如何在pipenv环境中处理'pip install'（不反映在pip文件中，仅反映在'pipenv图形'）中？

Question

如果有人在pipenv环境中意外地使用了pip install而不是pipenv install，则该包不会反映在Pipfile上的包列表中，也不会反映在Pipfile.lock中

问题是，您可能会使用这个Pipfile.lock进行部署，认为您已经拥有了所需的一切，而实际上您却缺少一个包

我查看了文档https://pipenv.pypa.io/以了解在运行pip install而不是pipenv install（甚至是错误地）时实际发生了什么，我找不到对此的解释

如果您运行pipenv graph，它实际上会显示通过pip安装的软件包！所以我知道pipenv不知怎么知道这些软件包。但是我需要做什么才能使这些反映在PIP文件中呢

Answer 1

首先，让我们澄清一下pipenv install命令只是pip的包装器。如果您使用 verbose安装，您将看到它也只是使用pip install并将软件包放在同一个激活的虚拟环境中。那么答案是什么呢

I was looking through the documentation https://pipenv.pypa.io/ to find out what actually happens when you run pip install instead of pipenv install (even by mistake)

只是pipenv特定的操作将不完成。这包括更新Pipfile和Pipfile.lock（这是首先使用pipenv的主要原因之一）以具有确定性构建。Pipfile您可以手动更新自己，但是对于Pipfile.lock…您不能

If you run pipenv graph it actually shows you the packages installed via pip!

是的，因为正如我所说，他们都只是使用pip。这两种方法都将在相同的虚拟环境中安装软件包，pipenv graph只是检查是否相同env。包将存储在lib/pythonX.Y/site-packages下的文件夹中，无论是使用pipenv还是普通pip

现在谈谈你的实际问题：

But what do I need to do to make those reflect in the Pipfile?

D Malan's comment of using ^{}是一个很好的方法。从文档中：

$ pipenv clean  help
Usage: pipenv clean [OPTIONS]

  Uninstalls all packages not specified in Pipfile.lock.

Options:
   bare           Minimal output.
   dry-run        Just output unneeded packages.
  ...

如上所述，您只需要运行该命令来检查不一致性。添加 dry-run命令，使其仅报告，而不是实际卸载它们

然后，您可以为此创建一个脚本，如下面的Bash脚本：

#!/usr/local/bin/bash

echo "Checking if there are packages in venv not in Pipfile.lock"

# Get packages pipenv did not find in Pipfile.lock
# NOTE:
#   Here, mapfile requires Bash 4.x syntax
#   For alternatives: https://stackoverflow.com/a/32931403/2745495
mapfile -t packages < <(pipenv clean  dry-run)

if [ ${#packages[@]} -eq 0 ]; then
    echo "All good!"
else
    echo "Found ${#packages[@]} not in Pipfile.lock!"
    for pkg in "${packages[@]}"; do
        echo "  ${pkg}"
    done
    echo ""
    echo "Check if they need to be 'pipenv install'-ed or deleted with 'pipenv clean'"

    # Make sure script exits with a non-zero code here
    exit 1
fi

在带有pip install-ed包（例如mypy）和pipenv install-ed包（例如flake8）的测试环境上运行它：

(my-test-repo) $ pipenv graph
flake8==3.8.4
  - mccabe [required: >=0.6.0,<0.7.0, installed: 0.6.1]
  - pycodestyle [required: >=2.6.0a1,<2.7.0, installed: 2.6.0]
  - pyflakes [required: >=2.2.0,<2.3.0, installed: 2.2.0]
mypy==0.790
  - mypy-extensions [required: >=0.4.3,<0.5.0, installed: 0.4.3]
  - typed-ast [required: >=1.4.0,<1.5.0, installed: 1.4.1]
  - typing-extensions [required: >=3.7.4, installed: 3.7.4.3]

(my-test-repo) $ cat Pipfile.lock | grep mypy

(my-test-repo) $ ./check.sh 
Checking if there are packages in venv not in Pipfile.lock
Found 4 not in Pipfile.lock!
  typing-extensions
  typed-ast
  mypy
  mypy-extensions

Check if they need to be 'pipenv install'-ed or deleted with 'pipenv clean'

(my-test-repo) $ pipenv install mypy
...
✔ Success! 
Updated Pipfile.lock (e60379)!
Installing dependencies from Pipfile.lock (e60379)...
  🐍   ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ 0/0 — 00:

(my-test-repo) $ ./check.sh 
Checking if there are packages in venv not in Pipfile.lock
All good!

解决

you might go to deployment with this Pipfile.lock thinking you have everything you need when actually you have a missing package.

如果您使用的是Git，那么将脚本作为git pre-commit hook的一部分

The pre-commit hook is run first, before you even type in a commit message. It’s used to inspect the snapshot that’s about to be committed, to see if you’ve forgotten something, to make sure tests run, or to examine whatever you need to inspect in the code. Exiting non-zero from this hook aborts the commit, although you can bypass it with git commit no-verify.

(my-test-repo) $ cp check.sh .git/hooks/pre-commit
(my-test-repo) $ chmod +x .git/hooks/pre-commit

(my-test-repo) $ git add .
(my-test-repo) $ git commit
Checking if there are packages in venv not in Pipfile.lock
Found 4 not in Pipfile.lock!
  typing-extensions
  mypy
  mypy-extensions
  typed-ast

Check if they need to be 'pipenv install'-ed or deleted with 'pipenv clean'
(my-test-repo) $

当发现不一致时，提交将中止，从而阻止您提交可能不完整的Pipfile.lock