open-code-review-toolkit 0.2.1__tar.gz → 0.3.0__tar.gz

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: open-code-review-toolkit
-Version: 0.2.1
+Version: 0.3.0
 Summary: Unofficial GitLab CI integration layer for Open Code Review
 Project-URL: Homepage, https://github.com/xeonvs/open-code-review-toolkit
 Project-URL: Repository, https://github.com/xeonvs/open-code-review-toolkit
@@ -244,6 +244,7 @@ ocr-ci --help
 ```
 
 The current compatibility target is OCR `1.7.17`. CI should pin the release and verify its published checksum before execution.
+The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. Set `OCR_REVIEW_LANGUAGE=Russian` to use Russian consistently in both OCR configuration and generated review context.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.0}/README.md

@@ -16,6 +16,7 @@ ocr-ci --help
 ```
 
 The current compatibility target is OCR `1.7.17`. CI should pin the release and verify its published checksum before execution.
+The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. Set `OCR_REVIEW_LANGUAGE=Russian` to use Russian consistently in both OCR configuration and generated review context.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.0}/pyproject.toml

@@ -38,6 +38,7 @@ ocr-ci = "ocr_toolkit.cli:main"
 
 [dependency-groups]
 dev = [
+  "bandit==1.9.4",
   "build>=1.2.2",
   "coverage[toml]>=7.6",
   "hatch-vcs>=0.4",
@@ -60,19 +61,7 @@ version-file = "src/ocr_toolkit/_version.py"
 packages = ["src/ocr_toolkit"]
 
 [tool.hatch.build.targets.sdist]
-include = [
-  "/src",
-  "/tests",
-  "/examples",
-  "/docs",
-  "/changelog.d",
-  "/README.md",
-  "/CONTRIBUTING.md",
-  "/SECURITY.md",
-  "/LICENSE",
-  "/CHANGELOG.md",
-  "/pyproject.toml",
-]
+only-include = ["src", "README.md", "LICENSE", "pyproject.toml"]
 
 [tool.hatch.version.raw-options]
 fallback_version = "0.3.0.dev0"
@@ -101,6 +90,11 @@ exclude = ["src/ocr_toolkit/_version.py"]
 warn_unreachable = false
 disable_error_code = ["arg-type", "assignment", "import-not-found", "index", "name-defined", "no-any-return", "no-redef", "union-attr", "unused-ignore", "var-annotated"]
 
+[tool.bandit]
+exclude_dirs = ["tests"]
+severity = "medium"
+confidence = "medium"
+
 [tool.pytest.ini_options]
 addopts = "--strict-config --strict-markers"
 testpaths = ["tests"]

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.0}/src/ocr_toolkit/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.2.1'
-__version_tuple__ = version_tuple = (0, 2, 1)
+__version__ = version = '0.3.0'
+__version_tuple__ = version_tuple = (0, 3, 0)
 
 __commit_id__ = commit_id = None

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.0}/src/ocr_toolkit/cli.py

@@ -33,9 +33,17 @@ def build_parser() -> argparse.ArgumentParser:
 
     post_parser = subparsers.add_parser("post", help="Publish an OCR result artifact to GitLab.")
     post_parser.add_argument(
-        "--result", default="/tmp/ocr-result.json", help="OCR JSON result path."
+        # The public GitLab example writes this fixed path inside an isolated CI job.
+        "--result",
+        default="/tmp/ocr-result.json",  # nosec B108
+        help="OCR JSON result path.",
+    )
+    post_parser.add_argument(
+        # The file contains only the current job's OCR stderr and is never shared.
+        "--stderr",
+        default="/tmp/ocr-stderr.log",  # nosec B108
+        help="OCR stderr log path.",
     )
-    post_parser.add_argument("--stderr", default="/tmp/ocr-stderr.log", help="OCR stderr log path.")
     return parser
 
 

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.0}/src/ocr_toolkit/context/manifests.py

