internal/detectors/python/lockfile_integration_test.go (3)

111-115: ⚡ Quick win

Assert the missing fourth transitive edge in the pip fixture test.

Line 111 says requests has four transitives, but Line 112-Line 115 only assert three edges. Add requests -> charset-normalizer so the lock fast-path edge contract is fully covered.

Suggested patch

 	// requests pulls its four transitive deps via "# via requests".
 	requirePyEdge(t, g, "requests", "2.32.3", "certifi", "2024.8.30")
+	requirePyEdge(t, g, "requests", "2.32.3", "charset-normalizer", "3.4.0")
 	requirePyEdge(t, g, "requests", "2.32.3", "idna", "3.10")
 	requirePyEdge(t, g, "requests", "2.32.3", "urllib3", "2.2.3")

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/detectors/python/lockfile_integration_test.go` around lines 111 -
115, The test comment indicates that requests has four transitive dependencies,
but the test only verifies three edges using requirePyEdge calls for certifi,
idna, and urllib3. Add a fourth requirePyEdge call to assert the missing edge
from requests version 2.32.3 to charset-normalizer to ensure the lock file
fast-path edge contract is fully tested.

---

100-176: ⚡ Quick win

Add doc comments for exported test functions to satisfy repository Go standards.

TestPipRequirementsLockFixture, TestPoetryLockFixture, TestUVLockFixture, and TestPipenvLockFixture are exported and should each have a short doc comment.

Suggested patch

+// TestPipRequirementsLockFixture validates requirements.lock fast-path graph construction.
 func TestPipRequirementsLockFixture(t *testing.T) {
@@
+// TestPoetryLockFixture validates poetry.lock + pyproject.toml fast-path graph construction.
 func TestPoetryLockFixture(t *testing.T) {
@@
+// TestUVLockFixture validates uv.lock fast-path graph construction.
 func TestUVLockFixture(t *testing.T) {
@@
+// TestPipenvLockFixture validates Pipfile.lock fast-path graph construction.
 func TestPipenvLockFixture(t *testing.T) {

As per coding guidelines, `**/*.go`: Every exported type and function must have a doc comment.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/detectors/python/lockfile_integration_test.go` around lines 100 -
176, Add documentation comments to the four exported test functions
TestPipRequirementsLockFixture, TestPoetryLockFixture, TestUVLockFixture, and
TestPipenvLockFixture. Each function requires a doc comment line placed directly
above its declaration that begins with the function name followed by a brief
description of what the test validates. Follow Go's standard documentation
format where the comment starts with the function name as it appears in the
code.

Source: Coding guidelines

---

190-196: ⚡ Quick win

Make the pipenv test enforce the documented flat-graph behavior and pluggy scope.

The comments on Line 190-Line 193 describe flat lock-only behavior and pluggy’s resulting scope, but the assertions do not verify either. Add explicit checks so this known limitation is regression-tested.

Suggested patch

 	// Scope is re-derived from the Pipfile's [packages] / [dev-packages]:
 	// requests is runtime, pytest is development. pluggy is only a transitive
 	// dependency of pytest, but Pipfile.lock is flat (no edge records it), so it
 	// stays runtime — a known limitation of the lock-only fast-path.
 	requirePyScope(t, g, "requests", "2.32.3", sdk.ScopeRuntime)
 	requirePyScope(t, g, "pytest", "8.3.3", sdk.ScopeDevelopment)
+	requirePyScope(t, g, "pluggy", "1.5.0", sdk.ScopeRuntime)
+
+	requestsDeps, err := g.DirectDependencies(pyStableID("requests", "2.32.3"))
+	if err != nil {
+		t.Fatalf("dependencies(requests@2.32.3): %v", err)
+	}
+	if len(requestsDeps) != 0 {
+		t.Errorf("expected flat Pipfile.lock graph; requests should have no direct deps, got %d", len(requestsDeps))
+	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/detectors/python/lockfile_integration_test.go` around lines 190 -
196, The test comments in this function describe how pluggy is a transitive
dependency of pytest that stays runtime due to the flat lock-only behavior, but
there is no assertion actually verifying pluggy's scope. Add an additional
requirePyScope call (similar to the existing ones for requests and pytest) that
explicitly checks pluggy's scope is sdk.ScopeRuntime to regression-test this
documented limitation and prevent accidental changes to this behavior in the
future.