assert-python-definition-is-used
Assert that every public Python definition in a tree is named somewhere else.
Why
A function whose last caller is deleted does not disappear. Its tests still pass, the coverage gate over its module stays green, and static analysis keeps reading it, so the tree grows a layer of code that is maintained and never called. Nothing in a normal toolchain reports it: coverage measures whether lines run, not whether anything wants them, and a module held at 100% by its own tests manufactures exactly the evidence that makes it look used.
This tool asks the other question. For every public top-level def and
class in the trees you point it at, it asks whether anything else
names it, and reports the ones nothing does.
Installation
pip install assert-python-definition-is-used
Usage
# Every definition in lib/python must be named somewhere in the repo
assert-python-definition-is-used lib/python \
--search-in lib/python --search-in scripts \
--search-in src --search-in test
# The same, but a module's own tests no longer count as a caller
assert-python-definition-is-used lib/python \
--search-in lib/python --search-in scripts \
--search-in src --search-in test \
--dont-search-in 'test/lib/python/test_{package}'
Those two runs are the pair worth having. The first is a cheap outer bound that catches a definition whose tests were deleted along with its caller. The second is the one that finds code kept alive only by the tests written for it, which is what a coverage gate hides.
Options
| Option | Effect |
|---|---|
--search-in PATH |
A tree to search for uses. Repeatable. |
--dont-search-in TEMPLATE |
Template left out of the search. |
--count-defining-file |
Count a use in the defining file. |
--exclude PATTERNS |
Comma-separated globs to leave out of both trees. |
--quiet |
Print nothing; report through the exit code. |
--count |
Print only how many findings there were. |
--verbose |
Print the trees read, each file scanned, and a summary. |
--fail-fast |
Stop at the first finding. |
--warn-only |
Always exit 0. |
Exit codes
| Code | Meaning |
|---|---|
| 0 | Nothing unused |
| 1 | Something unused |
| 2 | A tree was missing, unreadable, or would not parse |
What counts as a use
A use is the definition's name written as a whole word in any file the searched trees reach. That is deliberately blunt, and it has two consequences worth knowing before you read the output.
By default a name written elsewhere in its own defining file does not
count. A docstring example, an __all__ entry and a call from a
sibling that is itself dead all look the same as a live caller, so
crediting them hides real findings. Pass --count-defining-file for the
looser rule. When the stricter rule reports a definition that a live
sibling in the same file genuinely calls, the finding is that the
definition is public and should not be: rename it with a leading
underscore, which takes it out of scope.
Matching on a bare name also means a definition reads as used when any other file happens to contain that word, including a file that defines its own unrelated function of the same name. The count is a lower bound rather than an exact figure.
Only top-level def and class statements are read. A method and a
nested function are reached through the name of the thing that holds
them, so neither is something this tool can speak about. Names starting
with an underscore are skipped.
Packages and their own tests
The usual thing to leave out is a package's own tests, and
--dont-search-in takes a path template rather than a fixed layout,
because the convention differs between repositories. The {package}
field is the first directory below the definition tree:
lib/python/aws_clients/__init__.py -> package is "aws_clients"
So --dont-search-in 'test/lib/python/test_{package}' leaves out
test/lib/python/test_aws_clients/, and
--dont-search-in 'test/lib/python/{package}' leaves out
test/lib/python/aws_clients/.
A file sitting directly in the definition tree belongs to no package and so has no directory of its own to leave out. Uses of its definitions count wherever they appear.
--dont-search-in is not --exclude. An excluded file is dropped from
the run altogether, so its own definitions go unchecked too. A file left
out of the search is still read for the definitions it holds; it just
does not get a vote on whether anything else is used.
GitHub Actions
- name: Assert every definition is used outside its own tests
uses: 10U-Labs/assert-python-definition-is-used@latest
with:
dont-search-in: test/lib/python/test_{package}
search-in: lib/python scripts src test
trees: lib/python
verbose: true
License
Apache-2.0
Metadata
Release files for assert-python-definition-is-used 20260823033619
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| assert_python_definition_is_used-20260823033619.tar.gz | 32.6 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| assert_python_definition_is_used-20260823033619-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 47.9 kB
Release files / assert_python_definition_is_used-20260823033619.tar.gz
| Download URL | assert_python_definition_is_used-20260823033619.tar.gz |
|---|---|
| Size | 32.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
e0dd7f5b2b2811e77558ddd05b4ae9c6ceb3221ef9c4583fa5d4ab3afe567eac
|
|
BLAKE2b-256 checksum How to use checksums |
d64fa37b4757aa3e625ecdb81562ba33670c8f30fcb7cc0df7a0840d44015411
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 23, 2026.
Transparency logRelease files / assert_python_definition_is_used-20260823033619-py3-none-any.whl
| Download URL | assert_python_definition_is_used-20260823033619-py3-none-any.whl |
|---|---|
| Size | 15.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
84f771cd504a94bc76bcb8af42a1720fdb49e617d5db4c28ac484bd68d9e9867
|
|
BLAKE2b-256 checksum How to use checksums |
47a415af59901f6c3c2f0b020421944635070ec2b9379f2c5fc97c1736709264
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 23, 2026.
Transparency logSecurity for assert-python-definition-is-used 20260823033619
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for assert_python_definition_is_used-20260823033619.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 23, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.