@@ -196,9 +196,9 @@ def parse_pyproject(path: Path) -> dict[str, Any]:
 
     try:
         try:
-            import tomllib
+            import tomllib  # type: ignore[import-untyped]
         except ModuleNotFoundError:
-            import tomli as tomllib  # type: ignore[import-not-found]
+            import tomli as tomllib
 
         data = tomllib.loads(text)
     except ModuleNotFoundError:
@@ -209,9 +209,12 @@ def parse_pyproject(path: Path) -> dict[str, Any]:
     if not isinstance(data, dict):
         return {"present": True, "parse_error": JSON_OBJECT_PARSE_ERROR}
 
-    project = data.get("project") if isinstance(data.get("project"), dict) else {}
-    tool = data.get("tool") if isinstance(data.get("tool"), dict) else {}
-    poetry = tool.get("poetry") if isinstance(tool.get("poetry"), dict) else {}
+    raw_project = data.get("project")
+    raw_tool = data.get("tool")
+    project: dict[Any, Any] = raw_project if isinstance(raw_project, dict) else {}
+    tool: dict[Any, Any] = raw_tool if isinstance(raw_tool, dict) else {}
+    raw_poetry = tool.get("poetry")
+    poetry: dict[Any, Any] = raw_poetry if isinstance(raw_poetry, dict) else {}
 
     dependencies: list[str] = []
     if isinstance(project.get("dependencies"), list):
@@ -233,12 +236,14 @@ def parse_pyproject(path: Path) -> dict[str, Any]:
                     f"group.{group_name}: {redact_url_userinfo(str(dep))}" for dep in group_deps
                 )
 
-    poetry_deps = poetry.get("dependencies") if isinstance(poetry.get("dependencies"), dict) else {}
+    raw_poetry_deps = poetry.get("dependencies")
+    poetry_deps: dict[Any, Any] = raw_poetry_deps if isinstance(raw_poetry_deps, dict) else {}
     for name, version in poetry_deps.items():
         if str(name).lower() != "python":
             dependencies.append(f"{name}: {redact_url_userinfo(str(version))}")
 
-    poetry_groups = poetry.get("group") if isinstance(poetry.get("group"), dict) else {}
+    raw_poetry_groups = poetry.get("group")
+    poetry_groups: dict[Any, Any] = raw_poetry_groups if isinstance(raw_poetry_groups, dict) else {}
     for group_name, group_value in poetry_groups.items():
         if not isinstance(group_value, dict):
             continue
@@ -354,10 +359,14 @@ def parse_composer_json(path: Path) -> dict[str, Any]:
     if not isinstance(data, dict):
         return {"present": True, "parse_error": JSON_OBJECT_PARSE_ERROR}
 
-    require = data.get("require") if isinstance(data.get("require"), dict) else {}
-    require_dev = data.get("require-dev") if isinstance(data.get("require-dev"), dict) else {}
-    config = data.get("config") if isinstance(data.get("config"), dict) else {}
-    platform = config.get("platform") if isinstance(config.get("platform"), dict) else {}
+    raw_require = data.get("require")
+    raw_require_dev = data.get("require-dev")
+    raw_config = data.get("config")
+    require: dict[Any, Any] = raw_require if isinstance(raw_require, dict) else {}
+    require_dev: dict[Any, Any] = raw_require_dev if isinstance(raw_require_dev, dict) else {}
+    config: dict[Any, Any] = raw_config if isinstance(raw_config, dict) else {}
+    raw_platform = config.get("platform")
+    platform: dict[Any, Any] = raw_platform if isinstance(raw_platform, dict) else {}
 
     platform_items, platform_omitted = limited_manifest_items(
         [f"{name}: {version}" for name, version in platform.items()]
@@ -433,10 +442,13 @@ def parse_package_json(path: Path) -> dict[str, Any]:
     if not isinstance(data, dict):
         return {"present": True, "parse_error": JSON_OBJECT_PARSE_ERROR}
 
