audit-pipeline-cli/pyproject.toml at main · Copenhagen0x/audit-pipeline-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
[build-system]
requires = ["setuptools>=68", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "audit-pipeline"
version = "0.1.0"
description = "CLI orchestrator for the Solana Audit Pipeline"
readme = "README.md"
requires-python = ">=3.10"
license = {text = "Apache-2.0"}
authors = [
    {name = "Kirill Sakharuk", email = "noreply@github.com"},
]
keywords = ["solana", "security", "audit", "kani", "formal-verification", "litesvm"]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: Apache Software License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Topic :: Security",
    "Topic :: Software Development :: Quality Assurance",
]

# Cross-cutting audit Defect 18 (LOW): unpinned upper bounds let a
# major-version bump silently land at install time (e.g. click 9.x
# removed group.add_command kwargs we rely on; rich 14+ deprecated
# Console.line_offset). Cap each dep at the next major; bump deliberately
# after smoke-testing.
dependencies = [
    "click>=8.1,<9",
    "rich>=13.0,<15",
    "PyYAML>=6.0,<7",
    "Jinja2>=3.1,<4",
    "requests>=2.31,<3",
    "anthropic>=0.40,<1",
    "cryptography>=42.0,<46",
    # L1 surface-coverage layer parses Rust via tree-sitter (new Language()/Parser() API).
    "tree-sitter>=0.23,<0.26",
    "tree-sitter-rust>=0.23,<0.25",
]

[project.optional-dependencies]
dev = [
    "pytest>=8.0,<9",
    "pytest-cov>=5.0,<7",
    "ruff>=0.5,<1",
    "mypy>=1.10,<2",
]

[project.scripts]
audit-pipeline = "audit_pipeline.cli:main"

[project.urls]
Homepage = "https://github.com/Copenhagen0x/audit-pipeline-cli"
Methodology = "https://github.com/Copenhagen0x/audit-pipeline-cli/tree/main/docs/methodology"
Example = "https://github.com/Copenhagen0x/percolator-audit-2026-04"

[tool.setuptools.packages.find]
where = ["src"]

[tool.setuptools.package-data]
audit_pipeline = [
    "templates/*",
    "templates/**/*",
    "templates/**/**/*",
    "scripts/**/*",
]

[tool.ruff]
line-length = 100
target-version = "py310"

[tool.ruff.lint]
select = ["E", "F", "W", "I", "N", "UP", "B", "C4", "RET", "SIM"]
# Pragmatic ignores: rules that flag stylistic preferences rather than bugs.
# CI gates on bugs (F8xx undefined names, F4xx unused imports, etc.), not on
# naming conventions or refactor suggestions.
ignore = [
    "E501",   # line length — formatter's job
    "B904",   # raise X from Y — adds noise without changing behavior
    "B007",   # unused loop control var — common in for-counter idioms
    "N806",   # non-lowercase var inside function — UPPER for module-style locals
    "N814",   # camelCase imported as constant — yaml as Y, etc.
    "N818",   # Exception names ending in Error — legacy classes already shipped
    "SIM102", # collapsible if — readability call, not always cleaner
    "SIM103", # needless bool — sometimes the explicit return is clearer
    "SIM105", # contextlib.suppress — try/except is more debuggable
    "SIM108", # ternary instead of if/else — readability call
    "SIM115", # context manager for open — fine when paired with explicit close
    "E741",   # ambiguous variable name (single-char l/I/O) — limited surface
    "F841",   # unused variable — sometimes intentional for typing/destructure
]

# Test code legitimately uses naming conventions that violate PEP 8 — test
# methods sometimes embed CAPS for emphasis (test_foo_does_NOT_bar) and
# fixture/factory helpers occasionally use snake_case for parametrized
# class names. CI was failing on these stylistic flags; gate strictness
# stays on `src/`, tests get the relaxed set.
[tool.ruff.lint.per-file-ignores]
"tests/*" = [
    "N802",  # function name not lowercase — tests intentionally CAPS-ize words for emphasis
    "N803",  # arg name not lowercase — pytest fixtures via class names
]

[tool.mypy]
python_version = "3.10"
strict = true
warn_unused_ignores = true