gitmole 0.6.6__tar.gz → 0.6.8__tar.gz

{gitmole-0.6.6 → gitmole-0.6.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.6.6
+Version: 0.6.8
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole

{gitmole-0.6.6 → gitmole-0.6.8}/gitmole/__init__.py

@@ -1,3 +1,3 @@
 """gitmole: offline git repository analysis with a terminal report."""
 
-__version__ = "0.6.6"
+__version__ = "0.6.8"

{gitmole-0.6.6 → gitmole-0.6.8}/gitmole/filetypes.py

@@ -76,12 +76,13 @@ def is_sample_path(path: str) -> bool:
     return bool(_SAMPLE_PATH.search(path))
 
 
-_VENDOR_PATH = re.compile(r"(^|/)(_?vendor|node_modules|third_?party|external)(/|$)", re.I)
+_VENDOR_PATH = re.compile(r"(^|/)(_?vendor|vendored|node_modules|third_?party|external)(/|$)|^[^/]+/packages/", re.I)
 
 
 def is_vendor_path(path: str) -> bool:
     """Vendored and third-party trees: somebody else's code, so its complexity and its single
-    importer are not this repository's risk."""
+    importer are not this repository's risk. A `packages/` inside a package (requests/packages/,
+    the Python vendoring convention) counts; a monorepo's own `packages/` at the root does not."""
     return bool(_VENDOR_PATH.search(path))
 
 

{gitmole-0.6.6 → gitmole-0.6.8}/gitmole/findings.py

@@ -47,7 +47,8 @@ def secrets_found(report: dict) -> list:
     groups = leaks.group(report.get("secrets") or [])
 
     def in_source(g):
-        return any(not (filetypes.is_test_path(f) or filetypes.is_doc_path(f) or filetypes.is_sample_path(f)) for f in g["files"])
+        return any(not (filetypes.is_test_path(f) or filetypes.is_doc_path(f) or filetypes.is_sample_path(f) or filetypes.is_vendor_path(f))
+                   for f in g["files"])
     source = [g for g in groups if in_source(g)]
     aside = [g for g in groups if not in_source(g)]
     ignore = "Add the fingerprint of any false positive from secrets.json to .betterleaksignore in the repository."
@@ -56,7 +57,7 @@ def secrets_found(report: dict) -> list:
         out.append(_f("critical", f"{len(source)} secret(s) in history", _secret_statement(source),
                       f"Rotate them; deleting the file does not remove them from git. {ignore}"))
     if aside:
-        out.append(_f("warning", f"{len(aside)} secret(s) only in test, example or documentation files", _secret_statement(aside),
+        out.append(_f("warning", f"{len(aside)} secret(s) only in test, example, vendored or documentation files", _secret_statement(aside),
                       f"Confirm they are fixtures or templates, not live keys. {ignore}"))
     return out
 
@@ -173,8 +174,10 @@ def sizer_concerns(report: dict) -> list:
 
 
 def hotspot_dominance(report: dict, ratio: float = 2.0, minimum: int = 20) -> list:
-    """One source file takes most of the churn. Test files are left out: they change with everything."""
-    revs = sorted((r for r in report.get("revisions") or [] if not filetypes.is_test_path(r["entity"])), key=lambda r: -r["n-revs"])
+    """One source file takes most of the churn. Test files are left out: they change with everything.
+    So is release plumbing: a version file or a manifest changes on every release by design."""
+    revs = sorted((r for r in report.get("revisions") or [] if not (filetypes.is_test_path(r["entity"]) or filetypes.is_release_path(r["entity"]))),
+                  key=lambda r: -r["n-revs"])
     if len(revs) < 2 or revs[0]["n-revs"] < minimum or revs[0]["n-revs"] < ratio * revs[1]["n-revs"]:
         return []
     top, nxt = revs[0], revs[1]
@@ -213,9 +216,39 @@ def tight_coupling(report: dict, min_degree: int = 80, min_revs: int = 5) -> lis
                f"Review {first['entity']} and {first['coupled']} first: a shared layout or a hidden dependency links them.")]
 
