gitmole 0.6.6__tar.gz → 0.6.7__tar.gz

{gitmole-0.6.6 → gitmole-0.6.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.6.6
+Version: 0.6.7
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole

{gitmole-0.6.6 → gitmole-0.6.7}/gitmole/__init__.py

@@ -1,3 +1,3 @@
 """gitmole: offline git repository analysis with a terminal report."""
 
-__version__ = "0.6.6"
+__version__ = "0.6.7"

{gitmole-0.6.6 → gitmole-0.6.7}/gitmole/filetypes.py

@@ -76,12 +76,13 @@ def is_sample_path(path: str) -> bool:
     return bool(_SAMPLE_PATH.search(path))
 
 
-_VENDOR_PATH = re.compile(r"(^|/)(_?vendor|node_modules|third_?party|external)(/|$)", re.I)
+_VENDOR_PATH = re.compile(r"(^|/)(_?vendor|vendored|node_modules|third_?party|external)(/|$)|^[^/]+/packages/", re.I)
 
 
 def is_vendor_path(path: str) -> bool:
     """Vendored and third-party trees: somebody else's code, so its complexity and its single
-    importer are not this repository's risk."""
+    importer are not this repository's risk. A `packages/` inside a package (requests/packages/,
+    the Python vendoring convention) counts; a monorepo's own `packages/` at the root does not."""
     return bool(_VENDOR_PATH.search(path))
 
 

{gitmole-0.6.6 → gitmole-0.6.7}/gitmole/findings.py

@@ -47,7 +47,8 @@ def secrets_found(report: dict) -> list:
     groups = leaks.group(report.get("secrets") or [])
 
     def in_source(g):
-        return any(not (filetypes.is_test_path(f) or filetypes.is_doc_path(f) or filetypes.is_sample_path(f)) for f in g["files"])
+        return any(not (filetypes.is_test_path(f) or filetypes.is_doc_path(f) or filetypes.is_sample_path(f) or filetypes.is_vendor_path(f))
+                   for f in g["files"])
     source = [g for g in groups if in_source(g)]
     aside = [g for g in groups if not in_source(g)]
     ignore = "Add the fingerprint of any false positive from secrets.json to .betterleaksignore in the repository."
@@ -56,7 +57,7 @@ def secrets_found(report: dict) -> list:
         out.append(_f("critical", f"{len(source)} secret(s) in history", _secret_statement(source),
                       f"Rotate them; deleting the file does not remove them from git. {ignore}"))
     if aside:
-        out.append(_f("warning", f"{len(aside)} secret(s) only in test, example or documentation files", _secret_statement(aside),
+        out.append(_f("warning", f"{len(aside)} secret(s) only in test, example, vendored or documentation files", _secret_statement(aside),
                       f"Confirm they are fixtures or templates, not live keys. {ignore}"))
     return out
 
@@ -173,8 +174,10 @@ def sizer_concerns(report: dict) -> list:
 
 
 def hotspot_dominance(report: dict, ratio: float = 2.0, minimum: int = 20) -> list:
-    """One source file takes most of the churn. Test files are left out: they change with everything."""
-    revs = sorted((r for r in report.get("revisions") or [] if not filetypes.is_test_path(r["entity"])), key=lambda r: -r["n-revs"])
+    """One source file takes most of the churn. Test files are left out: they change with everything.
+    So is release plumbing: a version file or a manifest changes on every release by design."""
+    revs = sorted((r for r in report.get("revisions") or [] if not (filetypes.is_test_path(r["entity"]) or filetypes.is_release_path(r["entity"]))),
+                  key=lambda r: -r["n-revs"])
     if len(revs) < 2 or revs[0]["n-revs"] < minimum or revs[0]["n-revs"] < ratio * revs[1]["n-revs"]:
         return []
     top, nxt = revs[0], revs[1]
@@ -231,8 +234,10 @@ def stale_files(report: dict, months: int = 12, share: float = 0.3) -> list:
 
