gitmole 0.6.7__tar.gz → 0.6.9__tar.gz

{gitmole-0.6.7 → gitmole-0.6.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.6.7
+Version: 0.6.9
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole

{gitmole-0.6.7 → gitmole-0.6.9}/gitmole/__init__.py

@@ -1,3 +1,3 @@
 """gitmole: offline git repository analysis with a terminal report."""
 
-__version__ = "0.6.7"
+__version__ = "0.6.9"

{gitmole-0.6.7 → gitmole-0.6.9}/gitmole/findings.py

@@ -216,9 +216,39 @@ def tight_coupling(report: dict, min_degree: int = 80, min_revs: int = 5) -> lis
                f"Review {first['entity']} and {first['coupled']} first: a shared layout or a hidden dependency links them.")]
 
 
+def _months_apart(earlier: str, later: str) -> int:
+    """Whole months from one ISO date to another."""
+    y1, m1, d1 = (int(x) for x in earlier[:10].split("-"))
+    y2, m2, d2 = (int(x) for x in later[:10].split("-"))
+    return (y2 - y1) * 12 + (m2 - m1) - (1 if d2 < d1 else 0)
+
+
+def _dormant_months(report: dict) -> int:
+    """Months since the last commit, against the run's reference date (GITMOLE_NOW or today)."""
+    import datetime as _dt
+    last = report["meta"].get("last_date")
+    if not last:
+        return 0
+    now = report["meta"].get("now") or _dt.date.today().isoformat()
+    return max(0, _months_apart(last, now))
+
+
+def dormant(report: dict, months: int = 12) -> list:
+    """No commits for a year or more: everything else in the report describes a repository that has
+    stopped, which is the first thing to know about it."""
+    idle = _dormant_months(report)
+    if idle < months:
+        return []
+    return [_f("warning", "Dormant repository", f"No commits since {report['meta']['last_date']}, {idle} months ago.",
+               "The rest of the report describes a repository that has stopped; look for a successor or an archive notice before depending on it.")]
+
+
 def stale_files(report: dict, months: int = 12, share: float = 0.3) -> list:
     """Files still in the tree that nobody has touched. The age table covers every path in the
-    history, so paths that were deleted are left out here; they are not dead code, they are gone."""
+    history, so paths that were deleted are left out here; they are not dead code, they are gone.
+    In a dormant repository every file is untouched because nothing is; the dormancy finding says so."""
+    if _dormant_months(report) >= months:
+        return []
     age = report.get("age") or []
     tree = _tree(report)
     if tree:
@@ -467,8 +497,8 @@ def duplication(report: dict, min_lines: int = 30) -> list:
                f"Extract the {first['lines']}-line block {where} first.")]
 
 
-RULES = [secrets_found, placeholder_identity, bus_factor, sizer_concerns, hotspot_dominance, bug_magnets, reverts, brain_methods, complexity_growth,
-         tight_coupling, duplication, stale_files, knowledge_islands, knowledge_loss]
+RULES = [dormant, secrets_found, placeholder_identity, bus_factor, sizer_concerns, hotspot_dominance, bug_magnets, reverts, brain_methods,
+         complexity_growth, tight_coupling, duplication, stale_files, knowledge_islands, knowledge_loss]
 
 
 def evaluate(report: dict) -> list:

{gitmole-0.6.7 → gitmole-0.6.9}/gitmole/functions.py

@@ -30,10 +30,20 @@ def select_files(repo: str, ignore=(), types_spec: str = None) -> list:
     return [f for f in files if lizard.get_reader_for(f) is not None]
 
 
+NAME_CAP = 200        # a deeply nested fixture gives lizard a dotted name of megabytes; nobody reads past this
+LONG_NAME_CAP = 500
+
+
+def _cut(text: str, cap: int) -> str:
+    return text if len(text) <= cap else text[:cap - 1] + "…"
+
+
 def csv_row(info, fn) -> list:
-    """The columns `lizard --csv` prints, so the loader does not care which produced the file."""
+    """The columns `lizard --csv` prints, so the loader does not care which produced the file. Names
+    are cut to what a table can show, so one pathological fixture cannot make the file unreadable."""
+    name = _cut(fn.name, NAME_CAP)
     return [fn.nloc, fn.cyclomatic_complexity, fn.token_count, fn.parameter_count, fn.length,
-            f"{fn.name}@{fn.start_line}-{fn.end_line}@{info.filename}", info.filename, fn.name, fn.long_name, fn.start_line, fn.end_line]
+            f"{name}@{fn.start_line}-{fn.end_line}@{info.filename}", info.filename, name, _cut(fn.long_name, LONG_NAME_CAP), fn.start_line, fn.end_line]
 
 
 def write_duplicates(dup: Duplicates, fh) -> None:

{gitmole-0.6.7 → gitmole-0.6.9}/gitmole/identity.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 import re
 
