Recognize version guards however sys.version_info is spelled

is_sys_guard only matches the literal 'sys.version_info' attribute
access, so an import guarded by 'from sys import version_info' still
raised import-error when the guarded module was missing. PEP 810
forbids wrapping a lazy import in a try statement (the new
invalid-lazy-import above), which leaves version guards as the pattern
for version-dependent imports, so pylint had better recognize them
reliably.

import-error is only checked once an import has already failed, so the
guard detection can afford to be thorough: the new zealous_is_sys_guard
resolves the compared names instead of matching a spelling, and also
recognizes aliased imports, sys.hexversion, six's PY2/PY3 flags however
six is imported, comparisons putting the version on the right-hand
side, and guards combined with 'and'/'or'/'not'.

The pre-existing is_sys_guard call sites (no-name-in-module,
ungrouped-imports, deprecated-module, used-before-assignment) run on
every import whether it failed or not: they keep the cheap spelling
check, a known tradeoff between cost and thoroughness.

Author: Pierre-Sassoulas

doc/whatsnew/fragments/11209.false_positive

@@ -0,0 +1,8 @@
+Fixed a false positive for ``import-error`` when a failing import is guarded
+by a version check that does not spell out
+``sys.version_info`` literally: guards written ``from sys import
+version_info`` (possibly aliased), guards on an aliased ``sys`` import,
+``sys.hexversion``, and comparisons putting the version on the right-hand
+side are now recognized too.
+
+Refs #11209

pylint/checkers/imports.py

@@ -31,6 +31,7 @@
     is_module_ignored,
     is_sys_guard,
     node_ignores_exception,
+    zealous_is_sys_guard,
 )
 from pylint.constants import MAX_NUMBER_OF_IMPORT_SHOWN
 from pylint.exceptions import EmptyReportError
@@ -148,10 +149,11 @@ def _ignore_import_failure(
         return True
 
     # Ignore import failure if part of guarded import block
-    # I.e. `sys.version_info` or `typing.TYPE_CHECKING`
+    # I.e. `sys.version_info` or `typing.TYPE_CHECKING`. The import already
+    # failed, so this runs rarely and can afford the zealous guard detection.
     if in_type_checking_block(node):
         return True
-    if isinstance(node.parent, nodes.If) and is_sys_guard(node.parent):
+    if isinstance(node.parent, nodes.If) and zealous_is_sys_guard(node.parent):
         return True
 
     return node_ignores_exception(node, ImportError)

pylint/checkers/utils.py

@@ -1864,6 +1864,85 @@ def is_sys_guard(node: nodes.If) -> bool:
     return False
 
