Checking dependencies with Snyk

[flpStrri]

I was wondering what is the current best solution to validate a hatch project in Snyk. They have support for Pipenv and Poetry, but the way they handle these projects are very specific and would not work with the way Hatch manages a Python project.

Is there a “canonical” way to Snyk test a Hatch project?

[ofek]

Are you referring to environment-specific dependencies?

[flpStrri]

No, actually, just the good'n old dependencies.

— It can't use the pyproject.toml because it looks for poetry keys there.
— In the case of the pip mode, it looks for the installed dependencies.

So is the “right way” going inside the env shell, generating a requirements.txt and then calling Snyk? (and discarding the requirements.txt file later on)

[ofek]

Wait are you saying that it doesn't support the standard PEP 621?

[ofek]

You could use this https://github.com/repo-helper/hatch-requirements-txt