Repository navigation
fix(python): report dependency declarations deptry cannot read instead of skipping silently - #200
Open
tuyentran4992 wants to merge 2 commits into
Open
tuyentran4992 wants to merge 2 commits into
tuyentran4992 wants to merge 2 commits into
Conversation
…d of skipping silently A project that declares its dependencies only in setup.py, setup.cfg or a Pipfile was silently never checked: deptry failed with DependencySpecificationNotFoundError, the sensor printed [] and the run was reported clean. The sensor now reports a single parse-error finding that carries one issue per existing declaration file. A project with no declaration file, and every other deptry failure, behave exactly as before.
devill
reviewed
Oct 15, 2026
Comment on lines
+40
to
+45
| @pytest.mark.parametrize( | ||
| ("declaration", "contents"), DECLARATIONS, ids=[name for name, _ in DECLARATIONS] | ||
| ) | ||
| def test_dependencies_deptry_cannot_read_are_not_silently_skipped( | ||
| tmp_path: Path, deptry: str, declaration: str, contents: str | ||
| ) -> None: |
Collaborator
There was a problem hiding this comment.
CI's ruff check step fails on this PR: the parametrized test takes four arguments where the repo caps at three (max-args = 3 in the root pyproject). The two data arguments are one thing — a declaration file — and its contents are fixture data like any other, so a named constant keyed by filename keeps each argument meaningful and passes:
DECLARATION_CONTENTS = {
"setup.py": "from setuptools import setup\n\nsetup(name='demo', version='0.0.0')\n",
"setup.cfg": "[metadata]\nname = demo\nversion = 0.0.0\n\n"
"[options]\ninstall_requires =\n attrs\n",
"Pipfile": "[packages]\nattrs = '*'\n",
}
@pytest.mark.parametrize(
"declaration", DECLARATION_CONTENTS, ids=list(DECLARATION_CONTENTS)
)
def test_dependencies_deptry_cannot_read_are_not_silently_skipped(
tmp_path: Path, deptry: str, declaration: str
) -> None:
(tmp_path / declaration).write_text(
DECLARATION_CONTENTS[declaration], encoding="utf-8"
)
devill
reviewed
Oct 15, 2026
Comment on lines
+46
to
+49
| "message": ( | ||
| f"dependencies declared in {declaration} are never " | ||
| "checked — deptry reads pyproject.toml or requirements " | ||
| "files only" |
Collaborator
There was a problem hiding this comment.
Could you make sure the explanation lands in details.content rather than details.message? The shared guides print content after the file, and nothing renders message, so as written the user never sees why the run failed.
Suggested change
| "message": ( | |
| f"dependencies declared in {declaration} are never " | |
| "checked — deptry reads pyproject.toml or requirements " | |
| "files only" | |
| "content": ( | |
| f"dependencies declared in {declaration} are never " | |
| "checked — deptry reads pyproject.toml or requirements " | |
| "files only" | |
| ), |
…anation via details.content Addresses the two review points: the parametrized test keeps three parameters (fixture contents now live in a DECLARATION_CONTENTS mapping keyed by filename, satisfying PLR0913/max-args = 3), and the parse-error finding explains itself via details.content, which the shared guides render after the file. ruff check --config pyproject.toml src tests plugins: 0 errors; pytest plugins/python/tests: 7 passed.
Author
|
Both points are addressed in c43d5e2:
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #129.
A project that declares its dependencies only in
setup.py,setup.cfgor aPipfileis silently never checked: deptry fails withDependencySpecificationNotFoundError, the sensor prints[], and the run is reported clean.The sensor now reports a single
parse-errorfinding that carries one issue per existing declaration file, instead of printing[]. Two behaviours stay unchanged: a project with no declaration file at all keeps today's clean run ([], rc 0), and any other deptry failure still exits 2.Note that
parse-errorisenforced, so such projects fail the run rather than pass silently — the trade-off discussed on the issue.Test:
plugins/python/tests/test_dependencies_deptry_cannot_read_are_not_silently_skipped.py(each declaration format, plus the multi-file case), running alongside the existingtest_a_project_declaring_no_dependencies_is_clean.py.