Coverage for src/pullapprove/trust/lockfiles.py: 100%

1"""Trust rule: package-manager lockfiles are tool-generated, not hand-edited.""" 

2 

3from __future__ import annotations 

4 

5from pathlib import PurePosixPath 

6 

7from ..diff import DiffFile, DiffHunk 

8from .labels import Trust 

9 

10# Package-manager lockfiles: regenerated by tooling, not hand-edited. 

11LOCKFILE_NAMES = frozenset( 

12 { 

13 "package-lock.json", 

14 "yarn.lock", 

15 "pnpm-lock.yaml", 

16 "Cargo.lock", 

17 "Gemfile.lock", 

18 "poetry.lock", 

19 # go.sum is the tool-generated checksum lock; go.mod is the editable 

20 # manifest (dependencies, replace directives, module path) — reviewer- 

21 # relevant, so it is deliberately NOT trusted. 

22 "go.sum", 

23 "composer.lock", 

24 "Pipfile.lock", 

25 "bun.lockb", 

26 "bun.lock", 

27 "flake.lock", 

28 "packages.lock.json", 

29 "paket.lock", 

30 "pdm.lock", 

31 "uv.lock", 

32 } 

33) 

34 

35 

36def _lockfile(file: DiffFile, hunk: DiffHunk) -> Trust | None: 

37 if PurePosixPath(file.new_path).name in LOCKFILE_NAMES: 

38 return Trust.LOCKFILE 

39 return None