The current handling of Python virtual environment used for pip requirements checks in the common role is not optimal. There is a number of issues that cause intermittent failures. For example:

• Outdated setuptools or pip will prevent the tool from working.
• There is no guarantee around what version of setuptools or pip is installed at any time.
• Updating pip/setuptools is not possible.
• Initial syncing of environment is carried out by installing up-to-date version of pip-tools, and this could end up in failure due to incompatibilities listed above.

To make this functionality work more reliably, it would be necessary to change the way all the relevant packages are installed.

The following should be done:

• Update the common role.
  • Include all packages, including pip and setuptools in requirements.in and requirements.txt.
  • Install the necessary packages with the pip install -r requirements.txt initially, and then simply resort to invoking pip-sync as well to clean-up stale unused packages.
• Update the pip_check_requirements_upgrades.sh script to use to invoke pip-compile with --allow-unsafe option.
• Update role documentation with new parameter values, and notify of change in the use of --allow-unsafe option.
• Update role documentation.