pr-analyzer-cli 0.1.0__py3-none-any.whl

pr_analyzer/reporting/rich_reporter.py

@@ -0,0 +1,244 @@
+import json
+from rich.console import Console
+from rich.markup import escape
+from rich.table import Table
+from rich.panel import Panel
+from rich.text import Text
+from pr_analyzer.models import AnalysisResult, Suggestion
+
+console = Console()
+
+SEVERITY_ORDER = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
+
+SEVERITY_COLOURS = {
+    "CRITICAL": "white on red",
+    "HIGH":     "bold red",
+    "MEDIUM":   "yellow",
+    "LOW":      "blue",
+}
+
+# PR titles, file names and LLM text are untrusted: they're escaped (or wrapped in Text) before
+# Rich renders them, otherwise "[docs] Fix" loses its "[docs]" and "[/x]" crashes the report.
+
+
+class RichReporter:
+
+    def print_rich_report(self, result: AnalysisResult) -> None:
+        self._print_pr_header(result)
+        self._print_score_panel(result)
+        self._print_warnings(result)
+        self._print_dimension_table(result)
+        sorted_suggestions = self._sort_suggestions(result.suggestions)
+        self._print_suggestion_table(sorted_suggestions)
+        self._print_detail_panels(sorted_suggestions)
+        self._print_final_line(result)
+
+    def print_json_report(self, result: AnalysisResult) -> None:
+        output = {
+            "pr": {
+                "number":     result.pr.number,
+                "title":      result.pr.title,
+                "author":     result.pr.author,
+                "repo":       result.pr.repo,
+                "base":       result.pr.base_branch,
+                "head":       result.pr.head_branch,
+                "head_sha":   result.pr.head_sha,
+            },
+            "score": {
+                "overall":    result.score.overall_score,
+                "grade":      result.score.grade,
+                "passed":     result.score.passed,
+                "summary":    result.score.summary,
+                "delta":      result.score.delta,
+                "dimensions": result.score.dimension_scores,
+                "critical":   result.score.critical_count,
+                "high":       result.score.high_count,
+            },
+            "suggestions": [
+                {
+                    "filename":    s.filename,
+                    "line":        s.line,
+                    "severity":    s.severity,
+                    "category":    s.category,
+                    "title":       s.title,
+                    "description": s.description,
+                    "source":      s.source,
+                    "confidence":  s.confidence,
+                    "rule":        s.rule_id,   # the id .pr-analyzer.toml can disable
+                }
+                for s in result.suggestions
+            ],
+            "warnings": result.warnings,
+            "llm_provider": result.llm_provider_used,
+            "duration": result.duration,
+        }
+        print(json.dumps(output, indent=2))
+
+    def print_markdown_report(self, result: AnalysisResult) -> None:
+        lines = []
+
+        lines.append(f"# PR Analysis Report — #{result.pr.number} {_md(result.pr.title)}\n")
+        lines.append(f"**Author:** {_md(result.pr.author)}  ")
+        lines.append(f"**Repo:** {_md(result.pr.repo)}  ")
+        lines.append(f"**Branch:** `{result.pr.head_branch}` → `{result.pr.base_branch}`\n")
+
+        lines.append("## Score\n")
+        lines.append("| Overall | Grade | Status | Critical | High |")
+        lines.append("|---------|-------|--------|----------|------|")
+        status = "✅ PASSED" if result.score.passed else "❌ BLOCKED"
+        lines.append(
+            f"| {result.score.overall_score:.1f} "
+            f"| {result.score.grade} "
+            f"| {status} "
+            f"| {result.score.critical_count} "
+            f"| {result.score.high_count} |"
+        )
+
+        if result.warnings:
+            lines.append("\n## Warnings\n")
+            lines.extend(f"- {_md(w)}" for w in result.warnings)
+
+        lines.append("\n## Dimension Scores\n")
+        lines.append("| Dimension | Score |")
+        lines.append("|-----------|-------|")
+        for dim, score in result.score.dimension_scores.items():
+            lines.append(f"| {dim} | {score:.1f} |")
+
+        if result.suggestions:
+            lines.append("\n## Suggestions\n")
+            lines.append("| Severity | File | Line | Category | Title |")
+            lines.append("|----------|------|------|----------|-------|")
+            for s in self._sort_suggestions(result.suggestions):
