codesnake 1.2.1__tar.gz → 1.3.0__tar.gz

{codesnake-1.2.1/src/codesnake.egg-info → codesnake-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codesnake
-Version: 1.2.1
+Version: 1.3.0
 Summary: Semantic code checker for Python 3
 Author: CodeSnake Contributors
 License-Expression: MIT
@@ -30,6 +30,11 @@ Provides-Extra: dev
 Requires-Dist: codesnake[tools]; extra == "dev"
 Dynamic: license-file
 
+<p align="center">
+  <img src="https://raw.githubusercontent.com/bitWarrior/codesnake/main/images/codesnake-logo.jpg"
+       alt="CodeSnake — semantic analysis for Python" width="640">
+</p>
+
 # CodeSnake
 
 [![CI](https://github.com/bitWarrior/codesnake/actions/workflows/ci.yml/badge.svg)](https://github.com/bitWarrior/codesnake/actions/workflows/ci.yml)
@@ -97,10 +102,13 @@ adoption path is in [docs/INTEGRATIONS.md](docs/INTEGRATIONS.md#adopting-codesna
 ## Usage
 
 ```bash
-# Files or directories (walks *.py, skips venvs, caches, and .gitignore)
+# Files or directories (walks *.py; skips venvs, caches, and untracked .gitignore matches)
 codesnake check src/codesnake/checker.py test/example_bad_code.py
 codesnake check src/
 
+# Also analyze untracked files that .gitignore hides, e.g. generated output
+codesnake check --no-ignore src/
+
 # Same thing without the subcommand
 codesnake src/
 
@@ -137,11 +145,12 @@ codesnake config -o .codesnake.json
 | `--no-color` | Disable ANSI color (`NO_COLOR` also works) |
 | `--bandit` | Merge Bandit results when the `bandit` executable is installed |
 | `--staged` | Check `git diff --cached` Python files only |
+| `--no-ignore` | When walking directories, ignore `.gitignore` entirely, including for untracked files (venvs, caches, and `.git` are still skipped). Tracked files are analyzed either way. |
 | `--baseline FILE` | Hide issues whose fingerprint is already in the baseline |
 | `--update-baseline FILE` | Write the current finding set as a baseline |
 | `-j`, `--jobs N` | Worker processes (default: auto — one per CPU once 8+ files are checked; `1` disables) |
 
-`--staged` needs no file arguments and works from any directory inside the repository (paths from git are resolved against the repo root). With no staged `.py` files it exits **0**. `--baseline` fingerprints are `filename|code|message-with-numbers-normalized|occurrence`, so line-only edits and count changes (`52 lines long` → `53 lines long`) do not re-fail CI, while a *second* identical violation in the same file still does. Version-1 baselines are read transparently; `--update-baseline` writes version 2. A missing baseline file fails closed (exit 1).
+`--staged` needs no file arguments and works from any directory inside the repository (paths from git are resolved against the repo root). With no staged `.py` files it exits **0**. Directory walks skip `.gitignore` matches only for files git does not track, mirroring git's own behavior — so a file committed with `git add -f` is still analyzed, and no flag is needed to catch it. `--no-ignore` additionally covers *untracked* ignored files, such as generated output. `--baseline` fingerprints are `filename|code|message-with-numbers-normalized|occurrence`, so line-only edits and count changes (`52 lines long` → `53 lines long`) do not re-fail CI, while a *second* identical violation in the same file still does. Version-1 baselines are read transparently; `--update-baseline` writes version 2. A missing baseline file fails closed (exit 1).
 
 ### Output formats
 

{codesnake-1.2.1 → codesnake-1.3.0}/README.md

@@ -1,3 +1,8 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/bitWarrior/codesnake/main/images/codesnake-logo.jpg"
+       alt="CodeSnake — semantic analysis for Python" width="640">
+</p>
+
 # CodeSnake
 
 [![CI](https://github.com/bitWarrior/codesnake/actions/workflows/ci.yml/badge.svg)](https://github.com/bitWarrior/codesnake/actions/workflows/ci.yml)
@@ -65,10 +70,13 @@ adoption path is in [docs/INTEGRATIONS.md](docs/INTEGRATIONS.md#adopting-codesna
 ## Usage
 
