Skip to content

Build dependencies should only come from build backend#3687

Merged
gaborbernat merged 2 commits intotox-dev:mainfrom
rahuldevikar:users/rahuldevikar/fix3412
Feb 14, 2026
Merged

Build dependencies should only come from build backend#3687
gaborbernat merged 2 commits intotox-dev:mainfrom
rahuldevikar:users/rahuldevikar/fix3412

Conversation

@rahuldevikar
Copy link
Collaborator

@rahuldevikar rahuldevikar commented Feb 14, 2026

The .pkg packaging environment silently accepted deps configuration, but build dependencies for PEP-517 packagers should only come from the build backend (via pyproject.toml's [build-system] table). Users who set deps on .pkg got confusing ModuleNotFoundError at build time because their deps were not actually used by the build backend.

Fixes: #3412

  • ran the linter to address style issues (tox -e fix)
  • wrote descriptive pull request text
  • ensured there are test(s) validating the fix
  • added news fragment in docs/changelog folder
  • updated/extended the documentation

Copy link
Member

@gaborbernat gaborbernat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was a feature for non PEP-517 builds if I recall correctly, but probably we don't want to support that now.

@gaborbernat gaborbernat enabled auto-merge (squash) February 14, 2026 05:49
@rahuldevikar
Copy link
Collaborator Author

This was a feature for non PEP-517 builds if I recall correctly, but probably we don't want to support that now.

Yes, better throw error? IMO

@gaborbernat gaborbernat merged commit a36e8cf into tox-dev:main Feb 14, 2026
28 checks passed
@wshanks
Copy link

wshanks commented Feb 16, 2026

With this change, is there a way to install a dependency outside of build-system.requires in a packaging environment now? This change broke the configuration I had described in #3491 (reply in thread) (actual tox file is here) where I was installing build and using it for the wheel build. I understand what I was doing was not necessarily supported behavior. Any guidance on making it more standard would be appreciated. (If nothing else, I could add build to build-system.requires though it is not used by the build backend).

@gaborbernat
Copy link
Member

I'd say we should add package = sdist-wheel that does that dance 🤔

@rahuldevikar
Copy link
Collaborator Author

Thanks @wshanks for this. For your use case, since you're using package = external with a custom command that invokes build, the quickest fix would be to add build to your build-system.requires in pyproject.toml. That way the build backend's dependency resolution handles it properly.

I agree with @gaborbernat that a dedicated package = sdist-wheel mode would be the cleaner long-term solution for the sdis -> wheel workflow.

wshanks added a commit to wshanks/qiskit-experiments that referenced this pull request Feb 16, 2026
tox 4.36.0 started enforcing the constraint that a `package_env`
environemnt only installs what is listed in `build-system.requires`. We
use `pypa/build` to build the wheel from the sdist instead of building
the wheel directly. `pypa/build` is an external command so it was not
listed in `build-system/requires` and was just listed as an extra tox
environemnt dependency. Now listing an extra dependency is not allowed
so we just list `pypa/build` under `build-system.requires` until a
cleaner solution is found.

See tox-dev/tox#3687 (comment)
wshanks added a commit to wshanks/qiskit-experiments that referenced this pull request Feb 16, 2026
tox 4.36.0 started enforcing the constraint that a `package_env`
environemnt only installs what is listed in `build-system.requires`. We
use `pypa/build` to build the wheel from the sdist instead of building
the wheel directly. `pypa/build` is used as an external command so it
was not listed in `build-system/requires` and was just listed as an
extra tox environemnt dependency. Now listing an extra dependency is not
allowed so we install `pypa/build` in the packaging environment's
commands until a cleaner solution is found.

See tox-dev/tox#3687 (comment)
gaborbernat added a commit that referenced this pull request Feb 17, 2026
PR #3687 (fix for #3412) added a hard Fail in
Pep517VenvPackager._setup_env() that rejects any deps on PEP-517
packaging environments. This broke two downstream consumers:

tox-uv — Tests for editable-legacy, workspace, and no_pyproject
scenarios set deps = wheel on .pkg because uv doesn't seed wheel into
venvs by default (unlike virtualenv). The editable-legacy flow needs
wheel importable in the packaging venv for setup.py develop. CI:
https://github.com/tox-dev/tox-uv/actions/runs/22071221669

Uses package = external with deps = build on .pkg to run python -m build
for sdist→wheel workflow. Discussion:
#3491 (reply in thread)
Fix PR: qiskit-community/qiskit-experiments#1615


Only raise the error when call_require_hooks is a subset of {"sdist",
"wheel", "editable"} (standard PEP-517 types). Allow deps when
editable-legacy or external is involved

Fixes: #3731

<!-- Thank you for your contribution!

