# python/pip-installs

> Checks that pyproject.toml lists every dependency, with no hand-kept requirements file and no `pip install`.

Checks that pyproject.toml lists every dependency, with no hand-kept requirements file and no `pip install`.

Part of the [`python`](/reference/configurations/python/) configuration, at the `all` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), once per scope. gspot runs this check itself.

## Why

Two dependency lists drift apart, and the image installs packages the lockfile never pinned.

## What to do

Export the requirements file from the lockfile, declare it generated, and replace `pip install` with the locked command. Accept a reviewed path with `gspot ignore python/pip-installs --paths <glob> --reason "<why>"`.

## Example

A `requirements.txt` kept by hand beside a locked project reports a second dependency list. Export it from the lockfile, declare it generated, and install from the lock.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore python/pip-installs --paths "<glob>" --reason "<why>"
```