feat(parts): warn when a source is outside the project
Metadata
Current evaluation
No evaluation has been recorded for this issue yet.
Issue body
Fixes #1390
Warns when a part's `source` is an absolute path or a relative path that goes above the project dir, since those usually don't exist in a managed build. The check only looks at the path itself. URLs and `git@host:repo` sources are skipped. It uses `warnings.warn`, like `PartitionUsageWarning`.
Known limitations:
- With craft-application's experimental monorepo mode (git build root), `../shared` is valid but still warns. The app could filter the warning in that mode, or craft-parts could take a wider root for the check. Let me know which you'd prefer and I'll add it.
- A symlink inside the project that points outside isn't caught.
- craft-application doesn't route Python warnings, so it shows up as a plain `SourceOutsideProjectWarning: ...` line.
Tested with snapcraft 9.2 in destructive mode and in a simulated managed run, where the `../../../` case from the issue warns and then fails the same way. I ran ruff, ty, codespell and the unit tests in a container instead of `make lint && make test`.
---
- [x] I've followed the [contribution guidelines](https://github.com/canonical/craft-parts/blob/main/CONTRIBUTING.md).
- [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [x] I've updated the relevant release notes.
Evaluation history
No evaluation history available.
Update history
| Date | Change |
|---|---|
| created |
Related issues
No embedding available for this issue yet. Run scripts/run_llm.py evaluate to enable similarity search.