feat: support extracting package groups from v2+ poetry.lock files
#1477
+305
−6
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
(fwiw I plan to port this to osv-scalibr tomorrow, so this might end up getting closed but the actual core implementation should still be reviewable) |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #1477 +/- ##
==========================================
+ Coverage 66.93% 66.95% +0.01%
==========================================
Files 197 197
Lines 18621 18632 +11
==========================================
+ Hits 12464 12475 +11
Misses 5471 5471
Partials 686 686 ☔ View full report in Codecov by Sentry. |
cuixq
approved these changes
Jan 7, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Poetry v2 lockfiles now include the groups a package belongs to, meaning that we can support extracting them to allow filtering.
Similar to Maven and NPM, Poetry explicitly notes everything that isn't in an explicit group as being in the
maingroup meaning for packages that are considered in that group we always use an empty slice instead since that's how we indicate the "production" group.I generated the final fixture using the following
pyproject.toml:Technically we don't need the
python_versionconstraint onproto-plusfor this feature, but I realised we don't have any existing fixtures for this situation so I figured I'd sneak it in as part of this given it seems like we already support the lockfile having a package multiple names with different versionsThis is a sister PR to google/osv-scalibr#376 since
osv-scanneris still in the middle of transitioning to usingosv-scalibr- the core logic is exactly the same, and either (or both) should be fine to land