gitrupt 0.1.0__py3-none-any.whl

gitrupt/config.py

@@ -0,0 +1,269 @@
+"""
+Configuration management for Gitrupt.
+
+Reads .gitrupt.yml from the repository root and provides
+a validated, typed configuration object.
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+from typing import Any
+
+import yaml
+from pydantic import BaseModel, Field, field_validator, model_validator
+
+from gitrupt.models import PolicyAction, Severity
+
+logger = logging.getLogger(__name__)
+
+# Default configuration values
+DEFAULT_FORBIDDEN_PATHS: list[str] = [
+    ".env",
+    ".env.*",
+    "*.pem",
+    "*.key",
+    "*.p12",
+    "*.pfx",
+    "credentials.json",
+    "service-account.json",
+    "*.secret",
+]
+
+DEFAULT_FORBIDDEN_EXTENSIONS: list[str] = [
+    ".scr",
+]
+
+DEFAULT_ALLOW_PATHS: list[str] = [
+    ".env.example",
+]
+
+CONFIG_FILENAME = ".gitrupt.yml"
+
+
+class ScanConfig(BaseModel):
+    """Which scanners to run."""
+
+    secrets: bool = True
+    threats: bool = True
+    suspicious_code: bool = False
+    dependencies: bool = False
+
+    model_config = {"frozen": True}
+
+
+
+class EntropyConfig(BaseModel):
+    enabled: bool = True
+    threshold: float = Field(default=4.5, ge=0.0, le=8.0)
+    min_length: int = Field(default=20, ge=8)
+
+    model_config = {"frozen": True}
+
+
+
+
+class RulesConfig(BaseModel):
+    """File and path rules."""
+
+    forbidden_paths: list[str] = Field(default_factory=lambda: list(DEFAULT_FORBIDDEN_PATHS))
+    forbidden_extensions: list[str] = Field(
+        default_factory=lambda: list(DEFAULT_FORBIDDEN_EXTENSIONS)
+    )
+    max_file_size_mb: float = 50.0
+
+    model_config = {"frozen": True}
+
+
+class AllowConfig(BaseModel):
+    """Allowlisted paths that bypass rules."""
+
+    paths: list[str] = Field(default_factory=lambda: list(DEFAULT_ALLOW_PATHS))
+
+    model_config = {"frozen": True}
+
+
+class SuppressionConfig(BaseModel):
+    """Suppression and allowlist settings for findings."""
+
+    rules: list[str] = Field(default_factory=list)
+    files: list[str] = Field(default_factory=list)
+    paths: list[str] = Field(default_factory=list)
+
+    model_config = {"frozen": True}
+
+
+class PolicyConfig(BaseModel):
+    """Severity → action mapping."""
+
+    low: PolicyAction = PolicyAction.ALLOW
+    medium: PolicyAction = PolicyAction.WARN
+    high: PolicyAction = PolicyAction.BLOCK
+    critical: PolicyAction = PolicyAction.BLOCK
+
+    model_config = {"frozen": True}
+
+    def action_for(self, severity: Severity) -> PolicyAction:
+        return {
+            Severity.LOW: self.low,
+            Severity.MEDIUM: self.medium,
+            Severity.HIGH: self.high,
+            Severity.CRITICAL: self.critical,
+        }[severity]
+
+
+class SuspiciousCodeConfig(BaseModel):
+    """Tuning for the native suspicious-code scanner."""
+
+    min_confidence: float = Field(default=0.6, ge=0.0, le=1.0)
+    languages: list[str] = Field(
+        default_factory=lambda: [
+            "python",
+            "javascript",
+            "shell",
+            "powershell",
+            "php",
+            "ruby",
+            "go",
+        ]
+    )
+
+    model_config = {"frozen": True}
+
+
+
+
+
+class MalwareConfig(BaseModel):
+    """Tuning for the native malware scanner."""
+
+    use_yara: bool = True
+    max_file_size_mb: float = Field(default=50.0, gt=0.0)
+    custom_yara_dirs: list[str] = Field(default_factory=list)
+
+    model_config = {"frozen": True}
+
+
+
+
+class DependenciesConfig(BaseModel):
+    """Tuning for the native dependency scanner."""
