gitmole 0.6.12__tar.gz → 0.6.13__tar.gz

{gitmole-0.6.12 → gitmole-0.6.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.6.12
+Version: 0.6.13
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole

{gitmole-0.6.12 → gitmole-0.6.13}/gitmole/__init__.py

@@ -1,3 +1,3 @@
 """gitmole: offline git repository analysis with a terminal report."""
 
-__version__ = "0.6.12"
+__version__ = "0.6.13"

{gitmole-0.6.12 → gitmole-0.6.13}/gitmole/filetypes.py

@@ -190,6 +190,7 @@ def is_release(path: str, plumbing=frozenset()) -> bool:
 # What a generated file says about itself in its first lines: protoc, ajv, code generators of every kind.
 _GENERATED = re.compile(r"auto[- ]?generated|generated (by|from|file|code|automatically|with)|do not (edit|modify)|@generated|code generated", re.I)
 GENERATED_HEAD_LINES = 5
+_GENERATED_NAME = re.compile(r"\.(min\.js|min\.css|bundle\.js|map)$", re.I)   # a build output by name: nobody edits a bundle or a source map
 
 
 def _generated_patterns(repo: str) -> list:
@@ -219,7 +220,7 @@ def generated_files(repo: str, paths: list) -> list:
     patterns = _generated_patterns(repo)
     out = []
     for path in paths:
-        if any(_attribute_match(path, p) for p in patterns):
+        if _GENERATED_NAME.search(path) or any(_attribute_match(path, p) for p in patterns):
             out.append(path)
             continue
         try:

{gitmole-0.6.12 → gitmole-0.6.13}/gitmole/findings.py

@@ -194,9 +194,10 @@ def tight_coupling(report: dict, min_degree: int = 80, min_revs: int = 5) -> lis
     """A file and its test are expected to change together, so pairs with a test file on either side are
     left out; so are pairs where either file is no longer in the tree, which are history, not a dependency,
     and pairs of release plumbing (two version files, a manifest and its lock file), which are a release."""
-    tree, vendored = _tree(report), filetypes.vendor_dirs(report)
+    tree, vendored, derived = _tree(report), filetypes.vendor_dirs(report), _generated(report)
     pairs = [p for p in report.get("coupling") or [] if p["degree"] >= min_degree and p["average-revs"] >= min_revs
              and not (filetypes.is_test_path(p["entity"]) or filetypes.is_test_path(p["coupled"]))
+             and not (p["entity"] in derived or p["coupled"] in derived)
              and not (filetypes.is_release_path(p["entity"]) and filetypes.is_release_path(p["coupled"]))
              and not filetypes.is_header_pair(p["entity"], p["coupled"])
              and not (filetypes.is_vendored(p["entity"], vendored) or filetypes.is_vendored(p["coupled"], vendored))

{gitmole-0.6.12 → gitmole-0.6.13}/gitmole/identity.py

@@ -5,7 +5,7 @@ import re
 
 
 _BOT_WORDS = ("dependabot", "renovate", "github-actions", "github actions", "copilot", "cursor agent", "cursor-agent", "cursoragent")
-_BOT_NAME = re.compile(r"\bbot\b|\bci\b|deploy|automation", re.I)   # "Deploy from CI", "Release Bot", "Homebrew Automation"
+_BOT_NAME = re.compile(r"\bbot\b|\bci\b|deploy|automation|releaser|release-bot", re.I)   # "Deploy from CI", "Release Bot", "hugoreleaser"
 
 
 def is_bot(name: str, email: str = "") -> bool:

{gitmole-0.6.12 → gitmole-0.6.13}/gitmole/leaks.py

@@ -39,7 +39,8 @@ RAW_FIELDS = ("Secret", "Match", "Line", "Message", "Attributes")
 _VERSION = re.compile(r"^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$")
 _MARKER = re.compile(r"^(<[^<>]+>|x+|(?:x{2,}[-_ ]?)+|your[-_][\w-]+|change[-_]?me|replace[-_]?me)$", re.I)
 _EXAMPLE_WORDS = {"password", "passwd", "pass", "secret", "hello", "hey", "test", "example", "sample", "dummy", "foo", "bar",
-                  "baz", "admin", "root", "user", "123456", "12345678", "123456789", "abc123", "qwerty", "letmein", "welcome"}
+                  "baz", "admin", "root", "user", "123456", "12345678", "123456789", "abc123", "qwerty", "letmein", "welcome",
+                  "x-oauth-basic", "x-access-token", "x-token-auth"}   # documented literals for the password slot of token auth
 # A whole value that refers to an environment variable or a template field is where the secret will be
 # read from, not the secret: `@env:AC_PASSWORD`, `${DB_PASSWORD}`, `{{.Env.X}}`, `process.env.X`, `<%= ENV['X'] %>`.
 _ENV_REF = re.compile(r"^(@env:\w+|\$\{[^{}]+\}|\$[A-Za-z_]\w*|\$\([^()]+\)|%[A-Za-z_]\w*%|\{\{.*\}\}|<%=?.*%>"
@@ -78,14 +79,20 @@ def _made_up(value: str) -> bool:
     return letters == sorted(letters) and digits == sorted(digits) and len(set(letters)) >= 4 or (not letters and digits == sorted(digits))
 
 
+# A template field anywhere inside the value: {token}, ${X}, ${{ X }}, %(name)s, {{ x }}, <user>.
+_TEMPLATE_FIELD = re.compile(r"\{[A-Za-z_][\w.]*\}|\$\{[^{}]*\}|\$\{\{.*?\}\}|%\([A-Za-z_]\w*\)s|\{\{.*?\}\}|<[A-Za-z_][\w-]*>")
+# Five or more words of letters: a description of the secret, not the secret.
+_PROSE = re.compile(r"^[A-Za-z][A-Za-z'-]*(\s+[A-Za-z][A-Za-z'-]*){4,}\s*$")
+
+
 def is_placeholder(value: str, line: str = "") -> bool:
     """Whether `value` has a shape that cannot be a live secret. `line` is the source line the value
     sat on, read from the clone at scan time and never written."""
     value = (value or "").strip()
     if (_VERSION.match(value) or value.endswith("...") or value.endswith("…") or _MARKER.match(value) or value.lower() in _EXAMPLE_WORDS
-            or _ENV_REF.match(value) or _made_up(value)):
+            or _ENV_REF.match(value) or _made_up(value) or _TEMPLATE_FIELD.search(value) or _PROSE.match(value)):
         return True
-    if line and _EXAMPLE_LINE.search(line):
+    if line and (_EXAMPLE_LINE.search(line) or _TEMPLATE_FIELD.search(line)):   # the line is an example, or a template being filled in
         return True
     m = _KEY_BLOCK.search(value)
     if m:

{gitmole-0.6.12 → gitmole-0.6.13}/gitmole/maat.py

@@ -221,15 +221,16 @@ def activity(commits: list) -> dict:
             "reverted": dict(sorted(reverted.items(), key=lambda kv: (-kv[1], kv[0])))}
 
 
-def plumbing(commits: list, min_revs: int = 20, share: float = 0.8, max_lines: int = 2) -> list:
-    """Files whose commits nearly always change a line or two: a version constant in __init__.py, a
-    date in a header. Their churn is the release cadence, not where the next bug lands. Needs enough
-    commits to judge by."""
+def plumbing(commits: list, min_revs: int = 20, share: float = 0.8, max_lines: int = 3) -> list:
+    """Files whose commits nearly always swap a few lines for as many: a version constant in
+    __init__.py, the three fields of a version struct. Their churn is the release cadence, not where
+    the next bug lands. A commit that adds lines without removing any is growth, not a bump. Needs
+    enough commits to judge by."""
     revs, tiny = Counter(), Counter()
     for c in commits:
         for path, added, deleted in c["files"]:
             revs[path] += 1
-            if added + deleted <= max_lines:
+            if added == deleted and added <= max_lines:
                 tiny[path] += 1
     return [{"entity": e, "n-revs": n, "tiny-revs": tiny[e]} for e, n in sorted(revs.items()) if n >= min_revs and tiny[e] / n >= share]
 

