feat: Add setting generate_hashes for requirements (#1290)

Add the new parameter `generate_hashes` (default True) to
`compile_pip_requirements()`, letting the user control whether to put
`--hash` entries in the requirements lock file generated. In particular
if the generated file is supposed to be used as a constraints file the
hashes don't make much sense.

Fixes #894.

Author: vonschultz

docs/pip.md

@@ -21,6 +21,7 @@ def compile_pip_requirements(
         name,
         extra_args = [],
         extra_deps = [],
+        generate_hashes = True,
         py_binary = _py_binary,
         py_test = _py_test,
         requirements_in = None,
@@ -49,6 +50,7 @@ def compile_pip_requirements(
         name: base name for generated targets, typically "requirements".
         extra_args: passed to pip-compile.
         extra_deps: extra dependencies passed to pip-compile.
+        generate_hashes: whether to put hashes in the requirements_txt file.
         py_binary: the py_binary rule to be used.
         py_test: the py_test rule to be used.
         requirements_in: file expressing desired dependencies.
@@ -88,7 +90,7 @@ def compile_pip_requirements(
         loc.format(requirements_darwin) if requirements_darwin else "None",
         loc.format(requirements_windows) if requirements_windows else "None",
         "//%s:%s.update" % (native.package_name(), name),
-    ] + extra_args
+    ] + (["--generate-hashes"] if generate_hashes else []) + extra_args
 
     deps = [
         requirement("build"),

python/pip_install/requirements.bzl

@@ -153,7 +153,6 @@ def _locate(bazel_runfiles, file):
     os.environ["CUSTOM_COMPILE_COMMAND"] = update_command
     os.environ["PIP_CONFIG_FILE"] = os.getenv("PIP_CONFIG_FILE") or os.devnull
 
-    sys.argv.append("--generate-hashes")
     sys.argv.append("--output-file")
     sys.argv.append(requirements_file_relative if UPDATE else requirements_out)
     sys.argv.append(

python/pip_install/tools/dependency_resolver/dependency_resolver.py

@@ -33,6 +33,21 @@ compile_pip_requirements(
     requirements_txt = "requirements_lock.txt",
 )
 
+compile_pip_requirements(
+    name = "requirements_nohashes",
+    data = [
+        "requirements.in",
+        "requirements_extra.in",
+    ],
+    extra_args = [
+        "--allow-unsafe",
+        "--resolver=backtracking",
+    ],
+    generate_hashes = False,
+    requirements_in = "requirements.txt",
+    requirements_txt = "requirements_nohashes_lock.txt",
+)
+
 genrule(
     name = "generate_os_specific_requirements_in",
     srcs = [],

tests/compile_pip_requirements/BUILD.bazel

@@ -0,0 +1,10 @@
+#
+# This file is autogenerated by pip-compile with Python 3.9
+# by the following command:
+#
+#    bazel run //:requirements_nohashes.update
+#
+pip==22.3.1
+    # via -r requirements.in
+setuptools==65.6.3
+    # via -r requirements_extra.in