 
+def _months_apart(earlier: str, later: str) -> int:
+    """Whole months from one ISO date to another."""
+    y1, m1, d1 = (int(x) for x in earlier[:10].split("-"))
+    y2, m2, d2 = (int(x) for x in later[:10].split("-"))
+    return (y2 - y1) * 12 + (m2 - m1) - (1 if d2 < d1 else 0)
+
+
+def _dormant_months(report: dict) -> int:
+    """Months since the last commit, against the run's reference date (GITMOLE_NOW or today)."""
+    import datetime as _dt
+    last = report["meta"].get("last_date")
+    if not last:
+        return 0
+    now = report["meta"].get("now") or _dt.date.today().isoformat()
+    return max(0, _months_apart(last, now))
+
+
+def dormant(report: dict, months: int = 12) -> list:
+    """No commits for a year or more: everything else in the report describes a repository that has
+    stopped, which is the first thing to know about it."""
+    idle = _dormant_months(report)
+    if idle < months:
+        return []
+    return [_f("warning", "Dormant repository", f"No commits since {report['meta']['last_date']}, {idle} months ago.",
+               "The rest of the report describes a repository that has stopped; look for a successor or an archive notice before depending on it.")]
+
+
 def stale_files(report: dict, months: int = 12, share: float = 0.3) -> list:
     """Files still in the tree that nobody has touched. The age table covers every path in the
-    history, so paths that were deleted are left out here; they are not dead code, they are gone."""
+    history, so paths that were deleted are left out here; they are not dead code, they are gone.
+    In a dormant repository every file is untouched because nothing is; the dormancy finding says so."""
+    if _dormant_months(report) >= months:
+        return []
     age = report.get("age") or []
     tree = _tree(report)
     if tree:
@@ -231,8 +264,10 @@ def stale_files(report: dict, months: int = 12, share: float = 0.3) -> list:
 
 
 def bug_magnets(report: dict, min_recent: int = 3, warn_at: int = 5) -> list:
-    """Source files with a run of recent fix commits. Test files are left out: they change with every fix."""
-    hot = [f for f in report.get("fixes") or [] if f["recent-fixes"] >= min_recent and not filetypes.is_test_path(f["entity"])]
+    """Source files with a run of recent fix commits. Test files are left out: they change with every fix.
+    So is release plumbing: a manifest touched by every fix release is not where the bug was."""
+    hot = [f for f in report.get("fixes") or [] if f["recent-fixes"] >= min_recent
+           and not (filetypes.is_test_path(f["entity"]) or filetypes.is_release_path(f["entity"]))]
     if not hot:
         return []
     hot.sort(key=lambda f: (-f["recent-fixes"], -f["n-fixes"], f["entity"]))
@@ -462,8 +497,8 @@ def duplication(report: dict, min_lines: int = 30) -> list:
                f"Extract the {first['lines']}-line block {where} first.")]
 
 
-RULES = [secrets_found, placeholder_identity, bus_factor, sizer_concerns, hotspot_dominance, bug_magnets, reverts, brain_methods, complexity_growth,
-         tight_coupling, duplication, stale_files, knowledge_islands, knowledge_loss]
+RULES = [dormant, secrets_found, placeholder_identity, bus_factor, sizer_concerns, hotspot_dominance, bug_magnets, reverts, brain_methods,
+         complexity_growth, tight_coupling, duplication, stale_files, knowledge_islands, knowledge_loss]
 
 
 def evaluate(report: dict) -> list:

{gitmole-0.6.6 → gitmole-0.6.8}/gitmole/identity.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 import re
 
 
-_BOT_WORDS = ("dependabot", "renovate", "github-actions", "github actions")
+_BOT_WORDS = ("dependabot", "renovate", "github-actions", "github actions", "copilot", "cursor agent", "cursor-agent", "cursoragent")
 
 
 def is_bot(name: str, email: str = "") -> bool:
@@ -33,13 +33,27 @@ def _plain(name: str) -> str:
     return " ".join(name.lower().split())
 