Please, make sure you address all the checklists (for details on how see
[development
documentation](http://tox.readthedocs.org/en/latest/development.html#development))!
-->

- [x] ran the linter to address style issues (`tox -e fix`)
- [x] wrote descriptive pull request text
- [x] ensured there are test(s) validating the fix
- [x] added news fragment in `docs/changelog` folder
- [ ] updated/extended the documentation

---------

Co-authored-by: Bernát Gábor <gaborjbernat@gmail.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
github-merge-queue bot pushed a commit to qiskit-community/qiskit-experiments that referenced this pull request Feb 18, 2026
tox 4.36.0 started enforcing the constraint that a `package_env`
environment only installs what is listed in `build-system.requires`. We
use `pypa/build` to build the wheel from the sdist instead of building
the wheel directly. `pypa/build` is used as an external command so it
was not listed in `build-system/requires` and was just listed as an
extra tox environment dependency. Now listing an extra dependency is not
allowed so we install `pypa/build` in the packaging environment's
commands until a cleaner solution is found.

See tox-dev/tox#3687 (comment)

Additionally, a pylint disable comment was added to `numpy.finfo.eps`
since
this was also needed for the CI to pass.
github-merge-queue bot pushed a commit to qiskit-community/qiskit-experiments that referenced this pull request Feb 18, 2026
tox 4.36.0 started enforcing the constraint that a `package_env`
environment only installs what is listed in `build-system.requires`. We
use `pypa/build` to build the wheel from the sdist instead of building
the wheel directly. `pypa/build` is used as an external command so it
was not listed in `build-system/requires` and was just listed as an
extra tox environment dependency. Now listing an extra dependency is not
allowed so we install `pypa/build` in the packaging environment's
commands until a cleaner solution is found.

See tox-dev/tox#3687 (comment)

Additionally, a pylint disable comment was added to `numpy.finfo.eps`
since
this was also needed for the CI to pass.
github-merge-queue bot pushed a commit to qiskit-community/qiskit-experiments that referenced this pull request Feb 18, 2026
tox 4.36.0 started enforcing the constraint that a `package_env`
environment only installs what is listed in `build-system.requires`. We
use `pypa/build` to build the wheel from the sdist instead of building
the wheel directly. `pypa/build` is used as an external command so it
was not listed in `build-system/requires` and was just listed as an
extra tox environment dependency. Now listing an extra dependency is not
allowed so we install `pypa/build` in the packaging environment's
commands until a cleaner solution is found.

See tox-dev/tox#3687 (comment)

Additionally:

* A pylint disable comment was added to `numpy.finfo.eps` since 
  this was also needed for the CI to pass.
* testtools 2.8.3 was excluded from the test dependencies to avoid
  incompatibility with stestr. The hope is the next release of stestr or
  testtools will address the incompatibility. See:
  testing-cabal/testtools#566
github-merge-queue bot pushed a commit to qiskit-community/qiskit-experiments that referenced this pull request Feb 18, 2026
This change started as a fix for a change in behavior in tox but evolved
into
a set of three unrelated small fixes that are all needed to get the CI
to pass
again:

* Set a minimum version for `tox` of 4.38.0 so that we pick up
  tox-dev/tox#3730 which addresses
  tox-dev/tox#3687 (comment).
Additionally, `tox-uv` is added as a tox dependency for consistency
since
that is used in CI (but actually set it to !=4.36,!=4.37 since 4.38.0
requires
  Python >=3.10 and this change is a precursor to the one that drops
  Python 3.9).
* A pylint disable comment was added to `numpy.finfo.eps` since 
  this was also needed for the CI to pass.
* testtools 2.8.3 was excluded from the test dependencies to avoid
  incompatibility with stestr. The hope is the next release of stestr or
  testtools will address the incompatibility. See:
  testing-cabal/testtools#566
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

The .pkg environment has no project dependencies, raise ModuleNotFoundError: No module named 'xxx'

3 participants