#20368 Recipies for for analyzing python dependencies with common "pip-adjacent" tools New discussion created by cburroughs pip-licenses, pip-audit , and pip itself are useful tools for analyzing Python dependencies, but they don't know how to read a PEX lockfile. You can

pants export

and run any of these, but I took a rough stab at making them one line targets.

pex_binary(
    name="the-big-pex",
    include_tools=True,
    dependencies=[
    # [python.resolves]
    # default = "3rdparty/py/default.lock"
        "3rdparty/py",
    ],
)

adhoc_tool(
    name="adhoc-pip-freeze",
    runnable=":the-big-pex",
    extra_env_vars=["PEX_SCRIPT=pip"],
    args=["--disable-pip-version-check", "freeze"],
    root_output_directory=".",
    stdout="freeze.out",
)

run_shell_command(
    name="pip-freeze",
    execution_dependencies=[":adhoc-pip-freeze"],
    command="cat {chroot}/freeze.out",
)

adhoc_tool(
    name="adhoc-pip-list-outdated",
    runnable=":the-big-pex",
    extra_env_vars=["PEX_SCRIPT=pip"],
    args=["--disable-pip-version-check", "list", "-o"],
    root_output_directory=".",
    stdout="list.out",
)

run_shell_command(
    name="pip-list-outdated",
    execution_dependencies=[":adhoc-pip-list-outdated"],
    command="cat {chroot}/list.out",
)

adhoc_tool(
    name="adhoc-pip-licenses",
    runnable=":the-big-pex",
    extra_env_vars=["PEX_SCRIPT=pip-licenses"],
    args=[],
    root_output_directory=".",
    stdout="licenses.out",
)

run_shell_command(
    name="pip-licenses",
    execution_dependencies=[":adhoc-pip-licenses"],
    command="cat {chroot}/licenses.out",
)


adhoc_tool(
    name="adhoc-pip-audit",
    runnable=":the-big-pex",
    execution_dependencies=[":adhoc-pip-freeze"],
    extra_env_vars=["PEX_SCRIPT=pip-audit"],
    workdir="/",
    args=["--no-deps", "--disable-pip", "-r", "{chroot}/freeze.out"],
    root_output_directory=".",
    stdout="audit.out",
)

# NOTE: pip-audit insists on returning zero which incidentally prints to
# useful information to the console but doesn't give a clean report file.
run_shell_command(
    name="pip-audit", execution_dependencies=[":adhoc-pip-audit"], command="cat {chroot}/audit.out"
)

pantsbuild/pants