fix(dependencies): sort requirements files

[mprpic]

_write_requirements_file() wrote requirement sets in iteration order so rebuilds of identical sources could produced different files even though the content was the same.

Pull Request Description

What

Sort the fromager-build-system-requirements.txt file.

Why

Reproducibility.

Reproducer:

> podman run --rm ghcr.io/astral-sh/uv:python3.12-bookworm bash -c '
set -e
base=https://packages.redhat.com/api/pulp-content/public-rhai/rhoai/3.6-EA2
whl=tqdm-4.70.1-1-py3-none-any.whl
cd /tmp
for v in cpu-ubi9-prod spyre-ubi9-prod; do
  mkdir -p $v
  curl -sSf -o $v/$whl "$base/$v/$whl"
  python3 -m zipfile -e $v/$whl $v/x
  echo "== $v"
  cat $v/x/tqdm-4.70.1.dist-info/fromager-build-system-requirements.txt
done
'
== cpu-ubi9-prod
setuptools>=42
setuptools-scm[toml]>=3.4
== spyre-ubi9-prod
setuptools-scm[toml]>=3.4
setuptools>=42

• PR follows CONTRIBUTING.md guidelines

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: ebcf19a7-a9f3-41e0-b5e5-92c65ac3e86e

📥 Commits

Reviewing files that changed from the base of the PR and between 52457f1 and a8609e5.

📒 Files selected for processing (2)

• src/fromager/dependencies.py
• tests/test_dependencies.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

_write_requirements_file now sorts requirements by their string representation before writing them. This applies to requirement files generated for build-system, build-backend, build-sdist, and install requirements. A regression test verifies alphabetical ordering for requirements with specifiers and extras.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to a8609

This change deterministically orders generated requirement files without an identified current-head risk.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description explains that sorting requirement files fixes non-deterministic output and improves reproducibility. It matches the changeset.
Title check	✅ Passed	The title clearly and concisely identifies the main change: sorting requirements files in the dependencies logic.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[rd4398]

LGTM!

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request