Fix pip-compile output always including a local path

As we included the local package as editable, our pip compile runs always included a path. This required always manually removing the local path from the compile output afterwards and thus broke dependabot.

By reading the dependencies from a text file in setup.py, we can just reference that text file in the requirements.in and get the desired result.

MANIFEST.in

@@ -1 +1 @@
-include README.rst COPYING
+include README.rst COPYING core-requirements.txt extra-test-requirements.txt

core-requirements.txt

@@ -0,0 +1,3 @@
+devpi-client
+requests
+twitter.common.contextutil

extra-test-requirements.txt

@@ -0,0 +1 @@
+devpi-server>=5.2.0

requirements.in

@@ -1,7 +1,8 @@
 # Requirements definition for pip-compiler
 
 # Runtime dependencies
--e .[test]
+-r core-requirements.txt
+-r extra-test-requirements.txt
 
 # Setup requirements
 setuptools_scm

requirements.txt

@@ -1,6 +1,6 @@
 #
-# This file is autogenerated by pip-compile
-# To update, run:
+# This file is autogenerated by pip-compile with Python 3.7
+# by the following command:
 #
 #    pip-compile --no-emit-index-url
 #
@@ -18,7 +18,7 @@ attrs==21.2.0
     #   pytest
 babel==2.9.1
     # via sphinx
-backports.entry-points-selectable==1.1.0
+backports-entry-points-selectable==1.1.0
     # via virtualenv
 build==0.5.1
     # via check-manifest
@@ -35,13 +35,13 @@ coverage==5.5
 defusedxml==0.7.1
     # via devpi-server
 devpi-client==5.2.2
-    # via devpi-plumber
+    # via -r core-requirements.txt
 devpi-common==3.6.0
     # via
     #   devpi-client
     #   devpi-server
 devpi-server==6.1.0
-    # via devpi-plumber
+    # via -r extra-test-requirements.txt
 distlib==0.3.2
     # via virtualenv
 docutils==0.17.1
@@ -58,6 +58,15 @@ idna==3.2
     # via requests
 imagesize==1.2.0
     # via sphinx
+importlib-metadata==5.1.0
+    # via
+    #   backports-entry-points-selectable
+    #   build
+    #   pep517
+    #   pluggy
+    #   pytest
+    #   tox
+    #   virtualenv
 iniconfig==1.1.1
     # via pytest
 itsdangerous==2.0.1
@@ -84,12 +93,12 @@ pep517==0.11.0
     # via build
 pkginfo==1.7.1
     # via devpi-client
-plaster-pastedeploy==0.7
-    # via pyramid
 plaster==1.0
     # via
     #   plaster-pastedeploy
     #   pyramid
+plaster-pastedeploy==0.7
+    # via pyramid
 platformdirs==2.1.0
     # via virtualenv
 pluggy==0.13.1
@@ -113,27 +122,27 @@ pyparsing==2.4.7
     # via packaging
 pyramid==2.0
     # via devpi-server
-pytest-cov==2.12.1
-    # via -r requirements.in
 pytest==6.2.4
     # via
     #   -r requirements.in
     #   pytest-cov
+pytest-cov==2.12.1
+    # via -r requirements.in
 python-dateutil==2.8.2
     # via strictyaml
 pytz==2021.1
     # via babel
-repoze.lru==0.7
+repoze-lru==0.7
     # via devpi-server
 requests==2.26.0
     # via
+    #   -r core-requirements.txt
     #   devpi-common
-    #   devpi-plumber
     #   sphinx
-ruamel.yaml.clib==0.2.6
-    # via ruamel.yaml
-ruamel.yaml==0.17.10
+ruamel-yaml==0.17.10
     # via devpi-server
+ruamel-yaml-clib==0.2.6
+    # via ruamel-yaml
 setuptools-scm==6.0.1
     # via -r requirements.in
 six==1.16.0
@@ -173,12 +182,14 @@ tox==3.24.0
     # via devpi-client
 translationstring==1.4
     # via pyramid
-twitter.common.contextutil==0.3.11
-    # via devpi-plumber
-twitter.common.dirutil==0.3.11
-    # via twitter.common.contextutil
-twitter.common.lang==0.3.11
-    # via twitter.common.dirutil
+twitter-common-contextutil==0.3.11
+    # via -r core-requirements.txt
+twitter-common-dirutil==0.3.11
+    # via twitter-common-contextutil
+twitter-common-lang==0.3.11
+    # via twitter-common-dirutil
+typing-extensions==4.4.0
+    # via importlib-metadata
 urllib3==1.26.6
     # via requests
 venusian==3.0.0
@@ -189,9 +200,13 @@ waitress==2.0.0
     # via devpi-server
 webob==1.8.7
     # via pyramid
-zope.deprecation==4.4.0
+zipp==3.11.0
+    # via
+    #   importlib-metadata
+    #   pep517
+zope-deprecation==4.4.0
     # via pyramid
-zope.interface==5.4.0
+zope-interface==5.4.0
     # via pyramid
 
 # The following packages are considered to be unsafe in a requirements file:

setup.py

@@ -5,6 +5,11 @@
 
 with open('README.rst') as f:
     readme = f.read()
+with open('core-requirements.txt') as f:
+    requirements = [line.strip() for line in f.readlines() if line[:1] != '#']
+with open('extra-test-requirements.txt') as f:
+    extra_test_requirements = [line.strip() for line in f.readlines() if line[:1] != '#']
+
 
 setup(
     name='devpi-plumber',
@@ -20,13 +25,9 @@
     setup_requires=[
         'setuptools_scm',
     ],
-    install_requires=[
-        'devpi-client',
-        'requests',
-        'twitter.common.contextutil',
-    ],
+    install_requires=requirements,
     extras_require={
-        'test': ['devpi-server>=5.2.0'],
+        'test': extra_test_requirements,
     },
     tests_require=[
         'mock',