proofctl 0.4.1__tar.gz → 0.4.2__tar.gz

{proofctl-0.4.1 → proofctl-0.4.2}/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Kolawolu Odunola
+Copyright (c) 2025-2026 Kolawolu Odunola
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

proofctl-0.4.2/MANIFEST.in

@@ -0,0 +1,19 @@
+graft proofctl
+include README.md
+include LICENSE
+include pyproject.toml
+
+# Internal-only — never ship to PyPI
+prune tests
+prune doc
+prune docs
+prune examples
+prune build
+prune dist
+prune .github
+exclude AUDIT_AND_ROADMAP.md
+exclude AUDIT_VERIFICATION_v0.1.11.md
+
+global-exclude __pycache__
+global-exclude *.py[cod]
+global-exclude .DS_Store

{proofctl-0.4.1 → proofctl-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.4.1
+Version: 0.4.2
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.4.1 → proofctl-0.4.2}/proofctl.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.4.1
+Version: 0.4.2
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.4.1 → proofctl-0.4.2}/proofctl.egg-info/SOURCES.txt

@@ -1,4 +1,5 @@
 LICENSE
+MANIFEST.in
 README.md
 pyproject.toml
 proofctl/__init__.py
@@ -35,36 +36,4 @@ proofctl/checkers/yaml_checker.py
 proofctl/reporters/__init__.py
 proofctl/reporters/html_reporter.py
 proofctl/reporters/json_reporter.py
-proofctl/reporters/terminal.py
-tests/test_baseline.py
-tests/test_config_proofctl.py
-tests/test_dockerfile.py
-tests/test_engine.py
-tests/test_fixer.py
-tests/test_imports.py
-tests/test_leakage.py
-tests/test_llm.py
-tests/test_local_packages.py
-tests/test_phase1_audit_fixes.py
-tests/test_phase2_audit_fixes.py
-tests/test_phase3_audit_fixes.py
-tests/test_phase4_audit_fixes.py
-tests/test_phase5_llm_imports_fixes.py
-tests/test_phase5_p_l_v_fixes.py
-tests/test_phase5_quality_fixes.py
-tests/test_phase6_audit_fixes.py
-tests/test_phase8_audit_fixes.py
-tests/test_placeholders.py
-tests/test_quality.py
-tests/test_quality_ext.py
-tests/test_secrets.py
-tests/test_security.py
-tests/test_security_ext.py
-tests/test_security_external.py
-tests/test_suppression.py
-tests/test_terraform.py
-tests/test_terraform_ext.py
-tests/test_terragrunt.py
-tests/test_variants.py
-tests/test_yaml.py
-tests/test_yaml_k8s_gha.py
+proofctl/reporters/terminal.py

{proofctl-0.4.1 → proofctl-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.4.1"
+version = "0.4.2"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }

proofctl-0.4.1/tests/test_baseline.py

@@ -1,133 +0,0 @@
-from __future__ import annotations
-
-import json
-import tempfile
-from pathlib import Path
-
-from proofctl.baseline import (
-    filter_new_findings,
-    load_baseline,
-    save_baseline,
-)
-from proofctl.models import Finding, Severity
-
-
-def _f(rule_id: str, file: str = "foo.py", msg: str = "test msg", line: int = 1) -> Finding:
-    return Finding(
-        file=file, line=line, col=0,
-        rule_id=rule_id, rule_name="Test",
-        severity=Severity.ERROR, message=msg,
-    )
-
-
-# ── save / load ───────────────────────────────────────────────────────────────
-
-def test_save_creates_file():
-    with tempfile.TemporaryDirectory() as td:
-        root = Path(td)
-        findings = [_f("PROOFCTL-P-001")]
-        out = save_baseline(findings, root)
-        assert out.exists()
-
-
-def test_save_load_roundtrip():
-    """H-10: load_baseline returns the full versioned dict; the actual finding
-    list lives under `findings`. Schema is bumped to 2 by save_baseline."""
-    with tempfile.TemporaryDirectory() as td:
-        root = Path(td)
-        findings = [_f("PROOFCTL-P-001", msg="'foo' body is pass")]
-        save_baseline(findings, root)
-        loaded = load_baseline(root)
-        assert loaded is not None
-        assert loaded["schema_version"] >= 2
-        assert len(loaded["findings"]) == 1
-        assert loaded["findings"][0]["rule_id"] == "PROOFCTL-P-001"
-        assert loaded["findings"][0]["message"] == "'foo' body is pass"
-
-
-def test_load_returns_none_when_no_file():
-    with tempfile.TemporaryDirectory() as td:
-        assert load_baseline(Path(td)) is None
-
-
-def test_load_returns_none_on_corrupt_file():
-    with tempfile.TemporaryDirectory() as td:
-        root = Path(td)
-        (root / ".proofctl-baseline.json").write_text("not json")
-        assert load_baseline(root) is None
-
-
-def test_save_count_field():
-    with tempfile.TemporaryDirectory() as td:
-        root = Path(td)
-        save_baseline([_f("PROOFCTL-P-001"), _f("PROOFCTL-L-001")], root)
-        data = json.loads((root / ".proofctl-baseline.json").read_text())
-        assert data["count"] == 2
-
-
-# ── filter_new_findings ───────────────────────────────────────────────────────
-
-def test_all_in_baseline_suppressed():
-    f = _f("PROOFCTL-P-001", msg="'foo' body is pass")
-    baseline = [{"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"}]
-    assert filter_new_findings([f], baseline) == []
-
-
-def test_new_finding_not_suppressed():
-    f = _f("PROOFCTL-P-001", msg="'bar' body is pass")
-    baseline = [{"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"}]
-    assert filter_new_findings([f], baseline) == [f]
-
-
-def test_different_rule_not_suppressed():
-    f = _f("PROOFCTL-L-001", msg="'foo' body is pass")
-    baseline = [{"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"}]
-    assert filter_new_findings([f], baseline) == [f]
-
-
-def test_different_file_not_suppressed():
-    f = _f("PROOFCTL-P-001", file="bar.py", msg="'foo' body is pass")
-    baseline = [{"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"}]
-    assert filter_new_findings([f], baseline) == [f]
-
-
-def test_line_shift_suppressed():
-    # Same bug moved from line 10 to line 42 — message unchanged → still suppressed.
-    f = _f("PROOFCTL-P-001", msg="'foo' body is pass", line=42)
-    baseline = [{"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"}]
-    assert filter_new_findings([f], baseline) == []
-
-
-def test_empty_baseline_suppresses_nothing():
-    f = _f("PROOFCTL-P-001")
-    assert filter_new_findings([f], []) == [f]
-
-
-def test_multiset_exact_count_suppressed():
-    # Two identical findings in baseline suppress exactly two in new run.
-    f1 = _f("PROOFCTL-P-001", msg="'foo' body is pass")
-    f2 = _f("PROOFCTL-P-001", msg="'foo' body is pass")
-    baseline = [
-        {"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"},
-        {"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"},
-    ]
-    assert filter_new_findings([f1, f2], baseline) == []
-
-
-def test_multiset_one_extra_reported():
-    # Three identical in new run, two in baseline → one new.
-    f = _f("PROOFCTL-P-001", msg="'foo' body is pass")
-    baseline = [
-        {"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"},
-        {"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"},
-    ]
-    result = filter_new_findings([f, f, f], baseline)
-    assert len(result) == 1
-
-
-def test_mixed_findings():
-    f_old = _f("PROOFCTL-P-001", msg="old")
-    f_new = _f("PROOFCTL-Q-001", msg="new")
-    baseline = [{"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "old"}]
-    result = filter_new_findings([f_old, f_new], baseline)
-    assert result == [f_new]

proofctl-0.4.1/tests/test_config_proofctl.py

@@ -1,133 +0,0 @@
-"""Tests for proofctl config loading."""
-from __future__ import annotations
-
-from pathlib import Path
-
-import pytest
-
-from proofctl.config import ProofctlConfig, load_config
-from proofctl.models import Severity
-
-
-# ── defaults ──────────────────────────────────────────────────────────────────
-
-def test_load_config_no_file_returns_defaults(tmp_path):
-    cfg = load_config(tmp_path)
-    assert isinstance(cfg, ProofctlConfig)
-    assert "**/.venv/**" in cfg.exclude_paths
-    assert cfg.disable == []
-    assert cfg.severity_overrides == {}
-    assert cfg.any_threshold == 3
-
-
-def test_default_excludes_include_vendor_generated_paths(tmp_path):
-    """All vendor/generated tool paths must be present in default excludes."""
-    cfg = load_config(tmp_path)
-    required = [
-        # Flux CD bootstrap files
-        "**/flux-system/gotk-components.yaml",
-        "**/flux-system/gotk-sync.yaml",
-        # ArgoCD Autopilot bootstrap files
-        "**/bootstrap/argo-cd/kustomization.yaml",
-        "**/bootstrap/argo-cd.yaml",
-        # Terraform generated artifacts
-        "**/*.tfstate",
-        "**/*.tfplan",
-        # CDK tools
-        "**/cdk.out/**",
-        "**/.gen/**",
-        # Helm chart tarballs
-        "**/charts/*.tgz",
-        # Pulumi local backend
-        "**/.pulumi/**",
-        # Go vendor
-        "**/vendor/**",
-        # Python caches
-        "**/.tox/**",
-        "**/.pytest_cache/**",
-        "**/.mypy_cache/**",
-    ]
-    for pat in required:
-        assert pat in cfg.exclude_paths, f"missing default exclude: {pat}"
-
-
-def test_load_config_empty_file_returns_defaults(tmp_path):
-    (tmp_path / ".proofctl.yaml").write_text("")
-    cfg = load_config(tmp_path)
-    assert cfg.any_threshold == 3
-
-
-# ── overrides ─────────────────────────────────────────────────────────────────
-
-def test_load_config_disable_rule(tmp_path):
-    (tmp_path / ".proofctl.yaml").write_text("disable:\n  - PROOFCTL-P-001\n")
-    cfg = load_config(tmp_path)
-    assert cfg.is_disabled("PROOFCTL-P-001")
-    assert not cfg.is_disabled("PROOFCTL-P-002")
-
-
-def test_load_config_severity_override(tmp_path):
-    yaml = "severity_overrides:\n  PROOFCTL-P-001: ERROR\n"
-    (tmp_path / ".proofctl.yaml").write_text(yaml)
-    cfg = load_config(tmp_path)
-    assert cfg.effective_severity("PROOFCTL-P-001", Severity.WARNING) == Severity.ERROR
-
-
-def test_load_config_severity_override_invalid_raises_at_load(tmp_path):
-    """AUDIT H-8: bad severity_overrides values must fail at load_config(),
-    not silently propagate to the first finding (which had no file context)."""
-    yaml = "severity_overrides:\n  PROOFCTL-P-001: BOGUS\n"
-    (tmp_path / ".proofctl.yaml").write_text(yaml)
-    with pytest.raises(ValueError, match="invalid"):
-        load_config(tmp_path)
-
-
-def test_load_config_exclude_paths_override(tmp_path):
-    (tmp_path / ".proofctl.yaml").write_text("exclude_paths:\n  - '**/generated/**'\n")
-    cfg = load_config(tmp_path)
-    assert "**/generated/**" in cfg.exclude_paths
-
-
-# ── rule-level config ─────────────────────────────────────────────────────────
-
-def test_load_config_p002_any_threshold(tmp_path):
-    yaml = "rules:\n  PROOFCTL-Q-003:\n    any_threshold: 5\n"
-    (tmp_path / ".proofctl.yaml").write_text(yaml)
-    cfg = load_config(tmp_path)
-    assert cfg.any_threshold == 5
-
-
-def test_load_config_p002_todo_allowed(tmp_path):
-    yaml = "rules:\n  PROOFCTL-P-002:\n    allowed_formats:\n      - 'TODO\\(#\\d+\\)'\n"
-    (tmp_path / ".proofctl.yaml").write_text(yaml)
-    cfg = load_config(tmp_path)
-    assert len(cfg.todo_allowed_formats) == 1
-
-
-# ── is_disabled ───────────────────────────────────────────────────────────────
-
-def test_is_disabled_true():
-    cfg = ProofctlConfig(disable=["PROOFCTL-S-001"])
-    assert cfg.is_disabled("PROOFCTL-S-001")
-
-
-def test_is_disabled_false():
-    cfg = ProofctlConfig(disable=["PROOFCTL-S-001"])
-    assert not cfg.is_disabled("PROOFCTL-S-002")
-
-
-def test_is_disabled_empty():
-    cfg = ProofctlConfig()
-    assert not cfg.is_disabled("ANYTHING")
-
-
-# ── effective_severity ────────────────────────────────────────────────────────
-
-def test_effective_severity_no_override_returns_default():
-    cfg = ProofctlConfig()
-    assert cfg.effective_severity("PROOFCTL-P-001", Severity.WARNING) == Severity.WARNING
-
-
-def test_effective_severity_override_applied():
-    cfg = ProofctlConfig(severity_overrides={"PROOFCTL-P-001": "ERROR"})
-    assert cfg.effective_severity("PROOFCTL-P-001", Severity.WARNING) == Severity.ERROR