omerta 0.1.0__tar.gz

omerta-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sergii Shcherbak
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

omerta-0.1.0/PKG-INFO

@@ -0,0 +1,62 @@
+Metadata-Version: 2.4
+Name: omerta
+Version: 0.1.0
+Summary: Fail when a value of your env files, e.g. an API key in .env, is in git: staged, tracked, or anywhere in the history
+Keywords: secrets,env,dotenv,.env,git,pre-commit,leak,api-key,security,secret-scanning
+Author: Sergii Shcherbak
+Author-email: Sergii Shcherbak <sergii@shcherbak.ai>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Version Control :: Git
+Classifier: Environment :: Console
+Classifier: Typing :: Typed
+Requires-Dist: hyperscan==0.9.1
+Requires-Dist: python-dotenv==1.2.4
+Requires-Python: >=3.11
+Project-URL: Homepage, https://github.com/shcherbak-ai/omerta
+Project-URL: Repository, https://github.com/shcherbak-ai/omerta
+Project-URL: Issues, https://github.com/shcherbak-ai/omerta/issues
+Project-URL: Changelog, https://github.com/shcherbak-ai/omerta/blob/main/CHANGELOG.md
+Description-Content-Type: text/markdown
+
+# omerta
+
+Fail when a value of your env files, e.g. an API key in `.env`, is in git: in the staged changes, in a tracked file, or anywhere in the history.
+
+```bash
+uvx omerta check --all    # every tracked file
+uvx omerta history        # every commit, tag and message
+```
+
+- Matches your actual values, as written and as encoded in URLs, JSON and base64, so it catches secrets of any format; it complements pattern scanners, which find what looks like a key.
+- Reports the file, the line and the variable's name, never the value; a tracked env file is a leak in itself.
+- Runs entirely offline.
+
+As a pre-commit hook:
+
+```yaml
+repos:
+  - repo: https://github.com/shcherbak-ai/omerta
+    rev: v0.1.0
+    hooks:
+      - id: omerta
+```
+
+With Husky, Lefthook or a plain git hook: `uvx omerta@0.1.0 check`.
+
+See the [repository](https://github.com/shcherbak-ai/omerta#readme) for the options, CI and configuration.
+
+Licensed under [MIT](https://github.com/shcherbak-ai/omerta/blob/main/LICENSE).

omerta-0.1.0/PYPI.md

@@ -0,0 +1,28 @@
+# omerta
+
+Fail when a value of your env files, e.g. an API key in `.env`, is in git: in the staged changes, in a tracked file, or anywhere in the history.
+
+```bash
+uvx omerta check --all    # every tracked file
+uvx omerta history        # every commit, tag and message
+```
+
+- Matches your actual values, as written and as encoded in URLs, JSON and base64, so it catches secrets of any format; it complements pattern scanners, which find what looks like a key.
+- Reports the file, the line and the variable's name, never the value; a tracked env file is a leak in itself.
+- Runs entirely offline.
+
+As a pre-commit hook:
+
+```yaml
+repos:
+  - repo: https://github.com/shcherbak-ai/omerta
+    rev: v0.1.0
+    hooks:
+      - id: omerta
+```
+
+With Husky, Lefthook or a plain git hook: `uvx omerta@0.1.0 check`.
+
+See the [repository](https://github.com/shcherbak-ai/omerta#readme) for the options, CI and configuration.
+
+Licensed under [MIT](https://github.com/shcherbak-ai/omerta/blob/main/LICENSE).

