Context
As part of the org-wide Python packaging modernization (public-engineering#506), repos are migrating from pip-compile's requirements/*.txt to pyproject.toml + uv.lock. openedx-platform's migration is tracked in public-engineering#543.
find_python_dependencies (used by openedx-platform's .github/workflows/check_python_dependencies.yml) currently only knows how to scan flat pip-compile requirements/*.txt files (via --req-file) for undocumented git-hosted dependencies missing an issue-link comment, e.g.:
find_python_dependencies --req-file requirements/edx/base.txt --req-file requirements/edx/testing.txt --ignore ...
Once a repo moves to pyproject.toml, git-hosted dependencies are declared as direct PEP 508 references inline in [project.dependencies] (e.g. "pkg @ git+https://github.com/owner/repo.git@TAG"), not in a separate flat requirements file. find_python_dependencies has no way to scan pyproject.toml/uv.lock for these today.
Request
Teach find_python_dependencies to also accept pyproject.toml (and/or uv.lock) as an input, scanning [project.dependencies] (and any [dependency-groups] entries) for git-hosted (@ git+...) references lacking an issue-link comment, mirroring the existing requirements.txt behavior.
Impact
Until this is supported, openedx-platform has disabled check_python_dependencies.yml (set to workflow_dispatch only, job gated with if: false) rather than have it silently fail to scan anything after its input files (requirements/edx/base.txt, requirements/edx/testing.txt) were deleted in the pyproject.toml/uv migration. This is a gap other repos following the same migration path will hit too.
Context
As part of the org-wide Python packaging modernization (public-engineering#506), repos are migrating from pip-compile's
requirements/*.txttopyproject.toml+uv.lock. openedx-platform's migration is tracked in public-engineering#543.find_python_dependencies(used by openedx-platform's.github/workflows/check_python_dependencies.yml) currently only knows how to scan flat pip-compilerequirements/*.txtfiles (via--req-file) for undocumented git-hosted dependencies missing an issue-link comment, e.g.:Once a repo moves to
pyproject.toml, git-hosted dependencies are declared as direct PEP 508 references inline in[project.dependencies](e.g."pkg @ git+https://github.com/owner/repo.git@TAG"), not in a separate flat requirements file.find_python_dependencieshas no way to scanpyproject.toml/uv.lockfor these today.Request
Teach
find_python_dependenciesto also acceptpyproject.toml(and/oruv.lock) as an input, scanning[project.dependencies](and any[dependency-groups]entries) for git-hosted (@ git+...) references lacking an issue-link comment, mirroring the existing requirements.txt behavior.Impact
Until this is supported, openedx-platform has disabled
check_python_dependencies.yml(set toworkflow_dispatchonly, job gated withif: false) rather than have it silently fail to scan anything after its input files (requirements/edx/base.txt,requirements/edx/testing.txt) were deleted in the pyproject.toml/uv migration. This is a gap other repos following the same migration path will hit too.