Pin dev dependencies

This ensures the CI environment is consistent. It also allows us to
automate dependency updates, which will help to catch problems like the
recent `ruff` update that broke this tool.

.github/workflows/dependencies.yaml

@@ -0,0 +1,20 @@
+name: dependencies
+
+on:
+  pull_request:
+    paths:
+    - requirements*
+
+jobs:
+  compile:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.12'
+        cache: 'pip'
+    - run: python -m pip install pip-tools
+    - run: pip-compile requirements.in
+    - run: git diff --exit-code

requirements.txt

@@ -0,0 +1,126 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile requirements.in
+#
+attrs==23.2.0
+    # via
+    #   glom
+    #   jsonschema
+    #   referencing
+    #   semgrep
+boltons==21.0.0
+    # via
+    #   face
+    #   glom
+    #   semgrep
+bracex==2.4
+    # via wcmatch
+certifi==2024.6.2
+    # via requests
+charset-normalizer==3.3.2
+    # via requests
+click==8.1.7
+    # via
+    #   click-option-group
+    #   fixit
+    #   moreorless
+    #   semgrep
+click-option-group==0.5.6
+    # via semgrep
+colorama==0.4.6
+    # via semgrep
+covdefaults==2.3.0
+    # via -r requirements.in
+coverage==7.5.4
+    # via
+    #   -r requirements.in
+    #   covdefaults
+defusedxml==0.7.1
+    # via semgrep
+exceptiongroup==1.2.1
+    # via semgrep
+face==22.0.0
+    # via glom
+fixit==2.1.0
+    # via -r requirements.in
+flake8==7.1.0
+    # via -r requirements.in
+glom==22.1.0
+    # via semgrep
+idna==3.7
+    # via requests
+iniconfig==2.0.0
+    # via pytest
+jsonschema==4.22.0
+    # via semgrep
+jsonschema-specifications==2023.12.1
+    # via jsonschema
+libcst==1.4.0
+    # via fixit
+markdown-it-py==3.0.0
+    # via rich
+mccabe==0.7.0
+    # via flake8
+mdurl==0.1.2
+    # via markdown-it-py
+moreorless==0.4.0
+    # via fixit
+packaging==24.1
+    # via
+    #   fixit
+    #   pytest
+    #   semgrep
+pathspec==0.12.1
+    # via trailrunner
+peewee==3.17.5
+    # via semgrep
+pluggy==1.5.0
+    # via pytest
+pycodestyle==2.12.0
+    # via flake8
+pyflakes==3.2.0
+    # via flake8
+pygments==2.18.0
+    # via rich
+pytest==8.2.2
+    # via
+    #   -r requirements.in
+    #   pytest-subprocess
+pytest-subprocess==1.5.0
+    # via -r requirements.in
+pyyaml==6.0.1
+    # via libcst
+referencing==0.35.1
+    # via
+    #   jsonschema
+    #   jsonschema-specifications
+requests==2.32.3
+    # via semgrep
+rich==13.7.1
+    # via semgrep
+rpds-py==0.18.1
+    # via
+    #   jsonschema
+    #   referencing
+ruamel-yaml==0.17.40
+    # via semgrep
+ruamel-yaml-clib==0.2.8
+    # via ruamel-yaml
+ruff==0.5.0
+    # via -r requirements.in
+semgrep==1.78.0
+    # via -r requirements.in
+tomli==2.0.1
+    # via semgrep
+trailrunner==1.4.0
+    # via fixit
+typing-extensions==4.12.2
+    # via semgrep
+urllib3==2.2.2
+    # via
+    #   requests
+    #   semgrep
+wcmatch==8.5.2
+    # via semgrep

tox.ini

@@ -2,7 +2,7 @@
 envlist = py39,py310,py311,py312
 
 [testenv]
-deps = -rrequirements-dev.txt
+deps = -rrequirements.txt
 commands =
   coverage erase
   coverage run -m pytest {posargs:tests}