Support --pip-args=<some pip arg> in pip-compile

[cofiem]

I would like to use --pip-args for pip-compile.

After configuring the pip-compile manager, I encountered this warning (or error):

WARN: pip-compile error
{
  "baseBranch": "main",
  "matchedFile": "requirements.txt",
  "errorMessage": "Option --pip-args=--only-binary :all: not supported (yet)"
}

The reason for passing -pip-args='--only-binary :all:' is to ensure that pip only uses binary distribution files (built wheel files) and not source distribution files. Using only wheel files is a security improvement, as it reduces the opportunity for arbitrary code execution through building source distributions.

That error comes from:

renovate/lib/modules/manager/pip-compile/common.ts

Line 336 in da2c4b9

throw new Error(`Option ${arg} not supported (yet)`);

I've had a brief look at the code. It looks like pip-tools is used underneath.
If that's the case, then this diff seems like it would allow --pip-args to be passed:

From 5c60cbb6c83f811265a13c444be50e7c60b40d34 Mon Sep 17 00:00:00 2001
Subject: [PATCH] support passing pip-args to pip-compile

---
 .../manager/pip-compile/__fixtures__/requirementsWithHashes.txt | 2 +-
 lib/modules/manager/pip-compile/common.ts                       | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/modules/manager/pip-compile/__fixtures__/requirementsWithHashes.txt b/lib/modules/manager/pip-compile/__fixtures__/requirementsWithHashes.txt
index 49dba3058a5..d9d0e779cc4 100644
--- a/lib/modules/manager/pip-compile/__fixtures__/requirementsWithHashes.txt
+++ b/lib/modules/manager/pip-compile/__fixtures__/requirementsWithHashes.txt
@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile with python 3.9
 # To update, run:
 #
-#    pip-compile --allow-unsafe --generate-hashes --no-emit-index-url --strip-extras --resolver=backtracking --output-file=requirements.txt requirements.in
+#    pip-compile --allow-unsafe --generate-hashes --no-emit-index-url --strip-extras --pip-args='--only-binary :all:' --resolver=backtracking --output-file=requirements.txt requirements.in
 #
 attrs==21.2.0 \
     --hash=sha256:149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1 \
diff --git a/lib/modules/manager/pip-compile/common.ts b/lib/modules/manager/pip-compile/common.ts
index 951ca2c82fb..d7b0f737f90 100644
--- a/lib/modules/manager/pip-compile/common.ts
+++ b/lib/modules/manager/pip-compile/common.ts
@@ -126,6 +126,7 @@ const commonOptionsWithArguments = [
 const pipOptionsWithArguments = [
   '--resolver',
   '--constraint',
+  '--pip-args',
   ...commonOptionsWithArguments,
 ];
 const uvOptionsWithArguments = [

Am I on the right track?
Would this be a reasonable change?

[pcjedi]

i would like to pass

--pip-args --uploaded-prior-to P7D

which leads to the same error message as reported by OP