fix: add support for pyproject.toml and env.yml/env.yaml files #550
Conversation
|
Please note that this PR in the safety_schemas repo is needed for this to work: https://github.com/pyupio/safety_schemas/pull/1 |
|
Warning Rate limit exceeded@dylanpulver has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 18 minutes and 33 seconds before requesting another review. How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. WalkthroughThe changes introduce support for handling Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant FileFinder
participant PyProjectTomlHandler
participant DependencyParser
User->>FileFinder: Scan directory
FileFinder->>PyProjectTomlHandler: Process pyproject.toml
PyProjectTomlHandler->>DependencyParser: Extract dependencies
DependencyParser-->>PyProjectTomlHandler: Return dependencies
PyProjectTomlHandler-->>FileFinder: Provide dependency info
FileFinder-->>User: Display scan results
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (5)
- pyproject.toml (1 hunks)
- safety/scan/command.py (2 hunks)
- safety/scan/ecosystems/python/dependencies.py (3 hunks)
- safety/scan/finder/file_finder.py (3 hunks)
- safety/scan/finder/handlers.py (3 hunks)
Additional context used
Ruff
safety/scan/finder/handlers.py
5-5:
typing.Tupleimported but unusedRemove unused import:
typing.Tuple(F401)
safety/scan/finder/file_finder.py
11-11:
.handlers.PyProjectTomlHandlerimported but unusedRemove unused import:
.handlers.PyProjectTomlHandler(F401)
161-161: Use
enumerate()for index variablelevelinforloop(SIM113)
Additional comments not posted (9)
safety/scan/finder/handlers.py (4)
112-113: LGTM!The empty implementation of the
download_required_assetsmethod is appropriate since there are no required assets to download for Safety project files, as indicated by the docstring.
116-162: LGTM!The implementation of the
PyProjectTomlHandlerclass looks good:
- It correctly extends the
FileHandlerclass and sets the ecosystem toEcosystem.PYPROJECT_TOML.- The
download_required_assetsmethod fetches both the full and partial Safety databases, consistent with thePythonFileHandlerclass.- The
can_handlemethod correctly checks for thepyproject.tomlfile name and returns the correspondingFileType.- The
handlemethod reads thepyproject.tomlfile using thetomllibrary and extracts dependencies from the relevant sections.- The extracted dependencies are returned as a set, which is an appropriate data structure for unique dependencies.
Great job!
177-177: LGTM!Adding the
PyProjectTomlHandlerto theECOSYSTEM_HANDLER_MAPPINGdictionary is necessary and correctly implemented. This associates the handler with the correspondingEcosystem.PYPROJECT_TOMLecosystem.
Line range hint
1-179: Overall, the changes in this file look great!The introduction of the
PyProjectTomlHandlerclass is a valuable addition to support handlingpyproject.tomlfiles. The implementation is consistent with the existingFileHandlerclasses and follows the necessary conventions. The class correctly extends theFileHandlerclass and implements the required methods such asdownload_required_assets,can_handle, andhandleappropriately.The integration of the
PyProjectTomlHandlerwith the existing codebase is smooth, and the class is correctly added to theECOSYSTEM_HANDLER_MAPPINGdictionary to associate it with the corresponding ecosystem.Apart from the minor issues mentioned in the previous comments, the overall changes in this file are well-structured and contribute positively to the project's functionality.
Great work!
Tools
Ruff
167-167: Redefinition of unused
download_required_assetsfrom line 121(F811)
safety/scan/finder/file_finder.py (1)
153-160: LGTM!The new code block correctly handles the special files
pyproject.toml,env.yml, andenv.yamlby adding them to thefilesdictionary under their respective file types. This enhances the functionality of the file finder to support these important configuration files.safety/scan/ecosystems/python/dependencies.py (2)
273-308: LGTM!The
read_pyproject_toml_dependenciesfunction correctly reads dependencies from apyproject.tomlfile and yieldsPythonDependencyobjects. It handles both versioned and unversioned dependencies in the relevant sections of the TOML file.The implementation integrates well with the existing
PythonDependencymodel and thePythonSpecificationclass, enabling support forpyproject.tomlfiles in the project.
330-331: LGTM!The changes to the
get_dependenciesfunction correctly integrate the handling ofFileType.PYPROJECT_TOMLfiles by calling the newly introducedread_pyproject_toml_dependenciesfunction.This modification ensures that dependencies from
pyproject.tomlfiles are properly processed and returned asPythonDependencyobjects, seamlessly integrating with the existing dependency resolution logic.safety/scan/command.py (2)
48-48: LGTM!The new member
PYPROJECT_TOMLis added correctly to theScannableEcosystemsenumeration to support scanning projects defined by apyproject.tomlfile.
Line range hint
1-1: Skipped reviewingsystem_scanfunction.The
system_scanfunction is not changed in the provided code, so there is nothing to review.
Tested this manually by adding these files to the repo and conifrming they are picked up. This supports both versions: env.yml and env.yaml
Original issue: #505
Summary by CodeRabbit
New Features
pyproject.tomlfiles.pyproject.toml.pyproject.tomlfiles.Improvements
pyproject.tomlfor improved dependency management.Bug Fixes