 ```bash
-# Files or directories (walks *.py, skips venvs, caches, and .gitignore)
+# Files or directories (walks *.py; skips venvs, caches, and untracked .gitignore matches)
 codesnake check src/codesnake/checker.py test/example_bad_code.py
 codesnake check src/
 
+# Also analyze untracked files that .gitignore hides, e.g. generated output
+codesnake check --no-ignore src/
+
 # Same thing without the subcommand
 codesnake src/
 
@@ -105,11 +113,12 @@ codesnake config -o .codesnake.json
 | `--no-color` | Disable ANSI color (`NO_COLOR` also works) |
 | `--bandit` | Merge Bandit results when the `bandit` executable is installed |
 | `--staged` | Check `git diff --cached` Python files only |
+| `--no-ignore` | When walking directories, ignore `.gitignore` entirely, including for untracked files (venvs, caches, and `.git` are still skipped). Tracked files are analyzed either way. |
 | `--baseline FILE` | Hide issues whose fingerprint is already in the baseline |
 | `--update-baseline FILE` | Write the current finding set as a baseline |
 | `-j`, `--jobs N` | Worker processes (default: auto — one per CPU once 8+ files are checked; `1` disables) |
 
-`--staged` needs no file arguments and works from any directory inside the repository (paths from git are resolved against the repo root). With no staged `.py` files it exits **0**. `--baseline` fingerprints are `filename|code|message-with-numbers-normalized|occurrence`, so line-only edits and count changes (`52 lines long` → `53 lines long`) do not re-fail CI, while a *second* identical violation in the same file still does. Version-1 baselines are read transparently; `--update-baseline` writes version 2. A missing baseline file fails closed (exit 1).
+`--staged` needs no file arguments and works from any directory inside the repository (paths from git are resolved against the repo root). With no staged `.py` files it exits **0**. Directory walks skip `.gitignore` matches only for files git does not track, mirroring git's own behavior — so a file committed with `git add -f` is still analyzed, and no flag is needed to catch it. `--no-ignore` additionally covers *untracked* ignored files, such as generated output. `--baseline` fingerprints are `filename|code|message-with-numbers-normalized|occurrence`, so line-only edits and count changes (`52 lines long` → `53 lines long`) do not re-fail CI, while a *second* identical violation in the same file still does. Version-1 baselines are read transparently; `--update-baseline` writes version 2. A missing baseline file fails closed (exit 1).
 
 ### Output formats
 

{codesnake-1.2.1 → codesnake-1.3.0}/src/codesnake/_version.py

@@ -1,3 +1,3 @@
 """Single source of truth for the package version (read by pyproject.toml)."""
 
-__version__ = "1.2.1"
+__version__ = "1.3.0"

{codesnake-1.2.1 → codesnake-1.3.0}/src/codesnake/checker.py

@@ -360,6 +360,34 @@ def find_repo_root(start: Path) -> Optional[Path]:
     return None
 
 
+def git_tracked_files(repo_root: Path) -> Set[Path]:
+    """Resolved paths of every file git tracks in ``repo_root``, or an empty set.
+
+    git's own rule is that ``.gitignore`` governs *untracked* files only -- a
+    file that is committed is not affected by an ignore rule matching it. A
+    scanner that filters tracked files by ``.gitignore`` therefore diverges
+    from git, and can be made to skip a committed file with ``git add -f``.
+    Failure here (no git, not a repository, a timeout) yields an empty set,
+    which restores the previous behavior rather than hiding files.
+    """
+    try:
+        completed = _subprocess.run(
+            ['git', 'ls-files', '-z', '--full-name'],
+            capture_output=True,
+            timeout=30,
+            cwd=str(repo_root),
+        )
+    except (OSError, _subprocess.TimeoutExpired):
+        return set()
+    if completed.returncode != 0:
+        return set()
+    tracked: Set[Path] = set()
+    for name in completed.stdout.decode('utf-8', errors='replace').split('\0'):
+        if name:
+            tracked.add(repo_root / name)
+    return tracked
+
+
 def detect_source_encoding(data: bytes) -> str:
     """PEP 263 encoding cookie, else UTF-8 (with BOM)."""
     if data.startswith(b'\xef\xbb\xbf'):
@@ -404,12 +432,15 @@ def issue_ignored_by_pragma(code: str, line: int, source_lines: Sequence[str]) -
     return code.upper() in codes
 
