open-code-review-toolkit 0.2.1__tar.gz → 0.3.1__tar.gz

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: open-code-review-toolkit
-Version: 0.2.1
+Version: 0.3.1
 Summary: Unofficial GitLab CI integration layer for Open Code Review
 Project-URL: Homepage, https://github.com/xeonvs/open-code-review-toolkit
 Project-URL: Repository, https://github.com/xeonvs/open-code-review-toolkit
@@ -243,7 +243,8 @@ ocr --version
 ocr-ci --help
 ```
 
-The current compatibility target is OCR `1.7.17`. CI should pin the release and verify its published checksum before execution.
+The current compatibility target is OCR `1.8.0`. CI should pin the release and verify its published checksum before execution.
+The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. Set `OCR_REVIEW_LANGUAGE=Russian` to use Russian consistently in both OCR configuration and generated review context.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
@@ -276,7 +277,7 @@ ocr-ci preflight
 ocr-ci configure
 ocr-ci mcp-config
 ocr-ci context --output .review-context/dependencies.md
-# run: ocr review ... --format json
+ocr-ci review --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log -- ... --format json
 ocr-ci post --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log
 ```
 

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.1}/README.md

@@ -15,7 +15,8 @@ ocr --version
 ocr-ci --help
 ```
 
-The current compatibility target is OCR `1.7.17`. CI should pin the release and verify its published checksum before execution.
+The current compatibility target is OCR `1.8.0`. CI should pin the release and verify its published checksum before execution.
+The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. Set `OCR_REVIEW_LANGUAGE=Russian` to use Russian consistently in both OCR configuration and generated review context.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
@@ -48,7 +49,7 @@ ocr-ci preflight
 ocr-ci configure
 ocr-ci mcp-config
 ocr-ci context --output .review-context/dependencies.md
-# run: ocr review ... --format json
+ocr-ci review --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log -- ... --format json
 ocr-ci post --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log
 ```
 

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.1}/pyproject.toml

@@ -38,6 +38,7 @@ ocr-ci = "ocr_toolkit.cli:main"
 
 [dependency-groups]
 dev = [
+  "bandit==1.9.4",
   "build>=1.2.2",
   "coverage[toml]>=7.6",
   "hatch-vcs>=0.4",
@@ -60,19 +61,7 @@ version-file = "src/ocr_toolkit/_version.py"
 packages = ["src/ocr_toolkit"]
 
 [tool.hatch.build.targets.sdist]
-include = [
-  "/src",
-  "/tests",
-  "/examples",
-  "/docs",
-  "/changelog.d",
-  "/README.md",
-  "/CONTRIBUTING.md",
-  "/SECURITY.md",
-  "/LICENSE",
-  "/CHANGELOG.md",
-  "/pyproject.toml",
-]
+only-include = ["src", "README.md", "LICENSE", "pyproject.toml"]
 
 [tool.hatch.version.raw-options]
 fallback_version = "0.3.0.dev0"
@@ -101,6 +90,11 @@ exclude = ["src/ocr_toolkit/_version.py"]
 warn_unreachable = false
 disable_error_code = ["arg-type", "assignment", "import-not-found", "index", "name-defined", "no-any-return", "no-redef", "union-attr", "unused-ignore", "var-annotated"]
 
+[tool.bandit]
+exclude_dirs = ["tests"]
+severity = "medium"
+confidence = "medium"
+
 [tool.pytest.ini_options]
 addopts = "--strict-config --strict-markers"
 testpaths = ["tests"]

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.1}/src/ocr_toolkit/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.2.1'
-__version_tuple__ = version_tuple = (0, 2, 1)
+__version__ = version = '0.3.1'
+__version_tuple__ = version_tuple = (0, 3, 1)
 
 __commit_id__ = commit_id = None

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.1}/src/ocr_toolkit/cli.py

@@ -3,9 +3,11 @@
 from __future__ import annotations
 
 import argparse
+import sys
 from collections.abc import Sequence
+from pathlib import Path
 
-from ocr_toolkit import configure, mcp_config, preflight
+from ocr_toolkit import configure, mcp_config, preflight, review_runner
 from ocr_toolkit.context import render as context_render
 from ocr_toolkit.posting.workflow import main as posting_main
 
