SafeAI-Static-Analyzer 2.2.0__tar.gz → 2.2.1__tar.gz

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: SafeAI-Static-Analyzer
-Version: 2.2.0
+Version: 2.2.1
 Summary: The lightweight, open-source Static AI Capability & Risk Analyzer for CI/CD pipelines.
 Author: IkarusCareer
 License-Expression: Apache-2.0
@@ -41,7 +41,7 @@ Dynamic: license-file
 
 Enjoying SafeAI? A ⭐ on [GitHub](https://github.com/ikaruscareer/SafeAI) helps more security teams find it.
 
-**SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It runs entirely offline, never executes agents or calls LLMs, and integrates into CI/CD pipelines.
+**SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It is offline and source-private by default — it never executes agents or calls LLMs, and network activity occurs only through explicitly enabled integration commands (currently only `--pr-comment-post`). It integrates into CI/CD pipelines.
 
 > 🌐 [safeai-analyzer.ikaruscareer.com](https://safeai-analyzer.ikaruscareer.com) — project landing page
 

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.2.1}/README.md

@@ -8,7 +8,7 @@
 
 Enjoying SafeAI? A ⭐ on [GitHub](https://github.com/ikaruscareer/SafeAI) helps more security teams find it.
 
-**SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It runs entirely offline, never executes agents or calls LLMs, and integrates into CI/CD pipelines.
+**SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It is offline and source-private by default — it never executes agents or calls LLMs, and network activity occurs only through explicitly enabled integration commands (currently only `--pr-comment-post`). It integrates into CI/CD pipelines.
 
 > 🌐 [safeai-analyzer.ikaruscareer.com](https://safeai-analyzer.ikaruscareer.com) — project landing page
 

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.2.1}/SafeAI_Static_Analyzer.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: SafeAI-Static-Analyzer
-Version: 2.2.0
+Version: 2.2.1
 Summary: The lightweight, open-source Static AI Capability & Risk Analyzer for CI/CD pipelines.
 Author: IkarusCareer
 License-Expression: Apache-2.0
@@ -41,7 +41,7 @@ Dynamic: license-file
 
 Enjoying SafeAI? A ⭐ on [GitHub](https://github.com/ikaruscareer/SafeAI) helps more security teams find it.
 
-**SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It runs entirely offline, never executes agents or calls LLMs, and integrates into CI/CD pipelines.
+**SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It is offline and source-private by default — it never executes agents or calls LLMs, and network activity occurs only through explicitly enabled integration commands (currently only `--pr-comment-post`). It integrates into CI/CD pipelines.
 
 > 🌐 [safeai-analyzer.ikaruscareer.com](https://safeai-analyzer.ikaruscareer.com) — project landing page
 

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.2.1}/SafeAI_Static_Analyzer.egg-info/SOURCES.txt

@@ -193,6 +193,7 @@ tests/test_registry.py
 tests/test_registry_cli.py
 tests/test_registry_html.py
 tests/test_regression_fixtures.py
+tests/test_release_assets.py
 tests/test_release_fixes.py
 tests/test_release_validation.py
 tests/test_rules_loader_determinism.py

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.2.1}/safeai/cmd/cli.py

@@ -26,7 +26,9 @@ KYA (Know Your Agent) behavior:
   * ``--pr-comment`` writes a reviewer-facing Markdown summary of
     capability escalations to a file. SafeAI never posts it anywhere;
     publishing is the CI workflow's job.
-  * All outputs remain local: no network calls, no uploads.
+  * All outputs remain local: no network calls, no uploads — except the
+    explicitly enabled ``--pr-comment-post`` integration, which makes one
+    GitHub API request and announces itself on stderr.
 """
 
 import argparse
@@ -70,7 +72,9 @@ def _build_parser():
                       help="Print the PR comment Markdown to stdout")
     scan.add_argument("--pr-comment-post", action="store_true",
                       help="Post or update the PR comment on GitHub (requires GITHUB_TOKEN "
-                           "and CI context with PR number and repository)")
+                           "and CI context with PR number and repository). "
+                           "NETWORK: the one explicitly enabled integration that "
+                           "makes a GitHub API request; announces itself on stderr.")
     scan.add_argument("--fail-on-escalation", choices=["critical", "high", "medium"],
                       help="Fail the scan when a capability escalation at or above "
                            "this severity is detected (requires --baseline)")

