pycodegate 0.1.0__py3-none-any.whl

pycodegate/rules/security.py

@@ -0,0 +1,167 @@
+"""Security rules: eval, exec, pickle, yaml, secrets, weak hashes."""
+
+from __future__ import annotations
+
+import ast
+import re
+
+from pycodegate.rules.base import BaseRules
+from pycodegate.types import Category, Diagnostic, Severity
+
+# Patterns that suggest a hardcoded secret
+_SECRET_VAR_PATTERNS = re.compile(
+    r"(api_key|apikey|secret|password|passwd|token|auth_token|private_key|"
+    r"access_key|secret_key|credentials)",
+    re.IGNORECASE,
+)
+
+# Patterns that look like actual secret values (not empty/placeholder)
+_SECRET_VALUE_MIN_LENGTH = 7
+
+
+class SecurityRules(BaseRules):
+    """Security-related checks."""
+
+    def check(self, source: str, filename: str) -> list[Diagnostic]:
+        tree = self._parse(source)
+        if tree is None:
+            return []
+
+        diags: list[Diagnostic] = []
+        diags.extend(self._check_eval_exec(tree, filename))
+        diags.extend(self._check_pickle(tree, filename))
+        diags.extend(self._check_yaml(tree, filename))
+        diags.extend(self._check_hardcoded_secrets(tree, filename))
+        diags.extend(self._check_weak_hash(tree, filename))
+        return diags
+
+    def _check_eval_exec(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Call) and isinstance(node.func, ast.Name):
+                if node.func.id == "eval":
+                    diags.append(
+                        Diagnostic(
+                            file_path=filename,
+                            rule="no-eval",
+                            severity=Severity.ERROR,
+                            category=Category.SECURITY,
+                            message="Avoid eval() — it executes arbitrary code",
+                            help="Use ast.literal_eval() for safe parsing of literals",
+                            line=node.lineno,
+                            column=node.col_offset,
+                            cost=3.0,
+                        )
+                    )
+                elif node.func.id == "exec":
+                    diags.append(
+                        Diagnostic(
+                            file_path=filename,
+                            rule="no-exec",
+                            severity=Severity.ERROR,
+                            category=Category.SECURITY,
+                            message="Avoid exec() — it executes arbitrary code",
+                            help="Refactor to avoid dynamic code execution",
+                            line=node.lineno,
+                            column=node.col_offset,
+                            cost=3.0,
+                        )
+                    )
+        return diags
+
+    def _check_pickle(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute):
+                if node.func.attr in ("load", "loads") and isinstance(node.func.value, ast.Name):
+                    if node.func.value.id == "pickle":
+                        diags.append(
+                            Diagnostic(
+                                file_path=filename,
+                                rule="no-pickle-load",
+                                severity=Severity.ERROR,
+                                category=Category.SECURITY,
+                                message="pickle.load() can execute arbitrary code on untrusted data",
+                                help="Use JSON or a safe serialization format for untrusted data",
+                                line=node.lineno,
+                                column=node.col_offset,
+                                cost=3.0,
+                            )
+                        )
+        return diags
+
+    def _check_yaml(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute):
+                if (
+                    node.func.attr == "load"
+                    and isinstance(node.func.value, ast.Name)
+                    and node.func.value.id == "yaml"
+                ):
+                    has_loader = any(kw.arg == "Loader" for kw in node.keywords)
+                    if not has_loader:
+                        diags.append(
+                            Diagnostic(
+                                file_path=filename,
+                                rule="no-unsafe-yaml-load",
+                                severity=Severity.ERROR,
+                                category=Category.SECURITY,
+                                message="yaml.load() without Loader is unsafe — can execute arbitrary code",
+                                help="Use yaml.safe_load() or pass Loader=yaml.SafeLoader",
+                                line=node.lineno,
+                                column=node.col_offset,
+                                cost=3.0,
+                            )
+                        )
+        return diags
+
+    def _check_hardcoded_secrets(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Assign):
+                continue
+            if not isinstance(node.value, ast.Constant) or not isinstance(node.value.value, str):
+                continue
+            if len(node.value.value) < _SECRET_VALUE_MIN_LENGTH:
+                continue
+            for target in node.targets:
+                if isinstance(target, ast.Name) and _SECRET_VAR_PATTERNS.search(target.id):
+                    diags.append(
+                        Diagnostic(
+                            file_path=filename,
+                            rule="no-hardcoded-secret",
+                            severity=Severity.ERROR,
+                            category=Category.SECURITY,
+                            message=f"Hardcoded secret in '{target.id}' — use environment variables",
+                            help="Use os.environ or a .env file via python-dotenv",
+                            line=node.lineno,
+                            column=node.col_offset,
+                            cost=3.0,
+                        )
+                    )
+        return diags
+
+    def _check_weak_hash(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute):
+                if (
+                    node.func.attr in ("md5", "sha1")
+                    and isinstance(node.func.value, ast.Name)
+                    and node.func.value.id == "hashlib"
+                ):
+                    diags.append(
+                        Diagnostic(
+                            file_path=filename,
+                            rule="no-weak-hash",
+                            severity=Severity.WARNING,
+                            category=Category.SECURITY,
+                            message=f"hashlib.{node.func.attr}() is cryptographically weak",
+                            help="Use hashlib.sha256() or hashlib.sha3_256() instead",
+                            line=node.lineno,
+                            column=node.col_offset,
+                            cost=1.0,
+                        )
+                    )
+        return diags

pycodegate/rules/structure.py

@@ -0,0 +1,242 @@
+"""Structure rules: project-level health checks."""
+
+from __future__ import annotations
+
+import ast
+from pathlib import Path
+
+from pycodegate.types import Category, Diagnostic, Severity
+
+
+class StructureRules:
+    """Project-level structure health checks."""
+
+    def check_project(self, project_path: str, source_files: list[str]) -> list[Diagnostic]:
+        """Run all structure checks on the project."""
+        path = Path(project_path)
+        diags: list[Diagnostic] = []
+
+        diags.extend(self._check_large_files(source_files))
+        diags.extend(self._check_tests(path, source_files))
+        diags.extend(self._check_readme(path))
+        diags.extend(self._check_license(path))
+        diags.extend(self._check_gitignore(path))
+        diags.extend(self._check_linter_config(path))
+        diags.extend(self._check_type_checker(path))
+        diags.extend(self._check_type_coverage(source_files))
+
+        return diags
+
+    def _check_large_files(self, files: list[str]) -> list[Diagnostic]:
+        diags = []
+        for f in files:
+            try:
+                line_count = len(Path(f).read_text().splitlines())
+                if line_count > 1000:
+                    diags.append(
+                        Diagnostic(
+                            file_path=f,
+                            rule="structure/large-file",
+                            severity=Severity.WARNING,
+                            category=Category.STRUCTURE,
+                            message=f"File is {line_count} lines (max 1000)",
+                            help="Split into smaller, focused modules",
+                            line=1,
+                            cost=1.0,
+                        )
+                    )
+            except (OSError, UnicodeDecodeError):
+                pass
+        return diags
+
+    def _check_tests(self, path: Path, source_files: list[str]) -> list[Diagnostic]:
+        test_files = [
+            f
+            for f in source_files
+            if Path(f).stem.startswith("test_") or Path(f).stem.endswith("_test") or "/tests/" in f
+        ]
+        src_files = [f for f in source_files if f not in test_files]
+
+        if not test_files:
+            return [
+                Diagnostic(
+                    file_path=str(path),
+                    rule="structure/no-tests",
+                    severity=Severity.WARNING,
+                    category=Category.STRUCTURE,
+                    message="No test files found",
+                    help="Add tests to improve code reliability",
+                    line=0,
+                    cost=3.0,
+                )
+            ]
+
+        # Test ratio check
+        test_lines = sum(
+            len(Path(f).read_text().splitlines()) for f in test_files if Path(f).exists()
+        )
+        src_lines = sum(
+            len(Path(f).read_text().splitlines()) for f in src_files if Path(f).exists()
+        )
+
+        if src_lines > 0:
+            ratio = test_lines / src_lines
+            if ratio < 0.1:
+                return [
+                    Diagnostic(
+                        file_path=str(path),
+                        rule="structure/low-test-ratio",
+                        severity=Severity.WARNING,
+                        category=Category.STRUCTURE,
+                        message=f"Test:source ratio is {ratio:.1f} (< 0.3)",
+                        help="Add more tests to improve coverage",
+                        line=0,
+                        cost=2.0,
+                    )
+                ]
+            elif ratio < 0.3:
+                return [
+                    Diagnostic(
+                        file_path=str(path),
+                        rule="structure/low-test-ratio",
+                        severity=Severity.WARNING,
+                        category=Category.STRUCTURE,
+                        message=f"Test:source ratio is {ratio:.1f} (< 0.3)",
+                        help="Add more tests to improve coverage",
+                        line=0,
+                        cost=1.0,
+                    )
+                ]
+        return []
+
+    def _check_readme(self, path: Path) -> list[Diagnostic]:
+        for name in ["README.md", "README.rst", "README", "readme.md"]:
+            if (path / name).exists():
+                return []
+        return [
+            Diagnostic(
+                file_path=str(path),
+                rule="structure/no-readme",
+                severity=Severity.WARNING,
+                category=Category.STRUCTURE,
+                message="No README file found",
+                help="Add a README.md describing your project",
+                line=0,
+                cost=1.0,
+            )
+        ]
+
+    def _check_license(self, path: Path) -> list[Diagnostic]:
+        for name in ["LICENSE", "LICENSE.md", "LICENSE.txt", "LICENCE", "COPYING"]:
+            if (path / name).exists():
+                return []
+        return [
+            Diagnostic(
+                file_path=str(path),
+                rule="structure/no-license",
+                severity=Severity.WARNING,
+                category=Category.STRUCTURE,
+                message="No LICENSE file found",
+                help="Add a LICENSE file to clarify usage terms",
+                line=0,
+                cost=0.5,
+            )
+        ]
+
+    def _check_gitignore(self, path: Path) -> list[Diagnostic]:
+        if (path / ".gitignore").exists():
+            return []
+        return [
+            Diagnostic(
+                file_path=str(path),
+                rule="structure/no-gitignore",
+                severity=Severity.WARNING,
+                category=Category.STRUCTURE,
+                message="No .gitignore file found",
+                help="Add a .gitignore to exclude build artifacts and secrets",
+                line=0,
+                cost=0.5,
+            )
+        ]
+
+    def _check_linter_config(self, path: Path) -> list[Diagnostic]:
+        # Check for ruff, flake8, pylint configs
+        if (path / "ruff.toml").exists() or (path / ".flake8").exists():
+            return []
+        pyproject = path / "pyproject.toml"
+        if pyproject.exists():
+            content = pyproject.read_text()
+            if "[tool.ruff]" in content or "[tool.flake8]" in content or "[tool.pylint]" in content:
+                return []
+        return [
+            Diagnostic(
+                file_path=str(path),
+                rule="structure/no-linter-config",
+                severity=Severity.WARNING,
+                category=Category.STRUCTURE,
+                message="No linter configuration found",
+                help="Add ruff or flake8 config to enforce code style",
+                line=0,
+                cost=0.5,
+            )
+        ]
+
+    def _check_type_checker(self, path: Path) -> list[Diagnostic]:
+        if (
+            (path / "mypy.ini").exists()
+            or (path / "pyrightconfig.json").exists()
+            or (path / ".mypy.ini").exists()
+        ):
+            return []
+        pyproject = path / "pyproject.toml"
+        if pyproject.exists():
+            content = pyproject.read_text()
+            if "[tool.mypy]" in content or "[tool.pyright]" in content:
+                return []
+        return [
+            Diagnostic(
+                file_path=str(path),
+                rule="structure/no-type-checker",
+                severity=Severity.WARNING,
+                category=Category.STRUCTURE,
+                message="No type checker configuration found",
+                help="Add mypy or pyright config for type safety",
+                line=0,
+                cost=0.5,
+            )
+        ]
+
+    def _check_type_coverage(self, source_files: list[str]) -> list[Diagnostic]:
+        """Check what fraction of functions have type annotations."""
+        total_funcs = 0
+        annotated_funcs = 0
+        for f in source_files:
+            # Skip test files
+            if Path(f).stem.startswith("test_") or Path(f).stem.endswith("_test") or "/tests/" in f:
+                continue
+            try:
+                tree = ast.parse(Path(f).read_text())
+            except (SyntaxError, OSError, UnicodeDecodeError):
+                continue
+            for node in ast.walk(tree):
+                if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                    total_funcs += 1
+                    if node.returns or any(a.annotation for a in node.args.args if a.arg != "self"):
+                        annotated_funcs += 1
+
+        if total_funcs > 0:
+            coverage = annotated_funcs / total_funcs
+            if coverage < 0.5:
+                return [
+                    Diagnostic(
+                        file_path="project",
+                        rule="structure/low-type-coverage",
+                        severity=Severity.WARNING,
+                        category=Category.STRUCTURE,
+                        message=f"Only {coverage:.0%} of functions have type annotations (< 50%)",
+                        help="Add return type and parameter annotations to functions",
+                        line=0,
+                        cost=1.0,
+                    )
+                ]
+        return []