+
+    ecosystems: list[str] = Field(default_factory=lambda: ["python", "node"])
+    offline: bool = False
+    timeout_seconds: float = Field(default=10.0, gt=0.0)
+    cache_ttl_hours: int = Field(default=24, ge=0)
+
+    model_config = {"frozen": True}
+
+class HooksConfig(BaseModel):
+    """Which Git hooks Gitrupt installs and honors."""
+
+    pre_commit: bool = True
+    pre_push: bool = True
+
+    model_config = {"frozen": True}
+
+
+
+
+class GitruptConfig(BaseModel):
+    """
+    Top-level Gitrupt configuration.
+
+    Read from .gitrupt.yml in the repository root.
+    Falls back to safe defaults if no file is present.
+    """
+
+    version: int = 1
+    mode: str = "strict"
+    scan: ScanConfig = Field(default_factory=ScanConfig)
+    rules: RulesConfig = Field(default_factory=RulesConfig)
+    allow: AllowConfig = Field(default_factory=AllowConfig)
+    suppressions: SuppressionConfig = Field(default_factory=SuppressionConfig)
+    suspicious_code: SuspiciousCodeConfig = Field(default_factory=SuspiciousCodeConfig)
+    malware: MalwareConfig = Field(default_factory=MalwareConfig)
+    dependencies: DependenciesConfig = Field(default_factory=DependenciesConfig)
+    hooks: HooksConfig = Field(default_factory=HooksConfig)
+    entropy: EntropyConfig = Field(default_factory=EntropyConfig)
+    policy: PolicyConfig = Field(default_factory=PolicyConfig)
+    model_config = {"frozen": True}
+
+    @field_validator("version")
+    @classmethod
+    def validate_version(cls, v: int) -> int:
+        if v != 1:
+            raise ValueError(f"Unsupported configuration version: {v}. Only version 1 is supported.")
+        return v
+
+    @field_validator("mode")
+    @classmethod
+    def validate_mode(cls, v: str) -> str:
+        valid_modes = {"strict", "permissive", "warn-only"}
+        if v not in valid_modes:
+            raise ValueError(f"Invalid mode '{v}'. Must be one of: {', '.join(valid_modes)}")
+        return v
+
+    @model_validator(mode="after")
+    def apply_mode_overrides(self) -> "GitruptConfig":
+        """In warn-only mode, override all blocking policies to warn."""
+        if self.mode == "warn-only":
+            object.__setattr__(
+                self,
+                "policy",
+                PolicyConfig(
+                    low=PolicyAction.ALLOW,
+                    medium=PolicyAction.WARN,
+                    high=PolicyAction.WARN,
+                    critical=PolicyAction.WARN,
+                ),
+            )
+        return self
+
+
+def load_config(repo_root: str | Path) -> GitruptConfig:
+    """
+    Load Gitrupt configuration from the repository root.
+
+    If no .gitrupt.yml exists, returns a safe default configuration.
+    If the file is malformed, raises a descriptive error.
+    """
+    config_path = Path(repo_root) / CONFIG_FILENAME
+
+    if not config_path.exists():
+        logger.debug("No .gitrupt.yml found, using defaults")
+        return GitruptConfig()
+
+    try:
+        with config_path.open("r", encoding="utf-8") as f:
+            raw: dict[str, Any] = yaml.safe_load(f) or {}
+    except yaml.YAMLError as e:
+        raise ConfigurationError(f"Invalid YAML in {config_path}: {e}") from e
+    except OSError as e:
+        raise ConfigurationError(f"Cannot read {config_path}: {e}") from e
+
+    try:
+        config = GitruptConfig.model_validate(raw)
+    except Exception as e:
+        raise ConfigurationError(f"Invalid configuration in {config_path}: {e}") from e
+
+    logger.debug("Loaded configuration from %s", config_path)
+    return config
+
+
+def find_config_path(start: str | Path) -> Path | None:
+    """Walk up from start looking for .gitrupt.yml."""
+    current = Path(start).resolve()
+    for directory in [current, *current.parents]:
+        candidate = directory / CONFIG_FILENAME
+        if candidate.exists():
+            return candidate
+        # Stop at filesystem root
+        if directory == directory.parent:
+            break
+    return None
+
+
+class ConfigurationError(Exception):
+    """Raised when the Gitrupt configuration is invalid."""