add poetry command (#67)

* add poetry command

* add poetry.lock extractor & define cmd parser for poetry

* feat: support Poetry caret/tilde version syntax

* add wildcard constraint support & test cases

* readme update

* chore: small fixes

extractor/common.go

@@ -12,6 +12,7 @@ import (
 	"github.com/google/osv-scalibr/extractor/filesystem/language/javascript/bunlock"
 	"github.com/google/osv-scalibr/extractor/filesystem/language/javascript/packagelockjson"
 	"github.com/google/osv-scalibr/extractor/filesystem/language/javascript/pnpmlock"
+	"github.com/google/osv-scalibr/extractor/filesystem/language/python/poetrylock"
 	"github.com/google/osv-scalibr/extractor/filesystem/language/python/requirements"
 	"github.com/google/osv-scalibr/extractor/filesystem/language/python/uvlock"
 	"github.com/google/osv-scalibr/fs"
@@ -34,6 +35,8 @@ func getExtractorForFile(filename string) (filesystem.Extractor, error) {
 		return requirements.NewDefault(), nil
 	case filename == "uv.lock":
 		return uvlock.New(), nil
+	case filename == "poetry.lock":
+		return poetrylock.New(), nil
 	default:
 		return nil, fmt.Errorf("unsupported lockfile type: %s", filename)
 	}

extractor/ecosystems.go

@@ -22,11 +22,12 @@ type PackageManagerExtractor interface {
 type PackageManagerName string
 
 const (
-	Npm  PackageManagerName = "npm"
-	Pnpm PackageManagerName = "pnpm"
-	Pip  PackageManagerName = "pip"
-	Bun  PackageManagerName = "bun"
-	Uv   PackageManagerName = "uv"
+	Npm    PackageManagerName = "npm"
+	Pnpm   PackageManagerName = "pnpm"
+	Pip    PackageManagerName = "pip"
+	Bun    PackageManagerName = "bun"
+	Uv     PackageManagerName = "uv"
+	Poetry PackageManagerName = "poetry"
 )
 
 type ExtractorManager struct {
@@ -36,11 +37,12 @@ type ExtractorManager struct {
 func NewExtractorManager() *ExtractorManager {
 	return &ExtractorManager{
 		extractors: map[PackageManagerName]PackageManagerExtractor{
-			Npm:  &NpmExtractor{},
-			Pnpm: &PnpmExtractor{},
-			Pip:  &PipExtractor{},
-			Bun:  &BunExtractor{},
-			Uv:   &UvExtractor{},
+			Npm:    &NpmExtractor{},
+			Pnpm:   &PnpmExtractor{},
+			Pip:    &PipExtractor{},
+			Bun:    &BunExtractor{},
+			Uv:     &UvExtractor{},
+			Poetry: &PoetryExtractor{},
 		},
 	}
 }

extractor/pypi.go

@@ -41,3 +41,22 @@ func (u *UvExtractor) GetPackageManager() PackageManagerName {
 func (u *UvExtractor) Extract(lockfilePath, scanDir string) ([]*packagev1.PackageVersion, error) {
 	return parseLockfile(lockfilePath, scanDir, u.GetEcosystem())
 }
+
+// PoetryExtractor handles poetry.lock files
+type PoetryExtractor struct{}
+
+func (p *PoetryExtractor) GetSupportedFiles() []string {
+	return []string{"poetry.lock"}
+}
+
+func (p *PoetryExtractor) GetEcosystem() packagev1.Ecosystem {
+	return packagev1.Ecosystem_ECOSYSTEM_PYPI
+}
+
+func (p *PoetryExtractor) GetPackageManager() PackageManagerName {
+	return Poetry
+}
+
+func (p *PoetryExtractor) Extract(lockfilePath, scanDir string) ([]*packagev1.PackageVersion, error) {
+	return parseLockfile(lockfilePath, scanDir, p.GetEcosystem())
+}