Skip to content

chore: mirror sandbox requirements from openedx-platform #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MoisesGSalas merged 1 commit into from
Apr 14, 2026
Merged

chore: mirror sandbox requirements from openedx-platform #85

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,8 @@ compile-requirements: ## Re-compile *.in requirements to *.txt
$(PIP_COMPILE) -o requirements/validation.txt requirements/validation.in
$(PIP_COMPILE) -o requirements/ci.txt requirements/ci.in
$(PIP_COMPILE) -o requirements/dev.txt requirements/dev.in
# Sandbox
$(PIP_COMPILE) -o requirements/sandbox/base.txt requirements/sandbox/base.in
# Let tox control the Django version for tests
grep -e "^django==" requirements/base.txt > requirements/django.txt
sed '/^[dD]jango==/d' requirements/test.txt > requirements/test.tmp
Expand Down
4 changes: 1 addition & 3 deletions requirements/pip.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,6 @@ wheel==0.45.1

# The following packages are considered to be unsafe in a requirements file:
pip==24.2
# via
# -c https:/raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
# -r requirements/pip.in
# via -r requirements/pip.in
setuptools==80.9.0
# via -r requirements/pip.in
25 changes: 25 additions & 0 deletions requirements/sandbox/README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
============================
CodeJail Sandbox environment
============================

The requirements in this directory describe all the dependencies and libraries
available in the Sandbox runtime used to execute instructor-authored code by
openedx-platform.

Files in this directory
=======================

base.in
*******

This is the current set of requirements or the sandbox environment, and it
is used to generate the ``.txt``, described below.

Installing the openedx-sandbox environment from this file is **unsupported** and
**unstable**, because the packages are not pinned.

base.txt
********

These are the latest requirement pins for openedx-sandbox. They are regularly
updated with the latest compatible versions of each package.
Comment on lines +21 to +25
Copy link
Copy Markdown
Member

@kdmccormick kdmccormick Apr 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't add the releases directory because we can simply use the base.txt and point to a particular git revision of this repository.

Can you explain more? The purpose of the release.txt files and the changelog is that it makes it very obvious to operators which requirements go with which releases and how the sandbox environment changes every release. Installing base.txt from specific commits would technically work but I fear that it would be less clear for operators how to safely upgrade.

Copy link
Copy Markdown
Contributor Author

@MoisesGSalas MoisesGSalas Apr 7, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The logic is that the base.txt for a given release will be the one in openedx/codejail-service with the corresponding tag (e.g. release/ulmo.1). By default the tutor plugin will install the base.txt for the given OPENEDX_COMMON_VERSION.

In case you need to use a different set of dependencies you will use some mechanism that the plugin offers to retrieve the file from a different source. At the moment is a mix of docker build args and Tutor settings, but could probably be simplified to only Tutor settings.

I agree that keeping the changelog is valuable. What I think is confusing is keeping the snapshot of the files when that is already being done by git (although this move loses the previous versions).

Copy link
Copy Markdown
Member

@kdmccormick kdmccormick Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@MoisesGSalas Ah, I didn't realize SANDBOX_DEPS_VERSION could be easily configured to be different from the version of the codejail-service repository. Nice, I agree that this is much better than copying the text file every release 👍🏻

Where do you propose the changelog is kept? Named release notes, or part of this repo?

We'll need to update this part of the release process. I'm happy to help rewrite that part, let me know what you think would make sense for a process.

Copy link
Copy Markdown
Contributor Author

@MoisesGSalas MoisesGSalas Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the Named release notes is the better place. I myself go there first when I need to handle a particular upgrade.

I think removing the segment altogether is enough? The release manager shouldn't need to do anything in this repository besides tagging via the repo-tools script.

I don't know what would be the best way to catch breaking changes when upgrading the requirements in order to add them to the notes.

Copy link
Copy Markdown
Member

@kdmccormick kdmccormick Apr 7, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the past, I've made notes of two types of things:

  • major version bumps in any sandbox packages, particularly scipy and numpy
  • dropping of support for a python version

Maybe it could be a regularly scheduled task for the codejail-service maintainer to check those during each named release period and add it to the operator notes? https://openedx.atlassian.net/wiki/spaces/COMM/pages/5331222534/Verawood+-+Operator+Release+Notes

Copy link
Copy Markdown
Contributor Author

@MoisesGSalas MoisesGSalas Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah that makes sense, specially if the maintainer is the one that merges the weekly requirements upgrade anyways, so they can leave a note in the PR and collect them later at the time of release.

12 changes: 12 additions & 0 deletions requirements/sandbox/base.in
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
chem # A helper library for chemistry calculations
cryptography # Implementations of assorted cryptography algorithms
lxml[html_clean] # XML parser
matplotlib # 2D plotting library
networkx # Utilities for creating, manipulating, and studying network graphs
nltk # Natural language processing; used by the chem package
openedx-calc
pyparsing # Python Parsing module
random2 # Implementation of random module that works identically under Python 2 and 3
scipy # Math, science, and engineering library
sympy # Symbolic math library
codejail-includes # Checkers, verifiers, etc. available for course authors to use
86 changes: 86 additions & 0 deletions requirements/sandbox/base.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,86 @@
#
# This file is autogenerated by pip-compile with Python 3.12
# by the following command:
#
# make upgrade
#
cffi==2.0.0
# via cryptography
chem==2.0.0
# via -r requirements/sandbox/base.in
click==8.3.1
# via nltk
codejail-includes==2.0.0
# via -r requirements/sandbox/base.in
contourpy==1.3.3
# via matplotlib
cryptography==45.0.7
# via -r requirements/sandbox/base.in
cycler==0.12.1
# via matplotlib
fonttools==4.62.1
# via matplotlib
joblib==1.5.3
# via nltk
kiwisolver==1.5.0
# via matplotlib
lxml[html-clean]==5.3.2
# via
# -r requirements/sandbox/base.in
# lxml-html-clean
# openedx-calc
lxml-html-clean==0.4.4
# via lxml
markupsafe==3.0.3
# via
# chem
# openedx-calc
matplotlib==3.10.8
# via -r requirements/sandbox/base.in
mpmath==1.3.0
# via sympy
networkx==3.6.1
# via -r requirements/sandbox/base.in
nltk==3.9.3
# via
# -r requirements/sandbox/base.in
# chem
numpy==1.26.4
# via
# chem
# contourpy
# matplotlib
# openedx-calc
# scipy
openedx-calc==5.0.0
# via -r requirements/sandbox/base.in
packaging==26.0
# via matplotlib
pillow==12.1.1
# via matplotlib
pycparser==3.0
# via cffi
pyparsing==3.3.2
# via
# -r requirements/sandbox/base.in
# chem
# matplotlib
# openedx-calc
python-dateutil==2.9.0.post0
# via matplotlib
random2==1.0.2
# via -r requirements/sandbox/base.in
regex==2026.2.28
# via nltk
scipy==1.17.1
# via
# -r requirements/sandbox/base.in
# chem
six==1.17.0
# via python-dateutil
sympy==1.14.0
# via
# -r requirements/sandbox/base.in
# openedx-calc
tqdm==4.67.3
# via nltk
Loading