pyproject.toml

# Copyright (c) 2022 - 2026, Oracle and/or its affiliates. All rights reserved.
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.

# https://flit.pypa.io/en/latest/pyproject_toml.html
[build-system]
requires = ["flit_core >=3.2.0,<4.0.0"]
build-backend = "flit_core.buildapi"


[project]
name = "macaron"
requires-python = ">=3.11.14"
authors = [
    {"name" = "Trong Nhan Mai", "email" = "trong.nhan.mai@oracle.com"},
    {"name" = "Behnaz Hassanshahi", "email" = "behnaz.hassanshahi@oracle.com"},
]
maintainers = [
    {"name" = "Trong Nhan Mai", "email" = "trong.nhan.mai@oracle.com"},
    {"name" = "Behnaz Hassanshahi", "email" = "behnaz.hassanshahi@oracle.com"},
]
dynamic = ["version"]
license = "UPL-1.0"  # https://spdx.org/licenses/UPL-1.0.html
license-files = ["LICENSE.txt"]
description = "Macaron is an extensible supply-chain security analysis framework from Oracle Labs that supports a wide range of build systems and CI/CD services."
readme = "README.md"
dependencies = [
    "requests >=2.32.3,<3.0.0",
    "pydriller >=2.0,<3.0.0",
    "yamale >=6.0.0,<7.0.0",
    "packaging >=25.0,<27.0.0",
    "jinja2 >=3.1.2,<4.0.0",
    "SQLAlchemy >=2.0.0,<3.0.0",
    "defusedxml >=0.7.1,<1.0.0",
    "packageurl-python >=0.11.1,<1.0.0",
    "ruamel.yaml >=0.18.6,<1.0.0",
    "jsonschema >=4.22.0,<5.0.0",
    "cyclonedx-bom >=7.0.0,<8.0.0",
    "cyclonedx-python-lib[validation] >=9.0.0,<12.0.0",
    "beautifulsoup4 >=4.12.0,<5.0.0",
    "problog >=2.2.6,<3.0.0",
    "cryptography >=48.0.1,<49.0.0",
    "semgrep == 1.151.0",
    "email-validator >=2.2.0,<3.0.0",
    "rich >=13.5.3,<15.0.0",
    "lark >=1.3.0,<2.0.0",
    "frozendict >=2.4.6,<3.0.0",
]
keywords = []
# https://pypi.org/classifiers/
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "Natural Language :: English",
    "Operating System :: POSIX",
    "Operating System :: POSIX :: Linux",
    "Operating System :: MacOS",
    "Programming Language :: Python",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3 :: Only",
    "Programming Language :: Python :: Implementation :: CPython",
    "Topic :: Software Development :: Libraries :: Python Modules",
]

[project.scripts]
macaron = 'macaron.__main__:main'

[project.entry-points]

[project.optional-dependencies]
# The 'actions' requirements match exactly the packages installed by the workflows.
# We keep them listed here to ensure the infrastructure BOM is consistent with what's
# installed. Make sure to keep the requirements in sync with the workflows!
actions = [
    "commitizen >=4.0.0,<5.0.0",
    "twine >=6.0.0,<7.0.0",
]
dev = [
    "flit >=3.2.0,<4.0.0",
    "mypy >=1.19.1,<1.20",
    "types-pyyaml >=6.0.4,<7.0.0",
    "types-requests >=2.25.6,<3.0.0",
    "types-jsonschema >=4.22.0,<5.0.0",
    "types-defusedxml >=0.7.0,<1.0.0",
    "pip-audit >=2.5.6,<3.0.0",
    "pylint >=4.0.4,<5.0.0",
    "cyclonedx-bom >=7.0.0,<8.0.0",
    "types-beautifulsoup4 >=4.12.0,<5.0.0",
]
docs = [
    "sphinx >=8.0.0,<9.0.0",
    "sphinx-autodoc-typehints >=3.0.0,<4.0.0",
    "sphinx-rtd-theme >=3.0.0,<4.0.0",
    "numpydoc >=1.5.0,<2.0.0",
    "sphinx_tabs >=3.4.1,<4.0.0",
    "sphinx-togglebutton >=0.3.2,<1.0.0",
]
hooks = [
    "pre-commit >=4.2.0,<5.0.0",
]
# Note that the `custom_exit_code` and `env` plugins may currently be unmaintained.
test = [
    "hypothesis >=6.100.1,<7.0.0",
    "pytest >=9.0.2,<10.0.0",
    "pytest-custom_exit_code >=0.3.0,<1.0.0",
    "pytest-cov >=7.0.0,<8.0.0",
    "pytest-doctestplus >=1.7.0,<2.0.0",
    "pytest-env >=1.0.0,<2.0.0",
    "pytest_httpserver >=1.0.10,<2.0.0",
    "syrupy >=5.1.0,<6.0.0",
]

test-docker = [
    "jsonschema >=4.22.0,<5.0.0",
    "cfgv >=3.4.0,<4.0.0",
    "ruamel.yaml >=0.18.6,<1.0.0",
]

