Add check for pre-release requirements versions

[wwuck]

It would be nice to have a linting check for pre-release requirements versions. This would be useful in a CI scenario to ensure that a pull request from a feature branch to develop/master branch does not contain any pre-release requirements in setup.py, requirements.txt, etc.

https://packaging.pypa.io/en/latest/version.html#packaging.version.Version.is_prerelease would be useful for this.

[arkq]

Right now there is an option --requirements-file=FILE, maybe it will serve this purpose (at least for "requirements.txt")?

[wwuck]

I think my use case is a little different. I was thinking more like adding a new warning code I902: Package requirement contains a pre-release version or similar.

This would allow me to validate that the requirements.txt file only contains non-prerelease version numbers for pinned versions.

# requirements.txt
click==7.1.2
my_local_package==1.0.3.dev101+g21a74b2   # flake8-requirments flags this line with I902

Is this sort of detection even possible for a flake8 checker?

[arkq]

Ooo, I see now. I think that it might be possible, but the warning will be next to the import line (in the *py file), not in the requirements.txt. Will that be OK for you?

Attaching warning to other files than *py is rather problematic. My idea for I901 was to print these warning at the end of the flake8 run (not attached to any file). However, I901 is not implemented yet... to be honest I'm not sure how to do it without BIG performance issue. Anyway, I902 will be easier to implement.

[wwuck]

Yes that sounds good to me. It would also detect prerelease requirements from setup.py and poetry too?

[arkq]

It would also detect prerelease requirements from setup.py and poetry too?

Yes, it should work for requirements from these locations as well. But firstly I have to properly implement requirements.txt parser, because right now only name is read. It might take some time, because I have to share my spare time between many online and offline activities :D But stay tuned, I'll try to implement it sooner or later.