gitmole 0.6.7__tar.gz → 0.6.8__tar.gz

{gitmole-0.6.7 → gitmole-0.6.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.6.7
+Version: 0.6.8
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole

{gitmole-0.6.7 → gitmole-0.6.8}/gitmole/__init__.py

@@ -1,3 +1,3 @@
 """gitmole: offline git repository analysis with a terminal report."""
 
-__version__ = "0.6.7"
+__version__ = "0.6.8"

{gitmole-0.6.7 → gitmole-0.6.8}/gitmole/findings.py

@@ -216,9 +216,39 @@ def tight_coupling(report: dict, min_degree: int = 80, min_revs: int = 5) -> lis
                f"Review {first['entity']} and {first['coupled']} first: a shared layout or a hidden dependency links them.")]
 
 
+def _months_apart(earlier: str, later: str) -> int:
+    """Whole months from one ISO date to another."""
+    y1, m1, d1 = (int(x) for x in earlier[:10].split("-"))
+    y2, m2, d2 = (int(x) for x in later[:10].split("-"))
+    return (y2 - y1) * 12 + (m2 - m1) - (1 if d2 < d1 else 0)
+
+
+def _dormant_months(report: dict) -> int:
+    """Months since the last commit, against the run's reference date (GITMOLE_NOW or today)."""
+    import datetime as _dt
+    last = report["meta"].get("last_date")
+    if not last:
+        return 0
+    now = report["meta"].get("now") or _dt.date.today().isoformat()
+    return max(0, _months_apart(last, now))
+
+
+def dormant(report: dict, months: int = 12) -> list:
+    """No commits for a year or more: everything else in the report describes a repository that has
+    stopped, which is the first thing to know about it."""
+    idle = _dormant_months(report)
+    if idle < months:
+        return []
+    return [_f("warning", "Dormant repository", f"No commits since {report['meta']['last_date']}, {idle} months ago.",
+               "The rest of the report describes a repository that has stopped; look for a successor or an archive notice before depending on it.")]
+
+
 def stale_files(report: dict, months: int = 12, share: float = 0.3) -> list:
     """Files still in the tree that nobody has touched. The age table covers every path in the
-    history, so paths that were deleted are left out here; they are not dead code, they are gone."""
+    history, so paths that were deleted are left out here; they are not dead code, they are gone.
+    In a dormant repository every file is untouched because nothing is; the dormancy finding says so."""
+    if _dormant_months(report) >= months:
+        return []
     age = report.get("age") or []
     tree = _tree(report)
     if tree:
@@ -467,8 +497,8 @@ def duplication(report: dict, min_lines: int = 30) -> list:
                f"Extract the {first['lines']}-line block {where} first.")]
 
 
-RULES = [secrets_found, placeholder_identity, bus_factor, sizer_concerns, hotspot_dominance, bug_magnets, reverts, brain_methods, complexity_growth,
-         tight_coupling, duplication, stale_files, knowledge_islands, knowledge_loss]
+RULES = [dormant, secrets_found, placeholder_identity, bus_factor, sizer_concerns, hotspot_dominance, bug_magnets, reverts, brain_methods,
+         complexity_growth, tight_coupling, duplication, stale_files, knowledge_islands, knowledge_loss]
 
 
 def evaluate(report: dict) -> list:

{gitmole-0.6.7 → gitmole-0.6.8}/gitmole/identity.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 import re
 
 
-_BOT_WORDS = ("dependabot", "renovate", "github-actions", "github actions")
+_BOT_WORDS = ("dependabot", "renovate", "github-actions", "github actions", "copilot", "cursor agent", "cursor-agent", "cursoragent")
 
 
 def is_bot(name: str, email: str = "") -> bool:
@@ -33,13 +33,27 @@ def _plain(name: str) -> str:
     return " ".join(name.lower().split())
 