 
-def iter_python_files(root: Path) -> Iterable[Path]:
-    """Yield .py files under root, skipping venvs, caches, and .gitignore matches."""
-    try:
-        root_resolved = root.resolve()
-    except OSError:
-        root_resolved = root
+def _load_ignore_state(
+    root_resolved: Path,
+) -> Tuple['_IgnoreStack', Set[Path], Set[Path]]:
+    """Ignore rules for a walk, plus the tracked paths exempt from them.
+
+    Returns the loaded ``.gitignore`` stack, the set of files git tracks, and
+    the directories those files live in. Tracked entries are exempt because
+    git applies ignore rules to untracked files only.
+    """
     ignore = _IgnoreStack()
     # .gitignore files between the repository root and the target apply to
     # everything below them, so load them first (top-most first).
@@ -425,23 +456,68 @@ def iter_python_files(root: Path) -> Iterable[Path]:
         if gi_path.is_file():
             ignore.add_gitignore(gi_path)
 
+    if repo_root is None:
+        return ignore, set(), set()
+    try:
+        tracked = git_tracked_files(repo_root.resolve())
+    except OSError:
+        return ignore, set(), set()
+    # An ignored *directory* holding a committed file must still be walked, or
+    # the file-level exemption is never reached.
+    tracked_dirs: Set[Path] = set()
+    for path in tracked:
+        tracked_dirs.update(path.parents)
+    return ignore, tracked, tracked_dirs
+
+
+def iter_python_files(root: Path, *, respect_gitignore: bool = True) -> Iterable[Path]:
+    """Yield .py files under root, skipping venvs, caches, and (by default) .gitignore matches.
+
+    ``respect_gitignore=False`` still skips ``SKIP_DIR_NAMES`` (venvs, caches,
+    ``.git``, ...) so a CI gate does not have to crawl ``site-packages``. It
+    does not skip a committed file that ``.gitignore`` would hide — pass
+    ``--no-ignore`` for that, or name the file explicitly.
+    """
+    try:
+        root_resolved = root.resolve()
+    except OSError:
+        root_resolved = root
+    ignore, tracked, tracked_dirs = (
+        _load_ignore_state(root_resolved) if respect_gitignore
+        else (_IgnoreStack(), set(), set())
+    )
+
     for dirpath, dirnames, filenames in os.walk(root_resolved):
         current = Path(dirpath)
-        nested_gi = current / '.gitignore'
-        if nested_gi.is_file():
-            ignore.add_gitignore(nested_gi)
-        views = ignore.view(current)
+        views: _DirectoryView = []
+        if respect_gitignore:
+            nested_gi = current / '.gitignore'
+            if nested_gi.is_file():
+                ignore.add_gitignore(nested_gi)
+            views = ignore.view(current)
 
         dirnames[:] = [
             name for name in dirnames
             if name not in SKIP_DIR_NAMES
             and not name.endswith('.egg-info')
-            and not _IgnoreStack.ignored(views, name, is_dir=True)
+            and not (
+                respect_gitignore
+                and (current / name) not in tracked_dirs
+                and _IgnoreStack.ignored(views, name, is_dir=True)
+            )
         ]
 
         for name in filenames:
-            if name.endswith('.py') and not _IgnoreStack.ignored(views, name, is_dir=False):
-                yield current / name
+            if not name.endswith('.py'):
+                continue
+            candidate = current / name
+            if (
+                respect_gitignore
+                and candidate not in tracked
+                and _IgnoreStack.ignored(views, name, is_dir=False)
+            ):
+                continue
+            yield candidate
 
