pyproject.toml

# Tool-only config. The repo is distributed as a Claude Code plugin, not a
# pip package — there is no [build-system] block, and the [project] block
# below carries the minimum declarative metadata downstream tools rely on
# (requires-python, optional test extras for `pip install ".[test]"`).
# Runtime dependencies for the plugin itself are intentionally minimal
# (PyYAML, jsonschema) and assumed available from the system Python that
# runs Claude Code. The separate scripts/requirements.txt is for the
# standalone harvest-requirements.py URL crawler — a different workflow
# that runs in its own venv.

[project]
name = "appsec-advisor"
version = "0.6.0b6.dev0"
description = "Claude Code plugin: deterministic AppSec threat modeling for source repositories."
requires-python = ">=3.10"

[project.optional-dependencies]
test = [
    "pytest>=8.0",
    "pytest-cov>=5.0",
    "pyyaml>=6.0.1",
    "jsonschema>=4.20",
    "jinja2>=3.1",
]

[tool.ruff]
line-length = 120
target-version = "py310"
extend-exclude = [
    ".agents",
    ".appsec-cache",
    ".fragments",
    ".progress",
    "agents",
    "data",
    "docs",
    "examples",
    "schemas",
    "skills",
    "templates",
]

[tool.ruff.lint]
select = ["E", "F", "I", "UP", "B"]
# Disabled to keep the gate honest for *new* code without forcing a 47k-LOC
# semantic refactor up-front. Re-enable case-by-case in follow-up PRs.
ignore = [
    "E501",   # line-too-long — line-length=120 is advisory, not enforced
    "E701",   # multiple-statements-on-one-line-colon — used in defensive guards
    "E731",   # lambda-assignment — a handful of intentional small lambdas
    "E741",   # ambiguous-variable-name (l, I) — pre-existing usage, no rename in M1
    "E402",   # module-import-not-at-top — used by scripts with sys.path tweaks
    "B007",   # unused-loop-control-variable — _i / _ patterns OK
    "B008",   # function-call-in-default-argument
    "B023",   # function-uses-loop-variable — intentional closures, audited
    "B034",   # re-sub-positional-args — one call site, low-risk
    "B904",   # raise-without-from-inside-except — chains exist via context.error
    "B905",   # zip-without-explicit-strict — pre-existing
    "F841",   # unused-variable — kept for readability of intermediate names
    "UP007",  # non-pep604-annotation-union — Optional[X] is fine on py310
    "UP031",  # printf-string-formatting — one logging string
    "UP035",  # deprecated-import — typing.* re-exports still allowed
    "UP038",  # non-pep604-isinstance — deprecated by ruff itself (0.12+); the
              # `X | Y` form is slower at runtime than the tuple. Ignored so the
              # gate agrees across ruff versions (older ruff still flags it).
    "UP045",  # non-pep604-optional — Optional[X] is fine on py310
]

[tool.ruff.lint.per-file-ignores]
"tests/**" = ["B011"]
"scripts/model/migrate_v3_to_v4.py" = ["F401"]  # legacy re-exports
"scripts/harvest-requirements.py" = ["F401"]  # legacy re-exports

[tool.ruff.format]
quote-style = "double"
# Files with intentional column alignment asserted as doc-invariants by tests
exclude = [
    "scripts/runtime/resolve_config.py",
]

[tool.pytest.ini_options]
addopts = "--strict-markers --strict-config"
filterwarnings = [
    "error::DeprecationWarning:scripts",
]

[tool.coverage.run]
source = ["scripts"]
# Keep the data file (and its parallel `.coverage.<host>.<pid>.<rand>` shards)
# out of the plugin root — coverage.py creates the parent dir as needed.
data_file = ".coverage-data/.coverage"
# pytest-cov 7 delegates subprocess measurement to coverage.py. Several tests
# execute scripts via subprocess to match hook/CLI behavior; patching here makes
# those child interpreters contribute to the same coverage run.
patch = ["subprocess"]

[tool.coverage.report]
# Regression floor — current total is ~55%. Anything below this fails the
# coverage run (exit 2) in CI, `make test`, and `make coverage` alike.
# Ratchet upward as coverage improves; never lower it to make a PR pass.
fail_under = 50