pr-analyzer-cli 0.1.0__py3-none-any.whl

pr_analyzer/pipeline.py

@@ -0,0 +1,273 @@
+import time
+from collections import Counter
+from dataclasses import replace
+
+import structlog
+
+from pr_analyzer.analyzer.ast_analyzer import StaticAnalyzer
+from pr_analyzer.analyzer.scorer import Scorer
+from pr_analyzer.cache import open_cache
+from pr_analyzer.config import settings
+from pr_analyzer.diff import commentable_lines
+from pr_analyzer.exceptions import PRAnalyzerError
+from pr_analyzer.github.client import GithubClient
+from pr_analyzer.github.markdown import code_span, neutralise_line
+from pr_analyzer.llm.engine import LLM_RULE, LLMEngine
+from pr_analyzer.models import AnalysisResult, FileChange, PRSummary, Suggestion
+from pr_analyzer.project_config import (
+    CONFIG_FILE,
+    CONFIG_RULE,
+    ProjectConfig,
+    config_findings,
+    read_project_config,
+    severity_rank,
+)
+from pr_analyzer.security.scanner import SecurityScanner
+from pr_analyzer.suppression import ignored_warning, split_ignored
+
+log = structlog.get_logger(__name__)
+
+# findings without an inline comment that are still listed in the review body
+MAX_LISTED_IN_REVIEW = 20
+# files named in the warning about ignore_paths; any beyond this are only counted
+MAX_LISTED_SKIPPED = 10
+
+
+def gets_inline_comment(s: Suggestion, min_severity: str = "MEDIUM") -> bool:
+    # LOW findings are only counted in the review body by default: a comment on every one of
+    # them buried the findings that matter. A project can move the line in .pr-analyzer.toml.
+    return severity_rank(s.severity) >= severity_rank(min_severity)
+
+
+def skipped_files_warning(skipped: list[FileChange]) -> str:
+    names = ", ".join(f.filename for f in skipped[:MAX_LISTED_SKIPPED])
+    if len(skipped) > MAX_LISTED_SKIPPED:
+        names += f" and {len(skipped) - MAX_LISTED_SKIPPED} more"
+    return f"Skipped {len(skipped)} file(s) matching ignore_paths in {CONFIG_FILE}: {names}"
+
+
+def invalid_config_warning(source: str, problems: list[str]) -> str:
+    return f"{source} is invalid, so the default settings were used: " + "; ".join(problems)
+
+
+def check_pr_config(pr: PRSummary, warnings: list[str]) -> list[Suggestion]:
+    """Findings for the problems in the .pr-analyzer.toml this PR adds or changes, if any. That
+    copy is checked whatever ignore_paths says, and never applied (see _project_config_for)."""
+    changed = next(
+        (f for f in pr.files if f.filename == CONFIG_FILE and f.status != "removed"), None
+    )
+    if changed is None:
+        return []
+    if changed.raw_content is None:
+        warnings.append(f"Could not check the {CONFIG_FILE} this PR changes: its content "
+                        "isn't available")
+        return []
+    return config_findings(changed.raw_content)
+
+
+def findings_off_the_diff(findings: list[Suggestion]) -> list[str]:
+    # review-body lines for findings that should have had an inline comment but whose line
+    # isn't part of the diff. File names and titles can be shaped by the PR, so they're
+    # neutralised (see github/markdown.py), as are the counted titles and the notes below.
