Freezing Dependency Versions on Library Release

[AndrewSazonov]

Strict version pinning at release time (Hard Freeze)

To reduce the risk of unexpected breakages from dependency updates, improve reproducibility, and provide a more stable experience for users, we adopt strict version pinning at release time ("Hard Freeze"). This ensures that users always install the tested and validated environment corresponding to each release.

Summary of the decision

• All dependencies will be pinned to exact versions in pyproject.toml at the time of release.

  [project]
  dependencies = [
      "numpy==1.24.2",
      "scipy==1.10.0",
      "matplotlib==3.7.1"
  ]

• Running pip install easydiffraction will install the exact versions of dependencies that were tested and validated for the release.
• To keep development workflows clean and flexible:
  • A workflow will automatically create a pull request from master to develop after tagging a new release. This PR will unpin all dependencies in pyproject.toml, so that the develop branch always uses the latest available versions for development and CI testing.
  • A workflow will prevent or fail pull requests if the source branch was created from master, helping enforce consistent use of the branching model.
• Before merging develop into master, we will pin all dependencies in pyproject.toml to the current tested versions.

Links to the original discussions: #32