support requirements*.txt? local pyproject.toml?

[juju4]

Any plan to support requirements*.txt and not just requirements.txt? local pyproject.toml?
I got multiple findings on a repository with Pinned-Dependencies but for lines like below

pip install -r requirements-build.txt  # pinned
pip install -e '.[all]'  # folder has a pyproject.toml with pinned dependencies

[musaabhasan]

Current behavior is command-oriented rather than manifest-oriented. The Pinned-Dependencies check looks at install commands in workflows, scripts, and Dockerfiles; for pip, the important signal is whether the install command uses --require-hashes or an equivalent pinned source pattern.

For a requirements file with a non-standard name, this pattern should be the safer form:

python -m pip install --require-hashes -r requirements-build.txt

A file named requirements-build.txt is fine from a pip perspective, but the command still needs --require-hashes; exact versions in the file are not the same as artifact hashes.

For the editable local install:

pip install -e '.[all]'

Scorecard cannot reliably infer that the transitive dependencies in the local pyproject.toml are pinned. In the current implementation, editable installs are treated as pinned only when dependency installation is disabled with --no-deps and the editable source itself is local or a remote VCS source pinned to a full commit hash. In practice, that means splitting bootstrap/install steps tends to produce clearer results:

python -m pip install --require-hashes -r requirements-build.txt
python -m pip install --no-deps -e '.[all]'

Supporting pyproject.toml / lock-file semantics directly would probably need a separate parser path, because the present check is not reading Python project metadata as the source of truth.