fix(deps): improve management of release deps

.github/renovate.json5

@@ -24,4 +24,13 @@
         ],
         "minimumReleaseAge": null
     },
+    "packageRules": [
+        {
+            "description": "Bundle all updates that affect .kokoro/requirements.txt",
+            "matchFileNames": [
+                ".kokoro/requirements.txt"
+            ],
+            "groupName": "Release job dependencies"
+        }
+    ]
 }

.kokoro/requirements.txt

@@ -2,7 +2,10 @@
 # This file is autogenerated by pip-compile with Python 3.12
 # by the following command:
 #
-#    pip-compile --generate-hashes --no-emit-index-url --no-emit-trusted-host --output-file=.kokoro/requirements.txt .kokoro/requirements.in
+#    nox -s compile_kokoro_requirements
+#
+# Note: Forking Renovate automatically manages routine updates to this file.
+# Only run the command above for rare manual overrides (e.g. urgent security patches).
 #
 build==1.6.1 \
     --hash=sha256:51cc11666391ab6f092070437ac747002ff46f3e4113a3622177ee6b488bfc53 \

noxfile.py

@@ -59,3 +59,31 @@ def tests(session):
 def format(session):
     """Runs the black formatter and applies formatting fixes."""
     session.run("black", ".")
+
+
+@nox.session(python="3.12")
+def compile_kokoro_requirements(session):
+    """Recompiles .kokoro/requirements.txt.
+
+    NOTE: Forking Renovate automatically manages routine updates to this file.
+    Only run this session for manual overrides (e.g. urgent security patches).
+    """
+    custom_command = (
+        "nox -s compile_kokoro_requirements\n"
+        "#\n"
+        "# Note: Forking Renovate automatically manages routine updates to this file.\n"
+        "# Only run the command above for rare manual overrides (e.g. urgent security patches)."
+    )
+
+    session.install("pip-tools")
+    session.run(
+        "pip-compile",
+        "--upgrade",
+        "--verbose",
+        "--generate-hashes",
+        "--no-emit-index-url",
+        "--no-emit-trusted-host",
+        "--output-file=.kokoro/requirements.txt",
+        ".kokoro/requirements.in",
+        env={"CUSTOM_COMPILE_COMMAND": custom_command},
+    )