Tox v3, but it is a matter of time before an incompatibility or security vulnerability surfaces with either Tox v3 or with tox-conda, one which is unlikely to be fixed. 💣

If use of Tox is motivated by the large community - thus precluding Nox or other niche products - then we could explore something with Makefiles, although that would not offer the same environment conveniences.

See this thread for more: SciTools/iris#5184 (comment)

[bjlittle]

Agreed, it's a concern, has been for a while.

Difficult to judge the next best move, but a lot of folks are in the same position.

I was experimenting with dropping setuptools and moving to hatch, which would coincidentally open-up the opportunity to leverage the use of https://github.com/OldGrumpyViking/hatch-conda ... but that could simply lead to similar issues depending on the level of support and maintenance available on hatch-conda.

We could drop the use of conda and roll with pip freeze or something similar that plays ball natively with tox.

I guess there are alternative options out there, and I guess it all depends on how wedded we are to the current tooling.

Bit of a stalemate, it seems, at the moment 😐

[bjlittle]

@trexfeathers However, there is tox-dev/tox-conda#163, which is an open PoC PR ...

Still needs some effort, but looks promising 🤞

[trexfeathers]

@trexfeathers However, there is tox-dev/tox-conda#163, which is an open PoC PR ...

Still needs some effort, but looks promising 🤞

I know, I referenced it in my comment! Ironically I referenced it as a bad thing 😂 :

The PR for v4 compatibility - tox-dev/tox-conda#163 - has not moved for several months, and includes discussion about lack of maintainers.

[github-actions]

In order to maintain a backlog of relevant issues, we automatically label them as stale after 180 days of inactivity.

If this issue is still important to you, then please comment on this issue and the stale label will be removed.

Otherwise this issue will be automatically closed in 28 days time.