[napetrov]

Summary

A deptry gate in the typecheck job, plus the fixes for what it found on main. Each finding, its verdict and the action taken:

Finding (deptry 0.25.1, default config)	Verdict	Action
DEP002 pytest, pytest-*, diff-cover, ruff, mypy, types-*, scriv unused (13)	false positive: the dev extra is tooling	optional_dependencies_dev_groups = ["dev"]
DEP003 mkdocs, mkdocs_gen_files, markdown_it in scripts/docs/	false positive: docs-build hooks, deps in requirements-docs.txt	extend_exclude = ["scripts/docs"]
DEP002 langchain-community unused	false positive: declared only to cap what ragas resolves (<0.4.2)	per_rule_ignores DEP002, with the reason
DEP002 beautifulsoup4 unused	real: nothing has imported bs4 in this history	removed (drops soupsieve from the lock)
DEP002 anthropic unused	real: the direct SDK import is gone; langchain-anthropic still pulls it in	removed from the declared deps (still installed)
DEP003 langchain_openai, langchain_core (eval/ragas_eval.py)	real: imported directly, arriving only through ragas	declared >=1.0,<2

No DEP001 (missing), DEP004 (dev dep imported by the package) or DEP005 (stdlib declared) on main. tests/ stays out of the scan (deptry's default exclude): test deps live in requirements-test.txt and the dev extra.

 typecheck:            # already installs requirements.lock.txt on 3.13
   pip install -r requirements.lock.txt
   pip install mypy==2.4.0 types-PyYAML types-jsonschema
   mypy
+  pip install deptry==0.25.1     # Renovate's `pip install` regex bumps it
+  deptry .                       # if: !cancelled(), runs when mypy fails too

Why typecheck and not static: deptry maps import names to packages (PyYAML→yaml, PyGithub→github) and tells transitive (DEP003) from missing (DEP001) through the installed environment. static installs no lock, and the alternative there is a hand-kept package_module_name_map that goes stale with every new dependency. scripts/ci_local.py reads the new step and the install line from ci.yml, so make dev installs deptry and make ci-local runs it with no change to the script.

No pre-commit hook: pre-commit runs deptry in an isolated env without the lock, where every third-party import reads as DEP001. The typecheck job and make ci-local cover it.

requirements-test.txt repeats httpx, numpy, scipy, litellm, PyYAML and jsonschema. All six are runtime: the package imports them and [project.dependencies] declares them. The repeats are harmless, so they stay.

Evidence

• Before (main, CI's env: lock + deptry, dev group configured, scripts/docs excluded):

  dokimi/eval/ragas_eval.py:228:13: DEP003 'langchain_openai' imported but it is a transitive dependency
  dokimi/eval/ragas_eval.py:230:13: DEP003 'langchain_core' imported but it is a transitive dependency
  pyproject.toml: DEP002 'beautifulsoup4' defined as a dependency but not used in the codebase
  pyproject.toml: DEP002 'langchain-community' defined as a dependency but not used in the codebase
  pyproject.toml: DEP002 'anthropic' defined as a dependency but not used in the codebase
  Found 5 dependency issues.
  

  After: Scanning 221 files... Success! No dependency issues found., both in a fresh 3.13 venv with only the lock and deptry (what the CI step sees) and in the make dev venv.
• The gate trips. A probe module with import pytest, import bs4 and import tenacity gives DEP004 'pytest', DEP001 'bs4' and DEP003 'tenacity'.
• Lock. Regenerated with the command in its header (uv-native header unchanged). No pin moves: beautifulsoup4 and soupsieve go, and the # via lines of anthropic, langchain-core and langchain-openai change. requirements-docs.lock.txt has neither package, so it is unchanged.
• Install. make ci-local: 0 failed, 20 passed, 4 skipped (docker, test-latest, deploy, semgrep). That includes typecheck / deptry, the full pytest, and package-smoke, whose fresh-resolve wheel install no longer pulls beautifulsoup4 and still pulls anthropic (through langchain-anthropic). zizmor --offline --min-severity medium .github/workflows: no findings.

Merge Danger

Door: two-way. Reverting puts the two declarations back and drops one CI step. No persisted format, schema or score changes.