+                line = str(s.line) if s.line else "—"
+                lines.append(f"| {s.severity} | {_md(s.filename)} | {line} | {_md(s.category)} | {_md(s.title)} |")
+
+            lines.append("\n## Details\n")
+            for s in self._sort_suggestions(result.suggestions):
+                if s.severity in ("HIGH", "CRITICAL"):
+                    where = f" line {s.line}" if s.line else ""
+                    lines.append(f"### {s.severity} — {_md(s.title)}")
+                    lines.append(f"**File:** `{s.filename}`{where}  ")
+                    lines.append(f"**Source:** {s.source}  ")
+                    lines.append(f"> {_md(s.description)}\n")
+
+        lines.append(f"\n---\n*Generated by pr-analyzer — duration {result.duration:.2f}s*")
+        print("\n".join(lines))
+
+    def _sort_suggestions(self, suggestions: list[Suggestion]) -> list[Suggestion]:
+        return sorted(suggestions, key=lambda s: SEVERITY_ORDER.get(s.severity, 99))
+
+    def _severity_colour(self, severity: str) -> str:
+        return SEVERITY_COLOURS.get(severity, "white")
+
+    def _print_pr_header(self, result: AnalysisResult) -> None:
+        pr = result.pr
+        content = (
+            f"[bold]Author:[/bold] {escape(pr.author)}\n"
+            f"[bold]Repo:[/bold] {escape(pr.repo)}\n"
+            f"[bold]Branch:[/bold] {escape(pr.head_branch)} → {escape(pr.base_branch)}\n"
+            f"[bold]Draft:[/bold] {'Yes' if pr.is_draft else 'No'}\n"
+            f"[bold]Files:[/bold] {len(pr.files)}  "
+            f"[green]+{pr.total_additions}[/green]  "
+            f"[red]-{pr.total_deletions}[/red]"
+        )
+        title = f"PR #{pr.number} — {escape(pr.title)}"
+        console.print(Panel(content, title=title, border_style="blue"))
+
+    def _print_score_panel(self, result: AnalysisResult) -> None:
+        score = result.score
+        status_colour = "green" if score.passed else "red"
+        status_text = "✓ PASSED" if score.passed else "✗ BLOCKED"
+
+        delta_text = ""
+        if score.delta is not None:
+            delta_colour = "green" if score.delta >= 0 else "red"
+            delta_text = f"\n[bold]Delta:[/bold] [{delta_colour}]{score.delta:+.1f}[/{delta_colour}]"
+
+        content = (
+            f"[bold]Score:[/bold] {score.overall_score:.1f}   "
+            f"[bold]Grade:[/bold] {score.grade}   "
+            f"[{status_colour}][bold]{status_text}[/bold][/{status_colour}]"
+            f"{delta_text}\n"
+            f"[italic]{escape(score.summary)}[/italic]"
+        )
+        console.print(Panel(content, title="Quality Score", border_style=status_colour))
+
+    def _print_warnings(self, result: AnalysisResult) -> None:
+        if not result.warnings:
+            return
+        content = "\n".join(f"• {escape(w)}" for w in result.warnings)
+        console.print(Panel(content, title="Warnings", border_style="yellow"))
+
+    def _print_dimension_table(self, result: AnalysisResult) -> None:
+        table = Table(title="Dimension Scores", show_lines=True)
+        table.add_column("Dimension", style="bold")
+        table.add_column("Score", justify="right")
+        table.add_column("Bar", width=20)
+
+        for dim, score in result.score.dimension_scores.items():
+            if score >= 80:
+                colour = "green"
+            elif score >= 60:
+                colour = "yellow"
+            else:
+                colour = "red"
+
+            filled = int(score / 5)
+            bar = "█" * filled + "░" * (20 - filled)
+
+            table.add_row(dim, f"[{colour}]{score:.1f}[/{colour}]", f"[{colour}]{bar}[/{colour}]")
+
+        console.print(table)
+
+    def _print_suggestion_table(self, suggestions: list[Suggestion]) -> None:
+        if not suggestions:
+            console.print("[green]No suggestions — clean code![/green]")
+            return
+
+        # no fixed widths: they cut "CRITICAL" down to "CRIT…" on 80-column CI logs
+        table = Table(title="Suggestions", show_lines=True)
+        table.add_column("Severity", no_wrap=True)
+        table.add_column("File", overflow="fold")
+        table.add_column("Category", no_wrap=True)
+        table.add_column("Title", overflow="fold")
+
+        for s in suggestions:
+            colour = self._severity_colour(s.severity)
+            file_line = f"{s.filename}:{s.line}" if s.line else s.filename
+            table.add_row(
+                Text(s.severity, style=colour),
+                Text(file_line),
+                Text(s.category),
