Skip searching the `pyproject.toml` for dependencies if requirements-files is explicitly passed #1034

fpgmaas · 2025-01-23T15:35:55Z

…licitly set by the user

PR Checklist

A description of the changes is added to the description of this PR.
If there is a related issue, make sure it is linked to this PR.
If you've fixed a bug or added code that should be tested, add tests!
If you've added or modified a feature, documentation in docs is updated

Description of changes

Currently, we search for dependencies in the following order:

    - Search for pyproject.toml with a [tool.poetry] section
    - Search for pyproject.toml with a [tool.uv.dev-dependencies] section
    - Search for pyproject.toml with a [tool.pdm.dev-dependencies] section
    - Search for pyproject.toml with a [project] section
    - Search for requirements.txt or requirements.in files

However, this causes issues for users who have a pyproject.toml with a valid configuration, but still want to use the requirements.txt file for their dependency scanning by deptry. At the same time, it is a bit strange that deptry searches the pyproject.toml for dependencies, even if the user explicitly passed the requirements-files parameter.

We could solve both issues by skipping the search for dependencies in pyproject.toml when the user specifies requirements-files explicitly.

…licitly set by the user

codecov · 2025-01-23T15:45:37Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 93.1%. Comparing base (9e4ecd1) to head (4f1149f).
Report is 9 commits behind head on main.

Additional details and impacted files

@@          Coverage Diff          @@
##            main   #1034   +/-   ##
=====================================
  Coverage   93.0%   93.1%           
=====================================
  Files         37      37           
  Lines        994    1000    +6     
  Branches      99     101    +2     
=====================================
+ Hits         925     931    +6     
  Misses        55      55           
  Partials      14      14

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

fpgmaas · 2025-01-23T16:09:31Z

python/deptry/dependency_getter/builder.py

@@ -41,6 +43,15 @@ class DependencyGetterBuilder:
    def build(self) -> DependencyGetter:
        pyproject_toml_found = self._project_contains_pyproject_toml()

+        if not self.using_default_requirements_files:
+            if not self._any_requirements_files_exists():
+                raise FileNotFoundError(  # noqa: TRY003


Added noqa here. Alternative of creating a class called RequirementsFilesSpecifiedExplicitlyButNotFound feels a bit superfluous 🙈

mkniewallner

I'm wondering if it wouldn't be cleaner to expose a --package-manager <name> argument on the CLI to be able to enforce a specific manager if needed. This would have the benefit of being more generic, as it could solve the issue for any package manager.

fpgmaas · 2025-01-24T19:23:35Z

I'm wondering if it wouldn't be cleaner to expose a --package-manager <name> argument on the CLI to be able to enforce a specific manager if needed. This would have the benefit of being more generic, as it could solve the issue for any package manager.

I think that also makes sense! The main reason I chose the approach in this PR is that as a user I'd find it counterintuitive that if I pass requirements-files, deptry still attempt to fetch dependencies from the pyproject.toml file. Adding a --package-manager would not directly solve that, although it does give the user a way to work around it.

Given the fact that it probably very rarely happens though, I agree a --package-manager flag would be better.

Skip the pyproject.toml for dependencies if requirements-files is exp…

341f7d7

…licitly set by the user

fpgmaas marked this pull request as draft January 23, 2025 15:36

fix typing and improve docstring

2d43ce8

fpgmaas linked an issue Jan 23, 2025 that may be closed by this pull request

Add a way to ignore the pyproject.toml and only use the requirements.txt #911

Open

fpgmaas added 3 commits January 23, 2025 16:58

improve exception and unit test

aba42ef

fix test

0c8fa08

fix test

4f1149f

fpgmaas commented Jan 23, 2025

View reviewed changes

fpgmaas requested a review from mkniewallner January 23, 2025 16:13

mkniewallner reviewed Jan 23, 2025

View reviewed changes

fpgmaas closed this Jan 27, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Skip searching the `pyproject.toml` for dependencies if requirements-files is explicitly passed #1034

Skip searching the `pyproject.toml` for dependencies if requirements-files is explicitly passed #1034

fpgmaas commented Jan 23, 2025 •

edited

Loading

codecov bot commented Jan 23, 2025 •

edited

Loading

fpgmaas Jan 23, 2025

mkniewallner left a comment

fpgmaas commented Jan 24, 2025 •

edited

Loading

Skip searching the pyproject.toml for dependencies if requirements-files is explicitly passed #1034

Skip searching the pyproject.toml for dependencies if requirements-files is explicitly passed #1034

Conversation

fpgmaas commented Jan 23, 2025 • edited Loading

codecov bot commented Jan 23, 2025 • edited Loading

Codecov Report

fpgmaas Jan 23, 2025

Choose a reason for hiding this comment

mkniewallner left a comment

Choose a reason for hiding this comment

fpgmaas commented Jan 24, 2025 • edited Loading

Skip searching the `pyproject.toml` for dependencies if requirements-files is explicitly passed #1034

Skip searching the `pyproject.toml` for dependencies if requirements-files is explicitly passed #1034

fpgmaas commented Jan 23, 2025 •

edited

Loading

codecov bot commented Jan 23, 2025 •

edited

Loading

fpgmaas commented Jan 24, 2025 •

edited

Loading