Can dependency graph detect dependencies from pyproject.toml's build-system.requires ?

[Freed-Wu]

Select Topic Area

Product Feedback

Body

According to PEP621, a python project can have a pyproject.toml in the root directory of repo, which is like:

[build-system]
requires = ["setuptools_scm[toml] >= 6.2"]
build-backend = "setuptools.build_meta"

the build-system.requires is also a dependencies which should be displayed in dependency graph. However, https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph#supported-package-ecosystems doesn't support it now. Can it be supported? TIA!

[MicaelJarniac]

I'd say that now, this might even make more sense and be more important than the other supported files (requirements.txt, pipfile, pipfile.lock, setup.py), since as far as I know, pyproject.toml is now the officially recommended place to keep this info.

Edit: Just checked again, and pyproject.toml is listed there, but under Poetry. I wonder if it means it'll only be read correctly if it's being used together with Poetry, though.

[henryiii]

Support for PEP 621's [project] dependencies is present. Either Poetry or PEP 621 (everyone else!) can be used.

[build-system] requires, though, is not supported yet. :(

[stephenhazra]

I don't see my dependencies graph;
Mine is under [project.dependencies] is there a specific reason why?

[mjspeck]

This seems like a pretty important feature to incorporate.