 
+def _distinctive(token: str) -> bool:
+    """A word that names one person on its own: five letters or more and not a common first name."""
+    return len(token) >= 5 and token not in _COMMON_FIRST_NAMES
+
+
 def same_person(a: dict, b: dict) -> bool:
-    """Same email, two shared name tokens, or the same name spelled identically (a handle such as
-    KaKa under three emails), unless that name is a bare common first name."""
-    if a["email"].lower() == b["email"].lower() or len(_tokens(a["name"]) & _tokens(b["name"])) >= 2:
+    """Same email; two shared name tokens; the same name spelled identically (a handle such as KaKa
+    under three emails), unless that name is a bare common first name; or a one-word handle that is
+    one distinctive word of the other's fuller name (junegunn and Junegunn Choi)."""
+    if a["email"].lower() == b["email"].lower():
+        return True
+    ta, tb = _tokens(a["name"]), _tokens(b["name"])
+    if len(ta & tb) >= 2:
+        return True
+    na, nb = _plain(a["name"]), _plain(b["name"])
+    if na and na == nb and na not in _COMMON_FIRST_NAMES:
         return True
-    name = _plain(a["name"])
-    return bool(name) and name == _plain(b["name"]) and name not in _COMMON_FIRST_NAMES
+    for handle, full in ((na, tb), (nb, ta)):
+        if " " not in handle and handle in full and len(full) >= 2 and _distinctive(handle):
+            return True
+    return False
 
 
 def merge(identities: list) -> list:

{gitmole-0.6.6 → gitmole-0.6.8}/gitmole/leaks.py

@@ -40,6 +40,10 @@ _VERSION = re.compile(r"^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$")
 _MARKER = re.compile(r"^(<[^<>]+>|x+|(?:x{2,}[-_ ]?)+|your[-_][\w-]+|change[-_]?me|replace[-_]?me)$", re.I)
 _EXAMPLE_WORDS = {"password", "passwd", "pass", "secret", "hello", "hey", "test", "example", "sample", "dummy", "foo", "bar",
                   "baz", "admin", "root", "user", "123456", "12345678", "123456789", "abc123", "qwerty", "letmein", "welcome"}
+# A whole value that refers to an environment variable or a template field is where the secret will be
+# read from, not the secret: `@env:AC_PASSWORD`, `${DB_PASSWORD}`, `{{.Env.X}}`, `process.env.X`, `<%= ENV['X'] %>`.
+_ENV_REF = re.compile(r"^(@env:\w+|\$\{[^{}]+\}|\$[A-Za-z_]\w*|\$\([^()]+\)|%[A-Za-z_]\w*%|\{\{.*\}\}|<%=?.*%>"
+                      r"|process\.env\.\w+|os\.environ(\[[^\]]+\]|\.get\([^()]*\))|ENV\[[^\]]+\])$", re.S)
 _KEY_BLOCK = re.compile(r"-----BEGIN [A-Z ]*KEY-----(.*?)-----END [A-Z ]*KEY-----", re.S)
 _KEY_MATERIAL = 64   # a real body is hundreds of base64 characters; a template has dots or a few x's
 
@@ -57,7 +61,8 @@ def digest(value: str, key: bytes) -> str:
 
 def is_placeholder(value: str) -> bool:
     value = (value or "").strip()
-    if _VERSION.match(value) or value.endswith("...") or value.endswith("…") or _MARKER.match(value) or value.lower() in _EXAMPLE_WORDS:
+    if (_VERSION.match(value) or value.endswith("...") or value.endswith("…") or _MARKER.match(value) or value.lower() in _EXAMPLE_WORDS
+            or _ENV_REF.match(value)):
         return True
     m = _KEY_BLOCK.search(value)
     if m:

{gitmole-0.6.6 → gitmole-0.6.8}/gitmole/maat.py

@@ -4,7 +4,9 @@
 Standalone on purpose: gitmole runs it as a pipeline step with
 `python3 maat.py LOG OUT_DIR [--aliases META_JSON]` and it must not need the
 package on sys.path. Input is `git log --all --numstat --date=short
---pretty=format:--%h--%ad--%aN --no-renames`.
+--pretty=format:--%h--%ad--%aN -M`: renames are followed, so a moved file
+is one entity under its new path and a pure move adds and deletes nothing.
+Whoever moved a directory to src/ did not write it.
 """
 from __future__ import annotations
 