 
 @dataclass
@@ -2139,7 +2215,11 @@ def git_staged_python_files() -> Tuple[List[str], Optional[str]]:
     return files, None
 
 
-def expand_python_targets(paths: Sequence[str]) -> Tuple[List[str], List[Issue]]:
+def expand_python_targets(
+    paths: Sequence[str],
+    *,
+    respect_gitignore: bool = True,
+) -> Tuple[List[str], List[Issue]]:
     """Expand directories to .py files. Explicit files are kept as given."""
     targets: List[str] = []
     extras: List[Issue] = []
@@ -2160,7 +2240,12 @@ def expand_python_targets(paths: Sequence[str]) -> Tuple[List[str], List[Issue]]
     for raw in paths:
         path = Path(raw)
         if path.is_dir():
-            found = [str(candidate) for candidate in iter_python_files(path)]
+            found = [
+                str(candidate)
+                for candidate in iter_python_files(
+                    path, respect_gitignore=respect_gitignore,
+                )
+            ]
             if not found:
                 extras.append(_io_issue(raw, f"No Python files found in '{raw}'"))
                 continue
@@ -2609,10 +2694,14 @@ def run_check(
     baseline_path: Optional[str] = None,
     update_baseline: Optional[str] = None,
     jobs: Optional[int] = None,
+    no_ignore: bool = False,
 ) -> int:
     """Analyze one or more files. Returns 1 if any error-severity issue exists.
 
     ``jobs``: worker processes (``None``/``0`` = auto, ``1`` = sequential).
+    ``no_ignore``: walk directories without applying ``.gitignore`` (venvs,
+    caches, and ``.git`` are still skipped). Explicit file arguments are
+    never gitignore-filtered.
     """
     out = stream if stream is not None else sys.stdout
 
@@ -2643,7 +2732,9 @@ def run_check(
     if show_banner and output_format == 'text':
         print_snake_banner(use_color=use_color)
 
-    targets, extra_issues = expand_python_targets(file_list)
+    targets, extra_issues = expand_python_targets(
+        file_list, respect_gitignore=not no_ignore,
+    )
 
     file_reports: List[Tuple[str, List[Issue], Optional[str]]] = []
     for extra in extra_issues:

{codesnake-1.2.1 → codesnake-1.3.0}/src/codesnake/cli.py

@@ -54,6 +54,12 @@ def add_check_arguments(parser: argparse.ArgumentParser) -> argparse.ArgumentPar
         action='store_true',
         help='Check only Python files staged in git',
     )
+    parser.add_argument(
+        '--no-ignore',
+        action='store_true',
+        help='Do not skip .gitignore matches when walking directories '
+             '(venvs, caches, and .git are still skipped)',
+    )
     parser.add_argument(
         '--baseline',
         metavar='FILE',
@@ -141,6 +147,7 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
             baseline_path=args.baseline,
             update_baseline=args.update_baseline,
             jobs=args.jobs,
+            no_ignore=args.no_ignore,
         )
 
     if args.command == 'config':

{codesnake-1.2.1 → codesnake-1.3.0/src/codesnake.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codesnake
-Version: 1.2.1
+Version: 1.3.0
 Summary: Semantic code checker for Python 3
 Author: CodeSnake Contributors
 License-Expression: MIT
@@ -30,6 +30,11 @@ Provides-Extra: dev
 Requires-Dist: codesnake[tools]; extra == "dev"
 Dynamic: license-file
 
+<p align="center">
+  <img src="https://raw.githubusercontent.com/bitWarrior/codesnake/main/images/codesnake-logo.jpg"
+       alt="CodeSnake — semantic analysis for Python" width="640">
+</p>
+
 # CodeSnake
 
