gitmole 0.5.0__tar.gz → 0.6.2__tar.gz

{gitmole-0.5.0 → gitmole-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.5.0
+Version: 0.6.2
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole
@@ -63,6 +63,7 @@ gitmole . --json report.json           # every table, the watch list and the fin
 gitmole . --fail-on warning            # exit 3 if any finding is a warning or worse
 gitmole . --risk main --risk-threshold 5   # exit 3 if the files changed since main are too risky
 gitmole . --since 2y --full            # the current team, every row and column
+gitmole --clean                        # list what gitmole left behind, delete on a yes
 ```
 
 A CI job that runs `gitmole . --fail-on critical --markdown - >> "$GITHUB_STEP_SUMMARY"`
@@ -144,8 +145,10 @@ Why these and not others: [docs/tools.md](https://github.com/antvinni/gitmole/bl
 
 - Everything is offline except the optional clone step, which uses your
   existing gh auth. None of the tools send data anywhere.
-- Remote targets are cloned into a fresh temp directory. Local clones are
-  only read, but the log export and the secrets scan touch all branches.
+- Remote targets are cloned into a fresh temp directory that is removed when
+  the run ends. Local clones are only read, but the log export and the
+  secrets scan touch all branches. `gitmole --clean` lists every directory
+  gitmole created and deletes them after a y/N question.
 - Secret values never reach the output directory. betterleaks reports to
   gitmole in memory, and gitmole stores a short keyed hash in place of the
   value, the matched text and the commit message. The key is random, made

{gitmole-0.5.0 → gitmole-0.6.2}/README.md

@@ -43,6 +43,7 @@ gitmole . --json report.json           # every table, the watch list and the fin
 gitmole . --fail-on warning            # exit 3 if any finding is a warning or worse
 gitmole . --risk main --risk-threshold 5   # exit 3 if the files changed since main are too risky
 gitmole . --since 2y --full            # the current team, every row and column
+gitmole --clean                        # list what gitmole left behind, delete on a yes
 ```
 
 A CI job that runs `gitmole . --fail-on critical --markdown - >> "$GITHUB_STEP_SUMMARY"`
@@ -124,8 +125,10 @@ Why these and not others: [docs/tools.md](https://github.com/antvinni/gitmole/bl
 
 - Everything is offline except the optional clone step, which uses your
   existing gh auth. None of the tools send data anywhere.
-- Remote targets are cloned into a fresh temp directory. Local clones are
-  only read, but the log export and the secrets scan touch all branches.
+- Remote targets are cloned into a fresh temp directory that is removed when
+  the run ends. Local clones are only read, but the log export and the
+  secrets scan touch all branches. `gitmole --clean` lists every directory
+  gitmole created and deletes them after a y/N question.
 - Secret values never reach the output directory. betterleaks reports to
   gitmole in memory, and gitmole stores a short keyed hash in place of the
   value, the matched text and the commit message. The key is random, made

{gitmole-0.5.0 → gitmole-0.6.2}/gitmole/__init__.py

@@ -1,3 +1,3 @@
 """gitmole: offline git repository analysis with a terminal report."""
 
-__version__ = "0.5.0"
+__version__ = "0.6.2"

gitmole-0.6.2/gitmole/clean.py

@@ -0,0 +1,90 @@
+"""What gitmole leaves behind, found by looking: temp clones in the temp folder and analysis-* output
+directories under a base. Pure functions; the CLI prints, asks and reports."""
+from __future__ import annotations
+
+import glob
+import os
+import shutil
+import tempfile
+
+from . import run
+
+TEMP_PREFIX = "gitmole-"      # tempfile.mkdtemp(prefix=...) in cli._resolve_target and cli._portfolio
+OUT_PREFIX = "analysis-"      # run.output_dir and cli._portfolio
+
+
+def temp_dir() -> str:
+    """Where the temp clones went: mkdtemp(dir=os.environ.get("TMPDIR")) resolves the same way."""
+    return os.environ.get("TMPDIR") or tempfile.gettempdir()
+
+
+def _is_output(path: str) -> bool:
+    return os.path.isdir(path) and os.path.isfile(os.path.join(path, "meta.json"))
+
+
+def _whole_portfolio(path: str) -> bool:
+    """A portfolio parent is gitmole's as a whole when every directory in it is a repo output and every
+    other entry is a portfolio.* export or a dotfile."""
+    names = os.listdir(path)
+    dirs = [n for n in names if os.path.isdir(os.path.join(path, n))]
+    rest = [n for n in names if n not in dirs and not n.startswith(".")]
+    return bool(dirs) and all(_is_output(os.path.join(path, n)) for n in dirs) and all(n.startswith("portfolio.") for n in rest)
+
+
+def _outputs(base: str) -> list:
+    candidates = sorted(glob.glob(os.path.join(base, OUT_PREFIX + "*")))
+    if os.path.isdir(os.path.join(base, ".git")):
+        candidates.append(run.output_dir("path", base, None))
+    found = []
+    for path in candidates:
+        if not os.path.isdir(path):
+            continue
+        if _is_output(path) or _whole_portfolio(path):
+            found.append(path)
+        else:
+            found += [c for c in sorted(glob.glob(os.path.join(path, "*"))) if _is_output(c)]
+    return sorted(set(found))
+
+
+def _clones(tmp: str) -> list:
+    paths = [p for p in glob.glob(os.path.join(tmp, TEMP_PREFIX + "*")) if os.path.isdir(p)]
+    return sorted(paths, key=lambda p: (os.path.getmtime(p), p))
+
+
+def tree_size(path: str) -> int:
+    total = 0
+    for root, _dirs, files in os.walk(path):
+        for name in files:
+            try:
+                total += os.lstat(os.path.join(root, name)).st_size
+            except OSError:
+                pass
+    return total
+
+
+def find(base: str, tmp: str) -> list:
+    """(path, bytes, mtime) for every directory gitmole left behind: temp clones oldest first, then
+    output directories under base sorted by path."""
+    paths = _clones(tmp) + _outputs(os.path.abspath(base))
+    return [(p, tree_size(p), os.path.getmtime(p)) for p in paths]
+
+
+def human(n) -> str:
+    units = ["B", "kB", "MB", "GB", "TB"]
+    x, i = float(n), 0
+    while x >= 1000 and i < len(units) - 1:
+        x /= 1000
+        i += 1
+    if i == 0:
+        return f"{int(x)} B"
+    return f"{x:.1f} {units[i]}" if x < 10 else f"{x:.0f} {units[i]}"
+
+
+def remove(paths: list) -> list:
+    """rmtree each path, best effort; returns the ones still present afterwards."""
+    failed = []
+    for p in paths:
+        shutil.rmtree(p, ignore_errors=True)
+        if os.path.exists(p):
+            failed.append(p)
+    return failed