Blast Radius: install-set

• pip install dokimi no longer installs beautifulsoup4/soupsieve. Code outside dokimi that imported bs4 from the same env has to install it itself (changelog fragment says so). anthropic stays installed through langchain-anthropic (>=0.120,<2), but dokimi no longer sets the ~=1.12 floor itself.
• langchain-openai and langchain-core are now direct, bounded <2. Today they resolve to the same pins as before. A future major of either now needs a range bump in its own Renovate PR, where before it would have arrived silently through ragas.
• A new step in the existing mypy check (the job name is unchanged, so branch protection is unaffected). A PR that adds an import without declaring it, or drops the last import of a dependency, now fails that check.
• Conflict surface: no open PR touches requirements*.txt or the lock. ci.yml hunks of ci: add a Windows smoke test job #89, ci: no-growth ratchet for file length and function complexity #93 and docs, tests: user-journey catalog (J1–J15) and criterion evidence trace #102 are in other jobs. The CONTRIBUTING.md bullets of test(arch): enforce the import contract: layers, no new cycles, wrapped clients #91 and ci: no-growth ratchet for file length and function complexity #93 sit in the same list, about 25 lines above this one.

Checklist

• Tests added/updated and pytest passes (no code change; the full suite passes in make ci-local)
• ruff, mypy, and schema checks pass
• Docs updated (or N/A): CONTRIBUTING.md lists deptry . and what it holds a PR to
• No ad-hoc run artifacts committed
• New files carry the SPDX license header (or are exempt in .github/.licenserc.yaml): the changelog fragment is exempt

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.24%. Comparing base (6e695ce) to head (820801d).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #109   +/-   ##
=======================================
  Coverage   90.24%   90.24%           
=======================================
  Files         206      206           
  Lines       24289    24289           
  Branches     3906     3906           
=======================================
  Hits        21920    21920           
  Misses       1703     1703           
  Partials      666      666           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟢 Approval recommended

The dependency declarations, lockfile, CI gate, and documentation are consistent, with no blocking issues identified.

No open issues 🎉

What changed in this PR

Adds dependency hygiene checks to CI and aligns dokimi’s declared dependencies with its imports.

Changes:

• Runs deptry in the existing typecheck job with targeted exclusions.
• Removes unused dependency declarations, adds direct LangChain dependencies, and updates the lockfile.
• Documents the new gate and installation changes.

File	Description
dokimi/​requirements.txt	Aligns runtime dependencies with imports.
dokimi/​requirements.lock.txt	Removes unused packages and updates dependency origins.
dokimi/​pyproject.toml	Updates package dependencies and configures deptry.
dokimi/​CONTRIBUTING.md	Documents the dependency gate.
dokimi/​changelog.d/​20261018_120000_napetrov_ci-deptry.md	Explains installation changes.
.github/​workflows/​ci.yml	Adds deptry to the typecheck job.

_{Review effort: Balanced}

[antonwolfy]

LGTM. The gate runs from the right directory, the config options exist in deptry 0.25.1, and the declarations, requirements.txt and the lock agree. Three nits on text this PR leaves stale, all outside the diff.

What I ran, on a Linux review host at 820801d:

• make ci-local: 20 passed, 0 failed, 4 skipped. typecheck / deptry prints Success! No dependency issues found.; pytest 5179 passed, 1 skipped; package-smoke passes.
• A search for imports of bs4 and anthropic in dokimi/, cli.py, scripts/ and tests/: there are none, so both removals match the code.

Nits (outside this diff):

1. docs/quickstart.md:242 still says langchain-openai comes with ragas. This PR makes it a direct dependency (pyproject.toml, requirements.txt). Suggestion: say both langchain-openai and langchain-anthropic are direct dependencies.
2. The ci_local.py docstring (lines 21-24) says static is the only job whose steps after the install all run under if: ${{ !cancelled() }}. The two deptry steps in typecheck (ci.yml:152-160) now use the same condition. Suggestion: name typecheck as well.
3. The TRACKED_DEPS comment in dokimi/runner/manifest.py:22 says "Direct dependencies" and lists anthropic. It is now installed only through langchain-anthropic. The manifest still records its version, which is fine; only the comment is off.

Checked, no issues

• Working directory: the job's defaults.run.working-directory: dokimi puts deptry . next to pyproject.toml, after the lock install.
• Config: optional_dependencies_dev_groups and per_rule_ignores are real options; the dev extra exists; the langchain-community DEP002 ignore is needed because nothing imports it.
• Bounds: langchain-core>=1.0,<2 and langchain-openai>=1.0,<2 hold with ragas 0.3.9 and langchain-anthropic; the lock pins 1.6.7 for both, as before.
• Renovate: the pip install deptry==0.25.1 line matches the repo's custom regex manager.
• Changelog fragment: same format as the others in changelog.d.