+                Text(s.title),
+            )
+
+        console.print(table)
+
+    def _print_detail_panels(self, suggestions: list[Suggestion]) -> None:
+        for s in suggestions:
+            if s.severity not in ("HIGH", "CRITICAL"):
+                continue
+            content = (
+                f"[bold]Description:[/bold] {escape(s.description)}\n"
+                f"[bold]Source:[/bold] {escape(s.source)}\n"
+                f"[bold]Category:[/bold] {escape(s.category)}"
+            )
+            title = f"{s.severity} — {escape(s.filename)}" + (f" line {s.line}" if s.line else "")
+            console.print(Panel(content, title=title, border_style="red"))
+
+    def _print_final_line(self, result: AnalysisResult) -> None:
+        if result.score.passed:
+            status = "[bold green]✓ PASSED[/bold green]"
+        else:
+            status = "[bold red]✗ BLOCKED[/bold red]"
+
+        console.print(
+            f"\n{status}  "
+            f"[dim]{len(result.suggestions)} suggestion(s)  "
+            f"duration {result.duration:.2f}s[/dim]"
+        )
+
+
+def _md(text: str) -> str:
+    # keep untrusted text from breaking Markdown tables or blockquotes
+    return str(text).replace("|", "\\|").replace("\r", " ").replace("\n", " ")

pr_analyzer/security/dep_auditor.py

@@ -0,0 +1,179 @@
+import json
+import os
+import re
+import subprocess
+import tempfile
+
+import structlog
+
+from pr_analyzer.config import settings
+from pr_analyzer.diff import iter_added_lines
+from pr_analyzer.models import FileChange, Suggestion
+from pr_analyzer.security import tools
+
+log = structlog.get_logger(__name__)
+
+# the stage's id in .pr-analyzer.toml
+DEPENDENCY_AUDIT_RULE = "dependency-audit"
+
+# Only exact pins (`name==version`, optionally with extras or an environment marker) are audited.
+# Anything else - ranges, URLs, VCS links, -r/-e/--index-url options - is skipped: handing it to
+# pip would make the analyzer download and build packages chosen by the PR's author.
+PINNED_REQUIREMENT = re.compile(
+    r"^\s*(?P<name>[A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[[^\]]*\])?\s*"
+    r"==\s*(?P<version>[A-Za-z0-9][A-Za-z0-9.+!_-]*)\s*(?:;.*)?$"
+)
+
+
+def is_requirements_file(filename: str) -> bool:
+    # requirements.txt, requirements-dev.txt, dev-requirements.txt, requirements/base.txt, ...
+    parts = filename.replace("\\", "/").lower().split("/")
+    name = parts[-1]
+    in_requirements_dir = len(parts) > 1 and parts[-2] == "requirements"
+    return name.endswith(".txt") and ("requirements" in name or in_requirements_dir)
+
+
+def canonical_name(name: str) -> str:
+    # PEP 503 normalisation, so "Jinja2" in the file matches "jinja2" in pip-audit's output
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+class DepAuditScanner:
+
+    def __init__(self, timeout: int | None = None):
+        self.timeout = timeout or settings.pip_audit_timeout_seconds
+        self.warnings: list[str] = []
+
+    def scan(self, files: list[FileChange]) -> list[Suggestion]:
+        self.warnings = []
+        suggestions = []
+
+        for file in files:
+            if file.status == "removed" or not file.patch or not is_requirements_file(file.filename):
+                continue
+
+            pins = self._extract_added_pins(file)
+            if not pins:
+                continue
+
+            executable = tools.find_tool("pip-audit")
+            if executable is None:
+                self._warn("Dependency audit skipped: pip-audit is not installed "
+                           "(pip install 'pr-analyzer-cli[security]')")
+                break
+
+            log.info("running pip-audit", filename=file.filename, packages=len(pins))
+            requirements = [requirement for requirement, _ in pins.values()]
+            output = self._run_pip_audit(executable, requirements)
+            suggestions.extend(self._parse_audit_output(output, file.filename, pins))
+
+        log.info("dep audit complete", total_suggestions=len(suggestions))
+        return suggestions
+
+    def _extract_added_pins(self, file: FileChange) -> dict[str, tuple[str, int]]:
+        # canonical package name -> ("name==version", line number in the new file)
+        pins = {}
+        skipped = 0
+        for line_no, text in iter_added_lines(file.patch or ""):
+            requirement = re.sub(r"\s+#.*$", "", text).strip()   # pip comments need a space before #
+            if not requirement or requirement.startswith("#"):
+                continue
+            match = PINNED_REQUIREMENT.match(requirement)
