Standard Python support

[flying-sheep]

There’s exactly two standard ways of specifying dependencies, none of which dependabot supports.

1. PEP 517’s prepare_metadata_for_build_wheel().

   The legacy way to specify Python dependencies is requirements.txt. The standard way is having a PEP 517 build system configured. That build system can optionally define a function called prepare_metadata_for_build_wheel. If that function exists, the dependencies can be obtained (from the metadata) without building a wheel, otherwise build_wheel() needs to be called.

   Code to just do the above would look like:

   import build
   deps = build.ProjectBuilder("path/to/project").get_dependencies("sdist")
   # or
   deps = build.ProjectBuilder("path/to/project").get_dependencies("wheel") - {"wheel"}

2. PEP 631 a new standardized way to specify dependencies in a Python project (now merged into PEP 621).

   It’s supported by flit and a bunch of other new build backends. So if you want to continue your (incomplete) way of just parsing files and not calling into Python, this needs to be supported.

[flying-sheep]

This should be pretty straightforward (if one knows ruby, which I don’t). You already have

1. a format preserving TOML parser (for poetry support)
2. a parser and serializer for the PEP 508 dependency specifier language (for requirements.txt support)

So you just have to read the TOML lists project.dependencies and project.optional-dependencies.* instead of the toml tables tool.poetry.dependencies and tool.poetry.extras.*, and then use the PEP 508 handling logic instead of the poetry version specifier logic

[dreinon]

I just got a dependabot PR of my project using pdm! Hope this has been finally accepted 🙂
EDIT: False alarm, it's a dependency from github actions 🙁 , too good to be true haha

[drewcassidy]

now that setuptools supports PEP621, It would be nice to see this

[drewcassidy]

So you just have to read the TOML lists project.dependencies and project.optional-dependencies.* instead of the toml tables tool.poetry.dependencies and tool.poetry.extras.*, and then use the PEP 508 handling logic instead of the poetry version specifier logic

I would say to read build-system.requirements too. some of those things may be pinned too (like a project using pybind11).

[ofek]

I would say to read build-system.requirements too

Minor correction: build-system.requires