Security News
Fluent Assertions Faces Backlash After Abandoning Open Source Licensing
Fluent Assertions is facing backlash after dropping the Apache license for a commercial model, leaving users blindsided and questioning contributor rights.
a Python tool to enforce dependencies, written in Rust. Inspired by modular monolithic architecture.
Tach lets you define and enforce dependencies between Python modules within your project.
Here's an example:
If a module tries to import from another module that is not listed as a dependency, Tach can prevent it.
Tach is:
pip install tach
Tach allows you to configure where you want to place module boundaries in your project.
You can do this interactively - run:
tach mod
# Up/Down: Navigate Enter: Mark/unmark module Right: Expand Left: Collapse Ctrl + Up: Jump to parent
# Ctrl + s: Exit and save Ctrl + c: Exit without saving Ctrl + a: Mark/unmark all
Mark each module boundary with 'Enter'. You can mark all of your top-level Python source packages, or just a few which you want to isolate.
If your Python code lives below your project root, or if you are working in a monorepo with multiple Python packages, mark your Python source roots using the 's' key.
This will create the config file for your project, tach.toml
.
Once you've marked all the modules you want to enforce dependencies between, run:
tach sync
Dependencies that exist between each module you've marked will be written to tach.toml
.
Check out what Tach has found!
cat tach.toml
Note: Your source roots will implicitly be treated as module boundaries, and can show up as <root>
.
Tach comes with a cli command to enforce the boundaries that you just set up! From the root of your Python project, run:
tach check
You will see:
✅ All modules validated!
You can validate that Tach is working by either:
depends_on
key in tach.toml
Give both a try and run tach check
again. This will generate an error:
❌ tach/check.py[L8]: Cannot import 'tach.filesystem'. Module 'tach' cannot depend on 'tach.filesystem'.
Each error indicates an import which violates your dependencies. If your terminal supports hyperlinks, click on the file path to go directly to the error.
When an error is detected, tach check
will exit with a non-zero code. It can be easily integrated with CI/CD, Pre-commit hooks, and VS Code, and more!
Visualize your dependency graph.
tach show [--web]
Tach will generate a graph of your dependencies. Here's what this looks like for Tach:
Note that this graph is generated remotely with the contents of your tach.toml
when running tach show --web
.
If you would like to use the GraphViz DOT format locally, simply running tach show
will generate tach_module_graph.dot
in your working directory.
You can view the dependencies and usages for a given path:
tach report my_package/
# OR
tach report my_module.py
e.g.:
> tach report python/tach/filesystem
[Dependencies of 'python/tach/filesystem']
python/tach/filesystem/install.py[L6]: Import 'tach.hooks.build_pre_commit_hook_content'
python/tach/filesystem/project.py[L5]: Import 'tach.constants.CONFIG_FILE_NAME'
...
-------------------------------
[Usages of 'python/tach/filesystem']
python/tach/cache/access.py[L8]: Import 'tach.filesystem.find_project_config_root'
python/tach/cache/setup.py[L7]: Import 'tach.filesystem.find_project_config_root'
...
Tach also supports:
More info in the docs. Tach logs anonymized usage statistics which can be opted out of. If you have any feedback, we'd love to talk!
If you have any questions or run into any issues, let us know by either reaching out on Discord or submitting a Github Issue!
FAQs
A Python tool to maintain a modular package architecture.
We found that tach demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Fluent Assertions is facing backlash after dropping the Apache license for a commercial model, leaving users blindsided and questioning contributor rights.
Research
Security News
Socket researchers uncover the risks of a malicious Python package targeting Discord developers.
Security News
The UK is proposing a bold ban on ransomware payments by public entities to disrupt cybercrime, protect critical services, and lead global cybersecurity efforts.