feat(pypi): add pyproject.toml support to IntelliJ plugin (#244)

* feat(pypi): add pyproject.toml support to IntelliJ plugin

Add component analysis support for pyproject.toml manifest files,
enabling inline vulnerability diagnostics for Python projects using
PEP 621 ([project.dependencies]) and Poetry
([tool.poetry.dependencies]) formats.

New classes:
- PyprojectCAAnnotator: extracts dependencies from TOML PSI structure
- PyprojectCAIntentionAction: quick-fix for version updates
- PyprojectCAInspection: inspection registration

Modified files:
- SaAction, SaUtils: recognize pyproject.toml as supported manifest
- CAAnnotator, SAIntentionAction: add pyproject.toml to python mapping
- ApiService: apply Python-specific settings for pyproject.toml
- plugin.xml: register annotator and inspection for TOML language
- README.md: document pyproject.toml support

Implements TC-3853

Assisted-by: Claude Code

* fix(pypi): address Qodo review findings for pyproject.toml support

- Fix PEP 621 annotation targeting: use individual TomlLiteral elements
  instead of parent TomlKeyValue so each dependency gets its own highlight
- Fix quick-fix replacement: preserve package name in PEP 508 strings
  (e.g. "anyio==3.6.2" → "anyio==4.0.0" instead of just "==4.0.0")
- Add [project.optional-dependencies] parsing for PEP 621 optional groups
- Update README to reflect optional-dependencies are now analyzed

Implements TC-3853

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Assisted-by: Claude Code

* fix(pypi): preserve PEP 508 extras and markers in quick fix and version extraction

The version extraction regex was matching across the ';' environment
marker boundary, and the quick fix was dropping extras and markers
when rewriting the dependency string.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: fail fast when the toml file is not Cargo.toml

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>

* fix: implement license abstract methods

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>

* test(pypi): add unit tests for pyproject.toml support

Add 35 tests covering PEP 508 utility methods, PEP 621 and Poetry
dependency extraction, optional dependencies, intention action version
updates, availability checks, and SaAction/SaUtils manifest recognition.

Implements TC-4172

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Assisted-by: Claude Code

* fix(pypi): resolve Poetry ignore comment misbind for multi-line inline tables

When a trustify-da-ignore comment was placed on an inner key of a
multi-line Poetry inline table, findAssociatedDependency() returned
the inner key name (e.g., "version") instead of the outer dependency
name. Added resolvePoetryDependencyEntry() to walk up from inner
TomlKeyValue through TomlInlineTable to the actual dependency entry.

Resolves: TC-4173

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

README.md

@@ -21,7 +21,7 @@ while you build your application.
 - Gradle Kotlin and Groovy (gradle)
 - Golang (go mod)
 - Rust (cargo)
-- Python (pip) ecosystems, and base images in Dockerfile.
+- Python (pip, pyproject.toml) ecosystems, and base images in Dockerfile.
 
 In future releases, Red Hat plans to support other package managers.
 
@@ -108,7 +108,7 @@ according to your preferences.
   dependencies for Rust projects.
   <br >If the path is not provided, your IDE's `PATH` environment will be used to locate the executable.
 
-- **Python** (`requirements.txt`) :
+- **Python** (`requirements.txt`, `pyproject.toml`) :
   <br >Set the full paths of the Python and the package installer for Python executables, which allows Exhort to locate
   and run the `pip3` commands to resolve dependencies for Python projects.
   <br >Python 2 executables `python` and `pip` can be used instead, if the `Use python 2.x` option is selected.
@@ -318,6 +318,21 @@ When modifying the grammar or lexer files, you need to regenerate the parser cla
   tokio = { version = "1.0", features = ["full"] } # trustify-da-ignore
   ```
 
+  If you want to ignore vulnerabilities for a dependency in a `pyproject.toml` file, you must add `trustify-da-ignore` as a comment
+  against the dependency in the manifest file.
+  For PEP 621 format:
+  ```toml
+  [project]
+  dependencies = [
+      "anyio==3.6.2",  # trustify-da-ignore
+  ]
+  ```
+  For Poetry format:
+  ```toml
+  [tool.poetry.dependencies]
+  anyio = "^3.6.2"  # trustify-da-ignore
+  ```
+
 - **Excluding developmental or test dependencies**
   <br >Red Hat Dependency Analytics does not analyze dependencies marked as `dev` or `test`, these dependencies are
   ignored.
@@ -365,6 +380,10 @@ When modifying the grammar or lexer files, you need to regenerate the parser cla
   You can create an alternative file to `requirements.txt`, for example, a `requirements-dev.txt` or
   a `requirements-test.txt` file where you can add the development or test dependencies there.
 
+  For `pyproject.toml`, dependencies from `[project.dependencies]` (PEP 621),
+  `[project.optional-dependencies]`, and `[tool.poetry.dependencies]` are analyzed.
+  Poetry group dependencies (`[tool.poetry.group.*.dependencies]`) are excluded.
+
 
 - **Excluding manifest files with patterns**
   <br >You can exclude specific manifest files from component analysis using configurable glob patterns. This feature allows you to avoid analyzing third-party dependencies, test files, or other manifests that are not relevant to your security analysis.

src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java

@@ -524,7 +524,7 @@ public static String getPackageManager(String file) {
             case "pom.xml" -> "maven";
             case "package.json" -> "npm";
             case "go.mod" -> "go";
-            case "requirements.txt" -> "python";
+            case "requirements.txt", "pyproject.toml" -> "python";
             case "build.gradle", "build.gradle.kts" -> "gradle";
             case "Cargo.toml" -> "cargo";
             default -> null;

src/main/java/org/jboss/tools/intellij/componentanalysis/SAIntentionAction.java

@@ -49,7 +49,8 @@ public boolean isAvailable(@NotNull Project project, Editor editor, PsiFile file
                 || "requirements.txt".equals(file.getName())
                 || "build.gradle".equals(file.getName())
                 || "build.gradle.kts".equals(file.getName())
-                || "Cargo.toml".equals(file.getName());
+                || "Cargo.toml".equals(file.getName())
+                || "pyproject.toml".equals(file.getName());
     }
 
     @Override

src/main/java/org/jboss/tools/intellij/componentanalysis/cargo/CargoCAAnnotator.java

@@ -70,6 +70,10 @@ protected String getInspectionShortName() {
 
     @Override
     protected Map<Dependency, List<PsiElement>> getDependencies(PsiFile file) {
+        if (!"Cargo.toml".equals(file.getName())) {
+            return Map.of();
+        }
+
         Map<Dependency, List<PsiElement>> resultMap = new HashMap<>();
 
         Set<String> commentIgnoredDeps = getIgnoredDependencies(file);
@@ -381,4 +385,4 @@ private void parseFlatDependencies(TomlTable table, Set<String> ignoredDeps, Map
             resultMap.computeIfAbsent(dp, k -> new LinkedList<>()).add(keyValue);
         }
     }
-}
+}