 
+def zealous_is_sys_guard(node: nodes.If) -> bool:
+    """Return True if IF stmt is a version guard, however it is spelled.
+
+    A more thorough (and more expensive) version of ``is_sys_guard``: it
+    resolves names instead of matching the exact ``sys.version_info`` spelling,
+    so it also recognizes guards written ``from sys import version_info``,
+    guards on aliased imports, ``sys.hexversion``, and comparisons putting the
+    version on the right-hand side. Reserve it for checks that run rarely,
+    e.g. once an import has already failed.
+    """
+    if is_sys_guard(node):
+        return True
+    return _is_version_guard_test(node.test)
+
+
+def _is_version_guard_test(test: nodes.NodeNG) -> bool:
+    match test:
+        case nodes.BoolOp():
+            return any(_is_version_guard_test(value) for value in test.values)
+        case nodes.UnaryOp(op="not"):
+            return _is_version_guard_test(test.operand)
+        case nodes.Compare():
+            operands = [test.left] + [operand for _, operand in test.ops]
+            return any(_is_version_info_value(operand) for operand in operands)
+        case _:
+            # A bare truthiness guard: only six's version flags qualify.
+            return _is_six_version_flag(test)
+
+
+def _is_version_info_value(value: nodes.NodeNG) -> bool:
+    match value:
+        case nodes.Subscript():
+            return _is_version_info_value(value.value)
+        case nodes.Attribute(attrname="version_info" | "hexversion"):
+            return _resolves_to_module(value.expr, "sys")
+        case nodes.Attribute():
+            # e.g. the `major` in `version_info.major`
+            return _is_version_info_value(value.expr)
+        case nodes.Name():
+            return _binds_module_member(
+                value, "sys", frozenset({"version_info", "hexversion"})
+            )
+        case _:
+            return False
+
+
+def _is_six_version_flag(test: nodes.NodeNG) -> bool:
+    match test:
+        case nodes.Attribute(attrname="PY2" | "PY3"):
+            return _resolves_to_module(test.expr, "six")
+        case nodes.Name():
+            return _binds_module_member(test, "six", frozenset({"PY2", "PY3"}))
+        case _:
+            return False
+
+
+def _resolves_to_module(expr: nodes.NodeNG, modname: str) -> bool:
+    match safe_infer(expr):
+        case nodes.Module(name=name) if name == modname:
+            return True
+    return False
+
+
+def _binds_module_member(
+    name: nodes.Name, modname: str, members: frozenset[str]
+) -> bool:
+    """Whether the name is bound by a ``from modname import <member>``."""
+    _, assignments = name.lookup(name.name)
+    return any(
+        isinstance(assignment, nodes.ImportFrom)
+        and assignment.modname == modname
+        and any(
+            real in members and (alias or real) == name.name
+            for real, alias in assignment.names
+        )
+        for assignment in assignments
+    )
+
+
 def _is_node_in_same_scope(
     candidate: nodes.NodeNG, node_scope: nodes.LocalsDictNodeNG
 ) -> bool:

tests/checkers/unittest_utils.py

@@ -385,6 +385,66 @@ def test_if_sys_guard() -> None:
     assert utils.is_sys_guard(code[5]) is False
 
 
+def test_if_zealous_sys_guard() -> None:
+    code = astroid.extract_node("""
+    import sys
+    import sys as system
+    from sys import version_info
+    from sys import version_info as vi
+    from sys import hexversion
+    from six import PY2
+    from collections import OrderedDict as version_info_fake
+
+    if version_info >= (3, 8):  #@
+        pass
+
+    if vi[:2] >= (3, 8):  #@
+        pass
+
+    if system.version_info >= (3, 8):  #@
+        pass
+
+    if sys.version_info.major >= 3:  #@
+        pass
+
+    if (3, 8) <= sys.version_info:  #@
+        pass
+
+    if hexversion >= 0x030800F0:  #@
+        pass
+
+    if sys.version_info >= (3, 8) and sys.platform == "linux":  #@
+        pass
+
+    if not sys.version_info >= (3, 8):  #@
+        pass
+
+    if PY2:  #@
+        pass
+
+    if sys.version_info > (3, 8):  #@
+        pass
+
+    if sys.some_other_function > (3, 8):  #@
+        pass
+
+    if version_info_fake >= (3, 8):  #@
+        pass
+
+    if sys.platform == "linux":  #@
+        pass
+    """)
+    assert isinstance(code, list) and len(code) == 13
+
+    for guard in code[:10]:
+        assert isinstance(guard, nodes.If)
+        assert utils.zealous_is_sys_guard(guard) is True, guard.as_string()
+
+    for not_a_guard in code[10:]:
+        assert isinstance(not_a_guard, nodes.If)
+        assert utils.zealous_is_sys_guard(not_a_guard) is False, not_a_guard.as_string()
+
+
 def test_if_typing_guard() -> None:
     code = astroid.extract_node("""
     import typing

tests/functional/i/import_error.py

@@ -114,3 +114,18 @@
 with contextlib.suppress(ImportError):
     with contextlib.suppress(TypeError):
         import foo2
+
+# Version guards are recognized however `sys.version_info` is spelled
+from sys import version_info
+
+if version_info >= (3, 9):
+    import some_module
+    from some_module import some_class
+else:
+    import some_module_alt
+
+if (3, 9) <= version_info:
+    import some_module
+
+if version_info[:2] >= (3, 9):
+    import some_module