refactor: remove all Poetry fallbacks and related code

Poetry dependencies are explicitly rejected; remove the remaining
Poetry-specific fallbacks for name/version/license, the Poetry
dependency parsing and version-conversion methods, and all
corresponding tests to avoid false expectations.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

src/main/java/io/github/guacsec/trustifyda/providers/PythonPyprojectProvider.java

@@ -349,10 +349,6 @@ protected String getRootComponentName() {
       if (name != null && !name.isBlank()) {
         return name;
       }
-      String poetryName = toml.getString("tool.poetry.name");
-      if (poetryName != null && !poetryName.isBlank()) {
-        return poetryName;
-      }
     } catch (IOException e) {
       log.fine("Failed to parse pyproject.toml for root component name: " + e.getMessage());
     }
@@ -367,10 +363,6 @@ protected String getRootComponentVersion() {
       if (version != null && !version.isBlank()) {
         return version;
       }
-      String poetryVersion = toml.getString("tool.poetry.version");
-      if (poetryVersion != null && !poetryVersion.isBlank()) {
-        return poetryVersion;
-      }
     } catch (IOException e) {
       log.fine("Failed to parse pyproject.toml for root component version: " + e.getMessage());
     }
@@ -390,10 +382,6 @@ public String readLicenseFromManifest() {
       if (licenseText != null && !licenseText.isBlank()) {
         return licenseText;
       }
-      String poetryLicense = toml.getString("tool.poetry.license");
-      if (poetryLicense != null && !poetryLicense.isBlank()) {
-        return poetryLicense;
-      }
     } catch (IOException e) {
       log.fine("Failed to parse pyproject.toml for license: " + e.getMessage());
     }
@@ -437,16 +425,6 @@ private void collectIgnoredDeps() throws IOException {
         checkIgnored(rawLines, dep, dep);
       }
     }
-
-    // [tool.poetry.dependencies] - production only
-    TomlTable poetryDeps = toml.getTable("tool.poetry.dependencies");
-    if (poetryDeps != null) {
-      for (String name : poetryDeps.keySet()) {
-        if (!"python".equalsIgnoreCase(name)) {
-          checkIgnored(rawLines, name, name);
-        }
-      }
-    }
   }
 
   List<String> parseDependencyStrings() throws IOException {
@@ -461,15 +439,6 @@ List<String> parseDependencyStrings() throws IOException {
       }
     }
 
-    TomlTable poetryDeps = toml.getTable("tool.poetry.dependencies");
-    if (poetryDeps != null) {
-      for (String name : poetryDeps.keySet()) {
-        if (!"python".equalsIgnoreCase(name)) {
-          deps.add(poetryDepToRequirement(name, poetryDeps, name));
-        }
-      }
-    }
-
     return deps;
   }
 
@@ -482,80 +451,6 @@ private void checkIgnored(List<String> rawLines, String searchToken, String depI
     }
   }
 