 
+def _distinctive(token: str) -> bool:
+    """A word that names one person on its own: five letters or more and not a common first name."""
+    return len(token) >= 5 and token not in _COMMON_FIRST_NAMES
+
+
 def same_person(a: dict, b: dict) -> bool:
-    """Same email, two shared name tokens, or the same name spelled identically (a handle such as
-    KaKa under three emails), unless that name is a bare common first name."""
-    if a["email"].lower() == b["email"].lower() or len(_tokens(a["name"]) & _tokens(b["name"])) >= 2:
+    """Same email; two shared name tokens; the same name spelled identically (a handle such as KaKa
+    under three emails), unless that name is a bare common first name; or a one-word handle that is
+    one distinctive word of the other's fuller name (junegunn and Junegunn Choi)."""
+    if a["email"].lower() == b["email"].lower():
+        return True
+    ta, tb = _tokens(a["name"]), _tokens(b["name"])
+    if len(ta & tb) >= 2:
+        return True
+    na, nb = _plain(a["name"]), _plain(b["name"])
+    if na and na == nb and na not in _COMMON_FIRST_NAMES:
         return True
-    name = _plain(a["name"])
-    return bool(name) and name == _plain(b["name"]) and name not in _COMMON_FIRST_NAMES
+    for handle, full in ((na, tb), (nb, ta)):
+        if " " not in handle and handle in full and len(full) >= 2 and _distinctive(handle):
+            return True
+    return False
 
 
 def merge(identities: list) -> list:

{gitmole-0.6.7 → gitmole-0.6.8}/gitmole/leaks.py

@@ -40,6 +40,10 @@ _VERSION = re.compile(r"^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$")
 _MARKER = re.compile(r"^(<[^<>]+>|x+|(?:x{2,}[-_ ]?)+|your[-_][\w-]+|change[-_]?me|replace[-_]?me)$", re.I)
 _EXAMPLE_WORDS = {"password", "passwd", "pass", "secret", "hello", "hey", "test", "example", "sample", "dummy", "foo", "bar",
                   "baz", "admin", "root", "user", "123456", "12345678", "123456789", "abc123", "qwerty", "letmein", "welcome"}
+# A whole value that refers to an environment variable or a template field is where the secret will be
+# read from, not the secret: `@env:AC_PASSWORD`, `${DB_PASSWORD}`, `{{.Env.X}}`, `process.env.X`, `<%= ENV['X'] %>`.
+_ENV_REF = re.compile(r"^(@env:\w+|\$\{[^{}]+\}|\$[A-Za-z_]\w*|\$\([^()]+\)|%[A-Za-z_]\w*%|\{\{.*\}\}|<%=?.*%>"
+                      r"|process\.env\.\w+|os\.environ(\[[^\]]+\]|\.get\([^()]*\))|ENV\[[^\]]+\])$", re.S)
 _KEY_BLOCK = re.compile(r"-----BEGIN [A-Z ]*KEY-----(.*?)-----END [A-Z ]*KEY-----", re.S)
 _KEY_MATERIAL = 64   # a real body is hundreds of base64 characters; a template has dots or a few x's
 
@@ -57,7 +61,8 @@ def digest(value: str, key: bytes) -> str:
 
 def is_placeholder(value: str) -> bool:
     value = (value or "").strip()
-    if _VERSION.match(value) or value.endswith("...") or value.endswith("…") or _MARKER.match(value) or value.lower() in _EXAMPLE_WORDS:
+    if (_VERSION.match(value) or value.endswith("...") or value.endswith("…") or _MARKER.match(value) or value.lower() in _EXAMPLE_WORDS
+            or _ENV_REF.match(value)):
         return True
     m = _KEY_BLOCK.search(value)
     if m:

{gitmole-0.6.7 → gitmole-0.6.8}/gitmole.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.6.7
+Version: 0.6.8
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole

{gitmole-0.6.7 → gitmole-0.6.8}/tests/test_findings.py

@@ -305,6 +305,29 @@ class ReleasePlumbing(unittest.TestCase):
         self.assertNotIn("package.json", f[0]["detail"])
 
 
+class Dormant(unittest.TestCase):
+    def test_a_year_without_commits_is_a_warning_that_dates_the_last_one(self):
+        r = report()
+        r["meta"].update({"last_date": "2025-06-14", "now": "2026-09-17"})
+        f = findings.dormant(r)
+        self.assertEqual(f[0]["severity"], "warning")
+        self.assertEqual(f[0]["title"], "Dormant repository")
+        self.assertIn("No commits since 2025-06-14, 15 months ago.", f[0]["detail"])
+        self.assertIn("stopped", f[0]["advice"])
+
+    def test_a_recent_commit_is_not_dormant(self):
+        r = report()
+        r["meta"].update({"last_date": "2026-06-14", "now": "2026-09-17"})
+        self.assertEqual(findings.dormant(r), [])
+        self.assertEqual(findings.dormant(report()), [], "no dates, no finding")
+
+    def test_stale_files_are_not_reported_for_a_dormant_repository(self):
+        age = [{"entity": f"f{i}", "age-months": 15} for i in range(10)]
+        r = report(age=age)
+        r["meta"].update({"last_date": "2025-06-14", "now": "2026-09-17"})
+        self.assertEqual(findings.stale_files(r), [], "every file is untouched because nothing is; the dormancy finding says so")
+
+
 class StaleFiles(unittest.TestCase):
     def test_info_when_a_third_untouched_for_a_year(self):
         age = [{"entity": f"f{i}", "age-months": 12} for i in range(4)] + [{"entity": "g", "age-months": 0} for _ in range(6)]

