# Development / CI tooling for PDFApps.
#
# Runtime dependencies live in requirements.txt; this file is the test /
# static-analysis / security / lint toolchain. Only part of it runs in CI:
# tests.yml runs pytest, security-deps.yml runs pip-audit, and mypy and
# bandit are local-only today.
#
# There is no lint workflow, yet ruff is still mandatory in CI, because
# the suite shells out to it: tests/test_audit_pr_j.py::
# test_no_f401_f541_e741_lint_residual runs `python -m ruff check
# --select F401,F541,E741 app/ pdfapps.py installer.py` as a subprocess
# and pytest.fail()s on a non-zero exit, so a missing ruff is a test
# FAILURE, not a skip.
#
# PyYAML is mandatory for the same kind of reason: tests/
# test_release_bump_script.py imports it at module scope, so without it
# collection ERRORs and the run aborts as Interrupted. (tests/
# test_flatpak_dependency_pins.py and tests/test_security_deps_workflow.py
# do wrap the import in try/except and skip; that one does not.)
#
# Install with:  pip install -r requirements-dev.txt
#
# Deliberately NOT in requirements.txt: that file is the shipped runtime
# surface. It feeds the PyInstaller builds in build.yml, and every entry
# in it must also be pinned in flatpak/requirements-pinned.txt or listed
# in FLATPAK_OMITTED (enforced by
# tests/test_flatpak_dependency_pins.py::test_no_root_dependency_is_silently_dropped_from_the_flatpak).
# A test runner has no business in the app bundle.
#
# Lower bounds mirror the >= style of requirements.txt so a fresh venv
# picks up current releases while staying reproducible enough.
mypy>=2.3.0
bandit>=1.9.4
pip-audit>=2.10.1
pyyaml>=6.0.3
ruff>=0.16.10
# Test runners. pytest-qt is not optional: 12 tests in
# tests/test_viewer_shared_doc.py take the `qtbot` fixture directly, with
# no importorskip guard, so without it they ERROR with
# "fixture 'qtbot' not found" rather than skipping.
pytest>=9.1.1
pytest-qt>=4.5.0
coverage>=7.16.1
