Warn on updated Pythons

[edmorley]

Similar to heroku/heroku-buildpack-ruby#611, I think it would be a good idea to warn if the Python version isn't explicitly specified in runtime.txt. (Though unlike that case it needn't block heroku/heroku-repo#70).

[kennethreitz]

I don't think that's a good idea.

[edmorley]

By warn I don't mean fail the compile, instead output a friendly:
"We notice that the Python version isn't explicitly specified. It's recommended to do, see {devcenter link}".

Context:
heroku/heroku-repo#70 (comment)

[kennethreitz]

I don't recommend to do so — 99% of apps don't specify one.

[kennethreitz]

I don't want to clutter up 99% of builds with a warning they don't need to see.

[edmorley]

Some context...

My main concern was how the following interact:

• The desire to have minimal setup required for new apps (ie have runtime.txt be optional)
• Sticky Python versions (ie never update to newer default Python, re-use the version first used)

...in that it means 99% of apps will always be using out of date Python and not even know it.

In an ideal world where Python patch version updates never break anything, the buildpack could auto-update users who don't have a runtime.txt thereby preserving both the "keep Heroku friction free" and "keep people protected" aspects.

However that clearly isn't viable, which means the best we can do is try to make it more obvious to users what version they are using, and encouraging them to update it if needed. ie:

• increasing the visibility of the Python version used
  • by making it actually be output in the build log for cached runs too (I've filed Output the Python version when restoring from cache #453 for this)
  • by adding a runtime.txt to their repo so it's more visible to the developers that don't look at build logs (this issue)
• encouraging them to update by outputting more blatant warnings for known insecure Python versions (there's already a check during compile for InsecurePlatformWarning but I think that needs to be extended)

However I can understand the desire to not show a warning if most people are going to ignore it. I would be interested to know if there were better ways to try and keep users protected however. What do other buildpacks do?

[kennethreitz]

Let's warn if they don't have runtime.txt set AND python is out of date!

[kennethreitz]

in fact, let's simply things.

Let's just warn if Python's out of date, period.

[kennethreitz]

this is now implemented!

[edmorley]

Awesome - thank you :-)