repomatic.deps.requirements module

The requirement arrays of a pyproject.toml, and the package names in them.

Shared by the three modules that read what a project declares: the version policy (repomatic.deps.policy), the shippability gate (repomatic.deps.shippable) and the git-to-release swap (repomatic.deps.sources). Each array is located by its TOML path, the one spelling every report uses.

repomatic.deps.requirements.LOWER_BOUND_OPERATORS = frozenset({'>', '>='})

PEP 440 operators that put a floor under a requirement.

The one spelling of “lower bound” every check tests specifiers against. A site that also treats an exact pin as a bound unions PIN_OPERATOR in explicitly, so the difference stays a decision rather than an accident.

repomatic.deps.requirements.PIN_OPERATOR = frozenset({'=='})

The PEP 440 operator pinning a requirement to one version.

A pin demands its version the way a floor demands its minimum, so the checks asking “can PyPI serve what this declaration requires” test both; the checks looking for the managed git-branch floor idiom deliberately do not.

repomatic.deps.requirements.PUBLISHED_TABLES = ('project', 'project.optional-dependencies')

Tables whose requirement arrays land in the published Requires-Dist.

[dependency-groups] (PEP 735) is deliberately absent: it never reaches distribution metadata. Neither does [build-system].requires, which only the build front end reads.

repomatic.deps.requirements.BUILD_TABLE = 'build-system'

The table whose requires array lists the build dependencies.

repomatic.deps.requirements.TOML_TABLE_HEADER = re.compile('\\s*\\[{1,2}\\s*(?P<path>[^]]+?)\\s*\\]{1,2}\\s*$')

A [table] or [[array of tables]] header, capturing its dotted path.

class repomatic.deps.requirements.RequirementArray(table, key, items)

Bases: object

One requirement array of a pyproject.toml.

table: str

The dotted path of the table holding the array (project, project.optional-dependencies, dependency-groups, build-system).

key: str

The array’s key in that table: dependencies, an extra, a group, or requires.

items: list[Any]

The live array, so a caller can rewrite an item in place.

property location: str

The TOML path of the array, as every report spells it.

property published: bool

Whether the array reaches the published Requires-Dist.

What separates a finding an installer trips over from one only a contributor does: see PUBLISHED_TABLES.

requirements()

Yield each parsable requirement, with its index and its raw string.

Non-string items (like {include-group = …} entries) and malformed specifiers are skipped.

Return type:

Iterator[tuple[int, str, Requirement]]

repomatic.deps.requirements.read_project(pyproject_path)

Parse pyproject_path read-only, through the shared TOML cache.

Parameters:

pyproject_path (Path) – The pyproject.toml file, whatever its name.

Return type:

Mapping[str, Any]

Returns:

The parsed document, or an empty mapping when the file is missing. Shared with the cache: treat it as read-only.

repomatic.deps.requirements.requirement_arrays(doc)

Yield every requirement array of a parsed pyproject.toml.

Covers [project] dependencies, each [project.optional-dependencies] extra, each [dependency-groups] group, and [build-system] requires. Values that are not lists are skipped.

Parameters:

doc (Mapping[str, Any]) – The parsed pyproject.toml.

Return type:

Iterator[RequirementArray]

repomatic.deps.requirements.parse_requirement(item)

Parse a requirement array item, returning None for anything else.

Parameters:

item (object) – One entry of a requirement array.

Return type:

Requirement | None

Returns:

The parsed requirement, or None for a non-string entry or an unparsable specifier.

repomatic.deps.requirements.dev_floor(doc, name)

The highest .dev lower bound declared for name, if any.

Scans every requirement array for lower-bound clauses (>= or >) whose version is a dev release. The highest one is the project’s declared “awaited release” threshold.

Parameters:

• doc (Mapping[str, Any]) – The parsed pyproject.toml.

• name (str) – Package name (any capitalization or separator style).

Return type:

str | None

Returns:

The floor version string, or None when the package has no dev floor (a git override is then outside the managed idiom).

repomatic.deps.requirements.iter_toml_lines(text)

Yield each line of a TOML text, with its number and the table it sits in.

Enough TOML parsing to place a line: the parsed document holds values and comments, but no line numbers, and a reader needs one to find a declaration. A header line already belongs to the table it opens.

Parameters:

text (str) – The TOML text.

Return type:

Iterator[tuple[int, str, str]]

Returns:

(line number, table path, line) triples. Numbers start at 1, and the table path is empty above the first header.

repomatic.deps.requirements.pep503_pattern(name)

A regex matching name in any spelling PEP 503 treats as equal.

A canonical name separates its parts with -, where a declaration may spell any of -`, `_ or .. Match it case-insensitively, since the declaration also picks its own case.

Parameters:

name (str) – A package name, in any spelling.

Return type:

str

Returns:

The pattern, with no anchors or flags.