 
 def bug_magnets(report: dict, min_recent: int = 3, warn_at: int = 5) -> list:
-    """Source files with a run of recent fix commits. Test files are left out: they change with every fix."""
-    hot = [f for f in report.get("fixes") or [] if f["recent-fixes"] >= min_recent and not filetypes.is_test_path(f["entity"])]
+    """Source files with a run of recent fix commits. Test files are left out: they change with every fix.
+    So is release plumbing: a manifest touched by every fix release is not where the bug was."""
+    hot = [f for f in report.get("fixes") or [] if f["recent-fixes"] >= min_recent
+           and not (filetypes.is_test_path(f["entity"]) or filetypes.is_release_path(f["entity"]))]
     if not hot:
         return []
     hot.sort(key=lambda f: (-f["recent-fixes"], -f["n-fixes"], f["entity"]))

{gitmole-0.6.6 → gitmole-0.6.7}/gitmole/maat.py

@@ -4,7 +4,9 @@
 Standalone on purpose: gitmole runs it as a pipeline step with
 `python3 maat.py LOG OUT_DIR [--aliases META_JSON]` and it must not need the
 package on sys.path. Input is `git log --all --numstat --date=short
---pretty=format:--%h--%ad--%aN --no-renames`.
+--pretty=format:--%h--%ad--%aN -M`: renames are followed, so a moved file
+is one entity under its new path and a pure move adds and deletes nothing.
+Whoever moved a directory to src/ did not write it.
 """
 from __future__ import annotations
 
@@ -40,13 +42,26 @@ def parse_log(text: str, aliases: dict = None, types=None) -> list:
             commits.append(current)
         elif line.strip() and current is not None:
             added, deleted, path = line.split("\t", 2)
-            path = filetypes.unquote(path)
+            path = _renamed_to(filetypes.unquote(path))
             if not filetypes.matches(path, types):
                 continue
             current["files"].append((path, int(added) if added.isdigit() else 0, int(deleted) if deleted.isdigit() else 0))
     return commits
 
 
+_BRACED_RENAME = re.compile(r"\{([^{}]*) => ([^{}]*)\}")
+
+
+def _renamed_to(path: str) -> str:
+    """The new path of a rename as `git log -M --numstat` spells it: `{old => new}/rest`,
+    `dir/{a => b}` or `old => new` for a whole path. A path without ' => ' is itself."""
+    if " => " not in path:
+        return path
+    if "{" in path:
+        return _BRACED_RENAME.sub(lambda m: m.group(2), path).replace("//", "/")
+    return path.split(" => ", 1)[1]
+
+
 _FIX_CONVENTIONAL = re.compile(r"^(fix|hotfix|bugfix)(\([^)]*\))?!?:", re.I)
 _FIX_WORDS = re.compile(r"\b(fix|fixes|fixed|fixing|bugfix|hotfix|bug|bugs|regression|crash|crashes)\b", re.I)
 

{gitmole-0.6.6 → gitmole-0.6.7}/gitmole/render.py

@@ -395,7 +395,8 @@ def hotspots_section(report: dict, full: bool = True, width=None) -> dict:
     scored, hidden_note = _hide_tests(scored, lambda h: h["entity"], full)
     scored, deleted_note = _hide_deleted(scored, report, full)
     scored, generated_note = _hide_generated(scored, lambda h: h["entity"], report, full)
-    hidden_note = _join_hidden(hidden_note, deleted_note, generated_note)
+    scored, release_note = _hide_rows(scored, lambda h: h["entity"], full, filetypes.is_release_path, "release file")
+    hidden_note = _join_hidden(hidden_note, deleted_note, generated_note, release_note)
     title = "Hotspots (score = revisions × lines of code)" if full is True else "Hotspots"
     limit = _limit("Hotspots", full)
     series = (report.get("trend") or {}).get("files") or {}

