@produtype/core 0.27.0 → 0.28.0

package/dist/analyzer/analyzeProject.js

@@ -144,6 +144,15 @@ function isTestOrExamplePath(file) {
     // as a marketplace taking a cut. A field set to null is evidence of absence.
     return /(^|\/)(__tests__|__mocks__|mocks?|tests?|test-data|fixtures|frontend-example)(\/|$)/i.test(file)
         || /(^|\/)test[-_][^/]+\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
+        /**
+         * The other half of the convention.
+         *
+         * `test_settings.py` was recognised and `settings_tests.py` was not, so a Django
+         * project's test configuration was read as production and its `STRIPE_SECRET_KEY =
+         * "sk_test_fake"` raised a critical — the severity that bars a report from the top
+         * band — against a line written to be fake.
+         */
+        || /[-_]tests?\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         || /\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file);
 }
 /**

package/dist/utils/fileScanner.d.ts

@@ -4,9 +4,6 @@ export interface ScanOptions {
     patterns?: string[];
     ignore?: string[];
 }
-/**
- * Scan files relative to a root project path. Returns paths relative to cwd.
- */
 export declare function scanFiles(opts: ScanOptions): Promise<string[]>;
 /**
  * Quick check: does at least one path matching glob exist?

package/dist/utils/fileScanner.js

@@ -49,6 +49,20 @@ exports.DEFAULT_IGNORE = [
     '**/coverage/**',
     '**/venv/**',
     '**/.venv/**',
+    /**
+     * Where Python puts what you installed, whatever the surrounding directory is called.
+     *
+     * `venv/` and `.venv/` were ignored by name, and a repository whose virtualenv was
+     * called `venv52/` had 7331 of its 8438 source files read as its own: botocore, boto3,
+     * the whole of pip's output. It produced a critical — `SECRET_KEY =
+     * 'AWS_SECRET_ACCESS_KEY'`, which is botocore naming an environment variable — against
+     * a project that had not written it.
+     *
+     * This is `node_modules` for Python, and like `node_modules` it cannot be anything
+     * else. The name of the virtualenv is a guess; `site-packages` is a fact.
+     */
+    '**/site-packages/**',
+    '**/dist-packages/**',
     '**/__pycache__/**',
     '**/.next/**',
     '**/.turbo/**',
@@ -124,6 +138,24 @@ exports.DEFAULT_IGNORE = [
 /**
  * Scan files relative to a root project path. Returns paths relative to cwd.
  */
+/**
+ * The file Python writes at the root of a virtualenv, and the only reliable way to
+ * recognise one.
+ *
+ * A virtualenv can be called anything: `venv52`, `env-3.11`, `.direnv`. Its scripts live
+ * in `bin/` and its packages in `lib/pythonX/site-packages/`, but the marker at the root
+ * is always this. Finding it means everything beside it was installed rather than
+ * written.
+ */
+const VIRTUALENV_MARKER = 'pyvenv.cfg';
+function withoutVirtualenvs(files) {
+    const roots = files
+        .filter((file) => file === VIRTUALENV_MARKER || file.endsWith(`/${VIRTUALENV_MARKER}`))
+        .map((file) => file.slice(0, file.length - VIRTUALENV_MARKER.length));
+    if (roots.length === 0)
+        return files;
+    return files.filter((file) => !roots.some((root) => root !== '' && file.startsWith(root)));
+}
 async function scanFiles(opts) {
     const patterns = opts.patterns ?? ['**/*'];
     const ignore = [...exports.DEFAULT_IGNORE, ...(opts.ignore ?? [])];
@@ -135,7 +167,7 @@ async function scanFiles(opts) {
         ignore,
         suppressErrors: true,
     });
-    return entries.map((e) => e.split(path.sep).join('/'));
+    return withoutVirtualenvs(entries.map((e) => e.split(path.sep).join('/')));
 }
 /**
  * Quick check: does at least one path matching glob exist?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {