Pin pipenv in CI via ensure-pipenv and regenerate lock

[ideaship]

Summary

• Switches pre.yml to the ensure-pipenv role from osism/zuul-jobs
  (after ensure-pip), following the same pattern as Pin pipenv in CI via ensure-pipenv and regenerate lock netbox-manager#235
• Removes pipenv from the apt package list (Debian Bookworm ships
  2022.12.19, which has incompatible hash semantics with current pipenv)
• Updates test-setup.yml and test-unit.yml to invoke pipenv as
  {{ python_venv_dir }}/bin/pipenv (/tmp/venv/bin/pipenv)
• Adds --deploy to pipenv install --dev in test-unit.yml for
  strict lock-file verification on every run
• Regenerates Pipfile.lock with pipenv 2026.5.2 to resolve the hash
  mismatch introduced by PEP 503 name normalization in pipenv 2026.4.0;
  incidental lock bumps: pytz 2026.1.post1 → 2026.2, wcwidth 0.6.0 → 0.7.0

Dependency

Requires osism/zuul-jobs#182 (ensure-pipenv role) to be merged first.

Test plan

• Verify Zuul unit-test and test-setup jobs pass with pinned pipenv
• Verify pipenv install --dev --deploy no longer reports stale lock locally

🤖 AI-assisted: Claude Code

[sourcery-ai]

Hey - I've left some high level feedback:

• You now define python_venv_dir: /tmp/venv separately in both test-unit.yml and test-setup.yml; consider centralizing this (e.g., via a group_var, role var, or reusing the variable exposed by ensure-pipenv) so the virtualenv path stays consistent in one place.
• Since you're calling ensure-pipenv, it would be good to align the hardcoded {{ python_venv_dir }}/bin/pipenv path with whatever path that role actually provisions (or parameterize it), to avoid subtle breakage if the role’s default venv location changes.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- You now define `python_venv_dir: /tmp/venv` separately in both `test-unit.yml` and `test-setup.yml`; consider centralizing this (e.g., via a group_var, role var, or reusing the variable exposed by `ensure-pipenv`) so the virtualenv path stays consistent in one place.
- Since you're calling `ensure-pipenv`, it would be good to align the hardcoded `{{ python_venv_dir }}/bin/pipenv` path with whatever path that role actually provisions (or parameterize it), to avoid subtle breakage if the role’s default venv location changes.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}