The requirements file format allows to specify dependency versions using logical operators (for example chardet>=3.0.4) or specify dependencies without any versions. In this case the pip install -r requirements.txt command will always try to install the latest available package version. To be sure that the cache will be used, please stick to a specific dependency version and update it manually if necessary.

Although, it looks like both this and the caching we are currently doing end up being counter productive because we do not pin tightly enough in our requirements file (other than the min version run).

Is there an easy way to tell if this is hitting the cache before merging?
From the action examples, it looks like you might need to add the dependency wildcard path.

cache-dependency-path: 'requirements/*/*.txt'

I'm not sure this is doing the right thing at all (and have concerns about our current caching as well!)

I spent some time yesterday and today trying to get tests to run on old versions of Matplotlib which....was harder than I wished it would be. We may want to have one very pinned requirements file (possible managed by one of the auto-bump services 😞 or tools) that we rename to fully-pinned-v3.6.x.txt on branching. We can then use that (exclusively) for tests on the backport branch which should hopefully reduce the amount of dep-only backports we have to do (and provide a useful reference for anyone who wants to get old versions testing again).

This is bit rotted and I do not think this is the right apporach by itself. Replaced by #23548