Switch to pip-compile pinned dependencies (v1.3.0) (#28)

* Fix mermaid rendering: wide container width for landscape Gantt charts; ac:width on push; --no-cache on --rebuild

* Switch to pip-compile pinned dependencies

Introduce requirements.in / requirements-dev.in as the editable source
of truth for direct dependencies; requirements.txt and requirements-dev.txt
are now pip-compile-generated lockfiles with all transitive deps pinned.

Update test CI to install from both lockfiles instead of adding pytest
and pytest-cov ad-hoc. Dependabot auto-detects .in files and will
regenerate the lockfiles when bumping deps.

* docs: update README, CLAUDE.md, and SECURITY.md for pip-compile lockfiles

* chore: bump version to 1.3.0

Author: kellenmurphy

.github/workflows/test.yml

@@ -23,7 +23,7 @@ jobs:
             -v ${{ github.workspace }}:/workspace \
             -w /workspace \
             dhi.io/python:3.13-debian13-dev \
-            sh -c "pip install -r requirements.txt pytest pytest-cov -q && pytest tests/ -v --cov=py_conf_sync --cov-report=term-missing --cov-report=xml --cov-fail-under=100"
+            sh -c "pip install -q -r requirements.txt -r requirements-dev.txt && pytest tests/ -v --cov=py_conf_sync --cov-report=term-missing --cov-report=xml --cov-fail-under=100"
 
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v6

CLAUDE.md

@@ -22,14 +22,28 @@ py_conf_sync.py                    # Entire tool — CLI, API client, format con
 csync                              # Docker wrapper — use this instead of calling py_conf_sync.py directly
 .py-conf-sync.config.example.yaml # Example config — copy to .py-conf-sync.config.yaml and fill in values
 .csync.env.example                 # Credential template — copy to ~/.csync.env and fill in values
-requirements.txt                   # Python dependencies
+requirements.in                    # Direct runtime dependencies (editable — add/change bounds here)
+requirements.txt                   # Pinned lockfile generated by pip-compile — do not edit directly
+requirements-dev.in                # Direct test/dev dependencies (editable)
+requirements-dev.txt               # Pinned dev lockfile generated by pip-compile — do not edit directly
 tests/                             # pytest test suite
 Dockerfile                         # Uses Docker Hardened Images (dhi.io/python:3.13)
 ```
 
 The tool runs as a plain script — no `setup.py`/`pyproject.toml`, no packaging. The Docker
 wrapper handles dependencies.
 
+To regenerate the lockfiles after editing a `.in` file (run inside Docker per project convention):
+
+```bash
+docker run --rm --network=host -v $(pwd):/work -w /work dhi.io/python:3.13-debian13-dev \
+  sh -c "pip install -q pip-tools && \
+         pip-compile --strip-extras -o requirements.txt requirements.in && \
+         pip-compile --strip-extras -o requirements-dev.txt requirements-dev.in"
+```
+
+Dependabot regenerates them automatically on its weekly dep-bump PRs.
+
 ## Key architecture
 
 Everything lives in `py_conf_sync.py`. The main sections are:

README.md

@@ -73,7 +73,7 @@ It builds the image on first use and mounts your current directory into the cont
 Absolute paths in arguments are automatically mounted into the container, so
 cross-repo operations work without any extra flags.
 
-**After updating `py_conf_sync.py` or `requirements.txt`**, rebuild the image:
+**After updating `py_conf_sync.py` or `requirements.in`**, rebuild the image:
 
 ```bash
 ./csync --rebuild pull

SECURITY.md

@@ -40,7 +40,7 @@ receive a response within **5 business days** acknowledging the report.
 
 ## Supply chain
 
-- Dependencies are monitored by Dependabot and updated weekly
+- Dependencies are pinned via pip-compile lockfiles (`requirements.txt`, `requirements-dev.txt`) and updated weekly by Dependabot
 - All merges to `main` require a passing test suite
 - Docker images are published via GitHub Actions with pinned action versions
 - Images are tagged by semver and `latest` tracks the current release

csync

@@ -10,15 +10,15 @@ PUBLISHED_IMAGE="ghcr.io/kellenmurphy/py-conf-sync:latest"
 
 if [[ "${1:-}" == "--rebuild" ]]; then
     shift
-    docker build -t "$LOCAL_IMAGE" "$SCRIPT_DIR" >&2
+    docker build --no-cache --network=host -t "$LOCAL_IMAGE" "$SCRIPT_DIR" >&2
     IMAGE="$LOCAL_IMAGE"
 elif docker image inspect "$LOCAL_IMAGE" >/dev/null 2>&1; then
     IMAGE="$LOCAL_IMAGE"
 elif docker pull "$PUBLISHED_IMAGE" >/dev/null 2>&1; then
     IMAGE="$PUBLISHED_IMAGE"
 else
     echo "[py-conf-sync] No image found — building locally..." >&2
-    docker build -q -t "$LOCAL_IMAGE" "$SCRIPT_DIR" >&2
+    docker build --network=host -q -t "$LOCAL_IMAGE" "$SCRIPT_DIR" >&2
     IMAGE="$LOCAL_IMAGE"
 fi
 

py_conf_sync.py

@@ -26,7 +26,7 @@
 from markdownify import markdownify as md
 from dotenv import load_dotenv
 