-    engines = data.get("engines") if isinstance(data.get("engines"), dict) else {}
-    dependencies = data.get("dependencies") if isinstance(data.get("dependencies"), dict) else {}
-    dev_dependencies = (
-        data.get("devDependencies") if isinstance(data.get("devDependencies"), dict) else {}
+    raw_engines = data.get("engines")
+    raw_dependencies = data.get("dependencies")
+    raw_dev_dependencies = data.get("devDependencies")
+    engines: dict[Any, Any] = raw_engines if isinstance(raw_engines, dict) else {}
+    dependencies: dict[Any, Any] = raw_dependencies if isinstance(raw_dependencies, dict) else {}
+    dev_dependencies: dict[Any, Any] = (
+        raw_dev_dependencies if isinstance(raw_dev_dependencies, dict) else {}
     )
 
     engines_items, engines_omitted = limited_manifest_items(

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.0}/src/ocr_toolkit/context/repo.py

@@ -162,11 +162,13 @@ def resolve_output_path(value: str) -> Path | None:
     requested = Path(value)
     logical_output = requested if requested.is_absolute() else root_lexical / requested
     logical_output = logical_output.absolute()
-    temp_lexical = Path(tempfile.gettempdir()).absolute()
+    # tempfile supplies the platform temp root; containment and symlink checks follow.
+    temp_lexical = Path(tempfile.gettempdir()).absolute()  # nosec B108
     allowed_roots = [(root_lexical, root), (root, root)]
     temp_resolved = temp_lexical.resolve()
     allowed_roots.extend([(temp_lexical, temp_resolved), (temp_resolved, temp_resolved)])
-    tmp_path = Path("/tmp")
+    # POSIX /tmp may be a distinct lexical alias (for example, /private/tmp).
+    tmp_path = Path("/tmp")  # nosec B108
     if tmp_path.exists():
         tmp_lexical = tmp_path.absolute()
         tmp_resolved = tmp_path.resolve()

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.0}/src/ocr_toolkit/posting/gitlab.py

@@ -125,7 +125,7 @@ def _open_gitlab_request(request: urllib.request.Request) -> Any:
 def _read_limited_response(response: Any) -> bytes:
     """Read a GitLab response body and fail when it exceeds the success budget."""
 
-    body = response.read(MAX_API_RESPONSE_BODY_BYTES)
+    body: bytes = response.read(MAX_API_RESPONSE_BODY_BYTES)
     if len(body) >= MAX_API_RESPONSE_BODY_BYTES and response.read(1):
         raise GitLabResponseTooLarge(f"GitLab response exceeds {MAX_API_RESPONSE_BODY_BYTES} bytes")
     return body
@@ -323,11 +323,13 @@ def fetch_current_user_id(server_url: str, api_token: str, auth_header: str) ->
         return None
 
     raw_user_id = result.get("id")
-    try:
-        return int(raw_user_id)
-    except (TypeError, ValueError):
-        print_user_id_failure_banner("GET /user response has no valid id field")
-        return None
+    if isinstance(raw_user_id, (str, int, float)) and not isinstance(raw_user_id, bool):
+        try:
+            return int(raw_user_id)
+        except ValueError:
+            pass
+    print_user_id_failure_banner("GET /user response has no valid id field")
+    return None
 
 
 def load_gitlab_config() -> GitLabConfig | None:
@@ -481,10 +483,12 @@ def draft_note_id(value: Any) -> int | None:
     if isinstance(raw_id, bool):
         return None
 
-    try:
-        return int(raw_id)
-    except (TypeError, ValueError):
-        return None
+    if isinstance(raw_id, (str, int, float)) and not isinstance(raw_id, bool):
+        try:
+            return int(raw_id)
+        except ValueError:
+            pass
+    return None
 
 
 def created_draft_note(response: Any, context: str) -> DraftNoteCreation | None:

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.0}/src/ocr_toolkit/posting/markers.py

@@ -240,10 +240,12 @@ def author_id_from_note(note: dict[str, Any]) -> int | None:
         if isinstance(author, dict):
             raw_author_id = author.get("id")
 
-    try:
-        return int(raw_author_id)
-    except (TypeError, ValueError):
-        return None
+    if isinstance(raw_author_id, (str, int, float)) and not isinstance(raw_author_id, bool):
+        try:
+            return int(raw_author_id)
+        except ValueError:
+            pass
+    return None
 
 
 def is_diff_note(note: dict[str, Any]) -> bool:

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.0}/src/ocr_toolkit/posting/workflow.py

@@ -131,7 +131,7 @@ def changed_new_lines(
             timeout=15,
         )
     except (OSError, subprocess.SubprocessError):
-        lines = set()
+        lines: set[int] = set()
         if cache is not None:
             cache[cache_key] = lines
         return lines
@@ -217,7 +217,7 @@ def head_file_lines(
             size_result.returncode != 0
             or int(size_result.stdout.strip() or "0") > MAX_REMAP_FILE_BYTES
         ):
-            lines = []
+            lines: list[tuple[int, str]] = []
             if cache is not None:
                 cache[cache_key] = lines
             return lines
@@ -827,8 +827,9 @@ def main(argv: list[str] | None = None) -> int:
     """CLI entrypoint."""
 
     args = argv if argv is not None else sys.argv[1:]
-    result_path = Path(args[0]) if len(args) >= 1 else Path("/tmp/ocr-result.json")
-    stderr_path = Path(args[1]) if len(args) >= 2 else Path("/tmp/ocr-stderr.log")
+    # Defaults are per-job files in the isolated CI container; callers can override both.
+    result_path = Path(args[0]) if len(args) >= 1 else Path("/tmp/ocr-result.json")  # nosec B108
+    stderr_path = Path(args[1]) if len(args) >= 2 else Path("/tmp/ocr-stderr.log")  # nosec B108
 
     config = load_gitlab_config()
     if config is None:

open_code_review_toolkit-0.2.1/CHANGELOG.md

@@ -1,61 +0,0 @@
-## 0.2.1 - 2026-07-27
-
-### Features
-
-- Target Open Code Review 1.7.17 in preflight validation and the checksum-pinned GitLab CI example. ([#12](https://github.com/xeonvs/open-code-review-toolkit/issues/12))
-
-### Documentation
-
-- Document the durable toolkit strategy, milestone roadmap, and reconciled implementation backlog. ([#13](https://github.com/xeonvs/open-code-review-toolkit/issues/13))
-
-
-## 0.2.0 - 2026-07-21
-
-### Features
-
-- Target Open Code Review 1.7.14 in preflight validation and the checksum-pinned GitLab CI example. ([#11](https://github.com/xeonvs/open-code-review-toolkit/issues/11))
-- Replace the ambiguous `/ocr keep` and `/ocr skip` discussion replies with `/ocr resolve` and `/ocr suppress`, preserve human-owned deduplication, and document the complete GitLab review lifecycle for developers and CI operators. ([#8](https://github.com/xeonvs/open-code-review-toolkit/issues/8))
-
-### Bug fixes
-
-- Allow stable release verification to coexist with previously published development builds of the same base version on TestPyPI. ([#10](https://github.com/xeonvs/open-code-review-toolkit/issues/10))
-- Treat ordinary merged pull requests as a successful no-op in the production release workflow while keeping release-branch authorization fail-closed. ([#7](https://github.com/xeonvs/open-code-review-toolkit/issues/7))
-
-### Security
-
-- Mark every source-distribution smoke install as hash-required while retaining the no-dependency boundary, and document the single-maintainer security posture and Scorecard triage policy. ([#6](https://github.com/xeonvs/open-code-review-toolkit/issues/6))
-
-### Documentation
-
-- Reduce the routine Ubuntu CI matrix to the supported Python 3.10 and 3.14 endpoints, matching the macOS matrix. ([#10](https://github.com/xeonvs/open-code-review-toolkit/issues/10))
-- Document accepted project decisions, their optional `ocr-accept` marker convention, and the guard that prevents a merge request from whitelisting its own findings. ([#11](https://github.com/xeonvs/open-code-review-toolkit/issues/11))
-
-
-## 0.1.0 - 2026-07-20
-
-### Features
-
-- Publish one deterministic, checksum-verified TestPyPI development build after every merge into `main`, with bounded registry downloads and idempotent reruns. ([#4](https://github.com/xeonvs/open-code-review-toolkit/pull/4))
-- Target Open Code Review 1.7.13 in preflight validation and the pinned GitLab CI example. ([#4](https://github.com/xeonvs/open-code-review-toolkit/pull/4))
-- Support and continuously test Python 3.14 while retaining Python 3.10-3.13 compatibility. ([#4](https://github.com/xeonvs/open-code-review-toolkit/pull/4))
-- Publish reproducible 0.1.0 distributions to TestPyPI and PyPI with exact hash verification, provenance attestations, and immutable GitHub Release assets.
-- Introduce the standalone `ocr-ci` toolkit with safe context generation, GitLab posting, runtime configuration, MCP configuration, and preflight checks.
-
-### Bug fixes
-
-- Bind production release smoke tests to the exact reviewed wheel and sdist hashes, with bounded HTTPS downloads from TestPyPI and PyPI. ([#4](https://github.com/xeonvs/open-code-review-toolkit/pull/4))
-- Use `OCR_REVIEW_LANGUAGE` as the single safe language setting for OCR configuration and generated review context, with English as the default and Russian as an explicit option. ([#4](https://github.com/xeonvs/open-code-review-toolkit/pull/4))
-- Preserve bounded context and version discovery with a 7,950-character ceiling, improve provider billing classification, and prevent cross-file remapping of findings that already name a path. ([#3](https://github.com/xeonvs/open-code-review-toolkit/pull/3))
-
-### Security
-
-- Require secure credential endpoints, block unsafe GitLab redirects, redact secret-shaped environment values, and reduce GitHub Actions credential persistence and permissions. ([#3](https://github.com/xeonvs/open-code-review-toolkit/pull/3))
-
-### Documentation
-
-- Document the checksum-verified TestPyPI prerelease path used before the public stable release. ([#2](https://github.com/xeonvs/open-code-review-toolkit/pull/2))
-
-
-# Changelog
-
-Changes for each release are assembled from `changelog.d/` by Towncrier.

open_code_review_toolkit-0.2.1/CONTRIBUTING.md

@@ -1,14 +0,0 @@
-# Contributing
-
-Thank you for improving Open Code Review Toolkit. Keep changes focused, add regression tests for behavior changes, and use synthetic examples only.
-
-1. Create a branch from `main`.
-2. Install the locked development environment with `uv sync --frozen`.
-3. Update `PLANS.md` for substantial work.
-4. Add a Towncrier fragment for user-visible changes.
-5. Run the checks in [docs/development.md](docs/development.md).
-6. Open a pull request; protected `main` accepts changes only through green pull requests.
-
-Every non-release merge publishes a `0.2.0.devN` development build to TestPyPI. Stable releases use a repository-owned `release/vX.Y.Z` branch and an exact `Release vX.Y.Z` pull-request title; merging that reviewed PR authorizes the automated TestPyPI, PyPI, and GitHub Release chain.
-
-Do not include real credentials, provider payloads, internal hosts, or private repository details. Security reports should follow [SECURITY.md](SECURITY.md), not public issues.