{gitmole-0.5.0 → gitmole-0.6.2}/gitmole/cli.py

@@ -1,8 +1,9 @@
-"""Command line entry point: gitmole <path | owner/repo | url> [--out DIR] [--no-run]."""
+"""Command line entry point: gitmole <path | owner/repo | url> [--out DIR] [--no-run], or gitmole --clean [DIR]."""
 from __future__ import annotations
 
 import argparse
 import os
+import shutil
 import signal
 import sys
 import tempfile
@@ -19,7 +20,7 @@ from . import __version__, banner, filetypes, findings, load, loss, run
 
 def parse_args(argv):
     p = argparse.ArgumentParser(prog="gitmole", description="Analyse a git repository offline and print a report.")
-    p.add_argument("target", help="local clone path, owner/repo, or git URL")
+    p.add_argument("target", nargs="?", help="local clone path, owner/repo, or git URL; with --clean, the directory to look in (default .)")
     p.add_argument("--out", help="output directory (default: analysis-<repo> next to the clone, or in cwd for remote targets)")
     p.add_argument("--no-run", action="store_true", help="skip the tools; re-render the report from an existing output directory")
     p.add_argument("--workers", type=int, default=6, help="how many tools to run at once")
@@ -34,6 +35,8 @@ def parse_args(argv):
     p.add_argument("--gone", type=int, default=loss.DEFAULT_MONTHS, metavar="MONTHS", help="a person with no commits this many months before the last commit counts as gone (default 12)")
     p.add_argument("--file-types", metavar="LIST", help="comma-separated extensions to treat as code (default: a built-in source list), or 'all'")
     p.add_argument("--list-file-types", action="store_true", help="list the file types in the repository, with counts and whether they count as code, then exit")
+    p.add_argument("--clean", action="store_true", help="list the directories gitmole created (temp clones, analysis-* under the target) and delete them after a y/N question, then exit")
+    p.add_argument("--yes", action="store_true", help="with --clean: delete without asking")
     p.add_argument("--duplicates", action="store_true", help="also look for duplicated code blocks (minutes and gigabytes on a large repo; function metrics alone take seconds)")
     p.add_argument("--full", action="store_true", help="every column and every row in the terminal report, and the test files the default tables hide (the default is the tighter, readable one)")
     p.add_argument("--json", metavar="PATH", help="write the report and findings as JSON to PATH, or - for stdout")
@@ -54,7 +57,7 @@ def interrupt(*_):
 
 
 def main(argv=None, console: Console = None, tool_check=run.missing_tools, planner=run.plan, estimator=run.estimate_blames,
-         lister=run.list_repos, cloner=run.clone, lizard_check=run.has_lizard) -> int:
+         lister=run.list_repos, cloner=run.clone, lizard_check=run.has_lizard, ask=None) -> int:
     global _control
     _control = run.Control()
     if threading.current_thread() is threading.main_thread():
@@ -65,6 +68,8 @@ def main(argv=None, console: Console = None, tool_check=run.missing_tools, plann
     rc = _check_args(args, err)
     if rc is not None:
         return rc
+    if args.clean:
+        return _clean(args, console, ask or (lambda q: console.input(q, markup=False)))
     # When an export goes to stdout, everything else (banner, progress, report) moves to stderr.
     quiet = "-" in (args.json, args.markdown)
     ui = Console(stderr=True) if quiet else console
@@ -110,6 +115,9 @@ def main(argv=None, console: Console = None, tool_check=run.missing_tools, plann
     except NoCommits as e:
         err.print(f"[red]{e}[/red]")
         return 2
+    finally:
+        if kind == "remote":
+            shutil.rmtree(os.path.dirname(repo_dir), ignore_errors=True)   # the temp clone; nothing reads it after the run
     return _render(out_dir, console, ui, args, err)
 
 
@@ -117,7 +125,9 @@ def _check_args(args, err, kind=None) -> int | None:
     """The argument combinations that cannot work, in one place: 2 and a message, or None. Called
     once on the arguments alone, then again with the target's `kind` for the checks that need it."""
     if kind is None:
-        bad = "--risk-threshold needs --risk" if args.risk_threshold is not None and not args.risk else None
+        bad = ("--yes needs --clean" if args.yes and not args.clean else
+               "target required" if args.target is None and not args.clean else
+               "--risk-threshold needs --risk" if args.risk_threshold is not None and not args.risk else None)
     elif kind == "path":
         bad = None
     else:
@@ -165,6 +175,43 @@ def _no_run(args, console, ui, err) -> int:
     return _render(out_dir, console, ui, args, err)
 
 
+def _clean(args, console: Console, ask) -> int:
+    """Handle --clean: list what gitmole left behind, ask once, remove. ask(prompt) returns the answer."""
+    from . import clean, render
+
+    found = clean.find(args.target or ".", clean.temp_dir())
+    if not found:
+        console.print("nothing to clean")
+        return 0
+    total = sum(size for _, size, _ in found)
+    rows = [(path, clean.human(size), time.strftime("%Y-%m-%d", time.localtime(mtime))) for path, size, mtime in found]
+    sec = render._section("Left behind", [("directory", render.PATH), ("size", render.RIGHT), ("modified", {})], rows,
+                          caption=f"{_dirs(len(found))}, {clean.human(total)} in all")
+    render.print_section(console, sec)
+    console.print(Text(""))
+    if not args.yes:
+        if not console.is_terminal:
+            console.print("[red]--clean needs a terminal to confirm;[/red] pass --yes to skip the question")
+            return 2
+        try:
+            answer = ask(f"Delete {_dirs(len(found))} ({clean.human(total)})? [y/N] ")
+        except EOFError:
+            answer = ""
+        if answer.strip().lower() not in ("y", "yes"):
+            console.print("kept")
+            return 0
+    failed = clean.remove([p for p, _, _ in found])
+    removed = [(p, size) for p, size, _ in found if p not in failed]
+    console.print(f"removed {_dirs(len(removed))} ({clean.human(sum(s for _, s in removed))})")
+    for p in failed:
+        console.print(f"[red]could not remove[/red] {p}", soft_wrap=True)
+    return 1 if failed else 0
+
+
+def _dirs(n: int) -> str:
+    return f"{n} director{'y' if n == 1 else 'ies'}"
+
+
 def _resolve_target(kind, target, args, console, ui, err, planner, estimator, lister, cloner):
     """Resolve the classified target to (repo_dir, out_dir) for _analyse, or a final return code for the
     org and clone-failure paths. Returns (rc, repo_dir, out_dir); rc is None unless main should return early."""
@@ -177,6 +224,7 @@ def _resolve_target(kind, target, args, console, ui, err, planner, estimator, li
         try:
             repo_dir = cloner(target, parent)
         except run.GhError as e:
+            shutil.rmtree(parent, ignore_errors=True)
             err.print(f"[red]could not clone {target}:[/red] {e}", soft_wrap=True)
             return 2, None, None
     else:
@@ -325,23 +373,26 @@ def _portfolio(owner: str, args, console: Console, ui: Console, planner, estimat
         return 2
     parent = tempfile.mkdtemp(prefix="gitmole-", dir=os.environ.get("TMPDIR"))
     reports = []
-    for i, name in enumerate(repos, 1):
-        ui.print(f"[bold]{name}[/bold] [dim]({i}/{len(repos)})[/dim]")
-        try:
-            repo_dir = cloner(f"{owner}/{name}", parent)
-        except run.GhError as e:
-            ui.print(f"[red]could not clone {owner}/{name}:[/red] {e}", soft_wrap=True)
-            continue
-        out_dir = os.path.join(base, name)
-        try:
-            _analyse(repo_dir, out_dir, args, ui, planner, estimator)
-        except Interrupted:
-            return 130
-        except NoCommits as e:
-            ui.print(f"[yellow]{name}:[/yellow] {e}; skipped")
-            continue
-        report = load.load_report(out_dir)
-        reports.append((name, report, findings.evaluate(report)))
+    try:
+        for i, name in enumerate(repos, 1):
+            ui.print(f"[bold]{name}[/bold] [dim]({i}/{len(repos)})[/dim]")
+            try:
+                repo_dir = cloner(f"{owner}/{name}", parent)
+            except run.GhError as e:
+                ui.print(f"[red]could not clone {owner}/{name}:[/red] {e}", soft_wrap=True)
+                continue
+            out_dir = os.path.join(base, name)
+            try:
+                _analyse(repo_dir, out_dir, args, ui, planner, estimator)
+            except Interrupted:
+                return 130
+            except NoCommits as e:
+                ui.print(f"[yellow]{name}:[/yellow] {e}; skipped")
+                continue
+            report = load.load_report(out_dir)
+            reports.append((name, report, findings.evaluate(report)))
+    finally:
+        shutil.rmtree(parent, ignore_errors=True)   # the temp clones; nothing reads them after the run
 
     def export_path(p):
         return p if p == "-" or os.path.isabs(p) else os.path.join(base, p)