@@ -40,13 +42,26 @@ def parse_log(text: str, aliases: dict = None, types=None) -> list:
             commits.append(current)
         elif line.strip() and current is not None:
             added, deleted, path = line.split("\t", 2)
-            path = filetypes.unquote(path)
+            path = _renamed_to(filetypes.unquote(path))
             if not filetypes.matches(path, types):
                 continue
             current["files"].append((path, int(added) if added.isdigit() else 0, int(deleted) if deleted.isdigit() else 0))
     return commits
 
 
+_BRACED_RENAME = re.compile(r"\{([^{}]*) => ([^{}]*)\}")
+
+
+def _renamed_to(path: str) -> str:
+    """The new path of a rename as `git log -M --numstat` spells it: `{old => new}/rest`,
+    `dir/{a => b}` or `old => new` for a whole path. A path without ' => ' is itself."""
+    if " => " not in path:
+        return path
+    if "{" in path:
+        return _BRACED_RENAME.sub(lambda m: m.group(2), path).replace("//", "/")
+    return path.split(" => ", 1)[1]
+
+
 _FIX_CONVENTIONAL = re.compile(r"^(fix|hotfix|bugfix)(\([^)]*\))?!?:", re.I)
 _FIX_WORDS = re.compile(r"\b(fix|fixes|fixed|fixing|bugfix|hotfix|bug|bugs|regression|crash|crashes)\b", re.I)
 

{gitmole-0.6.6 → gitmole-0.6.8}/gitmole/render.py

@@ -395,7 +395,8 @@ def hotspots_section(report: dict, full: bool = True, width=None) -> dict:
     scored, hidden_note = _hide_tests(scored, lambda h: h["entity"], full)
     scored, deleted_note = _hide_deleted(scored, report, full)
     scored, generated_note = _hide_generated(scored, lambda h: h["entity"], report, full)
-    hidden_note = _join_hidden(hidden_note, deleted_note, generated_note)
+    scored, release_note = _hide_rows(scored, lambda h: h["entity"], full, filetypes.is_release_path, "release file")
+    hidden_note = _join_hidden(hidden_note, deleted_note, generated_note, release_note)
     title = "Hotspots (score = revisions × lines of code)" if full is True else "Hotspots"
     limit = _limit("Hotspots", full)
     series = (report.get("trend") or {}).get("files") or {}

{gitmole-0.6.6 → gitmole-0.6.8}/gitmole/run.py

@@ -172,7 +172,7 @@ def plan(repo_dir: str, out_dir: str, branch: str = "HEAD", age: bool = True, pl
         {"name": "scc", "argv": ["scc", "--by-file", "--format", "json"], "stdout": o("size.json"), "deps": []},
         {"name": "git-sizer", "argv": ["git-sizer", "--verbose"], "stdout": o("repo-health.txt"), "deps": []},
         {"name": "betterleaks", "argv": [sys.executable, LEAKS_SCRIPT, o("secrets.json")], "stdout": None, "deps": []},   # hashes the values before anything is written
-        {"name": "git-log", "argv": [*filetypes.GIT, "log", "--all", "--use-mailmap", "--numstat", "--date=iso-strict", "--pretty=format:--%h--%ad--%aN--%s", "--no-renames"], "stdout": log, "deps": []},
+        {"name": "git-log", "argv": [*filetypes.GIT, "log", "--all", "--use-mailmap", "--numstat", "--date=iso-strict", "--pretty=format:--%h--%ad--%aN--%s", "-M"], "stdout": log, "deps": []},   # -M: a move is not an edit
         {"name": "change analysis", "argv": [sys.executable, MAAT_SCRIPT, log, out_dir, *type_args, *(["--now", now] if now else []), *(["--since", since] if since else []), "--aliases", o("meta.json")], "stdout": None, "deps": ["git-log"]},
     ]
     if lizard:

{gitmole-0.6.6 → gitmole-0.6.8}/gitmole/watch.py

@@ -66,8 +66,8 @@ def risks(report: dict, min_revs: int = 2) -> list:
 
     rows = []
     for h in hotspots.ranked(report):
-        if h["code"] is None or h["revs"] < min_revs or filetypes.is_test_path(h["entity"]):
-            continue
+        if h["code"] is None or h["revs"] < min_revs or filetypes.is_test_path(h["entity"]) or filetypes.is_release_path(h["entity"]):
+            continue   # a version file or a manifest changes on every release, not where the next bug lands
         fx = fixes.get(h["entity"], {})
         own = owners.get(h["entity"]) or Counter()
         owner, owner_lines = (own.most_common(1)[0] if own else (None, 0))

{gitmole-0.6.6 → gitmole-0.6.8}/gitmole.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.6.6
+Version: 0.6.8
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole

{gitmole-0.6.6 → gitmole-0.6.8}/tests/test_filetypes.py

@@ -133,9 +133,10 @@ class TestPaths(unittest.TestCase):
 
     def test_vendored_trees(self):
         for path in ("vendor/github.com/x/y.go", "web/node_modules/a/index.js", "third_party/z/a.c", "thirdparty/a.c", "_vendor/a.py",
-                     "external/lib/a.cpp"):
+                     "external/lib/a.cpp", "requests/packages/urllib3/a.py", "pip/_vendor/six.py", "botocore/vendored/requests/a.py"):
             self.assertTrue(filetypes.is_vendor_path(path), path)
-        for path in ("vendors.py", "src/vendoring/a.py", "node/a.js", "externals.txt", "app/main.go"):
+        for path in ("vendors.py", "src/vendoring/a.py", "node/a.js", "externals.txt", "app/main.go",
+                     "packages/runtime-core/src/renderer.ts", "packages-private/x.ts"):   # a monorepo's own packages/ at the root
             self.assertFalse(filetypes.is_vendor_path(path), path)
 
 

{gitmole-0.6.6 → gitmole-0.6.8}/tests/test_findings.py

@@ -47,7 +47,7 @@ class SecretsFound(unittest.TestCase):
         self.assertIn("1 distinct value in 2 places: generic-api-key in app/settings.py (c1, c2)", crit["detail"])
         self.assertIn("Rotate", crit["advice"])
         self.assertIn(".betterleaksignore", crit["advice"])
-        self.assertEqual(warn["title"], "2 secret(s) only in test, example or documentation files")
+        self.assertEqual(warn["title"], "2 secret(s) only in test, example, vendored or documentation files")
         self.assertIn("2 distinct values in 3 places", warn["detail"])
         self.assertIn("tests/data/a.html and 1 other file", warn["detail"])
         self.assertIn(".betterleaksignore", warn["advice"])
@@ -62,15 +62,22 @@ class SecretsFound(unittest.TestCase):
                             self.row("h3", "pkg/testdata/creds.yaml", "c3")])
         f = findings.secrets_found(r)
         self.assertEqual([x["severity"] for x in f], ["warning"])
-        self.assertEqual(f[0]["title"], "3 secret(s) only in test, example or documentation files")
+        self.assertEqual(f[0]["title"], "3 secret(s) only in test, example, vendored or documentation files")
         r = report(secrets=[self.row("h1", "examples/app.py", "c1"), self.row("h1", "app/config.py", "c2")])
         self.assertEqual([x["severity"] for x in findings.secrets_found(r)], ["critical"], "the same value in source is a leak")
 
+    def test_a_value_only_in_vendored_code_is_a_warning(self):
+        # oauthlib's RFC test vectors inside requests/packages/: upstream's specimen, not this repository's credential
+        r = report(secrets=[self.row("h1", "requests/packages/oauthlib/oauth1/rfc5849/parameters.py", "9576518")])
+        f = findings.secrets_found(r)
+        self.assertEqual([x["severity"] for x in f], ["warning"])
+        self.assertIn("vendored", f[0]["title"])
+
     def test_a_value_only_in_documentation_is_a_warning_that_says_template(self):
         r = report(secrets=[self.row("h1", "docs/GA4-API-INTEGRATION.md", "e8c0508")])
         f = findings.secrets_found(r)
         self.assertEqual([x["severity"] for x in f], ["warning"])
-        self.assertEqual(f[0]["title"], "1 secret(s) only in test, example or documentation files")
+        self.assertEqual(f[0]["title"], "1 secret(s) only in test, example, vendored or documentation files")
         self.assertIn("fixtures or templates", f[0]["advice"])
         r = report(secrets=[self.row("h1", "docs/GA4-API-INTEGRATION.md", "e8c0508"), self.row("h1", "app/config.py", "c2")])
         self.assertEqual([x["severity"] for x in findings.secrets_found(r)], ["critical"], "the same value in source is a leak")
@@ -283,6 +290,44 @@ class TightCoupling(unittest.TestCase):
         self.assertEqual(findings.tight_coupling(report()), [])
 