-  /**
-   * Converts a Poetry dependency entry to a pip-compatible requirement string. Poetry uses {@code
-   * ^} and {@code ~} operators which are not PEP 440, so they must be converted to PEP 440 ranges.
-   */
-  static String poetryDepToRequirement(String name, TomlTable table, String key) {
-    String version = null;
-    if (table.isString(key)) {
-      version = table.getString(key);
-    } else if (table.isTable(key)) {
-      TomlTable depTable = table.getTable(key);
-      if (depTable != null) {
-        version = depTable.getString("version");
-      }
-    }
-    if (version == null || version.isEmpty() || "*".equals(version)) {
-      return name;
-    }
-    return name + convertPoetryVersion(version);
-  }
-
-  /**
-   * Converts a Poetry version constraint to PEP 440 format.
-   *
-   * <ul>
-   *   <li>{@code ^X.Y.Z} → {@code >=X.Y.Z,<(X+1).0.0} (when X &gt; 0)
-   *   <li>{@code ^0.Y.Z} → {@code >=0.Y.Z,<0.(Y+1).0} (when Y &gt; 0)
-   *   <li>{@code ^0.0.Z} → {@code >=0.0.Z,<0.0.(Z+1)}
-   *   <li>{@code ~X.Y.Z} → {@code >=X.Y.Z,<X.(Y+1).0}
-   *   <li>PEP 440 operators ({@code >=}, {@code ==}, etc.) are passed through unchanged
-   * </ul>
-   */
-  static String convertPoetryVersion(String version) {
-    if (version.startsWith("^")) {
-      return convertCaret(version.substring(1));
-    }
-    if (version.startsWith("~") && !version.startsWith("~=")) {
-      return convertTilde(version.substring(1));
-    }
-    if (version.matches("^\\d.*")) {
-      return "==" + version;
-    }
-    // Already PEP 440 compatible (>=, ==, ~=, !=, etc.)
-    return version;
-  }
-
-  private static int parseNumericPart(String part) {
-    return Integer.parseInt(part.replaceAll("[^0-9].*", ""));
-  }
-
-  private static String convertCaret(String ver) {
-    String[] parts = ver.split("\\.");
-    int major = parseNumericPart(parts[0]);
-    int minor = parts.length > 1 ? parseNumericPart(parts[1]) : 0;
-    int patch = parts.length > 2 ? parseNumericPart(parts[2]) : 0;
-    String fullVer = major + "." + minor + "." + patch;
-
-    if (major > 0) {
-      return ">=" + fullVer + ",<" + (major + 1) + ".0.0";
-    }
-    if (minor > 0) {
-      return ">=" + fullVer + ",<0." + (minor + 1) + ".0";
-    }
-    return ">=" + fullVer + ",<0.0." + (patch + 1);
-  }
-
-  private static String convertTilde(String ver) {
-    String[] parts = ver.split("\\.");
-    int major = parseNumericPart(parts[0]);
-    int minor = parts.length > 1 ? parseNumericPart(parts[1]) : 0;
-    int patch = parts.length > 2 ? parseNumericPart(parts[2]) : 0;
-    String fullVer = major + "." + minor + "." + patch;
-    return ">=" + fullVer + ",<" + major + "." + (minor + 1) + ".0";
-  }
-
   static final class PipPackage {
     final String name;
     final String version;

src/test/java/io/github/guacsec/trustifyda/providers/Python_Pyproject_Provider_Test.java

@@ -18,7 +18,6 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalStateException;
-import static org.assertj.core.api.Assertions.assertThatNoException;
 
 import io.github.guacsec.trustifyda.Api;
 import io.github.guacsec.trustifyda.ExhortTest;
@@ -64,34 +63,6 @@ void test_parse_pep621_excludes_optional_dependencies() throws IOException {
     assertThat(deps).doesNotContain("click==8.0.4");
   }
 
-  @Test
-  void test_parse_poetry_dependencies_converts_to_pep440() throws IOException {
-    Path pyprojectPath =
-        Path.of("src/test/resources/tst_manifests/pip/pip_pyproject_toml_poetry/pyproject.toml");
-    var provider = new PythonPyprojectProvider(pyprojectPath);
-    List<String> deps = provider.parseDependencyStrings();
-    assertThat(deps)
-        .contains("anyio>=3.6.2,<4.0.0", "flask>=2.0.3,<3.0.0", "requests>=2.25.1,<3.0.0");
-  }
-
-  @Test
-  void test_parse_poetry_excludes_python() throws IOException {
-    Path pyprojectPath =
-        Path.of("src/test/resources/tst_manifests/pip/pip_pyproject_toml_poetry/pyproject.toml");
-    var provider = new PythonPyprojectProvider(pyprojectPath);
-    List<String> deps = provider.parseDependencyStrings();
-    assertThat(deps).doesNotContain("python");
-  }
-
-  @Test
-  void test_parse_poetry_excludes_dev_group_dependencies() throws IOException {
-    Path pyprojectPath =
-        Path.of("src/test/resources/tst_manifests/pip/pip_pyproject_toml_poetry/pyproject.toml");
-    var provider = new PythonPyprojectProvider(pyprojectPath);
-    List<String> deps = provider.parseDependencyStrings();
-    assertThat(deps).doesNotContain("click", "click>=8.0.4,<9.0.0");
-  }
-
   @Test
   void test_provideStack_rejects_poetry_dependencies() {
     Path pyprojectPath =
@@ -112,65 +83,6 @@ void test_provideComponent_rejects_poetry_dependencies() {
         .withMessageContaining("Poetry dependencies in pyproject.toml are not supported");
   }
 