omerta-0.1.0/pyproject.toml

@@ -0,0 +1,193 @@
+[project]
+name = "omerta"
+version = "0.1.0"
+description = "Fail when a value of your env files, e.g. an API key in .env, is in git: staged, tracked, or anywhere in the history"
+readme = "PYPI.md"
+requires-python = ">=3.11"
+license = "MIT"
+license-files = ["LICENSE"]
+keywords = [
+    "secrets",
+    "env",
+    "dotenv",
+    ".env",
+    "git",
+    "pre-commit",
+    "leak",
+    "api-key",
+    "security",
+    "secret-scanning",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: 3.15",
+    "Operating System :: POSIX :: Linux",
+    "Operating System :: MacOS",
+    "Operating System :: Microsoft :: Windows",
+    "Topic :: Security",
+    "Topic :: Software Development :: Quality Assurance",
+    "Topic :: Software Development :: Version Control :: Git",
+    "Environment :: Console",
+    "Typing :: Typed",
+]
+dependencies = [
+    "hyperscan==0.9.1",
+    "python-dotenv==1.2.4",
+]
+
+[[project.authors]]
+name = "Sergii Shcherbak"
+email = "sergii@shcherbak.ai"
+
+[project.urls]
+Homepage = "https://github.com/shcherbak-ai/omerta"
+Repository = "https://github.com/shcherbak-ai/omerta"
+Issues = "https://github.com/shcherbak-ai/omerta/issues"
+Changelog = "https://github.com/shcherbak-ai/omerta/blob/main/CHANGELOG.md"
+
+[project.scripts]
+omerta = "omerta.cli:main"
+
+[dependency-groups]
+dev = [
+    "pytest>=8.0",
+    "pytest-cov>=6.0",
+    "pytest-xdist>=3.6",
+    "coverage[toml]>=7.0",
+    "tethered>=1.0.0",
+    "pre-commit>=4.0",
+    "pre-commit-hooks>=6.0",
+    "ruff>=0.9",
+    "bandit>=1.8",
+    "ty>=0.0.33",
+    "interrogate>=1.7",
+    "vulture>=2.16",
+    "deptry>=0.25.1",
+    "commitizen>=4.13",
+    "invoke>=2.2",
+    "licenseal>=1.0.1",
+]
+
+[tool.uv]
+exclude-newer = "7 days"
+
+[tool.uv.exclude-newer-package]
+certifi = "2026-10-20T02:25:00Z"
+virtualenv = "2026-10-22T20:11:00Z"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+filterwarnings = ["error"]
+
+[tool.coverage.run]
+source = ["omerta"]
+branch = true
+
+[tool.coverage.report]
+show_missing = true
+fail_under = 100
+exclude_lines = [
+    "pragma: no cover",
+    "if TYPE_CHECKING:",
+    "if __name__",
+]
+
+[tool.coverage.paths]
+source = ["src"]
+
+[tool.ruff]
+target-version = "py311"
+line-length = 100
+src = [
+    "src",
+    "tests",
+]
+
+[tool.ruff.lint]
+select = [
+    "E",
+    "W",
+    "F",
+    "I",
+    "N",
+    "UP",
+    "B",
+    "S",
+    "T20",
+    "SIM",
+    "FA",
+]
+ignore = ["S101"]
+
+[tool.ruff.lint.isort]
+required-imports = ["from __future__ import annotations"]
+known-first-party = ["omerta"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**/*.py" = [
+    "S",
+    "T20",
+]
+"scripts/**/*.py" = ["T20"]
+"tasks.py" = ["T20"]
+
+[tool.ty.src]
+include = ["src"]
+exclude = ["tests"]
+
+[tool.deptry]
+known_first_party = ["omerta"]
+
+[tool.deptry.per_rule_ignores]
+DEP004 = ["invoke"]
+
+[tool.bandit]
+exclude_dirs = ["tests"]
+skips = ["B101"]
+
+[tool.vulture]
+paths = ["src"]
+min_confidence = 60
+ignore_names = ["main"]
+
+[tool.interrogate]
+ignore-init-method = true
+ignore-init-module = true
+ignore-magic = true
+ignore-private = true
+ignore-semiprivate = true
+fail-under = 100
+exclude = [
+    "tests",
+    "node_modules",
+]
+
+[tool.commitizen]
+name = "cz_conventional_commits"
+version = "0.1.0"
+version_files = [
+    "src/omerta/__init__.py:__version__",
+    "pyproject.toml:^version",
+    "CITATION.cff:^version:",
+    "README.md:omerta@|rev: v",
+    "PYPI.md:omerta@|rev: v",
+]
+tag_format = "v$version"
+annotated_tag = true
+major_version_zero = true
+pre_bump_hooks = [
+    "uv lock --no-upgrade",
+    "git add uv.lock",
+    "uv run python scripts/date_release.py",
+    "uv run pytest tests/test_changelog.py -q -p no:cacheprovider",
+]
+
+[build-system]
+requires = ["uv_build>=0.13.0,<0.14"]
+build-backend = "uv_build"