 
-_BOT_WORDS = ("dependabot", "renovate", "github-actions", "github actions")
+_BOT_WORDS = ("dependabot", "renovate", "github-actions", "github actions", "copilot", "cursor agent", "cursor-agent", "cursoragent")
 
 
 def is_bot(name: str, email: str = "") -> bool:
@@ -33,13 +33,27 @@ def _plain(name: str) -> str:
     return " ".join(name.lower().split())
 
 
+def _distinctive(token: str) -> bool:
+    """A word that names one person on its own: five letters or more and not a common first name."""
+    return len(token) >= 5 and token not in _COMMON_FIRST_NAMES
+
+
 def same_person(a: dict, b: dict) -> bool:
-    """Same email, two shared name tokens, or the same name spelled identically (a handle such as
-    KaKa under three emails), unless that name is a bare common first name."""
-    if a["email"].lower() == b["email"].lower() or len(_tokens(a["name"]) & _tokens(b["name"])) >= 2:
+    """Same email; two shared name tokens; the same name spelled identically (a handle such as KaKa
+    under three emails), unless that name is a bare common first name; or a one-word handle that is
+    one distinctive word of the other's fuller name (junegunn and Junegunn Choi)."""
+    if a["email"].lower() == b["email"].lower():
+        return True
+    ta, tb = _tokens(a["name"]), _tokens(b["name"])
+    if len(ta & tb) >= 2:
+        return True
+    na, nb = _plain(a["name"]), _plain(b["name"])
+    if na and na == nb and na not in _COMMON_FIRST_NAMES:
         return True
-    name = _plain(a["name"])
-    return bool(name) and name == _plain(b["name"]) and name not in _COMMON_FIRST_NAMES
+    for handle, full in ((na, tb), (nb, ta)):
+        if " " not in handle and handle in full and len(full) >= 2 and _distinctive(handle):
+            return True
+    return False
 
 
 def merge(identities: list) -> list:

{gitmole-0.6.7 → gitmole-0.6.9}/gitmole/leaks.py

@@ -40,6 +40,10 @@ _VERSION = re.compile(r"^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$")
 _MARKER = re.compile(r"^(<[^<>]+>|x+|(?:x{2,}[-_ ]?)+|your[-_][\w-]+|change[-_]?me|replace[-_]?me)$", re.I)
 _EXAMPLE_WORDS = {"password", "passwd", "pass", "secret", "hello", "hey", "test", "example", "sample", "dummy", "foo", "bar",
                   "baz", "admin", "root", "user", "123456", "12345678", "123456789", "abc123", "qwerty", "letmein", "welcome"}
+# A whole value that refers to an environment variable or a template field is where the secret will be
+# read from, not the secret: `@env:AC_PASSWORD`, `${DB_PASSWORD}`, `{{.Env.X}}`, `process.env.X`, `<%= ENV['X'] %>`.
+_ENV_REF = re.compile(r"^(@env:\w+|\$\{[^{}]+\}|\$[A-Za-z_]\w*|\$\([^()]+\)|%[A-Za-z_]\w*%|\{\{.*\}\}|<%=?.*%>"
+                      r"|process\.env\.\w+|os\.environ(\[[^\]]+\]|\.get\([^()]*\))|ENV\[[^\]]+\])$", re.S)
 _KEY_BLOCK = re.compile(r"-----BEGIN [A-Z ]*KEY-----(.*?)-----END [A-Z ]*KEY-----", re.S)
 _KEY_MATERIAL = 64   # a real body is hundreds of base64 characters; a template has dots or a few x's
 
@@ -57,7 +61,8 @@ def digest(value: str, key: bytes) -> str:
 
 def is_placeholder(value: str) -> bool:
     value = (value or "").strip()
-    if _VERSION.match(value) or value.endswith("...") or value.endswith("…") or _MARKER.match(value) or value.lower() in _EXAMPLE_WORDS:
+    if (_VERSION.match(value) or value.endswith("...") or value.endswith("…") or _MARKER.match(value) or value.lower() in _EXAMPLE_WORDS
+            or _ENV_REF.match(value)):
         return True
     m = _KEY_BLOCK.search(value)
     if m:

{gitmole-0.6.7 → gitmole-0.6.9}/gitmole/load.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 
 import csv
 import io
+import sys
 import json
 import os
 import re
@@ -145,13 +146,21 @@ def parse_authors_log(text: str) -> list:
     ]
 