+            if match is None:
+                skipped += 1
+                continue
+            name, version = match.group("name"), match.group("version")
+            pins[canonical_name(name)] = (f"{name}=={version}", line_no)
+
+        if skipped:
+            log.info("unpinned_requirements_skipped", filename=file.filename, count=skipped)
+        return pins
+
+    def _run_pip_audit(self, executable: str, requirements: list[str]) -> dict:
+        with tempfile.TemporaryDirectory(prefix="pr-analyzer-pip-audit-") as workdir:
+            path = os.path.join(workdir, "requirements.txt")
+            with open(path, "w", encoding="utf-8") as handle:
+                handle.write("\n".join(requirements) + "\n")
+
+            # --no-deps --disable-pip: look the pinned versions up in the advisory database
+            # without installing, building or resolving anything
+            command = [
+                executable, "-r", path, "--no-deps", "--disable-pip",
+                "--format", "json", "--progress-spinner", "off",
+            ]
+            try:
+                result = subprocess.run(
+                    command,
+                    capture_output=True,
+                    text=True,
+                    timeout=self.timeout,
+                    env=tools.scrubbed_env(),
+                )
+            except subprocess.TimeoutExpired:
+                self._warn(f"Dependency audit skipped: pip-audit took longer than {self.timeout}s")
+                return {}
+            except OSError as e:
+                self._warn(f"Dependency audit skipped: could not run pip-audit ({e})")
+                return {}
+
+        # pip-audit exits 1 both when it finds vulnerabilities and when it fails, so trust the
+        # JSON report rather than the exit code
+        try:
+            output = json.loads(result.stdout) if result.stdout.strip() else None
+        except json.JSONDecodeError:
+            output = None
+        if not isinstance(output, dict):
+            self._warn(f"Dependency audit failed (exit {result.returncode}): "
+                       f"{result.stderr.strip()[:200]}")
+            return {}
+        return output
+
+    def _parse_audit_output(
+        self, output: dict, filename: str, pins: dict[str, tuple[str, int]]
+    ) -> list[Suggestion]:
+        # pip-audit output structure:
+        # output
+        #   dependencies[]
+        #     name     → package name e.g. "flask"
+        #     version  → pinned version e.g. "0.12.2"
+        #     vulns[]
+        #       id          → PYSEC/GHSA id
+        #       aliases[]   → other ids for the same advisory, e.g. a CVE
+        #       description → what the vulnerability is
+        #       fix_versions[] → versions that fix it
+        suggestions = []
+        seen = set()  # pip-audit can list the same advisory more than once
+        for dep in output.get("dependencies") or []:
+            name = dep.get("name", "unknown")
+            version = dep.get("version", "")
+            _, line = pins.get(canonical_name(name), ("", None))
+
+            for vuln in dep.get("vulns") or []:
+                vuln_id = vuln.get("id", "unknown")
+                key = (canonical_name(name), version, vuln_id)
+                if key in seen:
+                    continue
+                seen.add(key)
+                aliases = [a for a in vuln.get("aliases") or [] if a != vuln_id]
+                fix_versions = vuln.get("fix_versions") or []
+                alias_text = f" (also {', '.join(aliases[:3])})" if aliases else ""
+                fix_text = f" Fix: upgrade to {fix_versions[0]}." if fix_versions else ""
+                description = (vuln.get("description") or "").strip()[:300]
+
+                suggestions.append(Suggestion(
+                    filename=filename,
+                    severity="HIGH",
+                    category="security",
+                    # one suggestion per advisory: the id keeps several advisories for the same
+                    # package from being collapsed into one
+                    title=f"Vulnerable dependency: {name}=={version} ({vuln_id})",
+                    description=f"{vuln_id}{alias_text}: {description}{fix_text}",
+                    line=line,
+                    source="security",
+                    rule_id=DEPENDENCY_AUDIT_RULE,
+                ))
+        return suggestions
+
+    def _warn(self, message: str) -> None:
+        log.warning("pip_audit", problem=message)
+        self.warnings.append(message)