{gitmole-0.6.6 → gitmole-0.6.7}/gitmole/run.py

@@ -172,7 +172,7 @@ def plan(repo_dir: str, out_dir: str, branch: str = "HEAD", age: bool = True, pl
         {"name": "scc", "argv": ["scc", "--by-file", "--format", "json"], "stdout": o("size.json"), "deps": []},
         {"name": "git-sizer", "argv": ["git-sizer", "--verbose"], "stdout": o("repo-health.txt"), "deps": []},
         {"name": "betterleaks", "argv": [sys.executable, LEAKS_SCRIPT, o("secrets.json")], "stdout": None, "deps": []},   # hashes the values before anything is written
-        {"name": "git-log", "argv": [*filetypes.GIT, "log", "--all", "--use-mailmap", "--numstat", "--date=iso-strict", "--pretty=format:--%h--%ad--%aN--%s", "--no-renames"], "stdout": log, "deps": []},
+        {"name": "git-log", "argv": [*filetypes.GIT, "log", "--all", "--use-mailmap", "--numstat", "--date=iso-strict", "--pretty=format:--%h--%ad--%aN--%s", "-M"], "stdout": log, "deps": []},   # -M: a move is not an edit
         {"name": "change analysis", "argv": [sys.executable, MAAT_SCRIPT, log, out_dir, *type_args, *(["--now", now] if now else []), *(["--since", since] if since else []), "--aliases", o("meta.json")], "stdout": None, "deps": ["git-log"]},
     ]
     if lizard:

{gitmole-0.6.6 → gitmole-0.6.7}/gitmole/watch.py

@@ -66,8 +66,8 @@ def risks(report: dict, min_revs: int = 2) -> list:
 
     rows = []
     for h in hotspots.ranked(report):
-        if h["code"] is None or h["revs"] < min_revs or filetypes.is_test_path(h["entity"]):
-            continue
+        if h["code"] is None or h["revs"] < min_revs or filetypes.is_test_path(h["entity"]) or filetypes.is_release_path(h["entity"]):
+            continue   # a version file or a manifest changes on every release, not where the next bug lands
         fx = fixes.get(h["entity"], {})
         own = owners.get(h["entity"]) or Counter()
         owner, owner_lines = (own.most_common(1)[0] if own else (None, 0))

{gitmole-0.6.6 → gitmole-0.6.7}/gitmole.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.6.6
+Version: 0.6.7
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole

{gitmole-0.6.6 → gitmole-0.6.7}/tests/test_filetypes.py

@@ -133,9 +133,10 @@ class TestPaths(unittest.TestCase):
 
     def test_vendored_trees(self):
         for path in ("vendor/github.com/x/y.go", "web/node_modules/a/index.js", "third_party/z/a.c", "thirdparty/a.c", "_vendor/a.py",
-                     "external/lib/a.cpp"):
+                     "external/lib/a.cpp", "requests/packages/urllib3/a.py", "pip/_vendor/six.py", "botocore/vendored/requests/a.py"):
             self.assertTrue(filetypes.is_vendor_path(path), path)
-        for path in ("vendors.py", "src/vendoring/a.py", "node/a.js", "externals.txt", "app/main.go"):
+        for path in ("vendors.py", "src/vendoring/a.py", "node/a.js", "externals.txt", "app/main.go",
+                     "packages/runtime-core/src/renderer.ts", "packages-private/x.ts"):   # a monorepo's own packages/ at the root
             self.assertFalse(filetypes.is_vendor_path(path), path)
 
 

{gitmole-0.6.6 → gitmole-0.6.7}/tests/test_findings.py

@@ -47,7 +47,7 @@ class SecretsFound(unittest.TestCase):
         self.assertIn("1 distinct value in 2 places: generic-api-key in app/settings.py (c1, c2)", crit["detail"])
         self.assertIn("Rotate", crit["advice"])
         self.assertIn(".betterleaksignore", crit["advice"])
-        self.assertEqual(warn["title"], "2 secret(s) only in test, example or documentation files")
+        self.assertEqual(warn["title"], "2 secret(s) only in test, example, vendored or documentation files")
         self.assertIn("2 distinct values in 3 places", warn["detail"])
         self.assertIn("tests/data/a.html and 1 other file", warn["detail"])
         self.assertIn(".betterleaksignore", warn["advice"])
@@ -62,15 +62,22 @@ class SecretsFound(unittest.TestCase):
                             self.row("h3", "pkg/testdata/creds.yaml", "c3")])
         f = findings.secrets_found(r)
         self.assertEqual([x["severity"] for x in f], ["warning"])
-        self.assertEqual(f[0]["title"], "3 secret(s) only in test, example or documentation files")
+        self.assertEqual(f[0]["title"], "3 secret(s) only in test, example, vendored or documentation files")
         r = report(secrets=[self.row("h1", "examples/app.py", "c1"), self.row("h1", "app/config.py", "c2")])
         self.assertEqual([x["severity"] for x in findings.secrets_found(r)], ["critical"], "the same value in source is a leak")
 