{gitmole-0.5.0 → gitmole-0.6.2}/gitmole/filetypes.py

@@ -56,6 +56,15 @@ def is_test_path(path: str) -> bool:
     return bool(_TEST_PATH.search(path))
 
 
+_DOC_PATH = re.compile(r"(^|/)docs?(/|$)|\.(md|markdown|rst|txt|adoc)$", re.I)
+
+
+def is_doc_path(path: str) -> bool:
+    """Documentation: prose formats anywhere, or anything under docs/. A key in a planning document
+    is far more often a template than a leak."""
+    return bool(_DOC_PATH.search(path))
+
+
 def key(path: str) -> str:
     """The lowercased extension, or the whole lowercased name when there is none."""
     name = path.rsplit("/", 1)[-1].lower()

{gitmole-0.5.0 → gitmole-0.6.2}/gitmole/findings.py

@@ -40,19 +40,23 @@ def _secret_statement(groups: list) -> str:
 
 def secrets_found(report: dict) -> list:
     """Secrets grouped by value. A value anywhere in source is critical; one that only ever appears in
-    test files (fixtures, saved pages) is a warning, so a critical gate does not trip on test data.
-    Version strings and shortened tokens were flagged as placeholders and are not a finding."""
+    test files (fixtures, saved pages) or documentation (templates, samples) is a warning, so a
+    critical gate does not trip on test data or a planning document. Version strings, template markers
+    and key blocks without key material were flagged as placeholders and are not a finding."""
     groups = leaks.group(report.get("secrets") or [])
-    source = [g for g in groups if not g["test"]]
-    tests = [g for g in groups if g["test"]]
+
+    def in_source(g):
+        return any(not (filetypes.is_test_path(f) or filetypes.is_doc_path(f)) for f in g["files"])
+    source = [g for g in groups if in_source(g)]
+    aside = [g for g in groups if not in_source(g)]
     ignore = "Add the fingerprint of any false positive from secrets.json to .betterleaksignore in the repository."
     out = []
     if source:
         out.append(_f("critical", f"{len(source)} secret(s) in history", _secret_statement(source),
                       f"Rotate them; deleting the file does not remove them from git. {ignore}"))
-    if tests:
-        out.append(_f("warning", f"{len(tests)} secret(s) only in test files", _secret_statement(tests),
-                      f"Confirm they are fixtures, not live keys. {ignore}"))
+    if aside:
+        out.append(_f("warning", f"{len(aside)} secret(s) only in test or documentation files", _secret_statement(aside),
+                      f"Confirm they are fixtures or templates, not live keys. {ignore}"))
     return out
 
 
@@ -67,15 +71,24 @@ def _all_identities(report: dict):
 def placeholder_identity(report: dict, min_share: float = 0.01) -> list:
     """A placeholder name or mailbox with a real share of the commits. One stray commit in thousands
     is not worth the panel space."""
-    total = sum(i["commits"] for i in report["meta"].get("identities") or [])
+    identities = report["meta"].get("identities") or []
+    total = sum(i["commits"] for i in identities)
+
+    def is_placeholder(i):
+        return i["name"].strip().lower() in PLACEHOLDER_NAMES or bool(PLACEHOLDER_EMAIL.search(i["email"].lower()))
+    real = max((i for i in identities if not is_placeholder(i)), key=lambda i: i["commits"], default=None)
     out = []
     for i in _all_identities(report):
         if total and i["commits"] / total < min_share:
             continue
-        if i["name"].strip().lower() in PLACEHOLDER_NAMES or PLACEHOLDER_EMAIL.search(i["email"].lower()):
+        if is_placeholder(i):
+            # the busiest real identity is the likely owner; the line is offered, never applied
+            advice = (f"Set user.name and user.email. If those commits are {real['name']}'s, add to .mailmap: "
+                      f"{real['name']} <{real['email']}> {i['name']} <{i['email']}>; the people, bus factor and "
+                      f"knowledge findings then describe one person." if real
+                      else "Set user.name and user.email; consider a .mailmap for history.")
             out.append(_f("warning", "Unconfigured git identity",
-                          f"\"{i['name']} <{i['email']}>\" made {i['commits']} commits ({_pct(i['commits'], total)}).",
-                          "Set user.name and user.email; consider a .mailmap for history."))
+                          f"\"{i['name']} <{i['email']}>\" made {i['commits']} commits ({_pct(i['commits'], total)}).", advice))
     return out
 
 
@@ -130,12 +143,22 @@ def _sizer_advice(row: dict) -> str:
     return "Consider a shallow clone for CI; the history is the cost."
 
 
+def _tree(report: dict) -> dict:
+    """The files at HEAD, from scc, or {} when the run has no size listing to judge by."""
+    return (report.get("size") or {}).get("files") or {}
+
+
 def sizer_concerns(report: dict) -> list:
+    tree = _tree(report)
     out = []
     for row in report.get("sizer") or []:
         sev = "warning" if row["concern"] >= 2 else "info"
         where = f" at {row['ref']}" if row.get("ref") else ""
-        out.append(_f(sev, "Repo health", f"{row['name']} is {row['value']}{where}. git-sizer level of concern {row['concern']}.", _sizer_advice(row)))
+        advice = _sizer_advice(row)
+        if row.get("ref") and tree and row["name"].startswith("Blobs: ") and row["ref"] not in tree:
+            where += ", no longer in the tree"   # deleting it did not shrink the clone
+            advice = "It is already gone from the tree; a history rewrite is only worth it for clone size."
+        out.append(_f(sev, "Repo health", f"{row['name']} is {row['value']}{where}. git-sizer level of concern {row['concern']}.", advice))
     return out
 