{gitmole-0.6.12 → gitmole-0.6.13}/gitmole/render.py

@@ -443,7 +443,8 @@ def coupling_section(report: dict, full: bool = True, width=None) -> dict:
     pairs, release_note = _hide_release(pairs, full)
     pairs, header_note = _hide_header_pairs(pairs, full)
     pairs, vendor_note = _hide_vendor(pairs, lambda p: (p["entity"], p["coupled"]), full, noun="vendored pair", plural="vendored pairs", report=report)
-    gone_note = _join_hidden(gone_note, release_note, header_note, vendor_note)
+    pairs, generated_note = _hide_generated(pairs, lambda p: (p["entity"], p["coupled"]), report, full, noun="generated pair", plural="generated pairs")
+    gone_note = _join_hidden(gone_note, release_note, header_note, vendor_note, generated_note)
     groups, cluster_note = [], None
     if full is not True:
         # a directory whose files all change together is one row; --full lists every pair

{gitmole-0.6.12 → gitmole-0.6.13}/gitmole.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.6.12
+Version: 0.6.13
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole

{gitmole-0.6.12 → gitmole-0.6.13}/tests/test_filetypes.py

@@ -133,6 +133,9 @@ class TestPaths(unittest.TestCase):
                 "docs/notes.md": "generated notes are the best notes\n",
                 "dist/bundle.js": "var a = 1;\n",
                 "src/late.py": "\n" * 10 + "# generated by hand, do not edit\n",   # a marker past the first lines does not count
+                "internal/js/renderkatex.bundle.js": "var a=1;\n",   # a bundle, a minified file or a source map is a build output by name
+                "static/app.min.css": "a{b:c}\n",
+                "static/app.js.map": "{}\n",
             }
             for path, text in files.items():
                 os.makedirs(os.path.join(d, os.path.dirname(path)), exist_ok=True)
@@ -141,7 +144,8 @@ class TestPaths(unittest.TestCase):
             with open(os.path.join(d, ".gitattributes"), "w") as fh:
                 fh.write("* text=auto\ndist/* linguist-generated=true\n*.min.js linguist-generated\n")
             found = filetypes.generated_files(d, sorted(files))
-        self.assertEqual(found, ["dist/bundle.js", "gen/schema.py", "lib/config-validator.js", "pb/api.pb.go"])
+        self.assertEqual(found, ["dist/bundle.js", "gen/schema.py", "internal/js/renderkatex.bundle.js", "lib/config-validator.js", "pb/api.pb.go",
+                                 "static/app.js.map", "static/app.min.css"])
 
     def test_a_nested_licence_with_other_copyright_holders_marks_a_vendored_tree(self):
         with tempfile.TemporaryDirectory() as d:

{gitmole-0.6.12 → gitmole-0.6.13}/tests/test_findings.py

@@ -261,6 +261,16 @@ class TightCoupling(unittest.TestCase):
         f = findings.tight_coupling(report(coupling=pairs))
         self.assertIn("2 pairs", f[0]["detail"], "without a tree listing every pair counts")
 