 [![CI](https://github.com/bitWarrior/codesnake/actions/workflows/ci.yml/badge.svg)](https://github.com/bitWarrior/codesnake/actions/workflows/ci.yml)
@@ -97,10 +102,13 @@ adoption path is in [docs/INTEGRATIONS.md](docs/INTEGRATIONS.md#adopting-codesna
 ## Usage
 
 ```bash
-# Files or directories (walks *.py, skips venvs, caches, and .gitignore)
+# Files or directories (walks *.py; skips venvs, caches, and untracked .gitignore matches)
 codesnake check src/codesnake/checker.py test/example_bad_code.py
 codesnake check src/
 
+# Also analyze untracked files that .gitignore hides, e.g. generated output
+codesnake check --no-ignore src/
+
 # Same thing without the subcommand
 codesnake src/
 
@@ -137,11 +145,12 @@ codesnake config -o .codesnake.json
 | `--no-color` | Disable ANSI color (`NO_COLOR` also works) |
 | `--bandit` | Merge Bandit results when the `bandit` executable is installed |
 | `--staged` | Check `git diff --cached` Python files only |
+| `--no-ignore` | When walking directories, ignore `.gitignore` entirely, including for untracked files (venvs, caches, and `.git` are still skipped). Tracked files are analyzed either way. |
 | `--baseline FILE` | Hide issues whose fingerprint is already in the baseline |
 | `--update-baseline FILE` | Write the current finding set as a baseline |
 | `-j`, `--jobs N` | Worker processes (default: auto — one per CPU once 8+ files are checked; `1` disables) |
 
-`--staged` needs no file arguments and works from any directory inside the repository (paths from git are resolved against the repo root). With no staged `.py` files it exits **0**. `--baseline` fingerprints are `filename|code|message-with-numbers-normalized|occurrence`, so line-only edits and count changes (`52 lines long` → `53 lines long`) do not re-fail CI, while a *second* identical violation in the same file still does. Version-1 baselines are read transparently; `--update-baseline` writes version 2. A missing baseline file fails closed (exit 1).
+`--staged` needs no file arguments and works from any directory inside the repository (paths from git are resolved against the repo root). With no staged `.py` files it exits **0**. Directory walks skip `.gitignore` matches only for files git does not track, mirroring git's own behavior — so a file committed with `git add -f` is still analyzed, and no flag is needed to catch it. `--no-ignore` additionally covers *untracked* ignored files, such as generated output. `--baseline` fingerprints are `filename|code|message-with-numbers-normalized|occurrence`, so line-only edits and count changes (`52 lines long` → `53 lines long`) do not re-fail CI, while a *second* identical violation in the same file still does. Version-1 baselines are read transparently; `--update-baseline` writes version 2. A missing baseline file fails closed (exit 1).
 
 ### Output formats
 

{codesnake-1.2.1 → codesnake-1.3.0}/test/test_codesnake.py

@@ -864,6 +864,138 @@ class TestDirectoryWalkAndEncoding(unittest.TestCase):
             names = {Path(path).name for path in targets}
             self.assertEqual(names, {'kept.py'})
 
+    def _git_repo(self, tmp):
+        """A real git repo; skip if git is unavailable."""
+        import subprocess
+        root = Path(tmp).resolve()
+        try:
+            for cmd in (['git', 'init', '-q', '.'],
+                        ['git', 'config', 'user.email', 't@e.st'],
+                        ['git', 'config', 'user.name', 'test']):
+                subprocess.run(cmd, cwd=root, check=True, capture_output=True, timeout=30)
+        except (OSError, subprocess.CalledProcessError, subprocess.TimeoutExpired):
+            self.skipTest('git not available')
+        return root
+
+    def _git(self, root, *args):
+        import subprocess
+        subprocess.run(['git', *args], cwd=root, check=True, capture_output=True, timeout=30)
+
+    def test_committed_file_is_not_hidden_by_gitignore(self):
+        """git ignores .gitignore for tracked files; so must the walk.
