From e5ad0db63d8cbda1094e18c3a65381f9f15d2343 Mon Sep 17 00:00:00 2001
From: Josh Radcliff <jradcliff@users.noreply.github.com>
Date: Thu, 5 Nov 2026 15:42:28 -0500
Subject: [PATCH] fix(deps): improve management of release deps

- Bundle updates to versions in .kokoro/requirements.txt
- Add a nox session for the rare case where we need to run pip-compile
  manually.

Change-Id: Icf5c99a85c16e307d62e98743d0ca02d1ca42340
---
 .github/renovate.json5   |  9 +++++++++
 .kokoro/requirements.txt |  5 ++++-
 noxfile.py               | 28 ++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index bc74ad7..5674325 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -24,4 +24,13 @@
         ],
         "minimumReleaseAge": null
     },
+    "packageRules": [
+        {
+            "description": "Bundle all updates that affect .kokoro/requirements.txt",
+            "matchFileNames": [
+                ".kokoro/requirements.txt"
+            ],
+            "groupName": "Release job dependencies"
+        }
+    ]
 }
diff --git a/.kokoro/requirements.txt b/.kokoro/requirements.txt
index dd3d2f4..52cb6ff 100644
--- a/.kokoro/requirements.txt
+++ b/.kokoro/requirements.txt
@@ -2,7 +2,10 @@
 # This file is autogenerated by pip-compile with Python 3.12
 # by the following command:
 #
-#    pip-compile --generate-hashes --no-emit-index-url --no-emit-trusted-host --output-file=.kokoro/requirements.txt .kokoro/requirements.in
+#    nox -s compile_kokoro_requirements
+#
+# Note: Forking Renovate automatically manages routine updates to this file.
+# Only run the command above for rare manual overrides (e.g. urgent security patches).
 #
 build==1.6.1 \
     --hash=sha256:51cc11666391ab6f092070437ac747002ff46f3e4113a3622177ee6b488bfc53 \
diff --git a/noxfile.py b/noxfile.py
index 91d29d8..cdf45dd 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -59,3 +59,31 @@ def tests(session):
 def format(session):
     """Runs the black formatter and applies formatting fixes."""
     session.run("black", ".")
+
+
+@nox.session(python="3.12")
+def compile_kokoro_requirements(session):
+    """Recompiles .kokoro/requirements.txt.
+
+    NOTE: Forking Renovate automatically manages routine updates to this file.
+    Only run this session for manual overrides (e.g. urgent security patches).
+    """
+    custom_command = (
+        "nox -s compile_kokoro_requirements\n"
+        "#\n"
+        "# Note: Forking Renovate automatically manages routine updates to this file.\n"
+        "# Only run the command above for rare manual overrides (e.g. urgent security patches)."
+    )
+
+    session.install("pip-tools")
+    session.run(
+        "pip-compile",
+        "--upgrade",
+        "--verbose",
+        "--generate-hashes",
+        "--no-emit-index-url",
+        "--no-emit-trusted-host",
+        "--output-file=.kokoro/requirements.txt",
+        ".kokoro/requirements.in",
+        env={"CUSTOM_COMPILE_COMMAND": custom_command},
+    )