Use conda-lock so we know which versions we're using

[alisonrclarke]

I'm in the process of unpinning the versions in our environment.yml file so it can be used on both OS X and Linux (for CI). However, we should try to keep track of a working set of packages with a lock file.

Suggest using condo-lock: https://github.com/conda-incubator/conda-lock/ to create lock files for OS X and Linux.

[sjmf]

Currently, we cannot use conda-lock on this project because the Zentra-API dependency is installed directly from the git repository, using git+https://github.com/mt-climate-office/Zentra-API.

The Zentra API Library is not yet available via PyPI and may never be: it is unclear if the project is still maintained. I have opened an issue on that project to enquire: mt-climate-office/Zentra-API#2 – If the maintainers do not respond (e.g. before December), I will look into forking the repository and uploading it to PyPI myself, as the repo is GPL-v3 licensed thus allowing distribution.

Currently, attempting to use conda-lock on our base dependencies results in the following error:

pkg_resources.extern.packaging.requirements.InvalidRequirement: Parse error at "'+https:/'": Expected string_end

As the Zentra-API repo is not private, this should work per the conda-forge documentation. However, support for such URLs currently appears to be broken: this is referenced in the conda-lock issue here: conda/conda-lock#4