pyproject.toml

[project]
name = "yardstick"
requires-python = "<3.14,>=3.11"
authors = [
    {name = "Alex Goodman", email = "alex.goodman@anchore.com"},
]
license = {text = "Apache 2.0"}
dependencies = [
    "click<9,>=8",
    "dataclasses-json<1.0.0,>=0.6.7",
    "tabulate<1.0.0,>=0.9.0",
    "prompt-toolkit<4.0.0,>=3.0.48",
    "Pygments<3.0.0,>=2.18.0",
    "requests<3.0.0,>=2.32.3",
    "GitPython<4.0.0,>=3.1.43",
    "rfc3339<7.0,>=6.2",
    "omitempty<1.0.0,>=0.1.1",
    "importlib-metadata<9.0.0,>=7.0.1",
    "mergedeep<2.0.0,>=1.3.4",
    "dataclass-wizard<1.0.0,>=0.30.1",
    "PyYAML<7.0,>=6.0.0",
    "zstandard<1.0.0,>=0.23.0",
    "xxhash<4.0.0,>=3.5.0",
]
dynamic = ["version"]
description = "Tool for comparing the results from vulnerability scanners"
readme = "README.md"
keywords = [
  "vulnerability",
  "grype",
]
classifiers = [
  # derived from https://pypi.org/classifiers/
  "Development Status :: 5 - Production/Stable",
  "Intended Audience :: Developers",
  "Intended Audience :: Information Technology",
  "Intended Audience :: System Administrators",
  "Natural Language :: English",
  "Operating System :: POSIX :: Linux",
  "Operating System :: MacOS",
  "Topic :: Security",
  "Topic :: Software Development :: Libraries :: Python Modules",
  "Topic :: Utilities",
]

[project.urls]
repository = "https://github.com/anchore/yardstick"

[project.scripts]
yardstick = "yardstick.cli.cli:cli"

[build-system]
build-backend = "hatchling.build"
requires = ["hatchling", "uv-dynamic-versioning"]

[tool.hatch.version]
source = "uv-dynamic-versioning"

[tool.uv-dynamic-versioning]
vcs = "git"
style = "semver"

[tool.uv]
trusted-publishing = "always"

[[tool.uv.index]]
explicit = true
name = "testpypi"
url = "https://test.pypi.org/simple/"
publish-url = "https://test.pypi.org/legacy/"

[tool.mypy]
check_untyped_defs = 0
ignore_missing_imports = 1
ignore_errors = 0
strict_optional = 0
warn_unused_ignores = 0
warn_redundant_casts = 1
warn_unused_configs = 1

[tool.pytest.ini_options]
cache_dir = ".cache/pytest"

[tool.ruff]
cache-dir = ".cache/ruff"
# allow for a wide-birth relative to what black will correct to
line-length = 150


[lint]
ignore = [
  "ARG001", # unused args are ok, as they communicate intent in interfaces, even if not used in impls.
  "ARG002", # unused args are ok, as they communicate intent in interfaces, even if not used in impls.
  "G004", # it's ok to use formatted strings for logging
  "PGH004", # no blanket "noqa" usage, can be improved over time, but not now
  "PLR2004", # a little too agressive, not allowing any magic numbers
  "PLW2901", # "Outer for loop variable X overwritten by inner assignment target", not useful in most cases
  "RUF100", # no blanket "noqa" usage, can be improved over time, but not now
  "UP038", # Use `X | Y` in `isinstance` call instead of `(X, Y)` -- not compatible with python 3.9 (even with __future__ import)
  "S603", # subprocess calls are common and necessary in this codebase
  "S607", # we cannot rely on exact paths to all tools invoked for all users so must rely on PATH resolution
]

select = [
  "A",   # flake8-builtins
  # "ANN", # flake8-annotations   # this is great, but let mypy handle this so it can honor type:ignore comments without noqa comments too
  "ARG", # flake8-unused-arguments
  "B",   # flake8-bugbear
  "C",   # mccabe
  "C4",  # flake8-comprehensions
  "COM", # flake8-commas
  "DTZ", # flake8-datetimez
  "E",   # pycodestyle, errors
  # "EM",  # flake8-errmsg     # seems to aggressive relative to the current codebase
  # "ERA", # flake8-eradicate  # not all code in comments should be removed
  "EXE", # flake8-executable
  "F",   # pyflakes
  "G",   # flake8-logging-format
  "I",   # isort
  "ICN", # flake8-import-conventions
  "INP", # flake8-no-pep420
  "ISC", # flake8-implicit-str-concat
  "PGH", # pygrep-hooks
  "PIE", # flake8-pie
  "PL",  # pylint     (this can be broken down into more checks if needed)
  "PT",  # flake8-pytest-style
  # "PTH", # flake8-use-pathlib  # the codebase is not ready for this yet, but would be nice to add
  "Q",   # flake8-quotes
  "RET", # flake8-return
  "RSE", # flake8-raise
  "RUF", # ruff specific rules
  "S",   # flake8-bandit
  "SIM", # flake8-simplify
  "SLF", # flakes8-self
  "T10", # flake8-debugger
  "TCH", # flake8-type-checking
  "TID", # flake8-tidy-imports
  # "TRY", # tryceratops   # seems to aggressive relative to the current codebase
  "UP",  # pyupgrade
  "W",   # pycodestyle, warnings
  "YTT", # flake8-2020
]

[dependency-groups]
dev = [
    "pytest-mock<4.0.0,>=3.14.0",
    "pytest<9.0.0,>=8.3.4",
    "pre-commit<5.0.0,>=4.0.1",
    "mypy<2.0,>=1.13",
    "isort<6.0.0,>=5.13.2",
    "pylint<4.0.0,>=3.3.2",
    "autoflake<3.0,>=2.3",
    "ruff>=0.8.1,<1.0.0",
    "pytest-unordered<1.0.0,>=0.6.1",
    "pytest-sugar<2.0.0,>=1.0.0",
    "pytest-clarity<2.0.0,>=1.0.1",
    "pytest-cov<7.0.0,>=6.0.0",
    "pytest-picked<1.0.0,>=0.5.0",
    "pytest-xdist<4.0.0,>=3.6.1",
    "types-requests<3.0.0.0,>=2.32.0.20241016",
    "types-tabulate<1.0.0.0,>=0.9.0.20240106",
    "types-pyyaml<7.0.0.0,>=6.0.12.20240917",
    "types-pygments<3.0.0.0,>=2.18.0.20240506",
    "hatchling>=1.27.0",
    "hatch-vcs>=0.4.0",
]