`imports_for` has no notion of dev/test-only imports — tests inside a package are reported as missing runtime deps

[thorwhalen]

Summary

imports_for scans a package's entire source tree and has no notion of dev/test-only imports. So any project that keeps its tests inside the package gets test-only imports (pytest, hypothesis, fixtures' deps, …) reported as missing runtime dependencies.

This is a false positive in the library's headline feature: "which declared dependencies am I missing?"

How it was found

While modernizing unbox (PR #3), the regression suite was initially placed at unbox/tests/ — the conventional spot. That immediately broke two of unbox's own self-referential doctests:

• pytest became one of unbox's own scanned imports, and was duly reported "missing"
• the file listing asserted by unbox.recipes.key_and_pattern_counts changed

The workaround was to move tests to a repo-root tests/ directory. That is fine for unbox itself, but it is a workaround for a limitation that affects every package unbox analyses, and plenty of projects legitimately put tests inside the package.

Notably this only surfaced in a clean-venv Python 3.11 CI leg, not on the dev machine.

Suggested design

Give imports_for / dependency_diff a notion of import scope:

1. Exclude conventional test paths by default — tests/, test_*.py, *_test.py, conftest.py — via an overridable parameter (e.g. exclude=DFLT_EXCLUDE_PATTERNS) rather than hardcoding, so callers can opt out or extend.
2. Or classify rather than exclude: return imports partitioned into runtime / test / dev, and have dependency_diff compare runtime against [project] dependencies and test against [project.optional-dependencies] test/dev groups. PR Fix 3 dependency-analysis bugs, add pyproject.toml reading, modernize packaging + CI #3 already added opt-in extras= reading for [project.optional-dependencies], so the declared side of that comparison exists.

(2) is the more useful answer and fits the tool's purpose — "your test deps are undeclared" is a real finding, just a different one from "your runtime deps are undeclared".

Acceptance

• A package with pkg/tests/test_x.py importing pytest does not report pytest as a missing runtime dependency.
• unbox's own doctests still pass with the regression suite moved back under unbox/ (i.e. the workaround is no longer needed).

Surfaced during the 2026-07-30 wave-0 rollout batch.