pyproject.toml

[build-system]
requires = ["hatchling>=1.24"]
build-backend = "hatchling.build"

[project]
name = "gforge-python"
version = "0.1.2"
description = "A git firewall: a global pre-commit hook that blocks commits containing secrets (passwords, keys, tokens, .env files) across macOS, Linux, and Windows."
readme = "README.md"
requires-python = ">=3.9"
license = "Apache-2.0"
license-files = ["LICENSE", "NOTICE"]
keywords = [
    "git",
    "git-hooks",
    "githooks",
    "hooks",
    "pre-commit",
    "core.hookspath",
    "secrets",
    "secret-scanning",
    "secret-detection",
    "credentials",
    "security",
    "devsecops",
    "cli",
    "global-hooks",
]
# Original GForge authors first - the design and detection engine are their work
# and the three of them contributed to it equally. This port is maintained here.
#
# Deliberately name-only: PEP 621 sends any author carrying an email into
# Author-email, which PyPI hides behind an envelope icon, and only name-only
# authors reach the visible "Author" line. Mixing the two forms splits the
# credits. Contact details belong on maintainers instead.
authors = [
    { name = "Gaurang Joshi" },
    { name = "Shrey Tandel" },
    { name = "Dwij Acharya" },
    { name = "Mithil Maske" },
]
maintainers = [{ name = "Mithil Maske", email = "mithilm21@gmail.com" }]
classifiers = [
    "Development Status :: 4 - Beta",
    "Environment :: Console",
    "Intended Audience :: Developers",
    "Operating System :: MacOS",
    "Operating System :: Microsoft :: Windows",
    "Operating System :: POSIX :: Linux",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.9",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: Implementation :: CPython",
    "Topic :: Security",
    "Topic :: Software Development :: Version Control :: Git",
    "Typing :: Typed",
]
dependencies = []

[project.optional-dependencies]
dev = [
    "pytest>=8.0",
    # tomllib is stdlib from 3.11; the tests read pyproject.toml on 3.9/3.10 too.
    "tomli>=2.0.1; python_version < '3.11'",
    "pytest-cov>=5.0",
    "ruff>=0.6",
    "mypy>=1.11",
    "build>=1.2",
    "twine>=5.1",
]

[project.scripts]
gforge = "gforge.cli:main"

[project.urls]
Homepage = "https://github.com/mithilai/gforge-python"
Repository = "https://github.com/mithilai/gforge-python"
Issues = "https://github.com/mithilai/gforge-python/issues"
Changelog = "https://github.com/mithilai/gforge-python/releases"
"Upstream project (original)" = "https://github.com/psspl-gaurang/gforge"

[tool.hatch.build.targets.wheel]
packages = ["src/gforge"]

[tool.hatch.build.targets.sdist]
include = ["src", "tests", "README.md", "LICENSE", "NOTICE", "SECURITY.md"]

# --- tooling -----------------------------------------------------------------

[tool.pytest.ini_options]
minversion = "8.0"
testpaths = ["tests"]
addopts = "-q --strict-markers --strict-config"
filterwarnings = ["error"]

[tool.coverage.run]
source = ["gforge"]
branch = true

[tool.coverage.report]
# The script guards cannot execute under an in-process test runner; the scanner
# is separately proven to run as a script in tests/test_edge_cases.py.
exclude_also = [
    "if __name__ == .__main__.:",
    "if TYPE_CHECKING:",
]
# Local runs sit at 100%; the floor leaves a little headroom for platform-only
# branches rather than inviting a green run that quietly lost coverage.
fail_under = 98
show_missing = true

[tool.ruff]
line-length = 100
target-version = "py39"
src = ["src", "tests"]

[tool.ruff.lint]
select = [
    "E",    # pycodestyle errors
    "W",    # pycodestyle warnings
    "F",    # pyflakes
    "I",    # isort
    "B",    # flake8-bugbear
    "C4",   # comprehensions
    "UP",   # pyupgrade
    "SIM",  # flake8-simplify
    "PTH",  # prefer pathlib
    "S",    # flake8-bandit: this is a security tool, so hold it to that bar
    "RUF",  # ruff-specific
]
ignore = [
    "E501",  # long lines: the rule tables read better unwrapped
    # PEP 585/604 generics (list[str], X | None) are only safe in *annotation*
    # positions on Python 3.9, and this package also builds type aliases that are
    # evaluated at runtime. Supporting 3.9 means keeping typing.List/Optional.
    # Revisit when the floor moves to 3.10.
    "UP006",
    "UP007",
    "UP035",
    "UP045",
    # Deliberate, load-bearing choices rather than oversights:
    "S603",    # subprocess with a fixed argv and no shell IS the safe form
    "S607",    # git / python / gitleaks are resolved from PATH on purpose
    "SIM105",  # an explicit try/except/pass documents *why* it is swallowed
    "PTH100",  # os.path.abspath: the scanner avoids Path for its hot paths
    "PTH105",  # os.replace is the atomic rename; Path.replace hides that
]

[tool.ruff.lint.per-file-ignores]
# The scanner is copied verbatim into ~/.gforge/hooks and must stay importable
# by any stdlib-only interpreter, so a few module-level side effects are by design.
# S105/S106: rule identifiers and test fixtures are secret-*shaped* by nature.
# S110: the update path is best-effort and must never affect a commit.
# SIM102/SIM103: the nested branches each carry their own explanation.
"src/gforge/scanner.py" = ["E402", "S105", "S106", "S110", "SIM102", "SIM103"]
# Tests assert (S101) and use fake credential fixtures (S105/S106) on purpose.
"tests/*" = ["S101", "S105", "S106"]

# Strict type checking covers the shipped package. Tests are verified by pytest
# and use helpers/fixtures that gain nothing from full annotation.
[tool.mypy]
# mypy no longer accepts a 3.9 target; ruff's py39 target and CI's 3.9 job are
# what actually enforce the supported floor.
python_version = "3.10"
files = ["src/gforge"]
strict = true
warn_unreachable = true
show_error_codes = true