codegraph-brain 0.12.0__tar.gz → 0.13.0__tar.gz

codegraph_brain-0.13.0/.gitattributes

@@ -0,0 +1,6 @@
+# The review fingerprint (#375) hashes file bytes, so a checkout that stores
+# CRLF would produce a different digest for identical code — and the measured
+# digest would disagree with the reconstructed one on the same commit. Pinned
+# rather than normalised at hash time, because a normaliser can only fail by
+# merging two reviewers that differ.
+*.py text eol=lf

{codegraph_brain-0.12.0 → codegraph_brain-0.13.0}/.github/workflows/ci.yml

@@ -115,6 +115,34 @@ jobs:
           # Deliberately scoped to scripts/. src/ keeps the rule — metrics.py:70
           # is library code and its instance deserves a real answer (#342).
           #
+          # pythonsecurity:S2083 ("do not construct the path from user-controlled
+          # data") is exempted for scripts/ too, but for a DIFFERENT reason than
+          # S8707 above, and the difference matters. S8707's argument is that
+          # confining these tools to a root would break legitimate ad-hoc runs.
+          # S2083 was raised against backfill_review_fingerprint.py, which does
+          # the opposite: `safe_corpus_path` resolves the argument, requires a
+          # .jsonl regular file, confines it under the repository root, raises
+          # otherwise, and returns the resolved path that `backfill()` then uses
+          # for every read and write — the original argument never reaches the
+          # filesystem again (#375).
+          #
+          # The finding survived that. It was reported first at the read, then at
+          # the write, unchanged by binding the check to the value used, because
+          # SonarCloud's Python taint engine does not model `Path.resolve()` plus
+          # `is_relative_to()` as a sanitiser. The remaining report is an engine
+          # limitation, not an unvalidated path. Verified rather than assumed:
+          # main carries no open S2083, and the one S8707 left in src/ is marked
+          # FALSE-POSITIVE by a human, so neither rule has a working precedent
+          # here to copy blindly.
+          #
+          # The alternative considered and rejected was taking a bare filename
+          # and building the path from a fixed base, which the engine would
+          # accept. It makes traversal inexpressible, but it changes a documented
+          # CLI to satisfy an analyser rather than to close a hole that is
+          # already closed. If a script ever takes a path it does NOT validate,
+          # this exemption hides it — that is the cost, and it is the reason the
+          # rule stays on for src/.
+          #
           # `sonar.newCode.referenceBranch` overrides the server-side new-code
           # definition for this analysis. The instance default is
           # `previous_version` (confirmed: sonar.leak.period=previous_version,
@@ -173,9 +201,11 @@ jobs:
             -Dsonar.tests=tests
             -Dsonar.python.version=3.12
             -Dsonar.python.coverage.reportPaths=coverage.xml
-            -Dsonar.issue.ignore.multicriteria=e1,e2,e3
+            -Dsonar.issue.ignore.multicriteria=e1,e2,e3,e4
             -Dsonar.issue.ignore.multicriteria.e1.ruleKey=pythonsecurity:S8707
             -Dsonar.issue.ignore.multicriteria.e1.resourceKey=scripts/**/*.py
+            -Dsonar.issue.ignore.multicriteria.e4.ruleKey=pythonsecurity:S2083
+            -Dsonar.issue.ignore.multicriteria.e4.resourceKey=scripts/**/*.py
             -Dsonar.issue.ignore.multicriteria.e2.ruleKey=githubactions:S8541
             -Dsonar.issue.ignore.multicriteria.e2.resourceKey=.github/workflows/*.yml
             -Dsonar.issue.ignore.multicriteria.e3.ruleKey=githubactions:S8544

codegraph_brain-0.13.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.13.0"
+}

{codegraph_brain-0.12.0 → codegraph_brain-0.13.0}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.13.0](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.12.0...codegraph-brain-v0.13.0) (2026-08-15)
+
+
+### Features
+
+* **guardian:** an identity for a reviewer, that a commit does not fragment ([#375](https://github.com/zaebee/codegraph-brain/issues/375)) ([#383](https://github.com/zaebee/codegraph-brain/issues/383)) ([e339a38](https://github.com/zaebee/codegraph-brain/commit/e339a38743ddfdaac1e7c8f0724281844d5a8b38))
+
 ## [0.12.0](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.11.0...codegraph-brain-v0.12.0) (2026-08-13)
 
 

{codegraph_brain-0.12.0 → codegraph_brain-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codegraph-brain
-Version: 0.12.0
+Version: 0.13.0
 Summary: Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP.
 Project-URL: Homepage, https://github.com/zaebee/codegraph-brain
 Project-URL: Repository, https://github.com/zaebee/codegraph-brain