+    if not findings:
+        return []
+    lines = ["", f"**Findings not attached to a diff line ({len(findings)}):**"]
+    for s in findings[:MAX_LISTED_IN_REVIEW]:
+        where = f"{s.filename}:{s.line}" if s.line else s.filename
+        lines.append(f"- **{s.severity}** {code_span(where)} — {neutralise_line(s.title)}")
+    if len(findings) > MAX_LISTED_IN_REVIEW:
+        lines.append(f"- … and {len(findings) - MAX_LISTED_IN_REVIEW} more")
+    return lines
+
+
+def low_severity_counts(findings: list[Suggestion], min_severity: str = "MEDIUM") -> list[str]:
+    # findings below the inline-comment threshold: LOW ones, unless a project moved it
+    if not findings:
+        return []
+    # the rule id is what .pr-analyzer.toml's `disable` takes, for a rule a project finds noisy
+    counts = Counter((s.title, s.rule_id) for s in findings).most_common()
+    kind = "Low-severity findings" if min_severity == "MEDIUM" else f"Findings below {min_severity}"
+    lines = ["", f"**{kind} ({len(findings)}), counted but not commented inline:**"]
+    lines += [
+        f"- {count} × {neutralise_line(title)}" + (f" (`{rule}`)" if rule else "")
+        for (title, rule), count in counts[:MAX_LISTED_IN_REVIEW]
+    ]
+    if len(counts) > MAX_LISTED_IN_REVIEW:
+        rest = sum(count for _, count in counts[MAX_LISTED_IN_REVIEW:])
+        lines.append(f"- … and {rest} more")
+    return lines
+
+
+class AnalysisPipeline:
+    def __init__(
+        self, skip_llm: bool = False, post_review: bool = False, use_cache: bool = True
+    ) -> None:
+        # file contents and LLM replies; --no-cache (use_cache=False) neither reads nor writes it
+        self.cache    = open_cache(enabled=use_cache)
+        self.github   = GithubClient(cache=self.cache)
+        self.static   = StaticAnalyzer()
+        self.security = SecurityScanner()
+        self.llm      = LLMEngine(cache=self.cache)
+        self.scorer   = Scorer()
+        self.skip_llm = skip_llm
+        self.post_review = post_review
+        # settings from --config; None reads .pr-analyzer.toml from each PR's base branch
+        self.project_config: ProjectConfig | None = None
+
+    def close(self) -> None:
+        self.github.close()
+        self.cache.close()
+
+    def run(self, url: str, skip_llm: bool | None = None) -> AnalysisResult:
+        # the constructor's flag applies unless a caller overrides it for this run; run() used
+        # to ignore it, so --skip-llm had no effect
+        skip_llm = self.skip_llm if skip_llm is None else skip_llm
+        start = time.perf_counter()
+        warnings: list[str] = []
+
+        log.info("Fetching PR")
+        pr = self.github.fetch_pr(url)
+        log.info("PR fetched successfully", repo=pr.repo, number=pr.number, files=len(pr.files))
+
+        config = self._project_config_for(pr, warnings)
+        # a broken .pr-analyzer.toml in the PR blocks it, so it can't be merged unnoticed
+        pr_config_findings = check_pr_config(pr, warnings) if config.enabled(CONFIG_RULE) else []
+        # files matching ignore_paths aren't analysed at all, so they never reach the LLM either
+        skipped = [f for f in pr.files if config.ignores(f.filename)]
+        files = [f for f in pr.files if not config.ignores(f.filename)]
+        if skipped:
+            warnings.append(skipped_files_warning(skipped))
+
+        log.info("Static analysis starting..")
+        static_analysis = self.static.analyze(files, config.disable, config.thresholds)
+
+        log.info("Security analysis starting..")
+        security_analysis = self.security.scan(files, config.disable)
+        warnings.extend(self.security.warnings)
+
+        # findings on lines marked `pr-analyzer: ignore` are dropped and named in a warning
+        existing_findings, ignored = split_ignored(static_analysis + security_analysis, files)
+
+        llm_suggestions: list[Suggestion] = []
+        llm_provider_used = None
+        if skip_llm or not config.enabled(LLM_RULE):
+            log.info("skipping LLM analysis")
+        else:
+            log.info("running LLM analysis")
+            reviewed = replace(pr, files=files) if skipped else pr
+            try:
+                llm_suggestions = self.llm.analyze(reviewed, existing_findings)
+                llm_provider_used = settings.llm_provider
+                warnings.extend(self.llm.warnings)   # e.g. files left out over LLM_TOKEN_BUDGET
+            except Exception as e:  # the LLM review is optional; keep the deterministic results
+                log.warning("llm_failed", error=str(e))
+                warnings.append(f"LLM review skipped: {e}")
+            log.info("LLM analysis done", count=len(llm_suggestions))
+
+        llm_suggestions, ignored_llm = split_ignored(llm_suggestions, files)
+        ignored += ignored_llm
+        if ignored:
+            warnings.append(ignored_warning(ignored))
+
+        # the config findings carry text from the PR, so they stay out of the LLM's prompt; and
+        # with no line, no ignore marker can drop them
+        all_suggestions = pr_config_findings + existing_findings + llm_suggestions
+
+        log.info("Scoring: ")
+        score = self.scorer.score(all_suggestions, block_on=config.block_on)
+
+        result = AnalysisResult(
+            pr=pr,
+            suggestions=all_suggestions,
+            score=score,
+            duration=round(time.perf_counter() - start, 2),
+            llm_provider_used=llm_provider_used,
+            warnings=warnings,
+        )
+
+        if self.post_review:
+            self._post_github_review(result, config.inline_min_severity)
+
+        log.info("pipeline complete",
+                 score=score.overall_score,
+                 grade=score.grade,
+                 passed=score.passed,
+                 duration=result.duration
+        )
+        return result
+
+    def _project_config_for(self, pr: PRSummary, warnings: list[str]) -> ProjectConfig:
+        # --config wins (the CLI stops on an invalid one); otherwise the copy on the PR's base
+        # branch, never the PR's own, so a PR can't loosen its own checks. No file there means
+        # the defaults, and so does an invalid one, with a warning: stopping instead used to fail
+        # every PR until the file was fixed, the PR fixing it included.