omerta-0.1.0/pyproject.toml.orig

@@ -0,0 +1,202 @@
+[project]
+name = "omerta"
+version = "0.1.0"
+description = "Fail when a value of your env files, e.g. an API key in .env, is in git: staged, tracked, or anywhere in the history"
+readme = "PYPI.md"
+authors = [
+    { name = "Sergii Shcherbak", email = "sergii@shcherbak.ai" }
+]
+requires-python = ">=3.11"
+license = "MIT"
+license-files = ["LICENSE"]
+keywords = ["secrets", "env", "dotenv", ".env", "git", "pre-commit", "leak", "api-key", "security", "secret-scanning"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: 3.15",
+    "Operating System :: POSIX :: Linux",
+    "Operating System :: MacOS",
+    "Operating System :: Microsoft :: Windows",
+    "Topic :: Security",
+    "Topic :: Software Development :: Quality Assurance",
+    "Topic :: Software Development :: Version Control :: Git",
+    "Environment :: Console",
+    "Typing :: Typed",
+]
+# Pinned exactly, as uv.lock has them, which `uv lock --check` holds: both see
+# the values of the env files in cleartext, and pre-commit and uvx install from
+# these requirements, not from uv.lock. A release of either reaches users only
+# through a release of omerta, after the cooldown and the advisories check.
+dependencies = [
+    # Every form of every value is searched for in one pass over each blob, as
+    # literals of one Hyperscan database. Its wheels cover every platform but
+    # Windows on ARM.
+    "hyperscan==0.9.1",
+    # Findings depend on its parser: 1.2.4 parses `KEY= # comment` as empty,
+    # and 1.2.3 stopped a quoted value ending in an escaped backslash from
+    # swallowing the next lines.
+    "python-dotenv==1.2.4",
+]
+
+[project.urls]
+Homepage = "https://github.com/shcherbak-ai/omerta"
+Repository = "https://github.com/shcherbak-ai/omerta"
+Issues = "https://github.com/shcherbak-ai/omerta/issues"
+Changelog = "https://github.com/shcherbak-ai/omerta/blob/main/CHANGELOG.md"
+
+[project.scripts]
+omerta = "omerta.cli:main"
+
+[dependency-groups]
+dev = [
+    "pytest>=8.0",
+    "pytest-cov>=6.0",
+    "pytest-xdist>=3.6",
+    "coverage[toml]>=7.0",
+    "tethered>=1.0.0",
+    "pre-commit>=4.0",
+    "pre-commit-hooks>=6.0",
+    "ruff>=0.9",
+    "bandit>=1.8",
+    "ty>=0.0.33",
+    "interrogate>=1.7",
+    "vulture>=2.16",
+    "deptry>=0.25.1",
+    "commitizen>=4.13",
+    "invoke>=2.2",
+    "licenseal>=1.0.1",
+]
+
+[tool.uv]
+# A release enters uv.lock only a week after its upload, when a compromised one
+# has been found and removed.
+exclude-newer = "7 days"
+
+# Security fixes taken inside the cooldown, up to their uploads: the advisories
+# hook says when an entry is no longer needed.
+[tool.uv.exclude-newer-package]
+# 2026.10.19 drops the root CAs whose intermediate keys were compromised
+# (GHSA-6q48-6c7w-9gw2)
+certifi = "2026-10-20T02:25:00Z"
+# 21.14.13 escapes the --prompt value in the Bash activator (GHSA-cx6f-vjhg-g3cc)
+virtualenv = "2026-10-22T20:11:00Z"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+filterwarnings = ["error"]
