pyproject.toml

# The specification for this file can be found here:
# https://packaging.python.org/en/latest/specifications/pyproject-toml

[project]
name = "phylum"
version = "0.59.0"
description = "Utilities for integrating Phylum into CI pipelines"
license = "GPL-3.0-or-later"
license-files = ["LICENSE"]
readme = "README.md"
requires-python = ">=3.10,<3.14"
authors = [
    { name = "Veracode Inc.", email = "dl-phylum-engineering@veracode.com" },
]
keywords = ["dependency", "security", "CI", "integration"]
# Classifiers can be found here: https://pypi.org/classifiers/
# TODO: Update the "Development Status" as the project/package matures
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "Natural Language :: English",
    "Environment :: Console",
    "Topic :: Security",
    "Topic :: Software Development",
    "Topic :: Software Development :: Quality Assurance",
    # The remaining classifiers *could* be dynamically generated by Poetry,
    # but were left here as static entries so as to not be tied to the tool.
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
]
# Required dependencies for creating distributions are defined in this `project`
# table while optional dev dependencies are defined in the `dependency-groups` table.
dependencies = [
    "cryptography",
    "packaging",
    "pathspec",
    "requests",
    "rich",
    "ruamel.yaml",
]

[project.urls]
# Ref: https://packaging.python.org/en/latest/specifications/well-known-project-urls
homepage = "https://veracode.com/"
source = "https://github.com/phylum-dev/phylum-ci"
documentation = "https://docs.phylum.io/"
issues = "https://github.com/phylum-dev/phylum-ci/issues"
changelog = "https://github.com/phylum-dev/phylum-ci/blob/main/CHANGELOG.md"
releasenotes = "https://github.com/phylum-dev/phylum-ci/releases"
CI = "https://github.com/phylum-dev/phylum-ci/actions"

[project.scripts]
phylum-init = "phylum.init.cli:main"
phylum-ci = "phylum.ci.cli:script_main"

[build-system]
# NOTE: Changes to the build system values should be inspected closely!
# `poetry-core` and `poetry` should have matching version constraints.
requires = ["poetry-core>=2.2.1,<3.0"]
build-backend = "poetry.core.masonry.api"

[tool.poetry]
# `poetry-core` and `poetry` should have matching version constraints.
requires-poetry = ">=2.2.1,<3.0"
packages = [
    { include = "phylum", from = "src" },
    { include = "tests", format = "sdist" },
]

[dependency-groups]
ci = [
    "pytest-github-actions-annotate-failures",
    # PSR has a history of releasing breaking changes in minor and bugfix releases.
    # The irony is not lost, but it has become too much. This dependency has a hard
    # pin now so that every new release can be examined before it is used. Some notes:
    #
    # PSR re-defined the `context` variable in release notes templates in v9.8.7, but
    # expects to remove it again in the next major version.
    # https://github.com/python-semantic-release/python-semantic-release/pull/1005
    # https://github.com/python-semantic-release/python-semantic-release/issues/984
    #
    # TODO: Remove this pin
    #       https://github.com/phylum-dev/phylum-ci/issues/565
    "python-semantic-release==9.12.0",
    # A regression was added in v1.2.9 where config validation fails. It was fixed
    # in https://github.com/ewels/rich-codex/pull/54 and included in release v1.2.11
    "rich-codex>=1.2.11",
    "tox-gh-actions",
]
compile = ["nuitka"]
dev = [{ include-group = "test" }, { include-group = "qa" }]
qa = ["pre-commit", "tox", "types-requests"]
test = ["dulwich", "pytest", "pytest-cov", "tomli", "tox"]

[tool.poetry.group.ci]
optional = true

[tool.poetry.group.compile]
optional = true

[tool.poetry.group.dev]
optional = true

[tool.poetry.group.qa]
optional = true

[tool.poetry.group.test]
optional = true

[[tool.poetry.source]]
name = "phylum"
url = "https://pypi.phylum.io/simple/"
priority = "primary"

[tool.black]
line-length = 120

[tool.vulture]
paths = ["src", "tests"]
# Vulture doesn't understand pytest's fixture machinery
exclude = ["conftest.py"]

[tool.refurb]
python_version = "3.10"
format = "github"
# FURB184 (use-fluent-interface) is ignored because the benefits of "chaining" calls identified by this rule are not
# outweighed by the type checking based autocompletion and syntax highlighting provided by the IDE with the calls split.
ignore = [184]

[tool.ruff]
# Reference: https://docs.astral.sh/ruff/configuration/
line-length = 120
target-version = "py310"
force-exclude = true
src = ["src", "tests"]

[tool.ruff.lint]
select = [
    # Using `ALL` has the risk that new rules may be enabled when `ruff` is updated but updates are
    # automated, with a PR that includes enforced QA checks, to weekly dependency and pre-commit hook bumps.
    "ALL",
]
ignore = [
    # Reference: https://docs.astral.sh/ruff/rules/
    #
    # `one-blank-line-before-class` (D203) and `no-blank-line-before-class` (D211) are incompatible. Prefer D211.
    "D203", # one-blank-line-before-class
    # `multi-line-summary-first-line` (D212) and `multi-line-summary-second-line` (D213) are incompatible. Prefer D212.
    "D213", # multi-line-summary-second-line
    # These `flake8-fixme` (FIX) rules are incompatible with `flake8-todos` (TD). Prefer TD.
    "FIX001", # line-contains-fixme
    "FIX002", # line-contains-todo
    "FIX003", # line-contains-xxx
    # Cached instance methods are okay in this project b/c instances are short lived and won't lead to memory leaks.
    "B019", # cached-instance-method
    # Assigning to a variable before a return statement is more readable and useful for debugging
    "RET504", # unnecessary-assign
    # Allowing exception handling within loops improves readability with only a negligible performance impact.
    "PERF203", # try-except-in-loop
    # This code base does not require a license header at the top of every file.
    "CPY001", # missing-copyright-notice
    # This project makes extensive use of the `subprocess` module, but in a secure way
    "S404", # suspicious-subprocess-import
    # These ignores will be removed during https://github.com/phylum-dev/phylum-ci/issues/238
    "ANN", # flake8-annotations
    "TC",  # flake8-type-checking
    "FA",  # flake8-future-annotations
]

[tool.ruff.lint.per-file-ignores]
"test_*.py" = [
    # It is expected to use `assert` statements in `pytest` test code
    "S101", # assert
    # `subprocess` input is controlled in test code
    "S603", # subprocess-without-shell-equals-true
]

[tool.ruff.lint.isort]
force-sort-within-sections = true

[tool.ruff.lint.pydocstyle]
# Use PEP-257 style docstrings
convention = "pep257"

[tool.semantic_release]
# Reference: https://python-semantic-release.readthedocs.io/en/latest/configuration.html
version_toml = ["pyproject.toml:project.version"]
# TODO: remove this setting or change it to `true` after the project is stable and no longer zeroVer
major_on_zero = false
# These files (may) get updated in the release workflow before Python Semantic Release runs
assets = ["docs/img/phylum-ci_options.svg", "docs/img/phylum-init_options.svg"]
commit_message = "chore: bump to v{version}"
commit_author = "phylum-bot <69485888+phylum-bot@users.noreply.github.com>"
logging_use_named_masks = true

[tool.semantic_release.publish]
dist_glob_patterns = ["dist/*", "build/phylum-ci.exe", "build/phylum-ci.zip"]

[tool.semantic_release.changelog]
mode = "update"
insertion_flag = "<!--next-version-placeholder-->"

[tool.semantic_release.changelog.environment]
trim_blocks = true
lstrip_blocks = true
keep_trailing_newline = true