+    def test_a_value_only_in_vendored_code_is_a_warning(self):
+        # oauthlib's RFC test vectors inside requests/packages/: upstream's specimen, not this repository's credential
+        r = report(secrets=[self.row("h1", "requests/packages/oauthlib/oauth1/rfc5849/parameters.py", "9576518")])
+        f = findings.secrets_found(r)
+        self.assertEqual([x["severity"] for x in f], ["warning"])
+        self.assertIn("vendored", f[0]["title"])
+
     def test_a_value_only_in_documentation_is_a_warning_that_says_template(self):
         r = report(secrets=[self.row("h1", "docs/GA4-API-INTEGRATION.md", "e8c0508")])
         f = findings.secrets_found(r)
         self.assertEqual([x["severity"] for x in f], ["warning"])
-        self.assertEqual(f[0]["title"], "1 secret(s) only in test, example or documentation files")
+        self.assertEqual(f[0]["title"], "1 secret(s) only in test, example, vendored or documentation files")
         self.assertIn("fixtures or templates", f[0]["advice"])
         r = report(secrets=[self.row("h1", "docs/GA4-API-INTEGRATION.md", "e8c0508"), self.row("h1", "app/config.py", "c2")])
         self.assertEqual([x["severity"] for x in findings.secrets_found(r)], ["critical"], "the same value in source is a leak")
@@ -283,6 +290,21 @@ class TightCoupling(unittest.TestCase):
         self.assertEqual(findings.tight_coupling(report()), [])
 
 
+class ReleasePlumbing(unittest.TestCase):
+    def test_a_version_file_or_manifest_does_not_dominate_the_churn(self):
+        revs = [{"entity": "setup.py", "n-revs": 184}, {"entity": "requests/models.py", "n-revs": 60}, {"entity": "requests/api.py", "n-revs": 20}]
+        f = findings.hotspot_dominance(report(revisions=revs))
+        self.assertIn("requests/models.py changed 60 times", f[0]["detail"])
+        self.assertNotIn("setup.py", f[0]["detail"])
+
+    def test_a_manifest_is_not_a_bug_magnet(self):
+        fixes = [{"entity": "package.json", "n-fixes": 20, "last-fix": "2026-09-01", "recent-fixes": 6},
+                 {"entity": "lib/reply.js", "n-fixes": 10, "last-fix": "2026-09-01", "recent-fixes": 4}]
+        f = findings.bug_magnets(report(fixes=fixes))
+        self.assertIn("lib/reply.js", f[0]["detail"])
+        self.assertNotIn("package.json", f[0]["detail"])
+
+
 class StaleFiles(unittest.TestCase):
     def test_info_when_a_third_untouched_for_a_year(self):
         age = [{"entity": f"f{i}", "age-months": 12} for i in range(4)] + [{"entity": "g", "age-months": 0} for _ in range(6)]

{gitmole-0.6.6 → gitmole-0.6.7}/tests/test_maat.py

@@ -48,6 +48,18 @@ class ParseLog(unittest.TestCase):
         self.assertEqual(commits[0]["files"], [("src/a.py", 3, 1), ("src/b.py", 2, 0)])
         self.assertEqual(commits[1]["files"][2], ("img/logo.png", 0, 0))
 
