Package: pyproject-indirect-import-detector
pyproject-indirect-import-detector: Indirect import detectorMotivationIndirect import is bad.The biggest reason is requirements are not protected bysemantic versioning.Tests cannot check import-problem correctly.Virtual environment is not strictly synced withpyproject.tomlnorpoetry.lockbypoetry, so far.  It is possible that you delete a dependency but it still remains in the virtual environment.  This means, tests can accidentally pass.FYI, indirect import is not allowed in rust/cargo.We'll describe the first reason a little more.  There are two examples here.First, assume thatYou are developping a library or application X.X depends on a library A^1and indirectly depends on a library B^1, meaning, X imports B but does not declare the dependency inpyproject.toml.The latest A is version 1.0.0 and it depends on B 1.0.0.Indirect import; imported but no requirement in pyproject.toml
      |
  +--------> B
  |          ^
  |          |
  |          | ---+
  |          |    |
  X -------> A    Requirement in pyproject.toml
      |
      Requirement in pyproject.tomlConsider the case that the authers of A refactor A and publish A 1.1.0 and this does not depends on B anymore.  Then,If X is a library, user of library X can faceModuleNotFoundError.If X is an application and you're using a "blessed" lockfile, you'll get no errors.If X is an application and you're not lucky, you'll getModuleNotFoundError.The second example is almost the same to the first.
Consider the case that the authers of A refactor A and publish A 1.1.0 and this depends on B^2and B has breaking chanegs.
Then, you may not have an explicit errors but the behavior can differ from the expected.It's horrible, isn't it?
The most reliable and simple way is maintaining dependencies correctly.
Because the resource of human brain is limited and most precious, this should be checked in CI.pyproject-indirect-import-detectoris a tool for this purpose.LimitationCurrently, this tool only suuportpyproject.tomlusingpoetry.PEP 631support is planed if python community agree this motivation and use this tool.How to useInstallpoetry add --dev pyproject-indirect-import-detectorNote that this tool is intended to use in the virtual environment created bypoetry install.  See also:Why only works in venv?Usagepoetry run pyproject-indirect-import-detector -vSee alsoCI config, especially the jobcheck-indirect-import.ConfigurationYou can configure bypyproject.tomlas the following:[tool.pyproject-indirect-import-detector]
exclude_projects = [
    "dataclasses",           # If you use compat trick like https://github.com/kenoss/pyproject-indirect-import-detector/tree/main/tests/integration_test/case/ok_exclude_projects
]
exclude_modules = [
    "dataclasses",           # Corresponding "dataclasses" in `exclude_projects`.
    "tests",                 # If your test suite make `tests` module importable and use it like https://github.com/andreoliwa/nitpick/blob/v0.26.0/tests/test_json.py#L6 .
    "dummy_module_for_test", # If you use dummy modules in tests like https://github.com/PyCQA/isort/blob/5.8.0/tests/unit/example_crlf_file.py#L1-L2 .
]tool.pyproject-indirect-import-detector.exclude_projectsOmit searching the distributions corresponding designated package names.
Notice that this also prevent making "project to modules map".  You should also specifyexclude_modulesmanually.
For example, see testsOK,NG.tool.pyproject-indirect-import-detector.exclude_modulesOmit checks for the designated modules.
For example, see testsOK,NG.You can find more examples inCI config, the jobstest-external-project-*.FAQIt failes with not reasonable errors.Report an issue and let me know your case.
The core logic is not yet well-tested with real packages.
We need edge cases.Why only works in venv?This tool makes a correspondence frompackage names to module names.
This useimportliband requires an environment that has all packages installed.
This tool is designed to be used in CI.  So, runnable underpoetry runis enough.Why installable withpython >= 3.6and runnable only inpython >= 3.9?See the comment inpyproject.toml.
I tried to make it runnable in old pythons, but the cost is high.
This tool is designed to be used in CI.  So, this restriction is reasonable.How to developHow to releaseBump version, PR and merge.git tag <version>thengit push origin <version>.CI will pubish the package to PyPI:https://pypi.org/project/pyproject-indirect-import-detector/