librariesio / libraries.io

:books: The Open Source Discovery Service
https://libraries.io
GNU Affero General Public License v3.0
1.1k stars 206 forks source link

Mark a PyPI Project Deprecated If All Versions are Yanked #3393

Closed mikeyoung85 closed 1 month ago

mikeyoung85 commented 1 month ago

Follow up to https://github.com/librariesio/libraries.io/pull/3389

This PR uses the upstream API data to determine if a PyPI project should be marked as deprecated. It checks for all non pre-release version numbers and if they are all yanked then takes the reason text from the most recent release. This should capture projects like https://pypi.org/project/gitlab/#history which have essentially been completely pulled down for use.

mikeyoung85 commented 1 month ago

Should this deprecation call also be added to

https://github.com/librariesio/libraries.io/blob/aed17eeb7130ead25f82b8508b9c78f7f9706d6c/app/models/package_manager/base.rb#L148-L157 or somewhere nearby? Otherwise this method could update all the versions to "removed" but not the overall project status (unless it's being done in some method/callback after this blob).

It probably makes sense to set the project deprecation status and message in the PackageManager.update() method. Right now it is limited to only being set when we check the Project status and I'm not sure if there is a reason for that. I would like to do that in a separate PR from this since there could be some performance issue that needs to be ironed out if we add an additional call in the project update pipeline.