PHEP TBD: Packaging standards

[jtniehof]

This PHEP updates standards 1, 3, 4, and 10; these are part of the "software maturity" guidelines. It relates to #35 but does not close it.

I really need examples for the "best practices" section! Please, be bold and suggest!

• Rendered current text
• Changes from the current standards
• Google form to provide feedback on specific changes is linked from PyHC slack, to minimize spamming

[namurphy]

For developer-only dependencies, we should recommend that we use dependency groups rather than optional dependencies.

Optional dependencies can be installed with pip by end-users (e.g., with pip install antigravity[moon]) but dependency groups are not.

[jtniehof]

Points from today's discussion (poll results later):

• Revisit the "limit dependencies" standard. The core standard should be: installable in the PyHC environment. (@sapols: we should determine whether this is only accessible by using heliophysicsPy/pyhc-actions or if we can use heliophysicsPy/pyhc-docker-environment somehow if people don't use GHA).
• The "limited dependencies" moves into Best Practices, including @namurphy's comment, and the possibilities of subpackages and optional dependencies (where they make sense). Part of the reason for the original "limited dependencies" standard was problems in the early days of AstroPy, where dependencies wound up conflicting...the PyHC environment requirement gives us the hard requirement, and best practices can document how to minimize dependency conflicts (which is the bigger problem than just dependencies).
• There is support for requiring wheels before gold (although this is more complicated the more complicated the package...)
• conda-forge winds up being a transitive requirement on all dependencies, the ecosystem may not really be there yet. NASA is also now enforcing "no conda regardless of channel", more strict than the Anaconda license. mamba is a possible option. Some of this probably needs to be documented in best practices.
• Requiring "common OS" and "common arch" isn't a standard; if it's required, we have to list it. So should for the current wording, and gold becomes hard requirement of Windows x86_64 (but ARM is coming for us), Mac ARM, Linux x86_64 (maybe ARM?)