+        if self.project_config is not None:
+            return self.project_config
+        raw = self.github.fetch_file(pr.repo, CONFIG_FILE, pr.base_branch)
+        if raw is None:
+            return ProjectConfig()
+        config, problems = read_project_config(raw)
+        if problems:
+            warning = invalid_config_warning(f"{CONFIG_FILE} on {pr.base_branch}", problems)
+            log.warning("project_config_invalid", warning=warning)   # on stderr, as well
+            warnings.append(warning)
+            return ProjectConfig()
+        log.info("project config loaded", file=CONFIG_FILE, ref=pr.base_branch)
+        return config
+
+    def _post_github_review(self, result: AnalysisResult, min_severity: str = "MEDIUM") -> None:
+        comments = self._review_comments(result, min_severity)
+        body = self._build_review_body(result, comments, min_severity)
+
+        log.info("posting github review", comments=len(comments))
+        try:
+            self.github.post_review(result.pr, body, comments)
+        except PRAnalyzerError as e:
+            # the analysis itself succeeded; report the posting problem rather than losing it
+            log.warning("review_post_failed", error=str(e))
+            result.warnings.append(f"Could not post the GitHub review: {e}")
+
+    def _review_comments(
+        self, result: AnalysisResult, min_severity: str = "MEDIUM"
+    ) -> list[tuple[Suggestion, int]]:
+        # GitHub accepts inline comments only on lines that appear in the diff
+        diff_lines = {f.filename: commentable_lines(f.patch) for f in result.pr.files if f.patch}
+        comments = []
+        for s in result.suggestions:
+            if not gets_inline_comment(s, min_severity):
+                continue
+            if s.line is not None and s.line in diff_lines.get(s.filename, set()):
+                comments.append((s, s.line))
+        return comments
+
+    def _build_review_body(
+        self,
+        result: AnalysisResult,
+        comments: list[tuple[Suggestion, int]],
+        min_severity: str = "MEDIUM",
+    ) -> str:
+        score = result.score
+        status = "✅ PASSED" if score.passed else "❌ BLOCKED"
+
+        lines = [
+            "## PR Analysis Report",
+            "",
+            "| Score | Grade | Status | Critical | High |",
+            "|-------|-------|--------|----------|------|",
+            f"| {score.overall_score:.1f} | {score.grade} | {status} | {score.critical_count} | {score.high_count} |",
+            "",
+            f"**Summary:** {score.summary}",
+        ]
+
+        inline = {id(s) for s, _ in comments}
+        commentable = [s for s in result.suggestions if gets_inline_comment(s, min_severity)]
+        lines += findings_off_the_diff([s for s in commentable if id(s) not in inline])
+        lines += low_severity_counts(
+            [s for s in result.suggestions if not gets_inline_comment(s, min_severity)], min_severity
+        )
+
+        if result.warnings:
+            lines += ["", "**Notes:**"] + [f"- {neutralise_line(w)}" for w in result.warnings]
+
+        lines += ["", "---", f"*Generated by pr-analyzer — {result.duration:.2f}s*"]
+        return "\n".join(lines)

pr_analyzer/project_config.py

@@ -0,0 +1,266 @@
+"""Per-repository settings from a `.pr-analyzer.toml` file.