+
+        Otherwise a PR can add a file, gitignore it, `git add -f` it, and the
+        default directory walk never sees it.
+        """
+        with tempfile.TemporaryDirectory() as tmp:
+            root = self._git_repo(tmp)
+            (root / 'src').mkdir()
+            (root / 'src' / 'good.py').write_text('x = 1\n', encoding='utf-8')
+            (root / 'src' / 'evil.py').write_text('eval(input())\n', encoding='utf-8')
+            (root / '.gitignore').write_text('src/evil.py\n', encoding='utf-8')
+            self._git(root, 'add', '.gitignore', 'src/good.py')
+            self._git(root, 'add', '-f', 'src/evil.py')
+            self._git(root, 'commit', '-q', '-m', 'x')
+
+            targets, _ = expand_python_targets([str(root / 'src')])
+            self.assertEqual({Path(t).name for t in targets}, {'good.py', 'evil.py'})
+
+    def test_committed_file_inside_ignored_directory_is_walked(self):
+        """An ignored directory holding a tracked file must not be pruned."""
+        with tempfile.TemporaryDirectory() as tmp:
+            root = self._git_repo(tmp)
+            (root / 'src' / 'hidden').mkdir(parents=True)
+            (root / 'src' / 'good.py').write_text('x = 1\n', encoding='utf-8')
+            (root / 'src' / 'hidden' / 'evil.py').write_text('eval(input())\n', encoding='utf-8')
+            (root / '.gitignore').write_text('src/hidden/\n', encoding='utf-8')
+            self._git(root, 'add', '.gitignore', 'src/good.py')
+            self._git(root, 'add', '-f', 'src/hidden/evil.py')
+            self._git(root, 'commit', '-q', '-m', 'x')
+
+            targets, _ = expand_python_targets([str(root / 'src')])
+            self.assertEqual({Path(t).name for t in targets}, {'good.py', 'evil.py'})
+
+    def test_untracked_gitignored_files_are_still_skipped(self):
+        """The exemption is for tracked files only — build output stays ignored."""
+        with tempfile.TemporaryDirectory() as tmp:
+            root = self._git_repo(tmp)
+            (root / 'src' / 'build').mkdir(parents=True)
+            (root / 'src' / 'good.py').write_text('x = 1\n', encoding='utf-8')
+            (root / 'src' / 'generated.py').write_text('eval(input())\n', encoding='utf-8')
+            (root / 'src' / 'build' / 'gen.py').write_text('eval(input())\n', encoding='utf-8')
+            (root / '.gitignore').write_text('src/generated.py\nsrc/build/\n', encoding='utf-8')
+            self._git(root, 'add', '.gitignore', 'src/good.py')
+            self._git(root, 'commit', '-q', '-m', 'x')
+
+            targets, _ = expand_python_targets([str(root / 'src')])
+            self.assertEqual({Path(t).name for t in targets}, {'good.py'})
+
+    def test_no_ignore_includes_gitignored_files(self):
+        """A committed-but-ignored file must be visible to a CI directory walk."""
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / '.gitignore').write_text('ignored.py\nsecret/\n', encoding='utf-8')
+            (root / 'kept.py').write_text('x = 1\n', encoding='utf-8')
+            (root / 'ignored.py').write_text('eval(1)\n', encoding='utf-8')
+            (root / 'secret').mkdir()
+            (root / 'secret' / 'bad.py').write_text('eval(1)\n', encoding='utf-8')
+            targets, extras = expand_python_targets(
+                [str(root)], respect_gitignore=False,
+            )
+            self.assertEqual(extras, [])
+            names = {Path(path).name for path in targets}
+            self.assertEqual(names, {'kept.py', 'ignored.py', 'bad.py'})
+
+    def test_no_ignore_still_skips_venvs_and_caches(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / 'kept.py').write_text('x = 1\n', encoding='utf-8')
+            (root / '__pycache__').mkdir()
+            (root / '__pycache__' / 'skip.py').write_text('eval(1)\n', encoding='utf-8')
+            (root / '.venv').mkdir()
+            (root / '.venv' / 'lib.py').write_text('eval(1)\n', encoding='utf-8')
+            targets, extras = expand_python_targets(