-  @Test
-  void test_convert_caret_major() {
-    assertThat(PythonPyprojectProvider.convertPoetryVersion("^3.6.2")).isEqualTo(">=3.6.2,<4.0.0");
-  }
-
-  @Test
-  void test_convert_caret_zero_major() {
-    assertThat(PythonPyprojectProvider.convertPoetryVersion("^0.5.1")).isEqualTo(">=0.5.1,<0.6.0");
-  }
-
-  @Test
-  void test_convert_caret_zero_zero() {
-    assertThat(PythonPyprojectProvider.convertPoetryVersion("^0.0.3")).isEqualTo(">=0.0.3,<0.0.4");
-  }
-
-  @Test
-  void test_convert_caret_two_parts() {
-    assertThat(PythonPyprojectProvider.convertPoetryVersion("^2.0")).isEqualTo(">=2.0.0,<3.0.0");
-  }
-
-  @Test
-  void test_convert_tilde() {
-    assertThat(PythonPyprojectProvider.convertPoetryVersion("~1.2.3")).isEqualTo(">=1.2.3,<1.3.0");
-  }
-
-  @Test
-  void test_convert_tilde_two_parts() {
-    assertThat(PythonPyprojectProvider.convertPoetryVersion("~1.2")).isEqualTo(">=1.2.0,<1.3.0");
-  }
-
-  @Test
-  void test_pep440_passthrough() {
-    assertThat(PythonPyprojectProvider.convertPoetryVersion(">=2.0")).isEqualTo(">=2.0");
-    assertThat(PythonPyprojectProvider.convertPoetryVersion("==1.0.0")).isEqualTo("==1.0.0");
-    assertThat(PythonPyprojectProvider.convertPoetryVersion("~=1.4")).isEqualTo("~=1.4");
-  }
-
-  @Test
-  void test_convert_bare_version_prepends_equals() {
-    assertThat(PythonPyprojectProvider.convertPoetryVersion("1.2.3")).isEqualTo("==1.2.3");
-    assertThat(PythonPyprojectProvider.convertPoetryVersion("2.0")).isEqualTo("==2.0");
-  }
-
-  @Test
-  void test_convert_caret_prerelease_does_not_crash() {
-    assertThatNoException()
-        .isThrownBy(() -> PythonPyprojectProvider.convertPoetryVersion("^1.2.3b1"));
-    assertThat(PythonPyprojectProvider.convertPoetryVersion("^1.2.3b1"))
-        .isEqualTo(">=1.2.3,<2.0.0");
-  }
-
-  @Test
-  void test_convert_tilde_prerelease_does_not_crash() {
-    assertThatNoException()
-        .isThrownBy(() -> PythonPyprojectProvider.convertPoetryVersion("~1.2.3rc1"));
-    assertThat(PythonPyprojectProvider.convertPoetryVersion("~1.2.3rc1"))
-        .isEqualTo(">=1.2.3,<1.3.0");
-  }
-
   @Test
   void test_ignored_deps_collected_during_parsing() throws IOException {
     Path pyprojectPath =
@@ -193,14 +105,6 @@ void test_getRootComponentName_reads_pep621_name() {
     assertThat(provider.getRootComponentName()).isEqualTo("test-project");
   }
 
-  @Test
-  void test_getRootComponentName_reads_poetry_name() {
-    Path pyprojectPath =
-        Path.of("src/test/resources/tst_manifests/pip/pip_pyproject_toml_poetry/pyproject.toml");
-    var provider = new PythonPyprojectProvider(pyprojectPath);
-    assertThat(provider.getRootComponentName()).isEqualTo("test-project");
-  }
-
   @Test
   void test_getRootComponentName_falls_back_to_default() {
     Path pyprojectPath =
@@ -219,14 +123,6 @@ void test_getRootComponentVersion_reads_pep621_version() {
     assertThat(provider.getRootComponentVersion()).isEqualTo("2.0.0");
   }
 
-  @Test
-  void test_getRootComponentVersion_reads_poetry_version() {
-    Path pyprojectPath =
-        Path.of("src/test/resources/tst_manifests/pip/pip_pyproject_toml_poetry/pyproject.toml");
-    var provider = new PythonPyprojectProvider(pyprojectPath);
-    assertThat(provider.getRootComponentVersion()).isEqualTo("0.1.0");
-  }
-
   @Test
   void test_getRootComponentVersion_falls_back_to_default() {
     Path pyprojectPath =
@@ -245,15 +141,6 @@ void test_readLicenseFromManifest_reads_pep621_license() {
     assertThat(provider.readLicenseFromManifest()).isEqualTo("MIT");
   }
 
-  @Test
-  void test_readLicenseFromManifest_reads_poetry_license() {
-    Path pyprojectPath =
-        Path.of(
-            "src/test/resources/tst_manifests/pip/pip_pyproject_toml_poetry_license/pyproject.toml");
-    var provider = new PythonPyprojectProvider(pyprojectPath);
-    assertThat(provider.readLicenseFromManifest()).isEqualTo("Apache-2.0");
-  }
-
   // --- pip report parsing tests ---
 
   @Test