+    def test_generated_pairs_are_the_generators_coupling(self):
+        pairs = [{"entity": "js/greet.bundle.js", "coupled": "js/renderkatex.bundle.js", "degree": 83, "average-revs": 10},
+                 {"entity": "js/renderkatex.bundle.js", "coupled": "js/renderkatex.js", "degree": 83, "average-revs": 10},
+                 {"entity": "src/a.js", "coupled": "src/b.js", "degree": 85, "average-revs": 10}]
+        r = report(coupling=pairs)
+        r["meta"]["generated"] = ["js/greet.bundle.js", "js/renderkatex.bundle.js"]
+        f = findings.tight_coupling(r)
+        self.assertIn("1 pair changes together", f[0]["detail"])
+        self.assertIn("src/a.js", f[0]["detail"])
+
     def test_vendored_pairs_are_somebody_elses_coupling(self):
         pairs = [{"entity": "deps/hiredis/adapters/ae.h", "coupled": "deps/hiredis/adapters/libev.h", "degree": 84, "average-revs": 10},
                  {"entity": "src/ae.c", "coupled": "deps/hiredis/net.h", "degree": 85, "average-revs": 10},

{gitmole-0.6.12 → gitmole-0.6.13}/tests/test_identity.py

@@ -98,7 +98,8 @@ class IsBot(unittest.TestCase):
                             ("dependabot[bot]", "support@github.com"), ("Dependabot", "dependabot@example.com"),
                             ("Renovate Bot", "bot@renovateapp.com"), ("GitHub Actions", "actions@github.com"),
                             ("Copilot", "198982749+Copilot@users.noreply.github.com"), ("Cursor Agent", "cursoragent@cursor.com"),
-                            ("Deploy from CI", ""), ("Release Bot", "release@x.com"), ("CI", "ci@x.com"), ("Homebrew Automation", "a@x.com")]:
+                            ("Deploy from CI", ""), ("Release Bot", "release@x.com"), ("CI", "ci@x.com"), ("Homebrew Automation", "a@x.com"),
+                            ("hugoreleaser", "hugoreleaser@x.com"), ("semantic-release-bot", "s@x.com")]:
             self.assertTrue(identity.is_bot(name, email), (name, email))
 
     def test_people_are_not_bots(self):

{gitmole-0.6.12 → gitmole-0.6.13}/tests/test_leaks.py

@@ -61,8 +61,11 @@ class Placeholder(unittest.TestCase):
 
     def test_common_example_words_are_placeholders(self):
         # `password: 'hello'` in a doc comment, `secret` in a sample config: the words every example uses
-        for value in ["hello", "Hello", "secret", "password", "PASSWORD", "example", "123456", "qwerty", "letmein", "foo", "dummy"]:
+        for value in ["hello", "Hello", "secret", "password", "PASSWORD", "example", "123456", "qwerty", "letmein", "foo", "dummy",
+                      "x-oauth-basic", "x-access-token"]:   # GitHub's documented literals for the password slot of token auth
             self.assertTrue(leaks.is_placeholder(value), value)
+        self.assertTrue(leaks.is_placeholder("hunter2", line='url = f"https://{token}:hunter2@github.com/{SLUG}.git"'),
+                        "a line with a template field is a template being filled in")
         for value in ["hello123", "secret-9f8a7b6c5d4e", "s3cr3t!Passw0rd", "foobarbaz2024"]:
             self.assertFalse(leaks.is_placeholder(value), "a word inside other material is not a placeholder: " + value)
 
@@ -110,6 +113,21 @@ class Placeholder(unittest.TestCase):
         for value in ["nz5ej2kypkvcw0rn5cvhs6qxtm", "abcdefg", "zyxwvutsrq", "ghp_" + "a1" * 18]:
             self.assertFalse(leaks.is_placeholder(value), value)
 
