add lint/check to check extra dependency #2362

.github/workflows/build.yml

@@ -53,10 +53,46 @@ jobs:
         run: sudo apt-get install -y libyaml-dev
       - name: Upgrade pip, setuptools
         run: python -m pip install --upgrade pip setuptools
+      - name: Install dependencies
+        run: pip install -r requirements.txt
+      - name: Capture installed packages before installation
+        run: pip freeze > before.txt
       - name: Install capa with build requirements
         run: |
-          pip install -r requirements.txt
           pip install -e .[build]
+      - name: Capture installed packages after installation
+        run: pip freeze > after.txt
+      - name: Check for extra packages
+        shell: bash
+        run: |
+          diff <(sort before.txt) <(sort after.txt) > diff.txt || true
+
+          echo '^-e git\+https://github\.com/mandiant/capa@.*' > patterns.txt
+
+          grep -v -f patterns.txt \
+                  -e 'flare_capa==' \
+                  -e 'altgraph==' \
+                  -e 'build==' \
+                  -e 'macholib==' \
+                  -e 'pyinstaller==' \
+                  -e 'pywin32-ctypes==' \
+                  -e 'tomli==' \
+                  -e 'packaging==' \
+                  -e 'pyinstaller-hooks-contrib==' \
+                  -e 'pyproject_hooks==' \
+                  -e 'pefile==' \
+                  -e '^---$' \
+                  -e '^> ' \
+                  -e '^< '\
+                  -e '^[0-9]' diff.txt > unexpected.txt || true
+
+          if [ $(wc -l < unexpected.txt) -gt 1 ]; then 
+            echo "Error: More than one unexpected extra package was installed:"
+            cat unexpected.txt
+            exit 1
+          else
+            echo "No unexpected extra packages were installed."
+          fi
       - name: Build standalone executable
         run: pyinstaller --log-level DEBUG .github/pyinstaller/pyinstaller.spec
       - name: Does it run (PE)?

requirements.txt

@@ -21,7 +21,6 @@ mdurl==0.1.2
 msgpack==1.0.8
 networkx==3.4.2
 pefile==2024.8.26
-pip==25.0
 protobuf==5.29.3
 pyasn1==0.5.1
 pyasn1-modules==0.3.0