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.2.1}/safeai/report/pr_comment.py

@@ -20,6 +20,8 @@ Design constraints, all enforced by tests:
 * Nothing is posted anywhere. This module returns a string.
 """
 
+import sys
+
 from safeai.analysis.tool_identity import display_name
 from safeai.kya.assurance import BOUNDARY_SENTENCE
 from safeai.severity import ESCALATION_SEVERITIES
@@ -343,6 +345,13 @@ def post_pr_comment(report, ci_context=None, token=None):
     text = render_pr_comment(report, ci_context=ci_context)
     api_base = f"https://api.github.com/repos/{repository}"
 
+    # Explicit integration boundary: the scanner is offline by default;
+    # this is the one path that makes a network request, and it says so.
+    sys.stderr.write(
+        "Integration mode enabled: SafeAI is making an explicit GitHub API "
+        "request to post/update a PR comment.\n"
+    )
+
     # Find existing comment with our marker
     comment_id = _find_existing_comment(api_base, pr_number, token)
     if comment_id:

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.2.1}/safeai/version.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 
 import sys
 
-SAFEAI_VERSION = "2.2.0"
+SAFEAI_VERSION = "2.2.1"
 VERSION_FLAGS = ("--version", "-V")
 
 

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.2.1}/tests/test_pr_comment.py

@@ -299,3 +299,54 @@ def test_post_pr_comment_returns_none_without_token(monkeypatch):
         "repository": "ikaruscareer/SafeAI",
     })
     assert result is None
+
+
+def test_post_pr_comment_announces_integration_mode(monkeypatch, capsys):
+    """The one network path announces itself on stderr before requesting."""
+    import json as _json
+    import urllib.request
+
+    from safeai.report.pr_comment import post_pr_comment
+
+    calls = []
+
+    class _FakeResponse:
+        def __init__(self, payload):
+            self.payload = payload
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return False
+
+        def read(self):
+            return _json.dumps(self.payload).encode()
+
+    def _fake_urlopen(request, *args, **kwargs):
+        calls.append(request.full_url)
+        if request.full_url.endswith("/comments?per_page=100"):
+            return _FakeResponse([])
+        return _FakeResponse({"html_url": "https://github.com/x/y/pull/42#issuecomment-1"})
+
+    monkeypatch.setattr(urllib.request, "urlopen", _fake_urlopen)
+    result = post_pr_comment(typical_report(), ci_context={
+        "pr_number": 42,
+        "repository": "ikaruscareer/SafeAI",
+    }, token="fake-token")
+    assert result == "https://github.com/x/y/pull/42#issuecomment-1"
+    assert len(calls) == 2  # find existing, then create
+    err = capsys.readouterr().err
+    assert "Integration mode enabled" in err
+    assert "explicit GitHub API request" in err
+
+
+def test_post_pr_comment_silent_without_token(monkeypatch, capsys):
+    """No announcement when nothing will be sent (offline stays silent)."""
+    from safeai.report.pr_comment import post_pr_comment
+    monkeypatch.delenv("GITHUB_TOKEN", raising=False)
+    assert post_pr_comment(typical_report(), ci_context={
+        "pr_number": 42,
+        "repository": "ikaruscareer/SafeAI",
+    }) is None
+    assert "Integration mode" not in capsys.readouterr().err

