use .txt file generated from synapse's poetry.lock

Author: FrenchGithubUser

.github/workflows/famedly-tests.yml

@@ -402,6 +402,8 @@ jobs:
 
       - name: Update dependency to the current branch
         working-directory: synapse-invite-checker
+        # the synapse dependency of the invite-checker is already pointing to synapse's master branch
+        # we skip the branch update when the CI runs on master
         run: |
           if [ "${{ steps.synapse-ref.outputs.ref }}" != "master" ]; then
             sed -i 's|"matrix-synapse[^"]*"|"matrix-synapse @ git+https://github.com/${{ steps.synapse-ref.outputs.repo }}.git@${{ steps.synapse-ref.outputs.ref }}"|' pyproject.toml
@@ -446,8 +448,14 @@ jobs:
         with:
           python-version: "3.13"
 
-      - name: Install hatch
-        run: pip install hatch
+      - name: Install hatch and poetry
+        run: pip install hatch poetry poetry-plugin-export
+
+      - name: Generate constraints from Synapse lockfile
+        # hatch can't read synapse's lock file, we export it in a format hatch can use
+        # this avoids errors due to new dependency versions with breaking changes
+        run: |
+          poetry export --without-hashes --format requirements.txt --output "${{ github.workspace }}/synapse-token-authenticator/synapse-constraints.txt"
 
       - name: Determine synapse git ref
         id: synapse-ref
@@ -462,8 +470,6 @@ jobs:
 
       - name: Update dependency to the current branch
         working-directory: synapse-token-authenticator
-        # the synapse dependency of the token-authenticator is already pointing to synapse's master branch
-        # we skip the branch update when the CI runs on master
         run: |
           sed -i 's|"matrix-synapse[^"]*"|"matrix-synapse @ git+https://github.com/${{ steps.synapse-ref.outputs.repo }}.git@${{ steps.synapse-ref.outputs.ref }}"|' pyproject.toml
           # Check if the file was actually modified
@@ -472,8 +478,16 @@ jobs:
             exit 1
           fi
 
+      # - name: Inject synapse's poetry.lock constraints
+      #   working-directory: synapse-token-authenticator
+      #   run: |
+      #     # this works because Hatch passes the dependency list directly to pip
+      #     sed -i '/dependencies = \[/a \  "-r synapse-constraints.txt",' pyproject.toml
+
       - name: Run token-authenticator tests
         working-directory: synapse-token-authenticator
+        env:
+          PIP_CONSTRAINT: "${{ github.workspace }}/synapse-token-authenticator/synapse-constraints.txt"
         run: hatch run cov
 
       - name: Display Hatch Environment Info