+
+[tool.coverage.run]
+source = ["omerta"]
+branch = true
+
+[tool.coverage.report]
+show_missing = true
+fail_under = 100
+exclude_lines = [
+    "pragma: no cover",
+    "if TYPE_CHECKING:",
+    "if __name__",
+]
+
+[tool.coverage.paths]
+source = ["src"]
+
+[tool.ruff]
+target-version = "py311"
+line-length = 100
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = [
+    "E",      # pycodestyle errors
+    "W",      # pycodestyle warnings
+    "F",      # pyflakes
+    "I",      # isort
+    "N",      # pep8-naming
+    "UP",     # pyupgrade
+    "B",      # flake8-bugbear
+    "S",      # flake8-bandit
+    "T20",    # flake8-print
+    "SIM",    # flake8-simplify
+    "FA",     # flake8-future-annotations (FA100: require from __future__ import annotations)
+]
+ignore = [
+    "S101",   # assert used (fine in tests)
+]
+
+[tool.ruff.lint.isort]
+required-imports = ["from __future__ import annotations"]
+known-first-party = ["omerta"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**/*.py" = ["S", "T20"]
+"scripts/**/*.py" = ["T20"]
+"tasks.py" = ["T20"]
+
+[tool.ty.src]
+include = ["src"]
+exclude = ["tests"]
+
+[tool.deptry]
+known_first_party = ["omerta"]
+
+[tool.deptry.per_rule_ignores]
+DEP004 = [
+    "invoke",  # tasks.py, the development tasks
+]
+
+[tool.bandit]
+exclude_dirs = ["tests"]
+skips = ["B101"]
+
+[tool.vulture]
+paths = ["src"]
+min_confidence = 60
+# The command's entry point, which the console script calls.
+ignore_names = ["main"]
+
+[tool.interrogate]
+ignore-init-method = true
+ignore-init-module = true
+ignore-magic = true
+ignore-private = true
+ignore-semiprivate = true
+fail-under = 100
+exclude = ["tests", "node_modules"]
+
+[tool.commitizen]
+name = "cz_conventional_commits"
+version = "0.1.0"
+# Commitizen replaces the version on each line that the pattern after the colon
+# finds: anchored, so that `cff-version: 1.2.0` (the format of CITATION.cff)
+# keeps its own. The README and the package description pin a release in their
+# examples (`omerta@X.Y.Z`, `rev: vX.Y.Z`), which a bump moves too.
+version_files = [
+    "src/omerta/__init__.py:__version__",
+    "pyproject.toml:^version",
+    "CITATION.cff:^version:",
+    "README.md:omerta@|rev: v",
+    "PYPI.md:omerta@|rev: v",
+]
+tag_format = "v$version"
+annotated_tag = true
+major_version_zero = true
+# The hooks run after the version fields are rewritten and before the commit,
+# which takes in every changed file (`git commit -a`). scripts/date_release.py
+# names the `## [Unreleased]` section of the changelog after the new version,
+# with the day, and writes the day into CITATION.cff; the last hook checks both.
+pre_bump_hooks = [
+    "uv lock --no-upgrade",
+    "git add uv.lock",
+    "uv run python scripts/date_release.py",
+    "uv run pytest tests/test_changelog.py -q -p no:cacheprovider",
+]
+
+[build-system]
+requires = ["uv_build>=0.13.0,<0.14"]
+build-backend = "uv_build"