 
@@ -151,9 +174,12 @@ def hotspot_dominance(report: dict, ratio: float = 2.0, minimum: int = 20) -> li
 
 
 def tight_coupling(report: dict, min_degree: int = 80, min_revs: int = 5) -> list:
-    """A file and its test are expected to change together, so pairs with a test file on either side are left out."""
+    """A file and its test are expected to change together, so pairs with a test file on either side are
+    left out; so are pairs where either file is no longer in the tree, which are history, not a dependency."""
+    tree = _tree(report)
     pairs = [p for p in report.get("coupling") or [] if p["degree"] >= min_degree and p["average-revs"] >= min_revs
-             and not (filetypes.is_test_path(p["entity"]) or filetypes.is_test_path(p["coupled"]))]
+             and not (filetypes.is_test_path(p["entity"]) or filetypes.is_test_path(p["coupled"]))
+             and not (tree and (p["entity"] not in tree or p["coupled"] not in tree))]
     if not pairs:
         return []
     pairs.sort(key=lambda p: (-p["degree"], -p["average-revs"]))
@@ -169,7 +195,7 @@ def stale_files(report: dict, months: int = 12, share: float = 0.3) -> list:
     """Files still in the tree that nobody has touched. The age table covers every path in the
     history, so paths that were deleted are left out here; they are not dead code, they are gone."""
     age = report.get("age") or []
-    tree = (report.get("size") or {}).get("files") or {}
+    tree = _tree(report)
     if tree:
         age = [a for a in age if a["entity"] in tree]
     if not age:

{gitmole-0.5.0 → gitmole-0.6.2}/gitmole/leaks.py

@@ -31,9 +31,14 @@ ARGV = ["betterleaks", "git", "--no-banner", "--report-format", "json", "--repor
 # the value, the text around it, and the commit message, which can quote it; Attributes repeats the message
 RAW_FIELDS = ("Secret", "Match", "Line", "Message", "Attributes")
 
-# A version string (5.0.0-1667386184.dfbbb54) and a token shortened with an ellipsis are the only shapes
-# skipped. Nothing is skipped by prefix: a public and a private key of the same service often share one.
+# Shapes that cannot be a live secret: a version string (5.0.0-1667386184.dfbbb54), a token shortened
+# with an ellipsis, a whole-value template marker (your-project-id, <your-token>, XXXX-XXXX, changeme),
+# and a key block whose body holds no key material. Every rule is about the whole value; nothing is
+# skipped by prefix, since a public and a private key of the same service often share one.
 _VERSION = re.compile(r"^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$")
+_MARKER = re.compile(r"^(<[^<>]+>|x+|(?:x{2,}[-_ ]?)+|your[-_][\w-]+|change[-_]?me|replace[-_]?me)$", re.I)
+_KEY_BLOCK = re.compile(r"-----BEGIN [A-Z ]*KEY-----(.*?)-----END [A-Z ]*KEY-----", re.S)
+_KEY_MATERIAL = 64   # a real body is hundreds of base64 characters; a template has dots or a few x's
 
 
 def new_key() -> bytes:
@@ -48,8 +53,14 @@ def digest(value: str, key: bytes) -> str:
 
 
 def is_placeholder(value: str) -> bool:
-    value = value or ""
-    return bool(_VERSION.match(value)) or value.endswith("...") or value.endswith("…")
+    value = (value or "").strip()
+    if _VERSION.match(value) or value.endswith("...") or value.endswith("…") or _MARKER.match(value):
+        return True
+    m = _KEY_BLOCK.search(value)
+    if m:
+        body = re.sub(r"\s|\.|…|\\n", "", m.group(1))   # literal \n sequences appear in JSON samples
+        return len(body) < _KEY_MATERIAL
+    return False
 
 
 def sanitise(rows: list) -> list:
@@ -66,15 +77,16 @@ def sanitise(rows: list) -> list:
 
 def group(rows: list) -> list:
     """One entry per distinct secret value (placeholders left out): its rule, the files and commits it
-    appears in, the number of distinct places (commit, file, line), and whether every place is a test
-    file. Values that appear in source come first, then the most widespread."""
+    appears in, the number of distinct places (commit, file, line), whether every place is a test
+    file, and whether every place is a documentation file. Values that appear in source come first,
+    then the most widespread."""
     groups, order = {}, []
     for i, r in enumerate(rows):
         if r.get("placeholder"):
             continue
         key = r.get("value") or ("row", i)
         if key not in groups:
-            groups[key] = {"value": r.get("value"), "rule": r["rule"], "files": [], "commits": [], "_places": set(), "test": True}
+            groups[key] = {"value": r.get("value"), "rule": r["rule"], "files": [], "commits": [], "_places": set(), "test": True, "docs": True}
             order.append(key)
         g = groups[key]
         if r["file"] not in g["files"]:
@@ -83,6 +95,7 @@ def group(rows: list) -> list:
             g["commits"].append(r["commit"])
         g["_places"].add((r["commit"], r["file"], r.get("line")))
         g["test"] = g["test"] and filetypes.is_test_path(r["file"])
+        g["docs"] = g["docs"] and filetypes.is_doc_path(r["file"])
     out = []
     for key in order:
         g = groups[key]

{gitmole-0.5.0 → gitmole-0.6.2}/gitmole/render.py

@@ -98,6 +98,17 @@ def _hide_tests(rows: list, path_of, full, noun="test file", plural=None) -> tup
     return kept, note
 
 
+def _hide_gone(pairs: list, report: dict, full) -> tuple:
+    """Drop coupled pairs where either file is no longer in the tree, unless `full` is True: they
+    describe a layout that no longer exists. Returns (pairs, note) like _hide_tests."""
+    tree = (report.get("size") or {}).get("files") or {}
+    if full is True or not tree:
+        return pairs, None
+    kept = [p for p in pairs if p["entity"] in tree and p["coupled"] in tree]
+    hidden = len(pairs) - len(kept)
+    return kept, (f"{hidden} historical pair{'s' if hidden != 1 else ''} hidden; --full shows them" if hidden else None)
+
+
 def _empty_note(base, hidden_note, source_base=None) -> str:
     """The note that replaces a table with no rows left. When test rows were hidden the note has to
     carry the count, since the caption goes with the table, and what is left is the source rows."""
@@ -364,6 +375,8 @@ def hotspots_section(report: dict, full: bool = True, width=None) -> dict:
 def coupling_section(report: dict, full: bool = True, width=None) -> dict:
     pairs = sorted((p for p in report.get("coupling") or [] if p["average-revs"] >= 5), key=lambda p: (-p["degree"], -p["average-revs"]))
     pairs, hidden_note = _hide_tests(pairs, lambda p: (p["entity"], p["coupled"]), full, noun="test pair")
+    pairs, gone_note = _hide_gone(pairs, report, full)
+    hidden_note = "; ".join(n for n in (hidden_note, gone_note) if n) or None
     limit = _limit("Change coupling", full)
     rows = [(p["entity"], p["coupled"], f"{p['degree']}%", p["average-revs"]) for p in pairs[:limit]]
     columns = [("file", PATH), ("changes with", PATH), ("degree", RIGHT), ("avg revs", RIGHT)]

{gitmole-0.5.0 → gitmole-0.6.2}/gitmole/run.py

@@ -37,6 +37,9 @@ _URL = re.compile(r"^(https?://|git@|ssh://)")
 
 def classify_target(target: str) -> tuple:
     if os.path.isdir(target):
+        probe = subprocess.run(["git", "-C", target, "rev-parse", "--git-dir"], capture_output=True, text=True)
+        if probe.returncode != 0:
+            raise ValueError(f"{target} is not a git repository; pass a clone, owner/repo or owner/*")
         return ("path", os.path.abspath(target))
     if _ORG.match(target):
         return ("org", target[:-2])

