GitHub does not show dependency graph for projects which use poetry!

[aahnik]

My project tgcf has a pyproject.toml and poetry.lock file.

But GitHub does not show a dependency graph.

Some of my older projects used requirements.txt, and GitHub showed graphs perfectly fine.

How can I have dependency graphs for projects with poetry? One obvious way is to generate a requirements.txt file using poetry export. But any other way?

[abn]

This is more GitHub issue really. There is a GitHub community discussion on this too (I suspect several).

You could try what is specified by the OP at https://github.community/t/does-dependabot-native-support-poetry-for-python/133678/3. This actually configures dependabot, but I suspect this is what is being used to generate that.

[abn]

For more information see https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#package-ecosystem

[abn]

Looks like it might not have worked. See https://github.com/abn/github-dependency-graph-test/network/dependencies for example. Will wait a while longer to see if it eventually picks up the stray requirements.txt file.

[abn]

For completeness, here is the list of supported package ecosystems fro dependency graph feature of GitHub. Alas, no poetry.lock file. Maybe good to create an issue with GitHub. :)

https://docs.github.com/en/code-security/supply-chain-security/about-the-dependency-graph#supported-package-ecosystems

[gitonthescene]

@abn Where does one create such an issue? Googling turns up nothing.

Maybe here.

[EDIT: I’ve submitted a feature request to make it official.]

[teauxfu]

For anyone else interested in achieving the dependabot graph, a decent-enough workaround can be accomplished by relying on a pre-commit hook to automagically export a requirements.txt

  - repo: local
    hooks:
      - id: export-requirements
        name: export-requirements
        entry: poetry export
        language: system
        always_run: true
        pass_filenames: false
        args: ["-f", "requirements.txt", "--output", "requirements.txt"]

This is still a little awkward depending on your workflow because if you don't already have an up-to-date requirements.txt when you commit, pre-commit will make one for you, and then you'll have to commit that new file also.

See https://towardsdatascience.com/how-to-code-your-own-python-pre-commit-hooks-with-bash-171298c6ee05 for a cleaner approach if you have bash available

Edit:
also see https://github.com/Cielquan/mirrors-poetry/blob/master/.pre-commit-hooks.yaml

[abn]

That is handy, thanks @teauxfu. It might also be a good idea to output the file into .github/requirements.txt. Further a few things to keep in mind:

1. The export would be frozen from the lock file (which might be slightly different to results when the package metadata is used).
2. You can filter pre-commit to only run if/when pyproject or poetry.lock changes.