+
+    disable = ["magic-number", "llm"]       # rule ids and whole stages to switch off
+    ignore_paths = ["docs/**", "*.min.js"]  # files to leave out of the analysis
+    block_on = ["CRITICAL", "HIGH"]         # severities that block the PR
+    inline_min_severity = "MEDIUM"          # lowest severity that gets an inline comment
+
+    [thresholds]
+    complexity_medium = 15                  # a function above this is MEDIUM...
+    complexity_high = 30                    # ...and above this, HIGH
+    max_file_lines = 500
+    max_line_length = 120
+
+Every key is optional. When a PR is analysed the file is read from the PR's base branch, never
+from the PR itself, so a PR can't loosen its own checks; `--config PATH` names a local file
+instead. A missing file means the defaults. An invalid --config file is an error that names every
+problem. An invalid file on the base branch is ignored for the defaults, with a warning, so it
+can't stop every PR, the one that fixes it included; and a PR that adds or changes the file has
+its copy checked, never applied, each problem a finding (CONFIG_RULE) that blocks it.
+"""
+import dataclasses
+import difflib
+import json
+import re
+import tomllib
+from collections.abc import Iterable
+from dataclasses import dataclass
+from functools import lru_cache
+from pathlib import Path
+from typing import Any
+
+from pr_analyzer.analyzer import ast_analyzer
+from pr_analyzer.analyzer.ast_analyzer import Thresholds
+from pr_analyzer.exceptions import ConfigError
+from pr_analyzer.llm.engine import LLM_RULE
+from pr_analyzer.models import Suggestion
+from pr_analyzer.security import scanner
+
+CONFIG_FILE = ".pr-analyzer.toml"
+# the rule id of problems in the copy of CONFIG_FILE that a PR adds or changes
+CONFIG_RULE = "config"
+
+# lowest first, so a severity's position is its rank
+SEVERITIES = ("LOW", "MEDIUM", "HIGH", "CRITICAL")
+RULE_IDS = frozenset(ast_analyzer.RULE_IDS + scanner.RULE_IDS + (LLM_RULE, CONFIG_RULE))
+KEYS = ("disable", "ignore_paths", "block_on", "inline_min_severity", "thresholds")
+THRESHOLD_KEYS = tuple(f.name for f in dataclasses.fields(Thresholds))
+
+# The part of .gitignore's syntax that ignore_paths supports, matched as git matches it: `*` and
+# `?` stay within one path segment, and `**` as a whole segment crosses directories (`**/` any
+# number of them, a final `/**` everything inside); any other run of asterisks is a `*`, and
+# everything else is literal. The syntax in _UNSUPPORTED is rejected instead.
+_GLOB_TOKEN = re.compile(
+    r"(?P<dirs>(?:\A|(?<=/))\*{2,}/)|(?P<rest>(?:\A|(?<=/))\*{2,}\Z)|(?P<star>\*+)|(?P<one>\?)"
+    r"|[^*?]+"
+)
+_GLOB_PARTS = {"dirs": "(?:.*/)?", "rest": ".*", "star": "[^/]*", "one": "[^/]"}
+# syntax that git reads differently from the literal text glob_regex would make of it
+_UNSUPPORTED = (
+    (re.compile(r"\A!"), "uses negation (a leading !), which isn't supported: ignore_paths can "
+                         "only leave files out"),
+    (re.compile(r"[\[\]]"), "uses [ or ] (a character class in git), which isn't supported: "
+                            "list each name, or use ? for any one character"),
+    (re.compile(r"\\"), "uses a backslash, which isn't supported: there are no escapes, and / "
+                        "separates directories"),
+    # git's own matcher treats foo**/bar inconsistently: across directories or within one
+    (re.compile(r"[^/*]\*{2,}/[^/]"), "has ** inside a name before a /, which isn't supported: "
+                                      "write foo*/bar for one directory, or foo*/**/bar for any "
+                                      "number"),
+)
+
+
+@dataclass(frozen=True)
+class ProjectConfig:
+    disable: frozenset[str] = frozenset()
+    ignore_paths: tuple[str, ...] = ()
+    block_on: frozenset[str] = frozenset({"CRITICAL", "HIGH"})
+    inline_min_severity: str = "MEDIUM"
+    thresholds: Thresholds = Thresholds()
+
+    def enabled(self, rule_id: str) -> bool:
+        return rule_id not in self.disable
+
+    def ignores(self, path: str) -> bool:
+        """Whether the file matches one of ignore_paths."""