 
+class ReleasePlumbing(unittest.TestCase):
+    def test_a_version_file_or_manifest_does_not_dominate_the_churn(self):
+        revs = [{"entity": "setup.py", "n-revs": 184}, {"entity": "requests/models.py", "n-revs": 60}, {"entity": "requests/api.py", "n-revs": 20}]
+        f = findings.hotspot_dominance(report(revisions=revs))
+        self.assertIn("requests/models.py changed 60 times", f[0]["detail"])
+        self.assertNotIn("setup.py", f[0]["detail"])
+
+    def test_a_manifest_is_not_a_bug_magnet(self):
+        fixes = [{"entity": "package.json", "n-fixes": 20, "last-fix": "2026-09-01", "recent-fixes": 6},
+                 {"entity": "lib/reply.js", "n-fixes": 10, "last-fix": "2026-09-01", "recent-fixes": 4}]
+        f = findings.bug_magnets(report(fixes=fixes))
+        self.assertIn("lib/reply.js", f[0]["detail"])
+        self.assertNotIn("package.json", f[0]["detail"])
+
+
+class Dormant(unittest.TestCase):
+    def test_a_year_without_commits_is_a_warning_that_dates_the_last_one(self):
+        r = report()
+        r["meta"].update({"last_date": "2025-06-14", "now": "2026-09-17"})
+        f = findings.dormant(r)
+        self.assertEqual(f[0]["severity"], "warning")
+        self.assertEqual(f[0]["title"], "Dormant repository")
+        self.assertIn("No commits since 2025-06-14, 15 months ago.", f[0]["detail"])
+        self.assertIn("stopped", f[0]["advice"])
+
+    def test_a_recent_commit_is_not_dormant(self):
+        r = report()
+        r["meta"].update({"last_date": "2026-06-14", "now": "2026-09-17"})
+        self.assertEqual(findings.dormant(r), [])
+        self.assertEqual(findings.dormant(report()), [], "no dates, no finding")
+
+    def test_stale_files_are_not_reported_for_a_dormant_repository(self):
+        age = [{"entity": f"f{i}", "age-months": 15} for i in range(10)]
+        r = report(age=age)
+        r["meta"].update({"last_date": "2025-06-14", "now": "2026-09-17"})
+        self.assertEqual(findings.stale_files(r), [], "every file is untouched because nothing is; the dormancy finding says so")
+
+
 class StaleFiles(unittest.TestCase):
     def test_info_when_a_third_untouched_for_a_year(self):
         age = [{"entity": f"f{i}", "age-months": 12} for i in range(4)] + [{"entity": "g", "age-months": 0} for _ in range(6)]

{gitmole-0.6.6 → gitmole-0.6.8}/tests/test_identity.py

@@ -26,6 +26,14 @@ class Merge(unittest.TestCase):
         merged = {m["name"]: m["commits"] for m in identity.merge(ids)}
         self.assertEqual(merged, {"KaKa": 123, "namusyaka": 188, "Li Yu": 8})
 