{gitmole-0.5.0 → gitmole-0.6.2}/gitmole.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.5.0
+Version: 0.6.2
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole
@@ -63,6 +63,7 @@ gitmole . --json report.json           # every table, the watch list and the fin
 gitmole . --fail-on warning            # exit 3 if any finding is a warning or worse
 gitmole . --risk main --risk-threshold 5   # exit 3 if the files changed since main are too risky
 gitmole . --since 2y --full            # the current team, every row and column
+gitmole --clean                        # list what gitmole left behind, delete on a yes
 ```
 
 A CI job that runs `gitmole . --fail-on critical --markdown - >> "$GITHUB_STEP_SUMMARY"`
@@ -144,8 +145,10 @@ Why these and not others: [docs/tools.md](https://github.com/antvinni/gitmole/bl
 
 - Everything is offline except the optional clone step, which uses your
   existing gh auth. None of the tools send data anywhere.
-- Remote targets are cloned into a fresh temp directory. Local clones are
-  only read, but the log export and the secrets scan touch all branches.
+- Remote targets are cloned into a fresh temp directory that is removed when
+  the run ends. Local clones are only read, but the log export and the
+  secrets scan touch all branches. `gitmole --clean` lists every directory
+  gitmole created and deletes them after a y/N question.
 - Secret values never reach the output directory. betterleaks reports to
   gitmole in memory, and gitmole stores a short keyed hash in place of the
   value, the matched text and the commit message. The key is random, made

{gitmole-0.5.0 → gitmole-0.6.2}/gitmole.egg-info/SOURCES.txt

@@ -6,6 +6,7 @@ gitmole/__main__.py
 gitmole/backtest.py
 gitmole/banner.py
 gitmole/blame.py
+gitmole/clean.py
 gitmole/cli.py
 gitmole/filetypes.py
 gitmole/findings.py
@@ -31,6 +32,7 @@ gitmole.egg-info/top_level.txt
 tests/test_backtest.py
 tests/test_banner.py
 tests/test_blame.py
+tests/test_clean.py
 tests/test_cli.py
 tests/test_filetypes.py
 tests/test_findings.py

gitmole-0.6.2/tests/test_clean.py

@@ -0,0 +1,109 @@
+import os
+import subprocess
+import tempfile
+import unittest
+
+from gitmole import clean
+
+
+def _output(path):
+    os.makedirs(path, exist_ok=True)
+    with open(os.path.join(path, "meta.json"), "w") as fh:
+        fh.write("{}")
+    with open(os.path.join(path, "size.json"), "w") as fh:
+        fh.write("x" * 100)
+
+
+class Find(unittest.TestCase):
+    def test_output_directory_with_meta_is_found_and_one_without_is_not(self):
+        with tempfile.TemporaryDirectory() as d, tempfile.TemporaryDirectory() as tmp:
+            _output(os.path.join(d, "analysis-a"))
+            os.makedirs(os.path.join(d, "analysis-b"))
+            found = clean.find(d, tmp)
+        self.assertEqual([p for p, _, _ in found], [os.path.join(d, "analysis-a")])
+
+    def test_size_and_mtime_come_with_the_path(self):
+        with tempfile.TemporaryDirectory() as d, tempfile.TemporaryDirectory() as tmp:
+            _output(os.path.join(d, "analysis-a"))
+            [(path, size, mtime)] = clean.find(d, tmp)
+        self.assertEqual(size, 102)   # meta.json "{}" plus 100 bytes
+        self.assertGreater(mtime, 0)
+
+    def test_whole_portfolio_is_listed_once(self):
+        with tempfile.TemporaryDirectory() as d, tempfile.TemporaryDirectory() as tmp:
+            pf = os.path.join(d, "analysis-acme")
+            _output(os.path.join(pf, "one"))
+            _output(os.path.join(pf, "two"))
+            with open(os.path.join(pf, "portfolio.md"), "w") as fh:
+                fh.write("# acme\n")
+            with open(os.path.join(pf, ".DS_Store"), "w") as fh:
+                fh.write("")
+            found = clean.find(d, tmp)
+        self.assertEqual([p for p, _, _ in found], [pf])
+
+    def test_partial_portfolio_lists_its_children(self):
+        with tempfile.TemporaryDirectory() as d, tempfile.TemporaryDirectory() as tmp:
+            pf = os.path.join(d, "analysis-acme")
+            _output(os.path.join(pf, "one"))
+            os.makedirs(os.path.join(pf, "notes"))
+            found = clean.find(d, tmp)
+        self.assertEqual([p for p, _, _ in found], [os.path.join(pf, "one")])
+
+    def test_temp_clones_come_first_oldest_first_and_only_from_tmp(self):
+        with tempfile.TemporaryDirectory() as d, tempfile.TemporaryDirectory() as tmp:
+            newer = os.path.join(tmp, "gitmole-bbb")
+            older = os.path.join(tmp, "gitmole-aaa")
+            os.makedirs(newer)
+            os.makedirs(older)
+            os.utime(older, (1, 1))
+            os.utime(newer, (2, 2))
+            os.makedirs(os.path.join(d, "gitmole-under-base"))
+            _output(os.path.join(d, "analysis-a"))
+            found = clean.find(d, tmp)
+        self.assertEqual([p for p, _, _ in found], [older, newer, os.path.join(d, "analysis-a")])
+
+    def test_a_clone_as_base_includes_its_own_output_next_to_it(self):
+        with tempfile.TemporaryDirectory() as d, tempfile.TemporaryDirectory() as tmp:
+            repo = os.path.join(d, "widgets")
+            subprocess.run(["git", "init", "-q", repo], check=True)
+            _output(os.path.join(d, "analysis-widgets"))
+            found = clean.find(repo, tmp)
+        self.assertEqual([p for p, _, _ in found], [os.path.join(d, "analysis-widgets")])
+
+    def test_nothing_found_is_an_empty_list(self):
+        with tempfile.TemporaryDirectory() as d, tempfile.TemporaryDirectory() as tmp:
+            self.assertEqual(clean.find(d, tmp), [])
+
+
+class Human(unittest.TestCase):
+    def test_boundaries(self):
+        self.assertEqual(clean.human(0), "0 B")
+        self.assertEqual(clean.human(999), "999 B")
+        self.assertEqual(clean.human(1200), "1.2 kB")
+        self.assertEqual(clean.human(1_200_000), "1.2 MB")
+        self.assertEqual(clean.human(340_000_000), "340 MB")
+        self.assertEqual(clean.human(2_100_000_000), "2.1 GB")
+
+
+class Remove(unittest.TestCase):
+    def test_removes_trees_and_reports_what_is_left(self):
+        with tempfile.TemporaryDirectory() as d:
+            gone = os.path.join(d, "analysis-a")
+            _output(gone)
+            failed = clean.remove([gone, os.path.join(d, "never-existed")])
+            self.assertFalse(os.path.exists(gone))
+        self.assertEqual(failed, [])
+
+
+class TempDir(unittest.TestCase):
+    def test_honours_tmpdir(self):
+        with tempfile.TemporaryDirectory() as d:
+            old = os.environ.get("TMPDIR")
+            os.environ["TMPDIR"] = d
+            try:
+                self.assertEqual(clean.temp_dir(), d)
+            finally:
+                if old is None:
+                    del os.environ["TMPDIR"]
+                else:
+                    os.environ["TMPDIR"] = old

{gitmole-0.5.0 → gitmole-0.6.2}/tests/test_cli.py