safeai_static_analyzer-2.2.1/tests/test_release_assets.py

@@ -0,0 +1,100 @@
+"""Release asset invariants (supply-chain: no misattributed evidence)."""
+
+import hashlib
+import importlib.util
+import json
+import os
+
+REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+SCRIPT = os.path.join(REPO_ROOT, "scripts", "verify_release_assets.py")
+
+
+def _load():
+    spec = importlib.util.spec_from_file_location("verify_release_assets", SCRIPT)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+def _write(path, content=b"x"):
+    with open(path, "wb") as fh:
+        fh.write(content if isinstance(content, bytes) else content.encode())
+
+
+def _clean_tree(tmp_path, version="2.2.1"):
+    wheel = f"safeai_static_analyzer-{version}-py3-none-any.whl"
+    sdist = f"safeai_static_analyzer-{version}.tar.gz"
+    sbom = f"safeai-{version}-sbom.spdx.json"
+    slsa = f"safeai-{version}-slsa-provenance.json"
+    for name, content in (
+        (wheel, b"wheel-bytes"),
+        (sdist, b"sdist-bytes"),
+        (sbom, json.dumps({"spdxVersion": "SPDX-2.3"})),
+        (slsa, json.dumps({"_type": "in-toto"})),
+    ):
+        _write(os.path.join(str(tmp_path), name), content)
+    for name in (wheel, sdist):
+        _write(os.path.join(str(tmp_path), name + ".sig"), b"sig")
+        _write(os.path.join(str(tmp_path), name + ".pem"), b"pem")
+    lines = []
+    for name in (wheel, sdist, sbom, slsa):
+        with open(os.path.join(str(tmp_path), name), "rb") as fh:
+            digest = hashlib.sha256(fh.read()).hexdigest()
+        lines.append(f"{digest}  {name}")
+    _write(os.path.join(str(tmp_path), "SHA256SUMS"), "\n".join(lines) + "\n")
+    return str(tmp_path)
+
+
+def test_clean_release_passes(tmp_path):
+    mod = _load()
+    assert mod.verify(_clean_tree(tmp_path), "2.2.1") == []
+
+
+def test_historical_artifact_fails(tmp_path):
+    mod = _load()
+    root = _clean_tree(tmp_path)
+    _write(os.path.join(root, "safeai-2.0.1-sbom.spdx.json"), b"{}")
+    problems = mod.verify(root, "2.2.1")
+    assert any("2.0.1" in p and "foreign version" in p for p in problems)
+
+
+def test_generic_provenance_fails(tmp_path):
+    mod = _load()
+    root = _clean_tree(tmp_path)
+    _write(os.path.join(root, "provenance.json"), b"{}")
+    problems = mod.verify(root, "2.2.1")
+    assert any("generically named" in p for p in problems)
+
+
+def test_missing_sidecar_fails(tmp_path):
+    mod = _load()
+    root = _clean_tree(tmp_path)
+    os.remove(os.path.join(root, "safeai_static_analyzer-2.2.1.tar.gz.sig"))
+    problems = mod.verify(root, "2.2.1")
+    assert any("sidecar" in p for p in problems)
+
+
+def test_checksum_mismatch_fails(tmp_path):
+    mod = _load()
+    root = _clean_tree(tmp_path)
+    _write(os.path.join(root, "safeai_static_analyzer-2.2.1.tar.gz"), b"tampered")
+    problems = mod.verify(root, "2.2.1")
+    assert any("digest mismatch" in p for p in problems)
+
+
+def test_unlisted_file_fails(tmp_path):
+    mod = _load()
+    root = _clean_tree(tmp_path)
+    wheel = "safeai_static_analyzer-2.2.1-py3-none-any.whl"
+    sums = os.path.join(root, "SHA256SUMS")
+    with open(sums, encoding="utf-8") as fh:
+        kept = [ln for ln in fh if wheel not in ln]
+    with open(sums, "w", encoding="utf-8") as fh:
+        fh.writelines(kept)
+    problems = mod.verify(root, "2.2.1")
+    assert any("absent from SHA256SUMS" in p for p in problems)
+
+
+def test_bad_version_usage():
+    mod = _load()
+    assert mod.main([".", "not-a-version"]) == 2