[project.urls]
Homepage = "https://github.com/oracle/macaron"
Changelog = "https://github.com/oracle/macaron/blob/main/CHANGELOG.md"
Documentation = "https://oracle.github.io/macaron/index.html"
Issues = "https://github.com/oracle/macaron/issues"


# https://github.com/commitizen-tools/commitizen
# https://commitizen-tools.github.io/commitizen/bump/
[tool.commitizen]
bump_message = """bump: release $current_version → $new_version

Automatically generated by Commitizen.
"""
tag_format = "v$major.$minor.$patch$prerelease"
update_changelog_on_bump = true
version_files = [
    "src/macaron/__init__.py:__version__",
]
major_version_zero = true
version = "0.24.0"


# https://github.com/pytest-dev/pytest-cov
# https://github.com/nedbat/coveragepy
[tool.coverage.report]
fail_under = 60
show_missing = true

[tool.coverage.run]
omit = [
    "src/macaron/__main__.py",
]


# https://flit.pypa.io/en/latest/pyproject_toml.html#sdist-section
# See also: https://github.com/pypa/flit/issues/565
[tool.flit.sdist]
include = []
exclude = [
    ".github/",
    "docs/",
    "tests/",
    ".flake8",
    ".gitignore",
    ".pre-commit-config.yaml",
    "CHANGELOG.md",
    "Makefile",
    "SECURITY.md",
]


# https://mypy.readthedocs.io/en/stable/config_file.html#using-a-pyproject-toml
[tool.mypy]
show_error_codes = true
show_column_numbers = true
check_untyped_defs = true
incremental = false
strict_equality = true
warn_return_any = true
warn_redundant_casts = true
warn_unreachable = true
warn_unused_configs = true
warn_unused_ignores = true
disallow_untyped_calls = true
disallow_untyped_defs = true
disallow_incomplete_defs = true
disallow_untyped_decorators = true
# disable_error_code =

[[tool.mypy.overrides]]
module = [
    "pytest.*",  # https://github.com/pytest-dev/pytest/issues/7469
    "pydriller.*",
    "gitdb.*",
    "yamale.*",
    "problog.*",
]
ignore_missing_imports = true


# https://pylint.pycqa.org/en/latest/user_guide/configuration/index.html
[tool.pylint.MASTER]
fail-under = 10.0
load-plugins = [
    "pylint.extensions.check_elif",
    "pylint.extensions.for_any_all",
    "pylint.extensions.overlapping_exceptions",
    "pylint.extensions.set_membership",
    "pylint.extensions.typing",
]
# Disable unsubscriptable-object because Pylint has false positives and this check
# overlaps with mypy's checks. Enable the check when the related issue is resolved:
# https://github.com/pylint-dev/pylint/issues/9549
disable = [
    "fixme",
    "line-too-long",  # Replaced by Flake8 Bugbear B950 check.
    "too-few-public-methods",
    "too-many-ancestors",
    "too-many-arguments",
    "too-many-boolean-expressions",
    "too-many-branches",
    "too-many-function-args",
    "too-many-instance-attributes",
    "too-many-lines",
    "too-many-locals",
    "too-many-nested-blocks",
    "too-many-positional-arguments",
    "too-many-public-methods",
    "too-many-return-statements",
    "too-many-statements",
    "duplicate-code",
    "unsubscriptable-object",
]

[tool.pylint.MISCELLANEOUS]
notes = [
    "FIXME",
    "TODO",
    "BUGBUG",
]

[tool.pylint.FORMAT]
max-line-length = 120


# https://docs.pytest.org/en/latest/reference/customize.html#configuration-file-formats
# https://docs.pytest.org/en/latest/reference/reference.html#configuration-options
# https://docs.pytest.org/en/latest/reference/reference.html#command-line-flags
#
# To integrate Hypothesis into pytest and coverage, we use its native plugin:
# https://hypothesis.readthedocs.io/en/latest/details.html#the-hypothesis-pytest-plugin
#
# To discover tests in documentation, we use doctest and the doctest-plus plugin which
# adds multiple useful options to control tests in documentation. More details at:
# https://docs.python.org/3/library/doctest.html
# https://github.com/scientific-python/pytest-doctestplus
#
# To avoid failing pytest when no tests were dicovered, we need an extra plugin:
# https://docs.pytest.org/en/latest/reference/exit-codes.html
# https://github.com/yashtodi94/pytest-custom_exit_code
[tool.pytest.ini_options]
minversion = "7.0"
addopts = """-vv -ra --tb native --import-mode importlib \
    --hypothesis-show-statistics --hypothesis-explain --hypothesis-verbosity verbose \
    --doctest-modules --doctest-continue-on-failure --doctest-glob '*.rst' --doctest-plus \
    --cov macaron \
    --ignore tests/integration \
    --ignore tests/malware_analyzer/pypi/resources/sourcecode_samples \
"""  # Consider adding --pdb
# https://docs.python.org/3/library/doctest.html#option-flags
doctest_optionflags = "IGNORE_EXCEPTION_DETAIL"

env = [
    "PYTHONDEVMODE=1",  # https://docs.python.org/3/library/devmode.html
]
filterwarnings = [
    "error",
    "always::DeprecationWarning",
    # https://docs.pytest.org/en/latest/how-to/failures.html#warning-about-unraisable-exceptions-and-unhandled-thread-exceptions
    "error::pytest.PytestUnraisableExceptionWarning",
    "error::pytest.PytestUnhandledThreadExceptionWarning",
    # Remove the following when this issue is fixed: https://github.com/CycloneDX/cyclonedx-python-lib/issues/870
    "ignore::DeprecationWarning:cyclonedx.model.tool",
    "error::DeprecationWarning:pkg_resources",
]


# https://docs.astral.sh/ruff/formatter/
# https://docs.astral.sh/ruff/linter/
[tool.ruff]
line-length = 120

[tool.ruff.format]
exclude = [
    "tests/malware_analyzer/pypi/resources/sourcecode_samples/**/*.py",
]
docstring-code-format = true
docstring-code-line-length = 88

# https://docs.astral.sh/ruff/configuration/
# https://docs.astral.sh/ruff/rules/
[tool.ruff.lint]
exclude = ["docs/*"]
select = [
    "A",  # flake8-builtins
    "B",  # flake8-bugbear
    "C4",  # flake8-comprehensions
    "D",  # pydocstyle
    "DOC",  # pydoclint
    "E",  # pycodestyle
    "F",  # pyflakes
    "FURB",  # refurb
    "I",  # isort
    "ICN",  # flake8-import-conventions
    "LOG",  # flake8-logging
    "N",  # pep8-naming
    "PIE",  # flake8-pie
    "PT",  # flake8-pytest-style
    "PYI",  # flake8-pyi
    "RUF",  # ruff-specific rules
    "S",  # flake8-bandit
    "SIM",  # flake8-simplify
    "SLOT",  # flake8-slots
    "T20",  # flake8-print
    "UP",  # pyupgrade
]
ignore = [
    "D104",  # D104: Missing docstring in public package
    "D105",  # D105: Missing docstring in magic method
    "D404",  # D404: First word of the docstring should not be "This"
    "E203",  # E203: whitespace before ‘,’, ‘;’, or ‘:’ (not Black compliant)
    "E501",  # E501: line too long (managed better by Bugbear's B950)
    "SIM102",  # Use a single `if` statement instead of nested `if` statements
]

[tool.ruff.lint.flake8-pytest-style]
fixture-parentheses = true

[tool.ruff.lint.pydocstyle]
convention = "numpy"

[tool.ruff.lint.per-file-ignores]
"tests/*" = [
    "D102",  # D102: Missing docstring in public method
    "D104",  # D104: Missing docstring in public package
    "S101",  # S101 Use of `assert` detected
    "T201",  # T201 `print` found
]
"tests/malware_analyzer/pypi/resources/sourcecode_samples/**/*" = [
    "A",  # flake8-builtins
    "D",  # pydocstyle
    "E",  # pycodestyle
    "F",  # pyflakes
    "N",  # pep8-naming
    "S",  # flake8-bandit
    "SIM",  # flake8-simplify
]