-__version__ = "1.0.0"
+__version__ = "1.3.0"
 
 # ---------------------------------------------------------------------------
 # Config helpers
@@ -809,7 +809,7 @@ def _replace(m):
                 "<!DOCTYPE html><html>"
                 "<head><style>"
                 "body{margin:0;background:white}"
-                "#diagram{display:inline-block;padding:16px;background:white}"
+                "#diagram{display:block;padding:16px;background:white;width:1400px}"
                 "</style></head><body>"
                 f'<div id="diagram" class="mermaid">{escaped}</div>'
                 f"<script>{mermaid_js}</script>"
@@ -820,7 +820,8 @@ def _replace(m):
                 # so it renders at natural size instead of 100%-of-container.
                 "var svg=document.querySelector('#diagram svg');"
                 "if(svg){var vb=svg.viewBox.baseVal;"
-                "if(vb&&vb.width>0){svg.setAttribute('width',vb.width+'px');svg.setAttribute('height',vb.height+'px');}}"
+                "if(vb&&vb.width>0){svg.setAttribute('width',vb.width+'px');svg.setAttribute('height',vb.height+'px');"
+                "document.getElementById('diagram').style.width=Math.max(vb.width+32,1400)+'px';}}"
                 "document.title='ready';"
                 "}).catch(function(e){"
                 "document.title='error:'+e.message;"
@@ -851,7 +852,7 @@ def _replace(m):
 
             counter[0] += 1
             txt_file = tmp_dir / f"mermaid-{digest}.txt"
-            return f"![Diagram {counter[0]}]({output_file})\n\n[Mermaid source]({txt_file})"
+            return f'![Diagram {counter[0]}]({output_file} "ac:width=900")\n\n[Mermaid source]({txt_file})'
 
         try:
             result = _MERMAID_FENCE_RE.sub(_replace, body)

requirements-dev.in

@@ -0,0 +1,2 @@
+pytest>=8.0
+pytest-cov>=6.0

requirements-dev.txt

@@ -0,0 +1,24 @@
+#
+# This file is autogenerated by pip-compile with Python 3.13
+# by the following command:
+#
+#    pip-compile --output-file=requirements-dev.txt --strip-extras requirements-dev.in
+#
+coverage==7.14.1
+    # via pytest-cov
+iniconfig==2.3.0
+    # via pytest
+packaging==26.2
+    # via pytest
+pluggy==1.6.0
+    # via
+    #   pytest
+    #   pytest-cov
+pygments==2.20.0
+    # via pytest
+pytest==9.0.3
+    # via
+    #   -r requirements-dev.in
+    #   pytest-cov
+pytest-cov==7.1.0
+    # via -r requirements-dev.in

requirements.in

@@ -0,0 +1,6 @@
+requests>=2.34.2
+markdownify>=1.2.2
+markdown>=3.10.2
+python-dotenv>=1.2.2
+PyYAML>=6.0.3
+playwright>=1.60.0

requirements.txt

@@ -1,6 +1,40 @@
-requests>=2.34.2
-markdownify>=1.2.2
-markdown>=3.10.2
-python-dotenv>=1.2.2
-PyYAML>=6.0.3
-playwright>=1.60.0
+#
+# This file is autogenerated by pip-compile with Python 3.13
+# by the following command:
+#
+#    pip-compile --output-file=requirements.txt --strip-extras requirements.in
+#
+beautifulsoup4==4.14.3
+    # via markdownify
+certifi==2026.5.20
+    # via requests
+charset-normalizer==3.4.7
+    # via requests
+greenlet==3.5.1
+    # via playwright
+idna==3.17
+    # via requests
+markdown==3.10.2
+    # via -r requirements.in
+markdownify==1.2.2
+    # via -r requirements.in
+playwright==1.60.0
+    # via -r requirements.in
+pyee==13.0.1
+    # via playwright
+python-dotenv==1.2.2
+    # via -r requirements.in
+pyyaml==6.0.3
+    # via -r requirements.in
+requests==2.34.2
+    # via -r requirements.in
+six==1.17.0
+    # via markdownify
+soupsieve==2.8.4
+    # via beautifulsoup4
+typing-extensions==4.15.0
+    # via
+    #   beautifulsoup4
+    #   pyee
+urllib3==2.7.0
+    # via requests