Enable to explicitly disallow import of certain external dependencies

[janbernloehr]

We often have the usecase where for a certain package we want to disallow imports of an external package foo.

Now to please tach check-external we would have to add all other packages to the dependencies which is cumbersome and requires frequent changes. Instead, we would like to explicitly model the forbidden external import of foo only.

[emdoyle]

Hi @janbernloehr , thanks for raising this. Can you provide a few more details about your use case?

It sounds like you are maintaining multiple Python packages in your repo, are these built and released separately, or do they share an environment?

My assumption about listing dependencies for each package was that every external package would need to be listed there anyway, is this not the case? I might be misunderstanding the workaround you are describing.

[janbernloehr]

Our usecase is that we have two packages foo and bar in our repo. We would like to prohibit foo from importing tensorflow and bar from importing torch. Instead of having a list of all external dependencies of foo we would rather just add tensorflow to the list of prohibited imports.

[samuelhwilliams]

I also have this use case and would find it really valuable. In lieu of tach supporting it we might end up using import-linter or similar.

In our case, we want to limit the ability to import from eg sqlalchemy in anything except one of the modules in our codebase, so that all database access goes through a central place.

[emdoyle]

@janbernloehr @samuelhwilliams Thanks for your patience here - just coming back to this.

I'm still not sure I understand the behavior you are looking for, so let me sketch out my assumptions:

foo/
    src/...
    pyproject.toml
bar/
    src/...
    pyproject.toml

Since you are using tach check-external, I am assuming that your project looks similar to the above. I am surprised to hear that you have to list dependencies "to please tach check-external", because I would have assumed that each package already must list its dependencies in pyproject.toml so that it can be built. This is the list that check-external will validate against.

In your specific example, I would think that tensorflow would simply not be listed in foo/pyproject.toml, and pytorch would not be listed in bar/pyproject.toml -- tach check-external should immediately do what you want in this scenario.

Could you let me know where I am going wrong here? An example of your project layout and Tach configuration may be helpful.