+    def test_a_handle_that_is_one_distinctive_word_of_a_fuller_name_is_the_same_person(self):
+        ids = [{"name": "Junegunn Choi", "email": "junegunn.c@a.com", "commits": 2924}, {"name": "junegunn", "email": "junegunn@b.com", "commits": 123},
+               {"name": "Sam Altman", "email": "sam@a.com", "commits": 5}, {"name": "sam", "email": "sam@b.com", "commits": 2},
+               {"name": "Kevin Brown", "email": "kb@a.com", "commits": 76}, {"name": "Kevin", "email": "k@b.com", "commits": 21}]
+        merged = {m["name"]: m["commits"] for m in identity.merge(ids)}
+        self.assertEqual(merged, {"Junegunn Choi": 3047, "Sam Altman": 5, "sam": 2, "Kevin Brown": 76, "Kevin": 21},
+                         "a short or common first name is not distinctive enough")
+
     def test_a_bare_common_first_name_is_not_enough(self):
         ids = [{"name": "Jean", "email": "jean@a.com", "commits": 24}, {"name": "Jean", "email": "jean@b.com", "commits": 18},
                {"name": "Alex", "email": "alex@a.com", "commits": 3}, {"name": "alex", "email": "alex@b.com", "commits": 2}]
@@ -76,7 +84,8 @@ class IsBot(unittest.TestCase):
         for name, email in [("renovate[bot]", "29139614+renovate[bot]@users.noreply.github.com"),
                             ("github-actions[bot]", "41898282+github-actions[bot]@users.noreply.github.com"),
                             ("dependabot[bot]", "support@github.com"), ("Dependabot", "dependabot@example.com"),
-                            ("Renovate Bot", "bot@renovateapp.com"), ("GitHub Actions", "actions@github.com")]:
+                            ("Renovate Bot", "bot@renovateapp.com"), ("GitHub Actions", "actions@github.com"),
+                            ("Copilot", "198982749+Copilot@users.noreply.github.com"), ("Cursor Agent", "cursoragent@cursor.com")]:
             self.assertTrue(identity.is_bot(name, email), (name, email))
 
     def test_people_are_not_bots(self):

{gitmole-0.6.6 → gitmole-0.6.8}/tests/test_leaks.py

@@ -66,6 +66,14 @@ class Placeholder(unittest.TestCase):
         for value in ["hello123", "secret-9f8a7b6c5d4e", "s3cr3t!Passw0rd", "foobarbaz2024"]:
             self.assertFalse(leaks.is_placeholder(value), "a word inside other material is not a placeholder: " + value)
 
+    def test_references_to_an_environment_variable_are_placeholders(self):
+        # fzf's notarisation config: `password = "@env:AC_PASSWORD"`; goreleaser: `{{.Env.MACOS_SIGN_PASSWORD}}`
+        for value in ["@env:AC_PASSWORD", "{{.Env.MACOS_SIGN_PASSWORD}}", "${DB_PASSWORD}", "$DB_PASSWORD", "$(cat ~/.secret)", "%APPDATA_KEY%",
+                      "{{ secrets.API_TOKEN }}", "<%= ENV['KEY'] %>", "process.env.API_KEY", "os.environ['API_KEY']", "os.environ.get('K')", "ENV['SECRET']"]:
+            self.assertTrue(leaks.is_placeholder(value), value)
+        for value in ["p@ssw0rd!", "AKIA" + "X" * 16, "env-9f8a7b6c5d4e3f2a", "${not closed", "hello$world"]:
+            self.assertFalse(leaks.is_placeholder(value), value)
+
     def test_anything_else_is_taken_seriously(self):
         # built at runtime: a literal in these shapes would trip secret scanners on this very file
         key_id, long_key = "AKIA" + "X" * 16, "6L" + "x" * 38

{gitmole-0.6.6 → gitmole-0.6.8}/tests/test_maat.py

@@ -48,6 +48,18 @@ class ParseLog(unittest.TestCase):
         self.assertEqual(commits[0]["files"], [("src/a.py", 3, 1), ("src/b.py", 2, 0)])
         self.assertEqual(commits[1]["files"][2], ("img/logo.png", 0, 0))
 