@@ -330,6 +330,59 @@ class GhFailures(unittest.TestCase):
         self.assertIn("repository not found", text)
 
 
+class TempClones(unittest.TestCase):
+    """A remote or portfolio run removes the temp parent it cloned into, whatever happened in between."""
+
+    def _cloner(self, parents):
+        def cloner(target, parent):
+            parents.append(parent)
+            d = os.path.join(parent, target.split("/")[-1])
+            os.makedirs(d)
+            _tiny_repo(d)
+            return d
+        return cloner
+
+    def _planner(self, argv):
+        return lambda repo, out, branch="HEAD", **kw: [{"name": "q", "argv": argv, "stdout": None, "deps": []}]
+
+    def test_remote_run_removes_its_clone_on_success(self):
+        parents = []
+        with tempfile.TemporaryDirectory() as work:
+            rc = cli.main(["acme/widgets", "--out", os.path.join(work, "out")], console=console(), tool_check=lambda **kw: [],
+                          planner=self._planner(["true"]), estimator=lambda repo, interval, **kw: {"files": 1, "samples": 1, "blames": 1},
+                          cloner=self._cloner(parents))
+        self.assertEqual(rc, 0)
+        self.assertEqual(len(parents), 1)
+        self.assertFalse(os.path.exists(parents[0]))
+
+    def test_remote_run_removes_its_clone_when_a_step_fails(self):
+        parents = []
+        with tempfile.TemporaryDirectory() as work:
+            cli.main(["acme/widgets", "--out", os.path.join(work, "out")], console=console(), tool_check=lambda **kw: [],
+                     planner=self._planner(["false"]), estimator=lambda repo, interval, **kw: {"files": 1, "samples": 1, "blames": 1},
+                     cloner=self._cloner(parents))
+        self.assertFalse(os.path.exists(parents[0]))
+
+    def test_failed_clone_leaves_no_parent(self):
+        parents = []
+        def cloner(target, parent):
+            parents.append(parent)
+            raise run.GhError("repository not found")
+        rc = cli.main(["acme/missing"], console=console(), tool_check=lambda **kw: [], cloner=cloner)
+        self.assertEqual(rc, 2)
+        self.assertFalse(os.path.exists(parents[0]))
+
+    def test_portfolio_run_removes_its_parent(self):
+        parents = []
+        with tempfile.TemporaryDirectory() as work:
+            rc = cli.main(["acme/*", "--out", os.path.join(work, "pf")], console=console(), tool_check=lambda **kw: [],
+                          planner=self._planner(["true"]), estimator=lambda repo, interval, **kw: {"files": 1, "samples": 1, "blames": 1},
+                          lister=lambda owner: ["one", "two"], cloner=self._cloner(parents))
+        self.assertEqual(rc, 0)
+        self.assertEqual(len(set(parents)), 1)
+        self.assertFalse(os.path.exists(parents[0]))
+
+
 class FileTypes(unittest.TestCase):
     def test_list_file_types_prints_the_tree_and_exits(self):
         with tempfile.TemporaryDirectory() as d:
@@ -516,8 +569,20 @@ class Arguments(unittest.TestCase):
         self.assertEqual(rc, 2)
         self.assertIn("not a repo", c.export_text())
 
+    def test_non_repo_directory_is_reported_not_raised(self):
+        with tempfile.TemporaryDirectory() as d:
+            target = os.path.join(d, "checkouts")
+            os.mkdir(target)
+            c = console()
+            rc = cli.main([target], console=c, tool_check=lambda **kw: [])
+            created = os.listdir(d)
+        self.assertEqual(rc, 2)
+        self.assertIn("not a git repository", c.export_text())
+        self.assertEqual(created, ["checkouts"])   # no analysis-checkouts/ next to a bad target
+
     def test_missing_tools_are_listed(self):
         with tempfile.TemporaryDirectory() as d:
+            _tiny_repo(d)
             c = console()
             rc = cli.main([d], console=c, tool_check=lambda **kw: ["scc"])
         text = c.export_text()
@@ -527,6 +592,120 @@ class Arguments(unittest.TestCase):
         self.assertNotIn("jar", text)
 
 
+class Clean(unittest.TestCase):
+    """--clean lists what gitmole left behind and deletes on a yes. TMPDIR is pointed at a scratch dir so the
+    real temp folder is never listed or touched."""
+
+    def _with_tmp(self, fn):
+        with tempfile.TemporaryDirectory() as work, tempfile.TemporaryDirectory() as tmp:
+            old = os.environ.get("TMPDIR")
+            os.environ["TMPDIR"] = tmp
+            try:
+                return fn(work, tmp)
+            finally:
+                if old is None:
+                    del os.environ["TMPDIR"]
+                else:
+                    os.environ["TMPDIR"] = old
+
+    def _output(self, path):
+        os.makedirs(path)
+        with open(os.path.join(path, "meta.json"), "w") as fh:
+            fh.write("{}")
+
+    def test_nothing_to_clean(self):
+        def go(work, tmp):
+            c = console()
+            rc = cli.main(["--clean", work], console=c)
+            return rc, c.export_text()
+        rc, text = self._with_tmp(go)
+        self.assertEqual(rc, 0)
+        self.assertIn("nothing to clean", text)
+
+    def test_lists_then_keeps_on_anything_but_yes(self):
+        def go(work, tmp):
+            self._output(os.path.join(work, "analysis-a"))
+            os.makedirs(os.path.join(tmp, "gitmole-x"))
+            c = Console(file=io.StringIO(), width=120, record=True, force_terminal=True, color_system=None)
+            asked = []
+            rc = cli.main(["--clean", work], console=c, ask=lambda q: asked.append(q) or "n")
+            return rc, c.export_text(), asked, os.path.isdir(os.path.join(work, "analysis-a")), os.path.isdir(os.path.join(tmp, "gitmole-x"))
+        rc, text, asked, out_kept, tmp_kept = self._with_tmp(go)
+        self.assertEqual(rc, 0)
+        self.assertIn("Left behind", text)
+        self.assertIn("analysis-a", text)
+        self.assertIn("gitmole-x", text)
+        self.assertEqual(len(asked), 1)
+        self.assertIn("Delete 2 directories", asked[0])
+        self.assertIn("kept", text)
+        self.assertTrue(out_kept)
+        self.assertTrue(tmp_kept)
+
+    def test_yes_answer_removes_and_reports(self):
+        def go(work, tmp):
+            self._output(os.path.join(work, "analysis-a"))
+            os.makedirs(os.path.join(tmp, "gitmole-x"))
+            c = Console(file=io.StringIO(), width=120, record=True, force_terminal=True, color_system=None)
+            rc = cli.main(["--clean", work], console=c, ask=lambda q: "Y")
+            return rc, c.export_text(), os.listdir(work), os.listdir(tmp)
+        rc, text, work_left, tmp_left = self._with_tmp(go)
+        self.assertEqual(rc, 0)
+        self.assertIn("removed 2 directories", text)
+        self.assertEqual(work_left, [])
+        self.assertEqual(tmp_left, [])
+
+    def test_default_base_is_the_current_directory(self):
+        def go(work, tmp):
+            self._output(os.path.join(work, "analysis-a"))
