Is it advisable to only list package names, in TOML that can't be parsed from source comments with the AST parser?

This at the top of a notebook is less reproducible and less secure than a requirements.txt with checksums or better:

  %pip install ipytest pytest-cov jupyterlab-miami-nights

  %pip install -q -r requirements.txt

  %pip?
  %pip --help

But you don't need to run pip every time you run a notebook, so it's better to comment out the install steps. But then it requires manual input to run the notebook in a CI task, if it doesn't install everything in a requirements.txt and/or environment.yml or [Jupyter REES] first before running the notebook like repo2docker:

  #%pip install -r  requirements.txt
  #!pip --help
  #!mamba env update -f environment.yml
  #!pixi install --manifest-path pyproject.toml_or_pixi.toml