Find Files with Python glob and fnmatch

Select a timestamp to watch that moment on YouTube.

1. 00:00

   This filter returns main.py and src/a.py. Should a build tool treat the nested file as top level? Run it and compare that output with the intended file scope. The broken result includes a nested name because fnmatchcase sees the entire string and its *.py pattern matches the suffix even after a slash. The matching call does not know that the caller meant only names from one directory. A pattern is a matching rule, not a directory boundary. Notice that this bug has no exception and no failing exit status. The filter returns a plausible list containing main.py, so a test that only

2. 00:40

   checks it found one Python file could pass. A stronger test states the intended scope and asserts that nested paths are absent. The source list may have come from a recursive crawl or external manifest; fnmatchcase does not know that history. A package builder using the result could unintentionally include a nested module when it wanted only top-level files. The correction is to validate path depth as a separate requirement from suffix matching. The candidate list already contains src/a.py; this program is not searching a directory. fnmatchcase checks that whole string, and its star can consume the slash.

3. 01:23

   The extra result follows from the input contract, not a new disk file. The diagnosis prints separate checks for a nested path, an uppercase extension, and a plain Python filename. That separates three decisions: whether the input is a path or a base name, whether case matters, and whether matching results should be sorted. fnmatch may normalize case by platform; fnmatchcase applies the literal rule everywhere. This example applies a string matcher to names supplied by a caller; it never checks that those files exist. That distinction matters for a build manifest, where the list may contain stale or deliberately crafted paths.

4. 02:05

   A wildcard question mark or bracket class still matches characters of a string, not an authorized directory tree. If the program later discovers files with Path.glob, it must decide whether the search is immediate or recursive and retain the resulting paths until root containment is checked. Dropping the parent directories first would conceal a nested match. Backslash is a literal character in a POSIX filename but a separator in Windows paths, so this cross-platform selector rejects both slash styles under its own top-level-only rule. A test should state that rule explicitly rather than relying on the host operating system's path parser.

5. 02:47

   The first check rejects tool.PY because the pattern says lower-case py. The second accepts src/a.py despite its slash. Case policy and path scope therefore need separate tests. Also reject a Windows-style backslash when candidate strings may come from different systems. The fixed select function rejects names containing a separator before applying fnmatchcase with *.py. It sorts the selected base names, giving a.py and main.py in the terminal. Actual disk discovery is a different operation: pathlib.Path.glob walks a directory tree, and its results should be constrained to an approved root.

6. 03:30

   Silently replacing each input with Path(name).name would be tempting, but it turns src/a.py into a.py and erases evidence that the caller supplied a nested path. Rejecting the original string is clearer for this top-level-only contract. Filtering a list of names is distinct from discovering files: this function never opens a path or follows a link. If a later operation does, join the accepted name to a trusted base, resolve the actual candidate, and verify it remains inside the approved directory. A stable sort then makes the output suitable for deterministic manifests.

7. 04:11

   The path rule runs before the pattern rule, so only base names reach fnmatchcase. Sorting makes tests and display stable. For actual disk discovery with Path.glob, choose the root directory first and check is_file if the caller truly needs files rather than matching paths. The last run checks an uppercase .PY extension and a list with no matching names. It prints b.py for the chosen lower-case pattern and then an empty list. These two outputs clarify the lesson's case-sensitive contract and its empty- result behavior. Never use a glob pattern alone to authorize file deletion. The final mixed list is a contract test rather than proof that any listed file

8. 04:52

   exists. Add a name with a trailing space, a bare extension, and a Unicode filename if those can arrive from the manifest; decide whether each is accepted, normalized, or rejected. A stable sort makes output reproducible across input orders, which helps compare generated manifests. Keep path selection separate from any later operation that opens or deletes files. For deletion, join an accepted basename to a trusted root, resolve the actual destination, and verify containment after following links. A symlink that looks harmless by name could point outside the intended tree.

9. 05:34

   Pattern matching alone cannot grant filesystem authority. With an empty input list the selector should return an empty list, and it should never invent matches from a directory it did not inspect. The mixed input tests three properties: nested forward-slash path, uppercase suffix, and backslash path. Only b.py survives. An empty candidate list must return an empty result, not an exception. Keep both cases when changing the selection rule later.