+            here = os.getcwd()
+            os.chdir(work)
+            try:
+                c = console()
+                rc = cli.main(["--clean", "--yes"], console=c)
+            finally:
+                os.chdir(here)
+            return rc, os.listdir(work)
+        rc, left = self._with_tmp(go)
+        self.assertEqual(rc, 0)
+        self.assertEqual(left, [])
+
+    def test_no_terminal_lists_and_refuses_without_yes(self):
+        def go(work, tmp):
+            self._output(os.path.join(work, "analysis-a"))
+            c = console()   # force_terminal=False
+            rc = cli.main(["--clean", work], console=c, ask=lambda q: self.fail("must not ask"))
+            return rc, c.export_text(), os.path.isdir(os.path.join(work, "analysis-a"))
+        rc, text, kept = self._with_tmp(go)
+        self.assertEqual(rc, 2)
+        self.assertIn("analysis-a", text)
+        self.assertIn("needs a terminal", text)
+        self.assertIn("--yes", text)
+        self.assertTrue(kept)
+
+    def test_yes_flag_skips_the_question(self):
+        def go(work, tmp):
+            self._output(os.path.join(work, "analysis-a"))
+            c = console()
+            rc = cli.main(["--clean", work, "--yes"], console=c, ask=lambda q: self.fail("must not ask"))
+            return rc, c.export_text(), os.listdir(work)
+        rc, text, left = self._with_tmp(go)
+        self.assertEqual(rc, 0)
+        self.assertIn("removed 1 directory", text)
+        self.assertEqual(left, [])
+
+    def test_yes_without_clean_is_an_error(self):
+        c = console()
+        rc = cli.main([".", "--yes"], console=c)
+        self.assertEqual(rc, 2)
+        self.assertIn("--yes needs --clean", c.export_text())
+
+    def test_no_target_without_clean_is_an_error(self):
+        c = console()
+        rc = cli.main([], console=c)
+        self.assertEqual(rc, 2)
+        self.assertIn("target required", c.export_text())
+
+
 class Risk(unittest.TestCase):
     def _repo(self, d):
         import subprocess

{gitmole-0.5.0 → gitmole-0.6.2}/tests/test_filetypes.py

@@ -91,6 +91,12 @@ class TestPaths(unittest.TestCase):
         for path in ("src/contest.py", "gitmole/render.py", "attest/x.py", "latest.md"):
             self.assertFalse(filetypes.is_test_path(path), path)
 
+    def test_documentation_files_and_directories(self):
+        for path in ("README.md", "docs/GA4-API-INTEGRATION.md", "doc/guide.rst", "NOTES.txt", "a/b/CHANGELOG.markdown", "docs/conf.py", "x.adoc"):
+            self.assertTrue(filetypes.is_doc_path(path), path)
+        for path in ("app/settings.py", "static/index.html", "docsite/app.js", "mdx/a.py", "config.yaml"):
+            self.assertFalse(filetypes.is_doc_path(path), path)
+
 
 if __name__ == "__main__":
     unittest.main()

{gitmole-0.5.0 → gitmole-0.6.2}/tests/test_findings.py

@@ -47,7 +47,7 @@ class SecretsFound(unittest.TestCase):
         self.assertIn("1 distinct value in 2 places: generic-api-key in app/settings.py (c1, c2)", crit["detail"])
         self.assertIn("Rotate", crit["advice"])
         self.assertIn(".betterleaksignore", crit["advice"])
-        self.assertEqual(warn["title"], "2 secret(s) only in test files")
+        self.assertEqual(warn["title"], "2 secret(s) only in test or documentation files")
         self.assertIn("2 distinct values in 3 places", warn["detail"])
         self.assertIn("tests/data/a.html and 1 other file", warn["detail"])
         self.assertIn(".betterleaksignore", warn["advice"])
@@ -56,6 +56,15 @@ class SecretsFound(unittest.TestCase):
         r = report(secrets=[self.row("h3", "tests/t.py")])
         self.assertEqual([f["severity"] for f in findings.secrets_found(r)], ["warning"])
 
+    def test_a_value_only_in_documentation_is_a_warning_that_says_template(self):
+        r = report(secrets=[self.row("h1", "docs/GA4-API-INTEGRATION.md", "e8c0508")])
+        f = findings.secrets_found(r)
+        self.assertEqual([x["severity"] for x in f], ["warning"])
+        self.assertEqual(f[0]["title"], "1 secret(s) only in test or documentation files")
+        self.assertIn("fixtures or templates", f[0]["advice"])
+        r = report(secrets=[self.row("h1", "docs/GA4-API-INTEGRATION.md", "e8c0508"), self.row("h1", "app/config.py", "c2")])
+        self.assertEqual([x["severity"] for x in findings.secrets_found(r)], ["critical"], "the same value in source is a leak")
+
     def test_placeholder_shapes_are_not_a_finding(self):
         r = report(secrets=[self.row("h4", "web/package.json", placeholder=True)])
         self.assertEqual(findings.secrets_found(r), [])
@@ -75,6 +84,15 @@ class PlaceholderIdentity(unittest.TestCase):
         f = findings.placeholder_identity(r)
         self.assertEqual(f[0]["severity"], "warning")
         self.assertIn("64%", f[0]["detail"])
+        self.assertIn("Bob <bob@x.com> Your Name <you@example.com>", f[0]["advice"], "the .mailmap line, with the top real identity as the likely owner")
+        self.assertIn(".mailmap", f[0]["advice"])
+
+    def test_advice_without_a_real_identity_to_map_to(self):
+        r = report()
+        r["meta"]["identities"] = [{"name": "Your Name", "email": "you@example.com", "commits": 64}]
+        f = findings.placeholder_identity(r)
+        self.assertIn("Set user.name and user.email", f[0]["advice"])
+        self.assertNotIn("<you@example.com>", f[0]["advice"], "no real identity to suggest, so no invented line")
 
     def test_nothing_for_real_identities(self):
         self.assertEqual(findings.placeholder_identity(report()), [])
@@ -133,6 +151,19 @@ class SizerConcerns(unittest.TestCase):
         self.assertEqual(f[0]["advice"], "Move large files to Git LFS or rewrite them out of history.")
         self.assertEqual(f[1]["advice"], "Split the widest directory into subdirectories; a directory that wide slows every checkout and diff.")
 
+    def test_a_big_blob_that_left_the_tree_says_so(self):
+        r = report(sizer=[{"name": "Blobs: Maximum size", "value": "21.3 MiB", "concern": 2, "ref": "static/old.mp4"}],
+                   size={"files": {"static/coming-soon.mp4": {"code": 0, "complexity": 0}}})
+        f = findings.sizer_concerns(r)[0]
+        self.assertIn("static/old.mp4, no longer in the tree", f["detail"])
+        self.assertIn("a history rewrite is only worth it for clone size", f["advice"])
+        r["size"]["files"]["static/old.mp4"] = {"code": 0, "complexity": 0}
+        f = findings.sizer_concerns(r)[0]
+        self.assertNotIn("no longer", f["detail"])
+        self.assertEqual(f["advice"], "Move large files to Git LFS or rewrite them out of history.")
+        r["size"] = {}
+        self.assertNotIn("no longer", findings.sizer_concerns(r)[0]["detail"], "without a tree listing nothing is claimed")
+
     def test_advice_per_kind_of_concern(self):
         # keyed on the loader's "section: metric" names, which are the only ones that occur
