[stable-2.17] support pip-compile check mode and remove pip-compile workflows from stable branch (#1947)

* nox pip-compile: support check mode

Support a custom --check flag to fail if pip-compile made any changes so
we can check that that lockfiles are in sync with the input (.in) files.

(cherry picked from commit cb295b1)

* ci: remove pip-compile workflows from stable branch

We don't need these on stable branches, as they can be triggered from
the devel branch with a custom base-branch input.
They were also missing backports of various fixes from the devel branch.
Rather than trying to backport all the changes, let's just remove it
from stable branches and make sure we do so after each branching.

(cherry picked from commit 0d8d26e)

Author: gotmax23

.github/workflows/pip-compile-dev.yml

@@ -11,6 +11,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # Inputs:
+          #   session: name of session
+          #   python-versions: comma-separated list of Python versions to install
+          #   extra-args (optional): extra arguments to pass to nox session.
           - session: static
             python-versions: "3.11"
           - session: formatters_check
@@ -25,6 +29,9 @@ jobs:
             python-versions: "3.11"
           - session: "actionlint"
             python-versions: "3.11"
+          - session: "pip-compile"
+            extra-args: "--check"
+            python-versions: "3.10"
     name: "Run nox ${{ matrix.session }} session"
     steps:
       - name: Check out repo
@@ -38,4 +45,6 @@ jobs:
           nox -e clone-core
       - name: "Run nox -e ${{ matrix.session }}"
         run: |
-          nox -e "${{ matrix.session }}"
+          # Using GHA expression interpolation is fine here,
+          # as we control all the inputs.
+          nox -e "${{ matrix.session }}" -- ${{ matrix.extra-args }}

.github/workflows/pip-compile-docs.yml

@@ -161,7 +161,14 @@ def pip_compile(session: nox.Session, req: str):
 
     # Use --upgrade by default unless a user passes -P.
     args = list(session.posargs)
-    if not any(
+
+    # Support a custom --check flag to fail if pip-compile made any changes
+    # so we can check that that lockfiles are in sync with the input (.in) files.
+    check_mode = "--check" in args
+    if check_mode:
+        # Remove from args, as pip-compile doesn't actually support --check.
+        args.remove("--check")
+    elif not any(
         arg.startswith(("-P", "--upgrade-package", "--no-upgrade")) for arg in args
     ):
         args.append("--upgrade")
@@ -175,6 +182,9 @@ def pip_compile(session: nox.Session, req: str):
     )
     # fmt: on
 
+    if check_mode and session.run("git", "diff", "tests", silent=True, external=True):
+        session.error("Check mode: files were changed")
+
 
 @nox.session(name="clone-core")
 def clone_core(session: nox.Session):