Release coordination

[martinfleis]

Recent changes that made it to 4.9.2 caused a lot of trouble at many places.

• the change broke spreg (adapt imports to update in libpysal.common spreg#129) which wrongly did star imports from libpysal.common and used numpy imported from there instead of their own import numpy as np code. While we noticed this immediately, we released 4.9.2 without keeping track of these issues which then broke production environments.
• we have not updated requirements on conda-forge (libpysal v4.9.2 conda-forge/libpysal-feedstock#23) which resulted in 4.9.2 being installed in Python 3.9 and 3.8. environments while being incompatible with those (https://github.com/pysal/momepy/actions/runs/6764819962/job/18392907589, https://github.com/pysal/pointpats/actions/runs/6764866388/job/18383734872 and probably the rest of the ecosystem). I have updated the recipe (update reqs, add bot conda-forge/libpysal-feedstock#24) and added a bot checking this but 4.9.2 build 0 is still installable. That is being patched (patch libpysal python requirements conda-forge/conda-forge-repodata-patches-feedstock#585).
• The release of 4.9 was also a bit bumpy, that is why there is 4.9.2 already.

Considering all of this, I believe that we need to put in place additional checks before making a release of libpysal. A subset of that could be also applied elsewhere, to ensure that we don't break our own ecosystem.

[knaaptime]

as a first cut, we should probably make sure that all the subpackages test against libpysal@main (like esda), and that downstream tests pass before a new libpysal is released

[knaaptime]

we have not updated requirements on conda-forge (conda-forge/libpysal-feedstock#23) which resulted in 4.9.2 being installed in Python 3.9 and 3.8. environments while being incompatible with those

i think the other way to handle this is to turn off automerge. While i like automerge, there's no way to control something like the minimum dependency change we just encountered (unless you catch the recipe PR before the bot merges). When we issue a new release, the CI can guarantee the dependencies are correct in the source code, but theres no way to force the conda-forge recipe to use those deps

[martinfleis]

Automerge wasn't on.

[jGaboardi]

This specific time did not have to do with automerge, unfortunately. The PR passed, so I merged it 😞.

[knaaptime]

(but its turned on now)

EDIT: actually, is it? its defined twice in here

[martinfleis]

Ah, my bad! Then it probably was on and I just missed it. The PR was merged manually though.