         def advice(name, ref=""):
@@ -188,6 +219,16 @@ class TightCoupling(unittest.TestCase):
                  {"entity": "src/a.js", "coupled": "src/a.test.js", "degree": 100, "average-revs": 9}]
         self.assertEqual(findings.tight_coupling(report(coupling=pairs)), [])
 
+    def test_pairs_of_files_no_longer_in_the_tree_are_history(self):
+        pairs = [{"entity": "static/financial-reporting.html", "coupled": "static/internal-audit.html", "degree": 100, "average-revs": 10},
+                 {"entity": "sections/a.html", "coupled": "sections/b.html", "degree": 90, "average-revs": 8}]
+        tree = {"files": {"sections/a.html": {"code": 1, "complexity": 0}, "sections/b.html": {"code": 1, "complexity": 0}}}
+        f = findings.tight_coupling(report(coupling=pairs, size=tree))
+        self.assertIn("1 pair changes", f[0]["detail"])
+        self.assertNotIn("financial-reporting", f[0]["detail"])
+        f = findings.tight_coupling(report(coupling=pairs))
+        self.assertIn("2 pairs", f[0]["detail"], "without a tree listing every pair counts")
+
     def test_single_pair_reads_grammatically(self):
         pairs = [{"entity": "a", "coupled": "b", "degree": 100, "average-revs": 10}]
         f = findings.tight_coupling(report(coupling=pairs))

{gitmole-0.5.0 → gitmole-0.6.2}/tests/test_leaks.py

@@ -45,6 +45,20 @@ class Placeholder(unittest.TestCase):
         for value in [VERSION, "1.2.3", "10.4.0+build.7", "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...", "abcdef…"]:
             self.assertTrue(leaks.is_placeholder(value), value)
 
+    def test_a_key_block_without_key_material_is_a_template(self):
+        # Google's service-account sample: header, a dotted body, footer; a real body is hundreds of base64 characters
+        for body in ["...", "\\n...\\n", "", "…", "xxxx"]:
+            self.assertTrue(leaks.is_placeholder(f"-----BEGIN PRIVATE KEY-----{body}-----END PRIVATE KEY-----"), body)
+        self.assertTrue(leaks.is_placeholder("-----BEGIN RSA PRIVATE KEY-----\\n...\\n-----END RSA PRIVATE KEY-----\\n"))
+        real = "-----BEGIN PRIVATE KEY-----\\n" + "MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC" * 4 + "\\n-----END PRIVATE KEY-----"
+        self.assertFalse(leaks.is_placeholder(real))
+
+    def test_template_markers_are_placeholders(self):
+        for value in ["your-project-id", "YOUR_API_KEY", "<your-token-here>", "xxxxxxxxxxxxxxxxxxxx", "XXXX-XXXX-XXXX", "changeme", "CHANGE_ME", "replace-me"]:
+            self.assertTrue(leaks.is_placeholder(value), value)
+        for value in ["AKIA" + "X" * 16, "6L" + "x" * 38, "ghp_" + "a1" * 18, "yourkey" + "9" * 20]:
+            self.assertFalse(leaks.is_placeholder(value), "a marker inside real-looking material is not enough: " + value)
+
     def test_anything_else_is_taken_seriously(self):
         # built at runtime: a literal in these shapes would trip secret scanners on this very file
         key_id, long_key = "AKIA" + "X" * 16, "6L" + "x" * 38
@@ -136,12 +150,22 @@ class Group(unittest.TestCase):
         groups = leaks.group(rows)
         self.assertEqual([g["value"] for g in groups], ["h1", "h2", "h3"], "source first, then by places; placeholders left out")
         self.assertEqual(groups[0], {"value": "h1", "rule": "generic-api-key", "files": ["app/settings.py"], "commits": ["c1", "c2"],
-                                     "places": 2, "test": False})
+                                     "places": 2, "test": False, "docs": False})
         self.assertEqual(groups[1]["files"], ["tests/data/a.html", "app/tests/data/a.html"])
         self.assertEqual(groups[1]["places"], 2)
         self.assertTrue(groups[1]["test"])
         self.assertEqual(leaks.placeholders(rows), 1)
 
+    def test_a_value_only_in_documentation_is_flagged_as_such(self):
+        groups = leaks.group([self.row("h1", "docs/GA4-API-INTEGRATION.md", "c1"), self.row("h1", "README.md", "c2")])
+        self.assertTrue(groups[0]["docs"])
+        self.assertFalse(groups[0]["test"])
+        groups = leaks.group([self.row("h1", "docs/setup.md", "c1"), self.row("h1", "app/a.py", "c2")])
+        self.assertFalse(groups[0]["docs"], "one place in source is enough")
+        groups = leaks.group([self.row("h1", "tests/t.py", "c1")])
+        self.assertFalse(groups[0]["docs"])
+        self.assertTrue(groups[0]["test"])
+
     def test_a_value_seen_in_source_and_tests_counts_as_source(self):
         groups = leaks.group([self.row("h1", "tests/t.py", "c1"), self.row("h1", "app/a.py", "c2")])
         self.assertFalse(groups[0]["test"])

{gitmole-0.5.0 → gitmole-0.6.2}/tests/test_render.py

@@ -313,6 +313,18 @@ class Report(unittest.TestCase):
         hot = _section_text(rendered(r, [], width=200), "\u25c6 Hotspots")
         self.assertIn("no source hotspots; 1 test file hidden; --full shows them", hot)
 
+    def test_default_coupling_hides_pairs_of_deleted_files_and_says_so(self):
+        r = sample_report()   # the tree holds static/index.html and static/apps-metadata.json only
+        r["coupling"] = [{"entity": "static/index.html", "coupled": "static/apps-metadata.json", "degree": 90, "average-revs": 11},
+                         {"entity": "static/tax.html", "coupled": "static/treasury.html", "degree": 85, "average-revs": 11}]
+        coupling = _section_text(rendered(r, [], width=200), "Change coupling")
+        self.assertIn("static/index.html", coupling)
+        self.assertNotIn("static/tax.html", coupling)
+        self.assertIn("1 historical pair hidden; --full shows them", coupling)
+        full = _section_text(rendered(r, [], width=200, full=True), "Change coupling")
+        self.assertIn("static/tax.html", full)
+        self.assertNotIn("hidden", full)
+
     def test_coupling_with_only_test_pairs_says_what_was_hidden(self):
         r = sample_report()
         r["coupling"] = [{"entity": "static/tax.html", "coupled": "tests/test_tax.py", "degree": 100, "average-revs": 11}]

{gitmole-0.5.0 → gitmole-0.6.2}/tests/test_run.py

@@ -9,10 +9,17 @@ from gitmole import blame, run
 
 
 class ClassifyTarget(unittest.TestCase):
-    def test_existing_directory_is_a_path(self):
+    def test_existing_repository_is_a_path(self):
         with tempfile.TemporaryDirectory() as d:
+            subprocess.run(["git", "init", "-q", d], check=True)
             self.assertEqual(run.classify_target(d), ("path", os.path.abspath(d)))
 
+    def test_directory_that_is_not_a_repository_raises(self):
+        with tempfile.TemporaryDirectory() as d:
+            with self.assertRaises(ValueError) as cm:
+                run.classify_target(d)
+        self.assertIn("not a git repository", str(cm.exception))
+
     def test_owner_slash_repo_is_remote(self):
         self.assertEqual(run.classify_target("acme/widgets"), ("remote", "acme/widgets"))