{gitmole-0.6.7 → gitmole-0.6.8}/tests/test_identity.py

@@ -26,6 +26,14 @@ class Merge(unittest.TestCase):
         merged = {m["name"]: m["commits"] for m in identity.merge(ids)}
         self.assertEqual(merged, {"KaKa": 123, "namusyaka": 188, "Li Yu": 8})
 
+    def test_a_handle_that_is_one_distinctive_word_of_a_fuller_name_is_the_same_person(self):
+        ids = [{"name": "Junegunn Choi", "email": "junegunn.c@a.com", "commits": 2924}, {"name": "junegunn", "email": "junegunn@b.com", "commits": 123},
+               {"name": "Sam Altman", "email": "sam@a.com", "commits": 5}, {"name": "sam", "email": "sam@b.com", "commits": 2},
+               {"name": "Kevin Brown", "email": "kb@a.com", "commits": 76}, {"name": "Kevin", "email": "k@b.com", "commits": 21}]
+        merged = {m["name"]: m["commits"] for m in identity.merge(ids)}
+        self.assertEqual(merged, {"Junegunn Choi": 3047, "Sam Altman": 5, "sam": 2, "Kevin Brown": 76, "Kevin": 21},
+                         "a short or common first name is not distinctive enough")
+
     def test_a_bare_common_first_name_is_not_enough(self):
         ids = [{"name": "Jean", "email": "jean@a.com", "commits": 24}, {"name": "Jean", "email": "jean@b.com", "commits": 18},
                {"name": "Alex", "email": "alex@a.com", "commits": 3}, {"name": "alex", "email": "alex@b.com", "commits": 2}]
@@ -76,7 +84,8 @@ class IsBot(unittest.TestCase):
         for name, email in [("renovate[bot]", "29139614+renovate[bot]@users.noreply.github.com"),
                             ("github-actions[bot]", "41898282+github-actions[bot]@users.noreply.github.com"),
                             ("dependabot[bot]", "support@github.com"), ("Dependabot", "dependabot@example.com"),
-                            ("Renovate Bot", "bot@renovateapp.com"), ("GitHub Actions", "actions@github.com")]:
+                            ("Renovate Bot", "bot@renovateapp.com"), ("GitHub Actions", "actions@github.com"),
+                            ("Copilot", "198982749+Copilot@users.noreply.github.com"), ("Cursor Agent", "cursoragent@cursor.com")]:
             self.assertTrue(identity.is_bot(name, email), (name, email))
 
     def test_people_are_not_bots(self):

{gitmole-0.6.7 → gitmole-0.6.8}/tests/test_leaks.py

@@ -66,6 +66,14 @@ class Placeholder(unittest.TestCase):
         for value in ["hello123", "secret-9f8a7b6c5d4e", "s3cr3t!Passw0rd", "foobarbaz2024"]:
             self.assertFalse(leaks.is_placeholder(value), "a word inside other material is not a placeholder: " + value)
 
+    def test_references_to_an_environment_variable_are_placeholders(self):
+        # fzf's notarisation config: `password = "@env:AC_PASSWORD"`; goreleaser: `{{.Env.MACOS_SIGN_PASSWORD}}`
+        for value in ["@env:AC_PASSWORD", "{{.Env.MACOS_SIGN_PASSWORD}}", "${DB_PASSWORD}", "$DB_PASSWORD", "$(cat ~/.secret)", "%APPDATA_KEY%",
+                      "{{ secrets.API_TOKEN }}", "<%= ENV['KEY'] %>", "process.env.API_KEY", "os.environ['API_KEY']", "os.environ.get('K')", "ENV['SECRET']"]:
+            self.assertTrue(leaks.is_placeholder(value), value)
+        for value in ["p@ssw0rd!", "AKIA" + "X" * 16, "env-9f8a7b6c5d4e3f2a", "${not closed", "hello$world"]:
+            self.assertFalse(leaks.is_placeholder(value), value)
+
     def test_anything_else_is_taken_seriously(self):
         # built at runtime: a literal in these shapes would trip secret scanners on this very file
         key_id, long_key = "AKIA" + "X" * 16, "6L" + "x" * 38