omerta-0.1.0/src/omerta/__init__.py

@@ -0,0 +1,5 @@
+"""Fail when a value of your env files is in git."""
+
+from __future__ import annotations
+
+__version__ = "0.1.0"

omerta-0.1.0/src/omerta/check.py

@@ -0,0 +1,125 @@
+"""``omerta check``: the index content of the staged changes, of given paths, or of every entry."""
+
+from __future__ import annotations
+
+import os
+
+from omerta.errors import OmertaError
+from omerta.git import GITLINK, Entry, Git
+from omerta.output import Finding
+from omerta.patterns import Pattern, is_env_file
+from omerta.search import Matcher, Target, line_of
+
+
+def select(git: Git, index: list[Entry], paths: list[str], everything: bool) -> list[Entry]:
+    """The index entries that ``check`` searches.
+
+    A PATH selects the entry at that path, or with a folder the entries under
+    it, matched exactly, as literal pathspecs are. The paths are matched here,
+    not given to git, so that none goes on git's command line.
+
+    Args:
+        git: git, in the repository.
+        index: Every index entry.
+        paths: The PATH arguments, relative to the folder omerta runs in.
+        everything: ``--all``: every entry.
+
+    Raises:
+        OmertaError: A path is outside the repository.
+    """
+    if everything:
+        return index
+    if paths:
+        selected = [_from_root(git, path) for path in paths]
+        return [
+            entry
+            for entry in index
+            if any(
+                not chosen or entry.path == chosen or entry.path.startswith(chosen + b"/")
+                for chosen in selected
+            )
+        ]
+    staged = git.staged_paths()
+    return [entry for entry in index if entry.path in staged]
+
+
+def _from_root(git: Git, path: str) -> bytes:
+    """A PATH argument as an index path: from the root, with ``/``; empty for the root."""
+    full = os.path.abspath(os.path.join(git.folder, path))
+    try:
+        relative = os.path.relpath(full, os.path.abspath(git.top))
+    except ValueError:  # on another drive
+        relative = os.pardir
+    if relative == os.pardir or relative.startswith(os.pardir + os.sep):
+        raise OmertaError(f"{path} is outside the repository")
+    return b"" if relative == os.curdir else os.fsencode(relative.replace(os.sep, "/"))
+
+
+def run(
+    git: Git,
+    entries: list[Entry],
+    targets: list[Target],
+    patterns: tuple[Pattern, ...],
+    findings: list[Finding],
+) -> None:
+    """Search the entries, adding what is found to ``findings``.
+
+    An entry that matches the patterns is a tracked env file, and a path that
+    holds a value is a finding of its own. A gitlink (a submodule) has no
+    content to search. An unmerged entry is searched in each of its stages,
+    and a value is reported at its first occurrence in the lowest stage that
+    holds it.
+
+    Raises:
+        OmertaError: An entry's object cannot be read.
+    """
+    matcher = Matcher(targets)
+    for path in sorted({entry.path for entry in entries}):
+        for index, hit in matcher.search(path).items():
+            findings.append(_found(targets[index], hit.form, path=path, in_path=True))
+    entries = sorted(
+        (entry for entry in entries if entry.mode != GITLINK),
+        key=lambda entry: (entry.path, entry.stage),
+    )
+    tracked: set[bytes] = set()
+    for entry in entries:
+        if entry.path not in tracked and is_env_file(entry.path, patterns):
+            tracked.add(entry.path)
+            findings.append(Finding(path=entry.path))
+    if not targets:
+        return
+    by_oid: dict[str, list[Entry]] = {}
+    for entry in entries:
+        by_oid.setdefault(entry.oid, []).append(entry)
+    found: dict[tuple[bytes, int], tuple[int, Finding]] = {}
+    try:
+        for oid, _, data in git.objects(list(by_oid)):
+            hits = matcher.search(data)
+            for entry in by_oid[oid]:
+                for index, hit in hits.items():
+                    key = (entry.path, index)
+                    if key in found and found[key][0] <= entry.stage:
+                        continue
+                    line = line_of(data, hit.position)
+                    found[key] = (
+                        entry.stage,
+                        _found(targets[index], hit.form, path=entry.path, line=line),
+                    )
+    finally:
+        # What was found before an error is reported with it.
+        findings.extend(finding for _, finding in found.values())
+
+
+def _found(
+    target: Target, form: str, *, path: bytes, line: int | None = None, in_path: bool = False
+) -> Finding:
+    """A finding of a target in an entry: in its content at a line, or in its path."""
+    return Finding(
+        path=path,
+        line=line,
+        in_path=in_path,
+        variable=target.variable,
+        env_file=target.env_file,
+        env_order=target.env_order,
+        form=form,
+    )