add source validation in poetry check

[lucemia]

Pull Request Check List

• Resolves: poetry check does not consider the package source #8704
• add two one types of source validation in poetry check
  • Invalid source "{source}" referenced in dependencies. which means a dependency referenced to not exist source
  • Dependency "{k}" referenced to inconsistence sources. which means a dependency referenced to more than one source

• Added tests for changed code.
• Updated documentation for changed code.

[radoering]

Checking for inconsistent sources is not that easy. For example, the following inconsistent sources are not detected:

inconsistent_sources = [
    { version = "*", source = "not-consistence-1" },
    { version = "*", source = "not-consistence-2" },
]

and even worse, the following consistent sources are detected as inconsistent (same for python or markers instead of platform):

[tool.poetry.dependencies]
consistent_sources = { source = "not-consistence-1", platform = "win32" }

[tool.poetry.group.test.dependencies]
consistent_sources = { source = "not-consistence-2", platform = "linux" }

[radoering]

Checking for not existing sources is probably ok, but checking for inconsistent sources can lead to false positives (see #8709 (comment)).

[lucemia]

Thanks, @radoering. It's definitely more intricate than I initially anticipated. I'm going to delve deeper to explore potential solutions. Meanwhile, I would like to separate the pull request (PR) and create an independent one specifically for Checking for non-existing sources.

[lucemia]

@radoering, I've updated the pull request to focus on checking for sources that don't exist. While making changes, I realized that moving the logic to src/poetry/factory.py could be a viable alternative. I'm ok to proceed in either direction.

poetry/src/poetry/factory.py

Lines 357 to 379 in 0578ed8

	def validate(
	cls, config: dict[str, Any], strict: bool = False
	) -> dict[str, list[str]]:
	results = super().validate(config, strict)
	results["errors"].extend(validate_object(config))
	# A project should not depend on itself.
	dependencies = set(config.get("dependencies", {}).keys())
	dependencies.update(config.get("dev-dependencies", {}).keys())
	groups = config.get("group", {}).values()
	for group in groups:
	dependencies.update(group.get("dependencies", {}).keys())
	dependencies = {canonicalize_name(d) for d in dependencies}
	project_name = config.get("name")
	if project_name is not None and canonicalize_name(project_name) in dependencies:
	results["errors"].append(
	f"Project name ({project_name}) is same as one of its dependencies"
	)
	return results

[radoering]

While making changes, I realized that moving the logic to src/poetry/factory.py could be a viable alternative. I'm ok to proceed in either direction.

IMO, it's good as is. Moving it into the factory means that it is always executed (performance) and prevents any command. I think neither of these is necessary or wanted.

Edit: We could put it beyond strict to achieve the same effect as now. IIUC, there is no clear guidance when to put a check into the check command or the factory. 🤷 Anyway, I'd probably leave it as is.

[lucemia]

@radoering I have updated the implementation to support multiple-constraints dependency. Test case modified as well.

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.