fix: install each service's pinned pip into its venv

playbooks/roles/analytics_api/meta/main.yml

@@ -27,6 +27,7 @@ dependencies:
     edx_django_service_name: '{{ analytics_api_service_name }}'
     edx_django_service_user: '{{ analytics_api_user }}'
     edx_django_service_home: '{{ COMMON_APP_DIR }}/{{ analytics_api_service_name }}'
+    edx_django_service_pip_install_args: '-r {{ COMMON_APP_DIR }}/{{ analytics_api_service_name }}/{{ analytics_api_service_name }}/requirements/pip.txt'
     edx_django_service_config_overrides: '{{ analytics_api_service_config_overrides }}'
     edx_django_service_nginx_port: '{{ ANALYTICS_API_NGINX_PORT }}'
     edx_django_service_nginx_read_timeout: 300

playbooks/roles/edx_django_service/defaults/main.yml

@@ -33,6 +33,9 @@ edx_django_service_app_config_file: "{{ COMMON_CFG_DIR  }}/{{ edx_django_service
 edx_django_service_code_dir: '{{ edx_django_service_home }}/{{ edx_django_service_name }}'
 edx_django_service_venv_dir: '{{ edx_django_service_home }}/venvs/{{ edx_django_service_name }}'
 edx_django_service_venv_bin_dir: '{{ edx_django_service_venv_dir }}/bin'
+# Arguments for the "Pin pip" step. Services can override this, for example
+# with "-r <code_dir>/requirements/pip.txt" to follow the repo's own pin.
+edx_django_service_pip_install_args: 'pip=={{ COMMON_PIP_VERSION }}'
 
 edx_django_service_nodeenv_dir: '{{ edx_django_service_home }}/nodeenvs/{{ edx_django_service_name }}'
 edx_django_service_nodeenv_bin: '{{ edx_django_service_nodeenv_dir }}/bin'

playbooks/roles/edx_django_service/tasks/main.yml

@@ -220,7 +220,7 @@
     - install:system-requirements
 
 - name: Pin pip to a specific version.
-  command: "{{ edx_django_service_venv_dir }}/bin/pip install pip=={{ COMMON_PIP_VERSION }}"
+  command: "{{ edx_django_service_venv_dir }}/bin/pip install {{ edx_django_service_pip_install_args }}"
   become_user: "{{ edx_django_service_user }}"
   when: not edx_django_service_enable_experimental_docker_shim
   tags:

playbooks/roles/insights/defaults/main.yml

@@ -250,6 +250,7 @@ insights_manage: "{{ insights_code_dir }}/manage.py"
 
 insights_requirements_base: "{{ insights_code_dir }}/requirements"
 insights_requirements:
+  - pip.txt
   - production.txt
   - optional.txt
 

playbooks/roles/xqueue/defaults/main.yml

@@ -176,6 +176,7 @@ xqueue_environment:
   XQUEUE_CFG: '{{ COMMON_CFG_DIR }}/xqueue.yml'
 
 xqueue_requirements_file:      "{{ xqueue_code_dir }}/requirements.txt"
+xqueue_pip_requirements_file:  "{{ xqueue_code_dir }}/requirements/pip.txt"
 xqueue_openstack_requirements_file: "{{ xqueue_code_dir }}/openstack-requirements.txt"
 
 # These packages are required for the xqueue server,

playbooks/roles/xqueue/tasks/main.yml

@@ -69,6 +69,21 @@
     - install
     - install:system-requirements
 
+# The venv gets whatever pip python3.12's ensurepip bundles, so install the
+# repo's pinned pip before the app requirements.
+- name: "Install pinned pip into the python3.12 venv"
+  pip:
+    requirements: "{{ xqueue_pip_requirements_file }}"
+    virtualenv: "{{ xqueue_venv_dir }}"
+    virtualenv_command: 'python3.12 -m venv'
+    state: present
+    extra_args: "-i {{ COMMON_PYPI_MIRROR_URL }} --exists-action w"
+  become_user: "{{ xqueue_user }}"
+  when: xqueue_use_python312
+  tags:
+    - install
+    - install:app-requirements
+
 - name: "Install python3.12 requirements"
   pip:
     requirements: "{{ xqueue_requirements_file }}"

playbooks/roles/xqwatcher/defaults/main.yml

@@ -100,6 +100,7 @@ xqwatcher_use_python312: true
 xqwatcher_conf_dir: "{{ xqwatcher_app_dir }}"
 
 xqwatcher_requirements_file: "{{ xqwatcher_code_dir }}/requirements/production.txt"
+xqwatcher_pip_requirements_file: "{{ xqwatcher_code_dir }}/requirements/pip.txt"
 xqwatcher_log_dir: "{{ COMMON_LOG_DIR }}/{{ xqwatcher_service_name }}"
 xqwatcher_module: "xqueue_watcher"
 

playbooks/roles/xqwatcher/tasks/deploy_watcher.yml

@@ -2,6 +2,20 @@
 # The watcher can watch one or many queues and dispatch submissions
 # to the appropriate grader which lives in a separate SCM repository.
 
+# Install the repo's pinned pip first, rather than keeping the pip that
+# virtualenv bundles.
+- name: Install pinned pip
+  pip:
+    requirements: "{{ xqwatcher_pip_requirements_file }}"
+    virtualenv: "{{ xqwatcher_app_dir }}/venvs/{{ xqwatcher_service_name }}"
+    virtualenv_python: "{{ xqwatcher_python_version }}"
+    state: present
+  become: true
+  become_user: "{{ xqwatcher_user }}"
+  tags:
+    - install
+    - install:app-requirements
+
 - name: Install application requirements
   pip:
     requirements: "{{ xqwatcher_requirements_file }}"