Skip to main content

CHAIN001 — no-lockfile

PropertyValue
Rule IDCHAIN001-no-lockfile
Dimensionsupply_chain
SeverityMedium
Analyzer kindProjectLevel

What it detects​

CHAIN001 fires when a pyproject.toml is present at the project root but no recognised lock file exists alongside it.

Recognised lock files (any of the following satisfies the rule):

  • poetry.lock
  • uv.lock
  • pdm.lock
  • Any file matching requirements*.txt (e.g. requirements.txt, requirements-dev.txt, requirements-prod.txt)

Why it matters​

Without a lock file, every pip install or equivalent resolves dependency versions at install time. This means:

  • Builds are non-deterministic across machines and over time.
  • A future release of any transitive dependency can introduce a breaking change or, in the worst case, a supply-chain compromise.

Lock files record the exact version of every dependency (direct and transitive) so that all environments reproduce the same resolved graph.

How to fix​

Generate a lock file with your package manager:

# Poetry
poetry lock

# uv
uv lock

# PDM
pdm lock

# pip-tools
pip-compile requirements.in

Then commit the generated lock file to version control.

Suppression​

Pyproject-anchored inline suppression (# zuit: ignore CHAIN001) is not currently parsed by the engine for ProjectLevel rules. To suppress, add the rule to the engine's global ignore list in .zuit/config.toml:

[ignore]
rules = ["CHAIN001-no-lockfile"]

References​