Fix fetching of astropy-helpers on Python 2

[astrofrog]

As reported on #359 - the issue is that if the astropy-helpers submodule is not present or not checked out on Python 2, ah_bootstrap.py will then fetch the absolute latest version of astropy-helpers. This PR introduces a strict upper limit to the versions that will be fetched.

I considered another solution that would re-use _do_upgrade to only get the latest bugfix release, but when the submodule is not checked out, ah_bootstrap.py is not really tied to a specific astropy-helpers version - in fact maybe the reason some people don't include the submodule is precisely to not have to update astropy-helpers as often. So I think the fix in this PR is the right way to go.

This should be backported to v2.0.x - by the way this does raise the question of how we will update the astropy-helpers in different repos with these releases - how do we know whether to use the latest v2.0.x release or the v3.0.0 release? (maybe we can do some heuristics based on setup.py and e.g. .travis.yml?)

[astropy-bot]

Hi there @astrofrog 👋 - thanks for the pull request! I'm just a friendly 🤖 that checks for issues related to the changelog and making sure that this pull request is milestoned and labeled correctly. This is mainly intended for the maintainers, so if you are not a maintainer you can ignore this, and a maintainer will let you know if any action is required on your part 😃.

Everything looks good from my point of view! 👍

If there are any issues with this message, please report them here.

[astrofrog]

There is a separate PR to v2.0.x: #363 (this sets the upper version for Python 2 to 3.x)

[bsipocz]

This should be backported to v2.0.x - by the way this does raise the question of how we will update the astropy-helpers in different repos with these releases - how do we know whether to use the latest v2.0.x release or the v3.0.0 release? (maybe we can do some heuristics based on setup.py and e.g. .travis.yml?)

What I had in mind is that we keep doing the v2.0.x auto-updates, but for 3.0.0, we open an issue in their issue tracker to emphasize that it's python3 only and ask them to opt in when they are ready for it. We can run then the update based on a separate list, not the full affiliate registry.

[astrofrog]

Ah right yes, good idea - in fact we could just host the list of packages to update in the tools repo with for each package the major version of astropy-helpers to use - we could then include a note in the auto-update PR (rather than opening a separate issue) that they can do a PR to that list to opt in?

[bsipocz]

@astrofrog - Yes, that's a good idea.

[bsipocz]

Merging now. The failures are related to #361 (setuptools) and the sphinx-dev issue will be fixed in #365. On slack we agreed to temporarily allow to fail the setuptools >27 tests until #361 is figured out, I'll do that separately.

[bsipocz]

Thanks @astrofrog!