 
+NAME_CAP = 200   # a function name a table can show; deeply nested fixtures give lizard dotted names of megabytes
+csv.field_size_limit(min(sys.maxsize, 2**31 - 1))   # an older functions.csv may still carry such a name
+
+
+def _cut(name: str, cap: int = NAME_CAP) -> str:
+    return name if len(name) <= cap else name[:cap - 1] + "…"
+
+
 def parse_functions(text: str) -> list:
     """lizard --csv rows: nloc, ccn, tokens, params, length, location, file, function, long name, start, end."""
     rows = []
     for r in csv.reader(io.StringIO(text)):
         if len(r) < 11:
             continue
-        rows.append({"file": _rel(r[6]), "function": r[7] or "(anonymous)", "ccn": _num(r[1]), "nloc": _num(r[0]), "params": _num(r[3]),
+        rows.append({"file": _rel(r[6]), "function": _cut(r[7]) or "(anonymous)", "ccn": _num(r[1]), "nloc": _num(r[0]), "params": _num(r[3]),
                      "start": _num(r[9]), "end": _num(r[10])})
     return rows
 

{gitmole-0.6.7 → gitmole-0.6.9}/gitmole.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.6.7
+Version: 0.6.9
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole

{gitmole-0.6.7 → gitmole-0.6.9}/tests/test_findings.py

@@ -305,6 +305,29 @@ class ReleasePlumbing(unittest.TestCase):
         self.assertNotIn("package.json", f[0]["detail"])
 
 
+class Dormant(unittest.TestCase):
+    def test_a_year_without_commits_is_a_warning_that_dates_the_last_one(self):
+        r = report()
+        r["meta"].update({"last_date": "2025-06-14", "now": "2026-09-17"})
+        f = findings.dormant(r)
+        self.assertEqual(f[0]["severity"], "warning")
+        self.assertEqual(f[0]["title"], "Dormant repository")
+        self.assertIn("No commits since 2025-06-14, 15 months ago.", f[0]["detail"])
+        self.assertIn("stopped", f[0]["advice"])
+
+    def test_a_recent_commit_is_not_dormant(self):
+        r = report()
+        r["meta"].update({"last_date": "2026-06-14", "now": "2026-09-17"})
+        self.assertEqual(findings.dormant(r), [])
+        self.assertEqual(findings.dormant(report()), [], "no dates, no finding")
+
+    def test_stale_files_are_not_reported_for_a_dormant_repository(self):
+        age = [{"entity": f"f{i}", "age-months": 15} for i in range(10)]
+        r = report(age=age)
+        r["meta"].update({"last_date": "2025-06-14", "now": "2026-09-17"})
+        self.assertEqual(findings.stale_files(r), [], "every file is untouched because nothing is; the dormancy finding says so")
+
+
 class StaleFiles(unittest.TestCase):
     def test_info_when_a_third_untouched_for_a_year(self):
         age = [{"entity": f"f{i}", "age-months": 12} for i in range(4)] + [{"entity": "g", "age-months": 0} for _ in range(6)]

{gitmole-0.6.7 → gitmole-0.6.9}/tests/test_functions.py

@@ -67,6 +67,17 @@ class FunctionsScript(unittest.TestCase):
         self.assertIn('"tracked"', csv, "functions are still measured")
         self.assertIsNone(dup, "no duplicates.txt: the finder did not run, so nothing pretends it did")
 
+    def test_a_huge_nested_name_is_cut_before_it_is_written(self):
+        from types import SimpleNamespace
+        name = ".".join("a" for _ in range(100_000))
+        fn = SimpleNamespace(nloc=5, cyclomatic_complexity=3, token_count=40, parameter_count=1, length=5, name=name,
+                             long_name=name + "( )", start_line=1, end_line=5)
+        row = functions.csv_row(SimpleNamespace(filename="a.py"), fn)
+        self.assertEqual(len(row[7]), functions.NAME_CAP)
+        self.assertTrue(row[7].endswith("…"))
+        self.assertLessEqual(len(row[8]), functions.LONG_NAME_CAP)
+        self.assertLessEqual(len(row[5]), functions.NAME_CAP + len("@1-5@a.py"))
+
     def test_csv_matches_lizards_own_layout(self):
         with tempfile.TemporaryDirectory() as d:
             make_repo(d)

{gitmole-0.6.7 → gitmole-0.6.9}/tests/test_identity.py

@@ -26,6 +26,14 @@ class Merge(unittest.TestCase):
         merged = {m["name"]: m["commits"] for m in identity.merge(ids)}
         self.assertEqual(merged, {"KaKa": 123, "namusyaka": 188, "Li Yu": 8})
 