@@ -21,6 +23,14 @@ def build_parser() -> argparse.ArgumentParser:
     subparsers.add_parser("preflight", help="Validate OCR, GitLab, and LLM access.")
     subparsers.add_parser("configure", help="Write the OCR runtime configuration.")
     subparsers.add_parser("mcp-config", help="Write OCR MCP server configuration.")
+    review_parser = subparsers.add_parser(
+        "review", help="Run OCR with private artifacts and safe failure diagnostics."
+    )
+    review_parser.add_argument("--result", required=True, help="OCR JSON output path.")
+    review_parser.add_argument("--stderr", required=True, help="Full OCR stderr artifact path.")
+    review_parser.add_argument(
+        "ocr_args", nargs=argparse.REMAINDER, help="OCR review arguments after --."
+    )
 
     context_parser = subparsers.add_parser(
         "context", help="Generate bounded repository review context."
@@ -33,9 +43,17 @@ def build_parser() -> argparse.ArgumentParser:
 
     post_parser = subparsers.add_parser("post", help="Publish an OCR result artifact to GitLab.")
     post_parser.add_argument(
-        "--result", default="/tmp/ocr-result.json", help="OCR JSON result path."
+        # The public GitLab example writes this fixed path inside an isolated CI job.
+        "--result",
+        default="/tmp/ocr-result.json",  # nosec B108
+        help="OCR JSON result path.",
+    )
+    post_parser.add_argument(
+        # The file contains only the current job's OCR stderr and is never shared.
+        "--stderr",
+        default="/tmp/ocr-stderr.log",  # nosec B108
+        help="OCR stderr log path.",
     )
-    post_parser.add_argument("--stderr", default="/tmp/ocr-stderr.log", help="OCR stderr log path.")
     return parser
 
 
@@ -49,6 +67,13 @@ def main(argv: Sequence[str] | None = None) -> int:
         return configure.main()
     if args.command == "mcp-config":
         return mcp_config.configure_mcp_servers()
+    if args.command == "review":
+        ocr_args = args.ocr_args[1:] if args.ocr_args[:1] == ["--"] else args.ocr_args
+        try:
+            return review_runner.run_review(Path(args.result), Path(args.stderr), ocr_args)
+        except review_runner.ReviewRunnerError as exc:
+            print(f"Cannot run Open Code Review: {exc}", file=sys.stderr)
+            return 2
     if args.command == "context":
         return context_render.main(["--output", args.output])
     if args.command == "post":

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.1}/src/ocr_toolkit/context/manifests.py

@@ -196,9 +196,9 @@ def parse_pyproject(path: Path) -> dict[str, Any]:
 
     try:
         try:
-            import tomllib
+            import tomllib  # type: ignore[import-untyped]
         except ModuleNotFoundError:
-            import tomli as tomllib  # type: ignore[import-not-found]
+            import tomli as tomllib
 
         data = tomllib.loads(text)
     except ModuleNotFoundError:
@@ -209,9 +209,12 @@ def parse_pyproject(path: Path) -> dict[str, Any]:
     if not isinstance(data, dict):
         return {"present": True, "parse_error": JSON_OBJECT_PARSE_ERROR}
 
-    project = data.get("project") if isinstance(data.get("project"), dict) else {}
-    tool = data.get("tool") if isinstance(data.get("tool"), dict) else {}
-    poetry = tool.get("poetry") if isinstance(tool.get("poetry"), dict) else {}
+    raw_project = data.get("project")
+    raw_tool = data.get("tool")
+    project: dict[Any, Any] = raw_project if isinstance(raw_project, dict) else {}
+    tool: dict[Any, Any] = raw_tool if isinstance(raw_tool, dict) else {}
+    raw_poetry = tool.get("poetry")
+    poetry: dict[Any, Any] = raw_poetry if isinstance(raw_poetry, dict) else {}
 
     dependencies: list[str] = []
     if isinstance(project.get("dependencies"), list):
@@ -233,12 +236,14 @@ def parse_pyproject(path: Path) -> dict[str, Any]:
                     f"group.{group_name}: {redact_url_userinfo(str(dep))}" for dep in group_deps
                 )
 
