Add rule type to verify that a lockfile exists in a Python project

The idea is to have a catch-all rule that helps organizations enforce
the usage of lockfiles.

Signed-off-by: Juan Antonio Osorio <[email protected]>

rule-types/common/python_lock_file_exists.test.yaml

@@ -0,0 +1,48 @@
+---
+tests:
+  - name: "project contains Pipfile.lock"
+    def: {}
+    params: {}
+    expect: "pass"
+    entity: &test-repo
+      type: repository
+      entity:
+        owner: "coolhead"
+        name: "haze-wave"
+    git:
+      repo_base: pipfile_lock
+  - name: "project contains poetry.lock"
+    def: {}
+    params: {}
+    expect: "pass"
+    entity: *test-repo
+    git:
+      repo_base: poetry_lock
+  - name: "project contains pdm.lock"
+    def: {}
+    params: {}
+    expect: "pass"
+    entity: *test-repo
+    git:
+      repo_base: pdm_lock
+  - name: "project contains version-pinned requirements.txt"
+    def: {}
+    params: {}
+    expect: "pass"
+    entity: *test-repo
+    git:
+      repo_base: pinned_requirements_txt
+  - name: "project contains some unpinned requirements.txt"
+    def: {}
+    params: {}
+    expect: "fail"
+    entity: *test-repo
+    git:
+      repo_base: some_unpinned_requirements_txt
+  - name: "project contains no lock files"
+    def: {}
+    params: {}
+    expect: "fail"
+    entity: *test-repo
+    git:
+      repo_base: no_lock

rule-types/common/python_lock_file_exists.testdata/no_lock/pyproject.toml

@@ -0,0 +1,70 @@
+[tool.poetry]
+name = "codegate"
+version = "0.1.0"
+description = "Generative AI CodeGen security gateway"
+readme = "README.md"
+authors = []
+
+[tool.poetry.dependencies]
+python = ">=3.12,<4.0"
+click = ">=8.1.0"
+PyYAML = ">=6.0.1"
+fastapi = ">=0.115.5"
+uvicorn = ">=0.32.1"
+structlog = ">=24.4.0"
+litellm = "^1.57.10"
+llama_cpp_python = ">=0.3.2"
+cryptography = "^44.0.0"
+sqlalchemy = "^2.0.37"
+aiosqlite = "^0.20.0"
+ollama = ">=0.4.4"
+pydantic-settings = "^2.7.1"
+numpy = ">=1.24.0"
+tree-sitter = ">=0.23.2"
+tree-sitter-go = ">=0.23.4"
+tree-sitter-java = ">=0.23.5"
+tree-sitter-javascript = ">=0.23.1"
+tree-sitter-python = ">=0.23.6"
+tree-sitter-rust = ">=0.23.2"
+sqlite-vec-sl-tmp = "^0.0.4"
+
+[tool.poetry.group.dev.dependencies]
+pytest = ">=7.4.0"
+pytest-cov = ">=4.1.0"
+black = ">=23.7.0"
+ruff = ">=0.7.4"
+bandit = ">=1.7.10"
+build = ">=1.0.0"
+wheel = ">=0.40.0"
+litellm = ">=1.52.11"
+pytest-asyncio = "0.25.2"
+llama_cpp_python = ">=0.3.2"
+scikit-learn = ">=1.6.0"
+python-dotenv = ">=1.0.1"
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry.scripts]
+codegate = "codegate.cli:main"
+generate-openapi = "src.codegate.dashboard.dashboard:generate_openapi"
+
+[tool.black]
+line-length = 100
+target-version = ["py310"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"
+fix = true
+exclude = [
+    "src/codegate/db/queries.py",   # Ignore auto-generated file from sqlc
+]
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "N", "W"]
+
+[tool.pytest.ini_options]
+addopts = "-v --cov=codegate --cov-report=term-missing"
+testpaths = ["tests"]

rule-types/common/python_lock_file_exists.testdata/pdm_lock/pyproject.toml

@@ -0,0 +1,30 @@
+[project]
+name = "proj"
+version = "0.1.0"
+description = "Some description"
+authors = [
+]
+dependencies = [
+    "requests>=2.31.0",
+    "numpy>=1.25.0",
+    "scipy>=1.11.1",
+    "pandas>=2.0.3",
+    "matplotlib>=3.7.1",
+    "scikit-learn>=1.3.0",
+]
+requires-python = ">=3.9,<3.12"
+license = "MIT"
+classifiers = [
+    "Topic :: Utilities",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+]
+
+[project.optional-dependencies]
+[build-system]
+requires = ["pdm-pep517>=1.0.0"]
+build-backend = "pdm.pep517.api"
+
+[tool.pdm]

rule-types/common/python_lock_file_exists.testdata/pinned_requirements_txt/requirements.txt

@@ -0,0 +1,10 @@
+datacompy==0.16.0
+numpy==2.2.0
+ordered-set==4.1.0
+pandas==2.2.3
+polars==1.17.1
+pyarrow==18.1.0
+python-dateutil==2.9.0.post0
+pytz==2024.2
+six==1.17.0
+tzdata==2024.2

rule-types/common/python_lock_file_exists.testdata/pipfile_lock/Pipfile

@@ -0,0 +1,12 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+Django = "==4.*"
+waitress = {version = "*", markers="sys_platform == 'win32'"}
+gunicorn = {version = "*", markers="sys_platform == 'linux'"}
+
+[dev-packages]
+pytest-cov = "==3.*"