+        return any(glob_regex(pattern).fullmatch(path) for pattern in self.ignore_paths)
+
+
+@lru_cache(maxsize=None)
+def glob_regex(pattern: str) -> re.Pattern[str]:
+    """Match repo paths the way .gitignore does, for the syntax ignore_paths accepts: a pattern
+    with no `/` except a trailing one matches at any depth, one with a leading or inner `/` only
+    from the repository root, a trailing `/` only directories, and a pattern that matches a
+    directory covers every file below it."""
+    anchored = "/" in pattern.rstrip("/")
+    directory_only = pattern.endswith("/")
+    body = "".join(
+        _GLOB_PARTS[token.lastgroup] if token.lastgroup else re.escape(token.group())
+        for token in _GLOB_TOKEN.finditer(pattern.strip("/"))
+    )
+    prefix = "" if anchored else "(?:.*/)?"
+    suffix = "/.*" if directory_only else "(?:/.*)?"
+    return re.compile(prefix + body + suffix)
+
+
+def severity_rank(severity: str) -> int:
+    """Position in SEVERITIES; -1 for anything unknown, which ranks below every real one."""
+    normalized = str(severity).strip().upper()
+    return SEVERITIES.index(normalized) if normalized in SEVERITIES else -1
+
+
+def load_project_config(path: str | Path) -> ProjectConfig:
+    """Settings from a local file, as named by --config. Unlike the base-branch lookup, a missing
+    file is an error here: someone asked for it by name."""
+    try:
+        raw = Path(path).read_bytes()
+    except OSError as e:
+        raise ConfigError(f"Can't read {path}: {e.strerror or e}") from e
+    return parse_project_config(raw, source=str(path))
+
+
+def parse_project_config(raw: bytes | str, source: str = CONFIG_FILE) -> ProjectConfig:
+    """Settings the run must use, such as a --config file: any problem is an error naming all."""
+    config, problems = read_project_config(raw)
+    if problems:
+        raise ConfigError(f"{source} is invalid:\n" + "\n".join(f"  - {p}" for p in problems))
+    return config
+
+
+def read_project_config(raw: bytes | str) -> tuple[ProjectConfig, list[str]]:
+    """The settings in a file and every problem with it. With any problem the settings are the
+    defaults: the valid part of a broken file isn't what the project chose either."""
+    try:
+        text = raw.decode("utf-8") if isinstance(raw, bytes) else raw
+        data = tomllib.loads(text)
+    except UnicodeDecodeError:
+        return ProjectConfig(), ["the file is not UTF-8 text"]
+    except tomllib.TOMLDecodeError as e:
+        return ProjectConfig(), [f"the file is not valid TOML: {e}"]
+
+    problems: list[str] = []
+    values = _validate(data, problems)
+    return (ProjectConfig() if problems else ProjectConfig(**values)), problems
+
+
+def config_findings(text: str) -> list[Suggestion]:
+    """A HIGH finding for each problem in the copy of CONFIG_FILE that a PR adds or changes. The
+    copy is only checked, never applied; once merged, an invalid file is ignored on every PR until
+    it is fixed, so its problems block the PR that brings them in."""
+    _, problems = read_project_config(text)
+    if "\ufffd" in text:
+        # a PR's files arrive as text, with U+FFFD where the bytes weren't UTF-8; read as bytes
+        # from the base branch once merged, such a file is rejected outright
+        problems.insert(0, "the file has U+FFFD replacement characters, so it is probably not "
+                           "UTF-8 text")
+    return [
+        Suggestion(
+            filename=CONFIG_FILE,
+            severity="HIGH",
+            category="style",
+            title=f"Invalid config: {problem}",
+            description=(
+                f"This PR's {CONFIG_FILE} is invalid: {problem}. A PR's copy of the file is only "
+                "checked, never applied. Once merged, an invalid file is ignored, and every PR is "
+                "analysed with the default settings until it is fixed."
