feat(python): add pyproject.toml support and uv path settings (TC-3860)#256
feat(python): add pyproject.toml support and uv path settings (TC-3860)#256a-oren wants to merge 1 commit into
Conversation
Add pyproject.toml recognition as a Python manifest across all plugin code paths (stack analysis, component analysis, exclude/SA intentions). Add PyprojectCAAnnotator for TOML-based dependency parsing and vulnerability annotations. Add uv executable path setting to the settings UI with TRUSTIFY_DA_UV_PATH system property propagation. Bump trustify-da-java-client to 0.0.17-SNAPSHOT and api-spec to 2.0.7 for pyproject.toml pip report support and uv provider. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Review Summary by QodoAdd pyproject.toml support and uv path settings for Python dependency analysis
WalkthroughsDescription• Add pyproject.toml recognition as Python manifest file across all plugin code paths • Implement PyprojectCAAnnotator for TOML-based dependency parsing and vulnerability annotations • Add uv executable path setting to settings UI with TRUSTIFY_DA_UV_PATH system property propagation • Bump trustify-da-java-client to 0.0.17-SNAPSHOT and trustify-da-api-spec to 2.0.7 Diagramflowchart LR
A["pyproject.toml<br/>manifest file"] -->|"recognized in"| B["CAAnnotator<br/>ExcludeManifestIntentionAction<br/>SAIntentionAction<br/>SaAction<br/>SaUtils"]
A -->|"parsed by"| C["PyprojectCAAnnotator<br/>PyprojectCAInspection"]
C -->|"creates"| D["Vulnerability<br/>annotations"]
E["Settings UI"] -->|"adds"| F["uv executable<br/>path field"]
F -->|"propagates"| G["TRUSTIFY_DA_UV_PATH<br/>system property"]
H["Dependencies"] -->|"bumped to"| I["trustify-da-java-client<br/>0.0.17-SNAPSHOT<br/>trustify-da-api-spec<br/>2.0.7"]
File Changes1. src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java
|
Code Review by Qodo
1. Quickfix drops extras/markers
|
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| String depString = text.substring(1, text.length() - 1); | ||
| String name = PyprojectCAAnnotator.parseName(depString); | ||
| if (name == null) { | ||
| return; | ||
| } | ||
|
|
||
| String newText = "\"" + name + "==" + version + "\""; | ||
| Document document = PsiDocumentManager.getInstance(project).getDocument(file); | ||
| if (document != null) { | ||
| int start = literal.getTextRange().getStartOffset(); | ||
| int end = literal.getTextRange().getEndOffset(); | ||
| document.replaceString(start, end, newText); | ||
| PsiDocumentManager.getInstance(project).commitDocument(document); | ||
| } |
There was a problem hiding this comment.
1. Quickfix drops extras/markers 🐞 Bug ≡ Correctness
PyprojectCAIntentionAction rewrites the whole dependency entry to "<name>==<version>", which drops
PEP508 extras ("pkg[extra]") and environment markers ("; ...") and can change the dependency
semantics when users apply the quick-fix.
Agent Prompt
### Issue description
The pyproject.toml quick-fix currently replaces the entire dependency string literal with `"<name>==<version>"`, which discards extras (`[extra]`), environment markers (`; ...`), and any existing specifier structure.
### Issue Context
For pyproject dependencies, users commonly include extras and/or environment markers in the same string literal. The quick-fix should update only the version portion (or replace the version spec portion) while preserving any extras and markers.
### Fix Focus Areas
- src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PyprojectCAIntentionAction.java[35-58]
- src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PyprojectCAAnnotator.java[140-157]
- src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PyprojectCAAnnotator.java[207-218]
### Suggested implementation direction
- Parse the original dependency string into `{name, extras, versionSpec, marker}` (at minimum, split on the first `;` to preserve marker suffix).
- When applying the fix, rebuild as `name + extras + "==" + version + marker` (or keep the existing operator strategy, but preserve extras/marker).
- Tighten `isQuickFixApplicable` to only return true when an actual version specifier/operator exists, not when the suffix is marker-only.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| String text = literal.getText(); | ||
| if (text.length() < 2 || !text.startsWith("\"") || !text.endsWith("\"")) { | ||
| continue; | ||
| } |
There was a problem hiding this comment.
2. Single-quoted deps skipped 🐞 Bug ≡ Correctness
PyprojectCAAnnotator only treats TOML string literals as dependencies when they are double-quoted, so single-quoted dependency strings are ignored (no vulnerability annotations and ignore comments won’t match).
Agent Prompt
### Issue description
PyprojectCAAnnotator currently only recognizes dependency string literals when they are wrapped in double quotes (`"..."`). Single-quoted TOML string literals (`'...'`) will be skipped in:
- dependency extraction
- ignore comment association
- quick-fix applicability
### Issue Context
Other TOML handling in this repo preserves/handles both `"` and `'` quote styles during updates, so pyproject parsing should accept both styles for consistency and to avoid missing dependencies.
### Fix Focus Areas
- src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PyprojectCAAnnotator.java[111-137]
- src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PyprojectCAAnnotator.java[159-174]
- src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PyprojectCAAnnotator.java[207-214]
- src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PyprojectCAIntentionAction.java[35-58]
### Suggested implementation direction
- Introduce a small helper like `unwrapTomlStringLiteral(String text)` that:
- detects quote char (`"` or `'`)
- validates matching end quote
- returns the unquoted content + the quote char for later reconstruction.
- Use it in `parseDependencyArray`, `getIgnoredDependencies`, `isQuickFixApplicable`, and `updateVersion` so single-quoted strings are parsed and preserved on write.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
|
Closing: upstream already merged pyproject.toml support via #244. Will rebase and re-submit with only the remaining changes (version bump + uv settings). |
1 participant
Summary
pyproject.tomlrecognition as a Python manifest across all plugin code paths (stack analysis, component analysis, exclude/SA intentions)PyprojectCAAnnotatorfor TOML-based dependency parsing and vulnerability annotationsTRUSTIFY_DA_UV_PATHsystem property propagationtrustify-da-java-clientto 0.0.17-SNAPSHOT andtrustify-da-api-specto 2.0.7 for pyproject.toml pip report support and uv providerTest plan
pyproject.tomlin IntelliJ — verify red lines appear on vulnerable dependenciespyproject.toml→ verify "Dependency Analytics Report" action appears and generates reportrequirements.txt→ verify existing functionality unchangeduv.lockpresent → verify uv provider is used instead of pip🤖 Generated with Claude Code