open_code_review_toolkit-0.2.1/SECURITY.md

@@ -1,13 +0,0 @@
-# Security Policy
-
-## Supported versions
-
-Before 1.0, only the newest published release receives security fixes.
-
-## Reporting a vulnerability
-
-Use [GitHub private vulnerability reporting](https://github.com/xeonvs/open-code-review-toolkit/security/advisories/new) for this repository. Do not open a public issue or attach live credentials, proprietary source, or production provider responses. Include a minimal synthetic reproducer, impact, affected version, and suggested mitigation when available.
-
-Maintainers will acknowledge a report within five business days, privately validate severity and affected versions, and coordinate disclosure only after a fix or documented mitigation is available. Critical fixes are released as soon as practical; reporters receive status updates at least every ten business days while investigation remains open.
-
-The runtime trust model and deployment guidance are documented in [docs/security.md](docs/security.md).

open_code_review_toolkit-0.2.1/changelog.d/README.md

@@ -1,3 +0,0 @@
-# Changelog fragments
-
-Every user-visible 0.x change needs one fragment named `<issue>.<type>.md`, where type is `feature`, `bugfix`, `security`, or `doc`. Use a numeric GitHub issue or pull-request identifier so generated links remain valid.

open_code_review_toolkit-0.2.1/docs/codex/AGENT_EXECUTION_PITFALLS.md

@@ -1,44 +0,0 @@
-# Agent Execution Pitfalls
-
-## Closing a public-contract change after only the feature merge
-
-**Failure mode:** A feature changes a public command or integration contract, its pull request merges, and a TestPyPI `.devN` build succeeds. The plan is then marked completed even though stable PyPI users still receive the old behavior.
-
-**Why it happens:** Implementation, preview publication, and stable delivery are treated as separate mental tasks even when the user asked for one outcome. SCM-derived versions also make the source tree appear ready for the next version without proving that a stable tag or package exists.
-
-**Required prevention:**
-
-1. Classify the work at plan start and write the target stable version into `PLANS.md`.
-2. Treat feature merge and TestPyPI `.devN` verification as intermediate receipts.
-3. When release is required, prepare the version/changelog release PR immediately after the development build is verified.
-4. Keep the objective active until the release workflow publishes and independent readback confirms PyPI, TestPyPI, the signed tag, immutable GitHub Release, hashes, attestations, and supported-Python installs.
-5. If publication is intentionally deferred, record who deferred it, why, and the exact command or PR needed to resume.
-
-**Closure question:** "Can a user installing from production PyPI obtain the promised behavior now?" If not, the stable-release objective is not complete.
-
-This note records recurring execution mistake patterns discovered during real work. Record generalized lessons, not one-off complaints.
-
-## Planning And Context Discipline
-
-- Do not leave durable scope, source boundaries, or resume state only in chat; keep the active plan current.
-- Do not treat a local working specification as publishable documentation; translate its public requirements and keep private audit criteria outside tracked files.
-- Do not silently reduce extraction scope because the source is large; split it into coherent, validated subsystem slices.
-- Do not commit completed work while the active plan still says `planned` or `in_progress`.
-
-## Source And Privacy Boundaries
-
-- Inventory tracked source explicitly and avoid broad copy commands that could include ignored or untracked files.
-- Do not turn one-time private marker criteria into a tracked denylist or test fixture.
-- Do not use real provider payloads, hosts, repositories, or credentials in public fixtures.
-
-## Tooling And Validation Hygiene
-
-- Prefer the narrowest reproducer before broad reruns.
-- Verify both UTF-8 byte limits and Python character limits when changing note formatting.
-- Treat tests, lint, typing, artifact checks, install smoke, privacy scans, and source-integrity checks as distinct gates.
-- Pin third-party Actions by full commit SHA and keep readable version comments beside the pin.
-
-## Learning Loop
-
-- Promote a repeated stable lesson into `docs/engineering/project_principles.md`.
-- Record actionable future work in `docs/codex/TASKS_BACKLOG.md` only when it has an activation trigger and next safe action.