+            ),
+            line=None,
+            source="static",
+            rule_id=CONFIG_RULE,
+        )
+        for problem in problems
+    ]
+
+
+def _validate(data: dict[str, Any], problems: list[str]) -> dict[str, Any]:
+    problems += [unknown("key", key, KEYS) for key in data if key not in KEYS]
+    values: dict[str, Any] = {}
+    if "disable" in data:
+        values["disable"] = frozenset(_rule_ids(data["disable"], problems))
+    if "ignore_paths" in data:
+        values["ignore_paths"] = tuple(_ignore_paths(data["ignore_paths"], problems))
+    if "block_on" in data:
+        values["block_on"] = frozenset(_severities("block_on", data["block_on"], problems))
+    if "inline_min_severity" in data:
+        values["inline_min_severity"] = _severity(
+            "inline_min_severity", data["inline_min_severity"], problems
+        )
+    if "thresholds" in data:
+        values["thresholds"] = _thresholds(data["thresholds"], problems)
+    return values
+
+
+def unknown(kind: str, name: str, known: Iterable[str]) -> str:
+    """'unknown rule id "magic-numbers" (did you mean "magic-number"?)'"""
+    # compare as lower-case kebab-case, so MAGIC_NUMBER and ignore-paths find their match
+    by_form = {k.lower().replace("_", "-"): k for k in known}
+    close = difflib.get_close_matches(str(name).lower().replace("_", "-"), list(by_form), n=1)
+    if close:
+        return f"unknown {kind} {name!r} (did you mean {by_form[close[0]]!r}?)"
+    return f"unknown {kind} {name!r}; use one of: {', '.join(sorted(by_form.values()))}"
+
+
+def _strings(key: str, value: Any, problems: list[str]) -> list[str]:
+    if isinstance(value, list) and all(isinstance(item, str) for item in value):
+        return value
+    problems.append(f'{key} must be a list of strings, e.g. {key} = ["..."]')
+    return []
+
+
+def _rule_ids(value: Any, problems: list[str]) -> list[str]:
+    ids = _strings("disable", value, problems)
+    problems += [
+        f"disable: {unknown('rule id', rule, RULE_IDS)}" for rule in ids if rule not in RULE_IDS
+    ]
+    return [rule for rule in ids if rule in RULE_IDS]
+
+
+def _ignore_paths(value: Any, problems: list[str]) -> list[str]:
+    patterns = _strings("ignore_paths", value, problems)
+    found = {pattern: _pattern_problems(pattern) for pattern in patterns}
+    problems += [f"ignore_paths: {p!r} {why}" for p, whys in found.items() for why in whys]
+    return [p for p in patterns if not found[p]]
+
+
+def _pattern_problems(pattern: str) -> list[str]:
+    if not pattern.strip("/"):
+        return ["is not a path pattern"]
+    # rejected rather than read literally: each would quietly match something other than what
+    # the same line does in a .gitignore
+    return [why for syntax, why in _UNSUPPORTED if syntax.search(pattern)]
+
+
+def _severity(key: str, value: Any, problems: list[str]) -> str:
+    if isinstance(value, str) and severity_rank(value) >= 0:
+        return value.strip().upper()
+    problems.append(f"{key}: {value!r} is not a severity; use one of {', '.join(SEVERITIES)}")
+    return ""
+
+
+def _severities(key: str, value: Any, problems: list[str]) -> list[str]:
+    severities = (_severity(key, item, problems) for item in _strings(key, value, problems))
+    return [s for s in severities if s]
+
+
+def _thresholds(value: Any, problems: list[str]) -> Thresholds:
+    if not isinstance(value, dict):
+        problems.append("thresholds must be a table: a [thresholds] section")
+        return Thresholds()
+    limits: dict[str, int] = {}
+    for key, number in value.items():
+        if key not in THRESHOLD_KEYS:
+            problems.append(f"thresholds: {unknown('key', key, THRESHOLD_KEYS)}")
+        elif isinstance(number, bool) or not isinstance(number, int) or number < 1:
+            # shown the way TOML writes it: true, "120", 99.5
+            shown = json.dumps(number, default=str)
+            problems.append(f"thresholds.{key} must be a whole number above 0, not {shown}")
+        else:
+            limits[key] = number
+
+    thresholds = dataclasses.replace(Thresholds(), **limits)
+    if thresholds.complexity_medium > thresholds.complexity_high:
+        problems.append(
+            f"thresholds.complexity_medium ({thresholds.complexity_medium}) must not be above "
+            f"complexity_high ({thresholds.complexity_high})"
+        )
+    return thresholds