What would cause an automatic update of Pipfile.lock?

Question

Yesterday I encountered a problem in a GitHub Actions workflow that issues these commands:

pip install pipenv
pipenv install --dev
pipenv run dbt deps

dbt is a tool installed from pip package dbt-core. Here is Pipfile:

[[source]]
url = "https://pypi.org/simple"
verify_ssl = true
name = "pypi"

[packages]
dbt-core = "==1.5.4"
dbt-snowflake = "~=1.5"

[dev-packages]
pytest = "==7.1.2"
pytest-env = "==0.6.2"
schemachange = "==3.5.3"
pre-commit = "*"
black = "*"
isort = "*"
cryptography= "==41.0.6"
mypy = "==1.3.0"

[requires]
python_version = "3.10"

The error in my GitHub Actions workflow run was:

/bin/sh: 1: dbt: not found

Evidently dbt had not been installed when pipenv install --dev was executed. I found the root cause, dbt did not appear in Pipfile.lock so I issued pipenv lock, pushed the new Pipfile.lock, and my workflow then succeeded.

There is a mystery here though. The workflow had been working successfully for quite some time before yesterday's failure and there was no change evident to me that could have suddenly caused it to fail.

I compared the logs of the most recently succeeded run:

Successfully installed certifi-2023.11.17 distlib-0.3.8 filelock-3.13.1 pipenv-2023.11.15 platformdirs-4.1.0 setuptools-69.0.3 virtualenv-20.25.0.
Loading .env environment variables...
Pipfile.lock (5e4bb6) out of date, updating to (a67c89)...
Locking [packages] dependencies...
Building requirements...
Resolving dependencies...
Success!
Locking [dev-packages] dependencies...
Building requirements...
Resolving dependencies...
Success!
Updated Pipfile.lock (65984eea698a6fd36e7dbe3756a5185f36aa6e464d0ed1e9a3aa506b06a67c89)!
Installing dependencies from Pipfile.lock (a67c89)...
Installing dependencies from Pipfile.lock (a67c89)...
To activate this project's virtualenv, run pipenv shell.
Alternatively, run a command inside the virtualenv with pipenv run.
Loading .env environment variables...
12:05:49 Running with dbt=1.5.4.

with the logs of the failed run:

Successfully installed certifi-2023.11.17 distlib-0.3.8 filelock-3.13.1 pipenv-2023.11.15 platformdirs-4.1.0 setuptools-69.0.3 virtualenv-20.25.0
Loading .env environment variables...
Installing dependencies from Pipfile.lock (1f3b12)...
Installing dependencies from Pipfile.lock (1f3b12)...
To activate this project's virtualenv, run pipenv shell.
Alternatively, run a command inside the virtualenv with pipenv run.
Loading .env environment variables...
/bin/sh: 1: dbt: not found. Error: Process completed with exit code 127.

It is clear to see that on the successful run pipenv realised that Pipfile.lock was out of date (which, I assume, means that Pipfile.lock is not consistent with Pipfile) and hence updated it:

Pipfile.lock (5e4bb6) out of date, updating to (a67c89)...

However it did not do that on the failed run.

My question is....why? More specifically:

• In what circumstances would pipenv automatically update the lock file?
• In what circumstances would pipenv not automatically update the lock file?