+    def test_a_handle_that_is_one_distinctive_word_of_a_fuller_name_is_the_same_person(self):
+        ids = [{"name": "Junegunn Choi", "email": "junegunn.c@a.com", "commits": 2924}, {"name": "junegunn", "email": "junegunn@b.com", "commits": 123},
+               {"name": "Sam Altman", "email": "sam@a.com", "commits": 5}, {"name": "sam", "email": "sam@b.com", "commits": 2},
+               {"name": "Kevin Brown", "email": "kb@a.com", "commits": 76}, {"name": "Kevin", "email": "k@b.com", "commits": 21}]
+        merged = {m["name"]: m["commits"] for m in identity.merge(ids)}
+        self.assertEqual(merged, {"Junegunn Choi": 3047, "Sam Altman": 5, "sam": 2, "Kevin Brown": 76, "Kevin": 21},
+                         "a short or common first name is not distinctive enough")
+
     def test_a_bare_common_first_name_is_not_enough(self):
         ids = [{"name": "Jean", "email": "jean@a.com", "commits": 24}, {"name": "Jean", "email": "jean@b.com", "commits": 18},
                {"name": "Alex", "email": "alex@a.com", "commits": 3}, {"name": "alex", "email": "alex@b.com", "commits": 2}]
@@ -76,7 +84,8 @@ class IsBot(unittest.TestCase):
         for name, email in [("renovate[bot]", "29139614+renovate[bot]@users.noreply.github.com"),
                             ("github-actions[bot]", "41898282+github-actions[bot]@users.noreply.github.com"),
                             ("dependabot[bot]", "support@github.com"), ("Dependabot", "dependabot@example.com"),
-                            ("Renovate Bot", "bot@renovateapp.com"), ("GitHub Actions", "actions@github.com")]:
+                            ("Renovate Bot", "bot@renovateapp.com"), ("GitHub Actions", "actions@github.com"),
+                            ("Copilot", "198982749+Copilot@users.noreply.github.com"), ("Cursor Agent", "cursoragent@cursor.com")]:
             self.assertTrue(identity.is_bot(name, email), (name, email))
 
     def test_people_are_not_bots(self):

{gitmole-0.6.7 → gitmole-0.6.9}/tests/test_leaks.py

@@ -66,6 +66,14 @@ class Placeholder(unittest.TestCase):
         for value in ["hello123", "secret-9f8a7b6c5d4e", "s3cr3t!Passw0rd", "foobarbaz2024"]:
             self.assertFalse(leaks.is_placeholder(value), "a word inside other material is not a placeholder: " + value)
 
+    def test_references_to_an_environment_variable_are_placeholders(self):
+        # fzf's notarisation config: `password = "@env:AC_PASSWORD"`; goreleaser: `{{.Env.MACOS_SIGN_PASSWORD}}`
+        for value in ["@env:AC_PASSWORD", "{{.Env.MACOS_SIGN_PASSWORD}}", "${DB_PASSWORD}", "$DB_PASSWORD", "$(cat ~/.secret)", "%APPDATA_KEY%",
+                      "{{ secrets.API_TOKEN }}", "<%= ENV['KEY'] %>", "process.env.API_KEY", "os.environ['API_KEY']", "os.environ.get('K')", "ENV['SECRET']"]:
+            self.assertTrue(leaks.is_placeholder(value), value)
+        for value in ["p@ssw0rd!", "AKIA" + "X" * 16, "env-9f8a7b6c5d4e3f2a", "${not closed", "hello$world"]:
+            self.assertFalse(leaks.is_placeholder(value), value)
+
     def test_anything_else_is_taken_seriously(self):
         # built at runtime: a literal in these shapes would trip secret scanners on this very file
         key_id, long_key = "AKIA" + "X" * 16, "6L" + "x" * 38

{gitmole-0.6.7 → gitmole-0.6.9}/tests/test_load.py

@@ -138,6 +138,19 @@ class ParseFunctions(unittest.TestCase):
     def test_empty(self):
         self.assertEqual(load.parse_functions(""), [])
 
+    def test_a_row_with_a_huge_long_name_does_not_abort_the_report(self):
+        # ruff: lizard wrote a long name of several hundred kilobytes for one function, over csv's default field limit
+        huge = "f( " + "a, " * 100_000 + ")"
+        rows = load.parse_functions(f'5,3,40,1,5,"f@1-5@a.rs","a.rs","f","{huge}",1,5\n')
+        self.assertEqual((rows[0]["function"], rows[0]["file"], rows[0]["ccn"]), ("f", "a.rs", 3))
+
+    def test_a_huge_function_name_is_cut_to_something_a_table_can_show(self):
+        # a test fixture of deeply nested functions gives lizard a dotted name of megabytes
+        name = ".".join("a" for _ in range(100_000))
+        rows = load.parse_functions(f'5,3,40,1,5,"{name}@1-5@a.py","a.py","{name}","{name}( )",1,5\n')
+        self.assertEqual(len(rows[0]["function"]), load.NAME_CAP)
+        self.assertTrue(rows[0]["function"].endswith("…"))
+
     def test_a_nameless_function_is_called_anonymous(self):
         # lizard names Go function literals with an empty string where it names JavaScript's "(anonymous)"
         rows = load.parse_functions('136,47,926,1,270,"@316-585@completions.go","completions.go",""," c * Command",316,585\n')