+    def test_renames_are_followed_to_the_new_path_and_a_pure_move_adds_no_lines(self):
+        # `git log -M --numstat` spells a rename three ways; the mover is not the owner of what moved
+        log = ("--d63e94f5--2023-08-13T10:00:00+00:00--Nate--Move to src layout\n"
+               "0\t0\t{requests => src/requests}/__init__.py\n"
+               "4\t7\tSECURITY.md => .github/SECURITY.md\n"
+               "0\t0\tCODE_OF_CONDUCT.md => .github/CODE_OF_CONDUCT.md\n"
+               "2\t0\tsrc/requests/{models.py => models_v2.py}\n"
+               "1\t1\tMakefile\n")
+        commits = maat.parse_log(log, types=None)
+        self.assertEqual(commits[0]["files"], [("src/requests/__init__.py", 0, 0), (".github/SECURITY.md", 4, 7),
+                                                (".github/CODE_OF_CONDUCT.md", 0, 0), ("src/requests/models_v2.py", 2, 0), ("Makefile", 1, 1)])
+
     def test_subjects_with_exotic_line_break_characters_do_not_split_the_log(self):
         # U+2028 and form feed are line breaks to str.splitlines but not to git
         text = "--x--2026-05-04T10:00:00+00:00--Ann--Fix\u2028broken\x0cthing\n1\t0\tf.py\n"

{gitmole-0.6.6 → gitmole-0.6.8}/tests/test_render.py

@@ -334,6 +334,17 @@ class Report(unittest.TestCase):
         full = rendered(r, [], width=200, full=True)
         self.assertIn("validate10", full)
 
+    def test_default_hotspots_hide_release_plumbing_and_say_so(self):
+        r = sample_report()
+        r["size"]["files"].update({"setup.py": {"code": 6, "complexity": 0}, "version.go": {"code": 2, "complexity": 0}})
+        r["revisions"] += [{"entity": "setup.py", "n-revs": 184}, {"entity": "version.go", "n-revs": 29}]
+        hot = rendered(r, [], width=200)
+        hot = hot[hot.index("◆ Hotspots"):hot.index("Change coupling")]
+        self.assertNotIn("setup.py", hot)
+        self.assertIn("2 release files hidden; --full shows them", hot)
+        full = rendered(r, [], width=200, full=True)
+        self.assertIn("setup.py", full[full.index("◆ Hotspots"):])
+
     def test_default_coupling_hides_release_plumbing_pairs_and_says_so(self):
         r = sample_report()
         for f in ("lib/version.rb", "contrib/version.rb", "Gemfile", "Gemfile.lock"):

{gitmole-0.6.6 → gitmole-0.6.8}/tests/test_run.py

@@ -192,6 +192,8 @@ class Plan(unittest.TestCase):
         self.assertEqual(by["scc"]["stdout"], "/o/size.json")
         self.assertIn("--by-file", by["scc"]["argv"])
         self.assertIn("--use-mailmap", by["git-log"]["argv"])
+        self.assertIn("-M", by["git-log"]["argv"], "renames are followed so a move to src/ credits nobody with the moved lines")
+        self.assertNotIn("--no-renames", by["git-log"]["argv"])
         self.assertEqual(by["git-log"]["argv"][:4], ["git", "-c", "core.quotePath=false", "log"], "non-ASCII paths must not be octal-escaped and quoted")
 
     def test_function_metrics_step_is_optional_and_runs_the_bundled_script(self):

{gitmole-0.6.6 → gitmole-0.6.8}/tests/test_watch.py

@@ -53,6 +53,14 @@ class Risks(unittest.TestCase):
         self.assertNotIn("core/gone.py", files, "no longer in the tree")
         self.assertNotIn("core/once.py", files, "changed once")
 
+    def test_release_plumbing_is_not_on_the_list(self):
+        r = report()
+        r["size"]["files"].update({"setup.py": {"code": 6, "complexity": 0}, "version.go": {"code": 2, "complexity": 0}, "Makefile": {"code": 21, "complexity": 0}})
+        r["revisions"] = [{"entity": "setup.py", "n-revs": 184}, {"entity": "version.go", "n-revs": 29}, {"entity": "Makefile", "n-revs": 131},
+                          {"entity": "core/parser.py", "n-revs": 40}]
+        files = sorted(x["file"] for x in watch.risks(r))
+        self.assertEqual(files, ["Makefile", "core/parser.py"], "a version file or a manifest changes on every release, not where the next bug lands")
+
     def test_test_companions_and_weak_pairs_are_not_reasons(self):
         top = watch.risks(report())[0]
         coupling = [r for r in top["reasons"] if r.startswith("changes with")][0]