feat(drift): check dependency claims against pyproject.toml - #185
Open
abhinav-phi wants to merge 1 commit into
Open
feat(drift): check dependency claims against pyproject.toml#185abhinav-phi wants to merge 1 commit into
abhinav-phi wants to merge 1 commit into
Conversation
loadAllDependencies read only package.json files, so Python dependency claims (FastAPI, Celery, SQLAlchemy...) were reported as DEPENDENCY_MISSING whenever the project declared them in pyproject.toml instead. Add a bounded line-scan parser over the shapes a claim checker needs: the dependencies array inside [project], per-extra arrays in [project.optional-dependencies], and key-value pairs in [tool.poetry.dependencies]. No TOML dependency — the package name is the identity and the raw version specifier rides along as evidence. PEP 508 extras (celery[redis]) parse to the base package name. Per the issue's one-ecosystem-at-a-time guidance, this ships pyproject only; Cargo.toml and go.mod stay stubs for a follow-up. Resolves mex-memory#3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #3 (pyproject.toml only, per the issue's one-ecosystem-at-a-time note — Cargo.toml and go.mod remain follow-ups).
Problem
loadAllDependenciesinsrc/drift/checkers/dependency.tsread onlypackage.jsonfiles, so Python dependency claims — FastAPI, Celery, SQLAlchemy — were reportedDEPENDENCY_MISSINGwhenever the project declared them inpyproject.tomlinstead.What
A bounded line-scan parser (no TOML library) covering exactly the shapes a claim checker needs:
[project]→dependencies = [...](PEP 621)[project.optional-dependencies]→ per-extra arrays[tool.poetry.dependencies]→ key-value pairs (Poetry)celery[redis]==5.4.0) parse to the base package name; the raw specifier rides along as version evidence, which keeps the existing substring-basedVERSION_MISMATCHlogic working unchanged.Deliberately out of scope: dynamic declarations (
dynamic = ["dependencies"]), inline-table arrays spanning lines, and everything else in the file — the checker needs name identity, not a full TOML model.requires-python/pythonkeys are skipped (interpreter constraints, not packages).Tests
Two new cases in
test/checkers.test.ts: claims checked against[project].dependencies(missing one still reported), and optional-dependencies + Poetry tables read withpythoncorrectly skipped. Existing 95 checker tests pass;npm run typecheckgreen.