Add and use Pipfile

[stephendonner]

Passing ad-hoc here: https://qa-preprod-master.fxtest.jenkins.stage.mozaws.net/job/go-bouncer.adhoc/102/console

As-is, our Pyup.io bot support for dependencies will stop working for these tests - we'd need to address that with something like pyupio/pyup#197 (comment) (given the multi-directory nature of this repo, I haven't yet figured it out).

@davehunt @oremj @m8ttyB r?

[codecov-io]

Codecov Report

Merging #208 into master will not change coverage.
The diff coverage is n/a.

@@          Coverage Diff           @@
##           master    #208   +/-   ##
======================================
  Coverage    39.4%   39.4%           
======================================
  Files           8       8           
  Lines         604     604           
======================================
  Hits          238     238           
  Misses        341     341           
  Partials       25      25

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5e98cd5...4d64993. Read the comment docs.

[m8ttyB]

A curiosity, how does one update the .lock file with the correct hashes? Is that done automatically or should we update our docs to discuss how to do that?

[stephendonner]

It's done automatically when you either blow away Pipfile.lock, or issue

pipenv lock

https://docs.pipenv.org/basics/#pipfile-lock-security-features

[m8ttyB]

r+

[davehunt]

I'm concerned with the mass move to Pipfile. I was of the understanding that we were going to experiment with pyup's initial support for them, and now we have three open pull requests switching to them. Can we hold off for now? I don't see an immediate advantage to this, especially as we're typically using Docker to run the tests.

[davehunt]

As this removes pyup.io support, I think we should hold off until we can address that.

[stephendonner]

👍 - I'll hold off until we've proven the Pyup.io yaml model works.

[stephendonner]

Because we want to retain @pyup-bot support for auto-dependency updating, and I haven't seen my initial approach working yet (specifically: with lockfile, and two+ sets of separate dependencies/tree levels), I'm closing this PR.