Fix: Fixes hardcoded commit SHA on test_install_vcs_git.py

[sepehr-rs]

Fixes #13491,

I tried to fix this bug to the best of my ability. I’d appreciate any feedback or suggestions on how to make it better.

[notatallshaw]

@ichard26 this appears to be your commit: https://github.com/pypa/pip-test-package/commits/master/

[notatallshaw]

@sepehr-rs I don't think we need a news item here, or at least just make it a "trivial" news item.

[sepehr-rs]

@sepehr-rs I don't think we need a news item here, or at least just make it a "trivial" news item.

Got it, I’ve gone ahead and removed it.

[sepehr-rs]

@ichard26 this appears to be your commit: https://github.com/pypa/pip-test-package/commits/master/

I think this PR serves as a temporary fix. A more sustainable approach would be to avoid hardcoding, since every time there's a new commit on that project, a new PR will be needed here to address it.

[notatallshaw]

Thanks for the PR @sepehr-rs, probably you are correct, I'm going to hold of from merging for just a little bit to see if @ichard26 has any comment on something we could do better here.

[ichard26]

Could we clone a specific tag or branch on the pip-test-package repository that's meant to be frozen for the SHA test? We can call it frozen or even do-not-update (and I can set up protection rules to block inadvertent pushes). While I don't imagine we'd update the repository often, it would be nice to be able to make updates w/o having to update this test every time.

If that sounds reasonable, I'm happy to set this up on pip-test-package.

[notatallshaw]

The test seems to be specifically for "Clone the default branch", there's already tests for cloning a tag and specific commits.

To be more flexible I think the way this test works would need to change, rather than checking if some specific commit was sourced rather run some git command that checks the default branch has been sourced.

[sepehr-rs]

Hi @notatallshaw and @ichard26, thanks for the great discussion here!
I see that @ichard26’s suggestion to use a separate frozen branch could help avoid frequent updates, while @notatallshaw’s point about making the test more flexible sounds like a long-term improvement.
Would it make sense to merge the temporary fix for now to unblock things, and then open a dedicated issue or discussion to explore the frozen branch and more flexible test options in depth?
I’m happy to assist with either step if that would be helpful. Please let me know if this sounds like a reasonable way forward!

[notatallshaw]

Yeah, let's fix CI now and have a follow up PR later.

[sepehr-rs]

Yeah, let's fix CI now and have a follow up PR later.

That sounds great, should I open up an issue about it?

[notatallshaw]

You're welcome to if you would like, but there is no obligation.

[sepehr-rs]

You're welcome to if you would like, but there is no obligation.

Sure, I just made one :).