+                [str(root)], respect_gitignore=False,
+            )
+            self.assertEqual(extras, [])
+            self.assertEqual([Path(path).name for path in targets], ['kept.py'])
+
+    def test_run_check_no_ignore_reports_gitignored_error(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / '.gitignore').write_text('evil.py\n', encoding='utf-8')
+            (root / 'ok.py').write_text('x = 1\n', encoding='utf-8')
+            (root / 'evil.py').write_text('eval(input())\n', encoding='utf-8')
+            skipped = StringIO()
+            self.assertEqual(
+                run_check(
+                    [str(root)],
+                    config=CheckerConfig(),
+                    output_format='json',
+                    show_banner=False,
+                    color=False,
+                    stream=skipped,
+                ),
+                0,
+            )
+            found = StringIO()
+            rc = run_check(
+                [str(root)],
+                config=CheckerConfig(),
+                output_format='json',
+                show_banner=False,
+                color=False,
+                stream=found,
+                no_ignore=True,
+            )
+            self.assertEqual(rc, 1)
+            codes = [
+                issue['code']
+                for file_report in json.loads(found.getvalue())['files']
+                for issue in file_report['issues']
+            ]
+            self.assertIn('SEC001', codes)
+
     def test_run_check_on_directory(self):
         with tempfile.TemporaryDirectory() as tmp:
             root = Path(tmp)
@@ -2116,6 +2248,27 @@ class TestPackageAndCli(unittest.TestCase):
             self.assertEqual(main(['check']), 2)
         self.assertIn('provide files', err.getvalue())
 
+    def test_cli_no_ignore_checks_gitignored_file(self):
+        from unittest.mock import patch
+        from codesnake.cli import main
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / '.gitignore').write_text('evil.py\n', encoding='utf-8')
+            (root / 'ok.py').write_text('x = 1\n', encoding='utf-8')
+            (root / 'evil.py').write_text('eval(input())\n', encoding='utf-8')
+            with patch('sys.stdout', StringIO()):
+                self.assertEqual(
+                    main(['check', str(root), '--format', 'json', '--no-color']),
+                    0,
+                )
+            with patch('sys.stdout', StringIO()) as out:
+                rc = main([
+                    'check', str(root), '--format', 'json', '--no-color',
+                    '--no-ignore',
+                ])
+            self.assertEqual(rc, 1)
+            self.assertIn('SEC001', out.getvalue())
+
     def test_deeply_nested_file_is_contained_not_fatal(self):
         """One unanalyzable file must not sink the whole run."""
         from codesnake import check_file, run_check
@@ -2350,6 +2503,24 @@ class TestGitignoreFromRepoRoot(unittest.TestCase):
             targets, _ = expand_python_targets([str(outer / 'proj')])
             self.assertEqual({Path(t).name for t in targets}, {'a.py'})
 
+    def test_no_ignore_includes_root_gitignored_files(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp).resolve()
+            (root / '.git').mkdir()
+            (root / '.gitignore').write_text('generated/\n*_pb2.py\n', encoding='utf-8')
+            src = root / 'src'
+            (src / 'generated').mkdir(parents=True)
+            (src / 'a.py').write_text('x = 1\n', encoding='utf-8')
+            (src / 'proto_pb2.py').write_text('x = 1\n', encoding='utf-8')
+            (src / 'generated' / 'g.py').write_text('x = 1\n', encoding='utf-8')
+            targets, _ = expand_python_targets(
+                [str(src)], respect_gitignore=False,
+            )
+            self.assertEqual(
+                {Path(t).name for t in targets},
+                {'a.py', 'proto_pb2.py', 'g.py'},
+            )
+
 
 class TestBaselineFingerprints(unittest.TestCase):