cycode 3.14.1.dev3__tar.gz → 3.15.1.dev1__tar.gz

{cycode-3.14.1.dev3 → cycode-3.15.1.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.14.1.dev3
+Version: 3.15.1.dev1
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

cycode-3.15.1.dev1/cycode/__init__.py

@@ -0,0 +1 @@
+__version__ = '3.15.1.dev1'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.14.1.dev3 → cycode-3.15.1.dev1}/cycode/cli/consts.py

@@ -91,6 +91,7 @@ SCA_CONFIGURATION_SCAN_SUPPORTED_FILES = (  # keep in lowercase
     'build.scala',
     'build.sbt.lock',
     'pyproject.toml',
+    'uv.lock',
     'poetry.lock',
     'pipfile',
     'pipfile.lock',
@@ -124,6 +125,7 @@ SCA_EXCLUDED_FOLDER_IN_PATH = (
     '.build',
     '.dart_tool',
     '.pub',
+    '.uv',
 )
 
 PROJECT_FILES_BY_ECOSYSTEM_MAP = {
@@ -145,6 +147,7 @@ PROJECT_FILES_BY_ECOSYSTEM_MAP = {
     'nuget': ['packages.config', 'project.assets.json', 'packages.lock.json', 'nuget.config'],
     'ruby_gems': ['Gemfile', 'Gemfile.lock'],
     'sbt': ['build.sbt', 'build.scala', 'build.sbt.lock'],
+    'pypi_uv': ['pyproject.toml', 'uv.lock'],
     'pypi_poetry': ['pyproject.toml', 'poetry.lock'],
     'pypi_pipenv': ['Pipfile', 'Pipfile.lock'],
     'pypi_requirements': ['requirements.txt'],

cycode-3.15.1.dev1/cycode/cli/files_collector/sca/python/restore_uv_dependencies.py

@@ -0,0 +1,59 @@
+from pathlib import Path
+from typing import Optional
+
+import typer
+
+from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies, build_dep_tree_path
+from cycode.cli.models import Document
+from cycode.cli.utils.path_utils import get_file_content
+from cycode.logger import get_logger
+
+logger = get_logger('UV Restore Dependencies')
+
+UV_MANIFEST_FILE_NAME = 'pyproject.toml'
+UV_LOCK_FILE_NAME = 'uv.lock'
+
+_UV_TOOL_SECTION = '[tool.uv]'
+
+
+def _indicates_uv(pyproject_content: Optional[str]) -> bool:
+    """Return True if pyproject.toml content signals that this project uses UV."""
+    if not pyproject_content:
+        return False
+    return _UV_TOOL_SECTION in pyproject_content
+
+
+class RestoreUvDependencies(BaseRestoreDependencies):
+    def __init__(self, ctx: typer.Context, is_git_diff: bool, command_timeout: int) -> None:
+        super().__init__(ctx, is_git_diff, command_timeout)
+
+    def is_project(self, document: Document) -> bool:
+        if Path(document.path).name != UV_MANIFEST_FILE_NAME:
+            return False
+
+        manifest_dir = self.get_manifest_dir(document)
+        if manifest_dir and (Path(manifest_dir) / UV_LOCK_FILE_NAME).is_file():
+            return True
+
+        return _indicates_uv(document.content)
+
+    def try_restore_dependencies(self, document: Document) -> Optional[Document]:
+        manifest_dir = self.get_manifest_dir(document)
+        lockfile_path = Path(manifest_dir) / UV_LOCK_FILE_NAME if manifest_dir else None
+
+        if lockfile_path and lockfile_path.is_file():
+            content = get_file_content(str(lockfile_path))
+            relative_path = build_dep_tree_path(document.path, UV_LOCK_FILE_NAME)
+            logger.debug('Using existing uv.lock, %s', {'path': str(lockfile_path)})
+            return Document(relative_path, content, self.is_git_diff)
+
+        return super().try_restore_dependencies(document)
+
+    def get_commands(self, manifest_file_path: str) -> list[list[str]]:
+        return [['uv', 'lock']]
+
+    def get_lock_file_name(self) -> str:
+        return UV_LOCK_FILE_NAME
+
+    def get_lock_file_names(self) -> list[str]:
+        return [UV_LOCK_FILE_NAME]

{cycode-3.14.1.dev3 → cycode-3.15.1.dev1}/cycode/cli/files_collector/sca/sca_file_collector.py

@@ -18,6 +18,7 @@ from cycode.cli.files_collector.sca.nuget.restore_nuget_dependencies import Rest
 from cycode.cli.files_collector.sca.php.restore_composer_dependencies import RestoreComposerDependencies
 from cycode.cli.files_collector.sca.python.restore_pipenv_dependencies import RestorePipenvDependencies
 from cycode.cli.files_collector.sca.python.restore_poetry_dependencies import RestorePoetryDependencies
+from cycode.cli.files_collector.sca.python.restore_uv_dependencies import RestoreUvDependencies
 from cycode.cli.files_collector.sca.ruby.restore_ruby_dependencies import RestoreRubyDependencies
 from cycode.cli.files_collector.sca.sbt.restore_sbt_dependencies import RestoreSbtDependencies
 from cycode.cli.models import Document
@@ -159,6 +160,7 @@ def _get_restore_handlers(ctx: typer.Context, is_git_diff: bool) -> list[BaseRes
         RestoreDenoDependencies(ctx, is_git_diff, build_dep_tree_timeout),
         RestoreNpmDependencies(ctx, is_git_diff, build_dep_tree_timeout),  # Must be after Yarn & Pnpm for fallback
         RestoreRubyDependencies(ctx, is_git_diff, build_dep_tree_timeout),
+        RestoreUvDependencies(ctx, is_git_diff, build_dep_tree_timeout),  # Must be before Poetry for pyproject.toml
         RestorePoetryDependencies(ctx, is_git_diff, build_dep_tree_timeout),
         RestorePipenvDependencies(ctx, is_git_diff, build_dep_tree_timeout),
         RestoreComposerDependencies(ctx, is_git_diff, build_dep_tree_timeout),

{cycode-3.14.1.dev3 → cycode-3.15.1.dev1}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.14.1.dev3"
+version = "3.15.1.dev1"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"

cycode-3.14.1.dev3/cycode/__init__.py

@@ -1 +0,0 @@
-__version__ = '3.14.1.dev3'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag