Lock file

[sscivier]

Issue raised as part of the JOSS review: openjournals/joss-reviews#9408.

One of the items I have on my review checklist is:

Reproducibility: If the paper contains original results, results are entirely reproducible by reviewers. If the paper contains no original results, please check this item.

The code and results are almost entirely reproducible, with: dependencies specified via e.g., pyproject.toml and environment.yml, good testing infrastructure, detailed docs, the floatcsep reproduce command, and the easy command line usage. However, I would recommend adding a lockfile (e.g., conda-lock, uv.lock) to pin exact dependency versions (including hashes) used during development and testing. This would help avoid issues owing to e.g., version drift.

[pabloitu]

Thanks for raising this issue! I agree that a lockfile is required, which should pinpoint dependencies for every release. I created a current local lockfile (conda-lock.yml) with today dependencies' versions, which is included in the main repo. Additionally, added a lockfile.yml in the github CI, which tests the build given the fixed dependencies. The lockfile will be upgraded prior to a release (although the CI will warn of any dependency block on each PR), and should work as a repro environment for the release in the future. These changes were included in #102

[sscivier]

Thanks, @pabloitu. This looks good to me.