+    def test_renames_are_followed_to_the_new_path_and_a_pure_move_adds_no_lines(self):
+        # `git log -M --numstat` spells a rename three ways; the mover is not the owner of what moved
+        log = ("--d63e94f5--2023-08-13T10:00:00+00:00--Nate--Move to src layout\n"
+               "0\t0\t{requests => src/requests}/__init__.py\n"
+               "4\t7\tSECURITY.md => .github/SECURITY.md\n"
+               "0\t0\tCODE_OF_CONDUCT.md => .github/CODE_OF_CONDUCT.md\n"
+               "2\t0\tsrc/requests/{models.py => models_v2.py}\n"
+               "1\t1\tMakefile\n")
+        commits = maat.parse_log(log, types=None)
+        self.assertEqual(commits[0]["files"], [("src/requests/__init__.py", 0, 0), (".github/SECURITY.md", 4, 7),
+                                                (".github/CODE_OF_CONDUCT.md", 0, 0), ("src/requests/models_v2.py", 2, 0), ("Makefile", 1, 1)])
+
     def test_subjects_with_exotic_line_break_characters_do_not_split_the_log(self):
         # U+2028 and form feed are line breaks to str.splitlines but not to git
         text = "--x--2026-05-04T10:00:00+00:00--Ann--Fix\u2028broken\x0cthing\n1\t0\tf.py\n"

{gitmole-0.6.6 → gitmole-0.6.7}/tests/test_render.py

@@ -334,6 +334,17 @@ class Report(unittest.TestCase):
         full = rendered(r, [], width=200, full=True)
         self.assertIn("validate10", full)
 
+    def test_default_hotspots_hide_release_plumbing_and_say_so(self):
+        r = sample_report()
+        r["size"]["files"].update({"setup.py": {"code": 6, "complexity": 0}, "version.go": {"code": 2, "complexity": 0}})
+        r["revisions"] += [{"entity": "setup.py", "n-revs": 184}, {"entity": "version.go", "n-revs": 29}]
+        hot = rendered(r, [], width=200)
+        hot = hot[hot.index("◆ Hotspots"):hot.index("Change coupling")]
+        self.assertNotIn("setup.py", hot)
+        self.assertIn("2 release files hidden; --full shows them", hot)
+        full = rendered(r, [], width=200, full=True)
+        self.assertIn("setup.py", full[full.index("◆ Hotspots"):])
+
     def test_default_coupling_hides_release_plumbing_pairs_and_says_so(self):
         r = sample_report()
         for f in ("lib/version.rb", "contrib/version.rb", "Gemfile", "Gemfile.lock"):

{gitmole-0.6.6 → gitmole-0.6.7}/tests/test_run.py

@@ -192,6 +192,8 @@ class Plan(unittest.TestCase):
         self.assertEqual(by["scc"]["stdout"], "/o/size.json")
         self.assertIn("--by-file", by["scc"]["argv"])
         self.assertIn("--use-mailmap", by["git-log"]["argv"])
+        self.assertIn("-M", by["git-log"]["argv"], "renames are followed so a move to src/ credits nobody with the moved lines")
+        self.assertNotIn("--no-renames", by["git-log"]["argv"])
         self.assertEqual(by["git-log"]["argv"][:4], ["git", "-c", "core.quotePath=false", "log"], "non-ASCII paths must not be octal-escaped and quoted")
 
     def test_function_metrics_step_is_optional_and_runs_the_bundled_script(self):

{gitmole-0.6.6 → gitmole-0.6.7}/tests/test_watch.py

@@ -53,6 +53,14 @@ class Risks(unittest.TestCase):
         self.assertNotIn("core/gone.py", files, "no longer in the tree")
         self.assertNotIn("core/once.py", files, "changed once")
 
+    def test_release_plumbing_is_not_on_the_list(self):
+        r = report()
+        r["size"]["files"].update({"setup.py": {"code": 6, "complexity": 0}, "version.go": {"code": 2, "complexity": 0}, "Makefile": {"code": 21, "complexity": 0}})
+        r["revisions"] = [{"entity": "setup.py", "n-revs": 184}, {"entity": "version.go", "n-revs": 29}, {"entity": "Makefile", "n-revs": 131},
+                          {"entity": "core/parser.py", "n-revs": 40}]
+        files = sorted(x["file"] for x in watch.risks(r))
+        self.assertEqual(files, ["Makefile", "core/parser.py"], "a version file or a manifest changes on every release, not where the next bug lands")
+
     def test_test_companions_and_weak_pairs_are_not_reasons(self):
         top = watch.risks(report())[0]
         coupling = [r for r in top["reasons"] if r.startswith("changes with")][0]