Handle --only-final with -r pylock.toml

Release control behaves identically for requirements coming from lock
files and other requirements.

Author: sbidoul

news/13950.feature.rst

@@ -0,0 +1 @@
+Honor ``--only-final`` when sourcing requirements with ``-r pylock.toml``.

src/pip/_internal/cli/req_command.py

@@ -353,6 +353,7 @@ def get_requirements(
                             package_dist,
                             filename,
                             options.format_control,
+                            options.release_control,
                             user_supplied=True,
                         )
                     )

src/pip/_internal/req/constructors.py

@@ -26,6 +26,7 @@
 from pip._internal.models.format_control import FormatControl
 from pip._internal.models.index import PyPI, TestPyPI
 from pip._internal.models.link import Link
+from pip._internal.models.release_control import ReleaseControl
 from pip._internal.models.wheel import Wheel
 from pip._internal.req.req_file import ParsedRequirement
 from pip._internal.req.req_install import InstallRequirement
@@ -595,6 +596,7 @@ def install_req_from_pylock_package(
     ),
     pylock_path_or_url: str,
     format_control: FormatControl,
+    release_control: ReleaseControl | None,
     user_supplied: bool,
 ) -> InstallRequirement:
     pass
@@ -666,6 +668,17 @@ def install_req_from_pylock_package(
             requirement_url = package_sdist_requirement_url(
                 pylock_path_or_url, package_dist
             )
+        if (
+            release_control is not None
+            and version.is_prerelease
+            # is False is intentional as allows_prereleases is tri-valued
+            and release_control.allows_prereleases(package.name) is False
+        ):
+            raise InstallationError(
+                f"Only final releases are allowed for package {package.name!r} "
+                f"but it is pinned to a prerelease version {version!s} "
+                f"in {pylock_path_or_url!r}."
+            )
         ireq = InstallRequirement(
             req=Requirement(f"{package.name}=={version}"),
             comes_from=pylock_path_or_url,

tests/data/lockfiles/pylock.prerelease-archive.toml

@@ -0,0 +1,11 @@
+lock-version = "1.0"
+created-by = "pip"
+
+[[packages]]
+name = "pkg-prerelease"
+
+[packages.archive]
+path = "../packages/pkg_prerelease-1.0a1-py3-none-any.whl"
+
+[packages.archive.hashes]
+sha256 = "5b170526e52d17d1b2e0162c006142e792293a7975a1f51df39035f1b14768d5"

tests/data/lockfiles/pylock.prerelease-wheel.toml

@@ -0,0 +1,13 @@
+lock-version = "1.0"
+created-by = "pip"
+
+[[packages]]
+name = "pkg-prerelease"
+version = "1.0a1"
+
+[[packages.wheels]]
+name = "pkg_prerelease-1.0a1-py3-none-any.whl"
+path = "../packages/pkg_prerelease-1.0a1-py3-none-any.whl"
+
+[packages.wheels.hashes]
+sha256 = "5b170526e52d17d1b2e0162c006142e792293a7975a1f51df39035f1b14768d5"

tests/data/packages/pkg_prerelease-1.0a1-py3-none-any.whl

@@ -197,3 +197,61 @@ def test_install_pylock_only_binary_ignored_for_archives(
     )
     assert "experimental" in result.stderr
     assert "Would install simple2-3.0" in result.stdout
+
+
+def test_install_pylock_default_prerelease(
+    script: PipTestEnvironment,
+    shared_data: TestData,
+) -> None:
+    """Prereleases are allowed by default."""
+    pylock_path = shared_data.lockfiles.joinpath("pylock.prerelease-wheel.toml")
+    result = script.pip(
+        "install",
+        "--no-index",
+        "--dry-run",
+        "-r",
+        pylock_path,
+        allow_stderr_warning=True,
+    )
+    assert "experimental" in result.stderr
+    assert "Would install pkg-prerelease-1.0a1" in result.stdout
+
+
+def test_install_pylock_reject_prerelease(
+    script: PipTestEnvironment,
+    shared_data: TestData,
+) -> None:
+    """Prereleases are rejected when --only-final is set."""
+    pylock_path = shared_data.lockfiles.joinpath("pylock.prerelease-wheel.toml")
+    result = script.pip(
+        "install",
+        "--no-index",
+        "--dry-run",
+        "-r",
+        pylock_path,
+        "--only-final=pkg-prerelease",
+        expect_error=True,
+    )
+    assert (
+        "Only final releases are allowed for package 'pkg-prerelease' "
+        "but it is pinned to a prerelease version 1.0a1" in result.stderr
+    )
+
+
+def test_install_pylock_allow_archive_prerelease(
+    script: PipTestEnvironment,
+    shared_data: TestData,
+) -> None:
+    """--only-final does not influence direct URL requirements."""
+    pylock_path = shared_data.lockfiles.joinpath("pylock.prerelease-archive.toml")
+    result = script.pip(
+        "install",
+        "--no-index",
+        "--dry-run",
+        "-r",
+        pylock_path,
+        "--only-final=pkg-prerelease",
+        allow_stderr_warning=True,
+    )
+    assert "experimental" in result.stderr
+    assert "Would install pkg-prerelease-1.0a1" in result.stdout