commitguardian 0.1.0__py3-none-any.whl

commitguard/__init__.py

@@ -0,0 +1,26 @@
+"""CommitGuard: Git commit provenance and contribution policy enforcement.
+
+CommitGuard analyses Git commits, produces structured security *findings* with
+independent *detectors*, and turns those findings into an ALLOW / WARN / BLOCK
+*decision* using a separately configured *policy*.
+
+Package layout (dependency direction flows downwards only)::
+
+    cli          -> user interface (Typer); the only layer that prints
+    core         -> detection engine, findings, decisions, scan context
+    detectors    -> pure functions of a commit; never touch the repository
+    policies     -> maps findings to actions
+    provenance   -> identity / trailer / signature models and analysis
+    git          -> safe Git CLI wrapper (isolated from detection)
+    config       -> validated repository configuration
+    github       -> GitHub Actions and GitHub App adapters (webhooks, Checks API)
+    audit        -> audit events (recorded by the GitHub App service)
+    observability-> structured logs, correlation IDs and metrics for services
+    security     -> input validation, sanitisation, hashing
+    exceptions   -> error hierarchy
+    utils        -> subprocess / filesystem / platform helpers
+"""
+
+__version__ = "0.1.0"
+
+__all__ = ["__version__"]

commitguard/__main__.py

@@ -0,0 +1,6 @@
+"""Allow ``python -m commitguard`` to invoke the CLI."""
+
+from commitguard.cli.app import main
+
+if __name__ == "__main__":
+    main()

commitguard/api/__init__.py

@@ -0,0 +1,18 @@
+"""The CommitGuard dashboard API (``/api/v1``) and dashboard hosting.
+
+::
+
+    WSGI request
+      -> request ID, size limits, strict query/cookie/JSON parsing
+      -> CORS (explicit allow-list) and security headers
+      -> authentication (session cookie)            401 UNAUTHENTICATED / SESSION_EXPIRED
+      -> CSRF (Origin + X-CSRF-Token) on writes     403 CSRF_FAILED
+      -> rate limits (sign-in, writes, GitHub calls, search)
+      -> route permission -> access scope           tenant resolution
+      -> handler -> control plane service -> state store
+      -> {"data": ..., "meta": ...} | {"error": {"code", "message", "request_id"}}
+
+Like the webhook endpoint it has no web framework dependency. Routes are thin:
+they parse input, call :mod:`commitguard.controlplane` services and serialise
+the resource models from :mod:`commitguard.controlplane.views`.
+"""