[zahlman]

Sure, they presumably have a local dev environment where they install dependencies to test their own code.

But there are a lot of possible workflows around that. Some people might separately install things one at a time according to what they appear to need as they're developing, and then use `pip freeze` to create the `requirements.txt` file. Others might edit `requirements.txt` directly, and repeatedly re-create their environment based off that. Still others might involve any number of tools here, such as pip-tools (https://pypi.org/project/pip-tools/), pipenv (https://pypi.org/project/pipenv/), etc.

[Feynmanix]

As long as they run `pip install` locally at any point in their process before pushing to the repo, they should get the opportunity to see the pipask report.

[zahlman]

True. I was only trying to address "it's pretty uncommon to use lockfiles with pip". I should have quoted it in my first post.