-    poetry_deps = poetry.get("dependencies") if isinstance(poetry.get("dependencies"), dict) else {}
+    raw_poetry_deps = poetry.get("dependencies")
+    poetry_deps: dict[Any, Any] = raw_poetry_deps if isinstance(raw_poetry_deps, dict) else {}
     for name, version in poetry_deps.items():
         if str(name).lower() != "python":
             dependencies.append(f"{name}: {redact_url_userinfo(str(version))}")
 
-    poetry_groups = poetry.get("group") if isinstance(poetry.get("group"), dict) else {}
+    raw_poetry_groups = poetry.get("group")
+    poetry_groups: dict[Any, Any] = raw_poetry_groups if isinstance(raw_poetry_groups, dict) else {}
     for group_name, group_value in poetry_groups.items():
         if not isinstance(group_value, dict):
             continue
@@ -354,10 +359,14 @@ def parse_composer_json(path: Path) -> dict[str, Any]:
     if not isinstance(data, dict):
         return {"present": True, "parse_error": JSON_OBJECT_PARSE_ERROR}
 
-    require = data.get("require") if isinstance(data.get("require"), dict) else {}
-    require_dev = data.get("require-dev") if isinstance(data.get("require-dev"), dict) else {}
-    config = data.get("config") if isinstance(data.get("config"), dict) else {}
-    platform = config.get("platform") if isinstance(config.get("platform"), dict) else {}
+    raw_require = data.get("require")
+    raw_require_dev = data.get("require-dev")
+    raw_config = data.get("config")
+    require: dict[Any, Any] = raw_require if isinstance(raw_require, dict) else {}
+    require_dev: dict[Any, Any] = raw_require_dev if isinstance(raw_require_dev, dict) else {}
+    config: dict[Any, Any] = raw_config if isinstance(raw_config, dict) else {}
+    raw_platform = config.get("platform")
+    platform: dict[Any, Any] = raw_platform if isinstance(raw_platform, dict) else {}
 
     platform_items, platform_omitted = limited_manifest_items(
         [f"{name}: {version}" for name, version in platform.items()]
@@ -433,10 +442,13 @@ def parse_package_json(path: Path) -> dict[str, Any]:
     if not isinstance(data, dict):
         return {"present": True, "parse_error": JSON_OBJECT_PARSE_ERROR}
 
-    engines = data.get("engines") if isinstance(data.get("engines"), dict) else {}
-    dependencies = data.get("dependencies") if isinstance(data.get("dependencies"), dict) else {}
-    dev_dependencies = (
-        data.get("devDependencies") if isinstance(data.get("devDependencies"), dict) else {}
+    raw_engines = data.get("engines")
+    raw_dependencies = data.get("dependencies")
+    raw_dev_dependencies = data.get("devDependencies")
+    engines: dict[Any, Any] = raw_engines if isinstance(raw_engines, dict) else {}
+    dependencies: dict[Any, Any] = raw_dependencies if isinstance(raw_dependencies, dict) else {}
+    dev_dependencies: dict[Any, Any] = (
+        raw_dev_dependencies if isinstance(raw_dev_dependencies, dict) else {}
     )
 
     engines_items, engines_omitted = limited_manifest_items(

{open_code_review_toolkit-0.2.1 → open_code_review_toolkit-0.3.1}/src/ocr_toolkit/context/repo.py

@@ -162,11 +162,13 @@ def resolve_output_path(value: str) -> Path | None:
     requested = Path(value)
     logical_output = requested if requested.is_absolute() else root_lexical / requested
     logical_output = logical_output.absolute()
-    temp_lexical = Path(tempfile.gettempdir()).absolute()
+    # tempfile supplies the platform temp root; containment and symlink checks follow.
+    temp_lexical = Path(tempfile.gettempdir()).absolute()  # nosec B108
     allowed_roots = [(root_lexical, root), (root, root)]
     temp_resolved = temp_lexical.resolve()
     allowed_roots.extend([(temp_lexical, temp_resolved), (temp_resolved, temp_resolved)])
-    tmp_path = Path("/tmp")
+    # POSIX /tmp may be a distinct lexical alias (for example, /private/tmp).
+    tmp_path = Path("/tmp")  # nosec B108
     if tmp_path.exists():
         tmp_lexical = tmp_path.absolute()
         tmp_resolved = tmp_path.resolve()