+    def test_a_value_with_a_template_field_inside_it_is_a_template(self):
+        # pytest's release script: oauth_url = f"https://{token}:x-oauth-basic@github.com/{SLUG}.git"
+        for value in ["https://{token}:x-oauth-basic@github.com/pytest-dev/pytest.git", "Bearer ${TOKEN}", "key-%(api_key)s", "sk_live_{{ secret }}",
+                      "${{ secrets.CODECOV_TOKEN }}", "https://<user>:<pass>@host/db"]:
+            self.assertTrue(leaks.is_placeholder(value), value)
+        for value in ["https://x:hunter2@host/db", "ghp_" + "a1" * 18, "{" + "a1" * 10]:
+            self.assertFalse(leaks.is_placeholder(value), value)
+
+    def test_a_sentence_of_prose_is_a_description_not_a_secret(self):
+        # pytest's devpi task: 'password': 'user password on devpi to stage the generated package '
+        for value in ["user password on devpi to stage the generated package", "The API key used to talk to the billing service"]:
+            self.assertTrue(leaks.is_placeholder(value), value)
+        for value in ["correct horse battery", "nz5ej2kypkvcw0rn5cvhs6qxtm", "one two 3 four five"]:
+            self.assertFalse(leaks.is_placeholder(value), "under five words, or a digit among them: not prose")
+
     def test_anything_else_is_taken_seriously(self):
         # built at runtime: a literal in these shapes would trip secret scanners on this very file
         key_id, long_key = "AKIA" + "X" * 16, "6L" + "x" * 38

{gitmole-0.6.12 → gitmole-0.6.13}/tests/test_maat.py

@@ -111,6 +111,14 @@ class Plumbing(unittest.TestCase):
         self.assertEqual(rows, [{"entity": "fastapi/__init__.py", "n-revs": 331, "tiny-revs": 300}],
                          "routing.py has real edits; VERSION has too few commits to judge")
 
+    def test_a_bump_that_swaps_three_lines_is_tiny_but_growth_is_not(self):
+        # hugo's version_current.go: every release edits Major, Minor and PatchLevel, 3 lines out and 3 in
+        bumps = [{"hash": f"b{i}", "date": "2026-01-01", "time": "", "author": "A", "subject": "release", "files": [("common/hugo/version_current.go", 3, 3)]}
+                 for i in range(30)]
+        growth = [{"hash": f"g{i}", "date": "2026-01-01", "time": "", "author": "A", "subject": "add", "files": [("lib/list.py", 3, 0)]} for i in range(30)]
+        rows = maat.plumbing(bumps + growth)
+        self.assertEqual([r["entity"] for r in rows], ["common/hugo/version_current.go"], "three lines added with nothing removed is growth, not a bump")
+
     def test_written_alongside_the_other_analyses(self):
         with tempfile.TemporaryDirectory() as d:
             log = os.path.join(d, "log.txt")

{gitmole-0.6.12 → gitmole-0.6.13}/tests/test_render.py

@@ -368,6 +368,19 @@ class Report(unittest.TestCase):
         self.assertNotIn("deps/", coupling)
         self.assertIn("2 vendored pairs hidden; --full shows them", coupling)
 
+    def test_default_coupling_hides_generated_pairs_and_says_so(self):
+        r = sample_report()
+        r["meta"]["generated"] = ["js/a.bundle.js", "js/b.bundle.js"]
+        for f in ("js/a.bundle.js", "js/b.bundle.js", "js/b.js", "src/x.js", "src/y.js"):
+            r["size"]["files"][f] = {"code": 30, "complexity": 1}
+        r["coupling"] = [{"entity": "js/a.bundle.js", "coupled": "js/b.bundle.js", "degree": 83, "average-revs": 20},
+                         {"entity": "js/b.bundle.js", "coupled": "js/b.js", "degree": 83, "average-revs": 20},
+                         {"entity": "src/x.js", "coupled": "src/y.js", "degree": 60, "average-revs": 9}]
+        coupling = _section_text(rendered(r, [], width=200), "Change coupling")
+        self.assertIn("src/y.js", coupling)
+        self.assertNotIn("bundle", coupling)
+        self.assertIn("2 generated pairs hidden; --full shows them", coupling)
+
     def test_default_coupling_hides_header_pairs_and_says_so(self):
         r = sample_report()
         for f in ("src/vector.c", "src/vector.h", "src/list.c"):