False positive lock file requirement because of pyproject.toml

SonarQube Cloud
,
1

The repo contains a list of scripts deployed to S3 and used by AWS Glue. pyproject.toml is used to configure linters and triggers the Sonar rule text:S8565 “Python dependency lock file should be committed to source control”, which is a false positive because the environment is managed by AWS.
Minimal example of pyproject.toml:

[project]
name = "glue-etl"
version = "0.1.0"

[tool.isort]
profile = "black"
line_length = 120
skip = [
    ".git",
    "__pycache__",
]
4

Hi @VShkaberda & thanks for the feedback!

You are absolutely right, the analyzer logic in cases like yours is too eager to raise. I have already created a pull request to change the behavior to avoid raising an issue when the pyproject.toml is not used for dependency management, so this will be fixed in the very near future.

Best wishes,

Teemu R.