pylock: reject str when Sequence is expected

Author: sbidoul

src/packaging/pylock.py

@@ -106,6 +106,12 @@ def _get_sequence(
     """Get a list value from the dictionary and verify it's the expected items type."""
     if (value := _get(d, Sequence, key)) is None:  # type: ignore[type-abstract]
         return None
+    if isinstance(value, str):
+        # special case: str is a Sequence, but we want to reject it
+        raise PylockValidationError(
+            f"Unexpected type {type(value).__name__} (expected Sequence)",
+            context=key,
+        )
     for i, item in enumerate(value):
         if not isinstance(item, expected_item_type):
             raise PylockValidationError(

tests/test_pylock.py

@@ -508,3 +508,17 @@ def test_validate() -> None:
         str(exc_info.value)
         == "Name 'example_package' is not normalized in 'packages[0].name'"
     )
+
+
+def test_validate_sequence_of_str() -> None:
+    pylock = Pylock(
+        lock_version=Version("1.0"),
+        created_by="some_tool",
+        packages=[],
+        dependency_groups="abc",  # should be a sequence of str
+    )
+    with pytest.raises(PylockValidationError) as exc_info:
+        pylock.validate()
+    assert str(exc_info.value) == (
+        "Unexpected type str (expected Sequence) in 'dependency-groups'"
+    )