pycodegate/scan.py

@@ -0,0 +1,201 @@
+"""Scan orchestration: runs lint + dead code in parallel, produces ScanResult."""
+
+from __future__ import annotations
+
+import fnmatch
+import time
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from pycodegate.discover import discover_project
+from pycodegate.profile import PROFILES, detect_profile
+from pycodegate.rules import get_all_rule_sets, get_framework_rules
+from pycodegate.rules.dead_code import DeadCodeRules
+from pycodegate.rules.dependencies import DependencyRules
+from pycodegate.rules.imports import ImportsRules
+from pycodegate.rules.structure import StructureRules
+from pycodegate.score import calculate_score
+from pycodegate.types import Diagnostic, ScanResult
+from pycodegate.utils.diff import get_changed_files
+from pycodegate.utils.file_discovery import find_python_files
+
+if TYPE_CHECKING:
+    from pycodegate.config import Config
+
+
+def scan_project(
+    project_path: str,
+    config: Config,
+    diff_base: str | None = None,
+) -> ScanResult:
+    """Run full scan and return results."""
+    start = time.monotonic()
+    project = discover_project(project_path)
+
+    # Resolve profile: config/CLI override takes precedence over auto-detection
+    if config.profile and config.profile in PROFILES:
+        profile = PROFILES[config.profile]
+    else:
+        profile = detect_profile(project_path)
+
+    files = _resolve_files(project_path, diff_base)
+    all_diags = _run_checks(files, project.framework, project_path, config)
+    all_diags = _apply_filters(all_diags, config, project_path, profile.suppressed_rules)
+    max_deduction_overrides = _build_max_deduction_overrides(
+        profile.max_deduction_overrides, config.max_deduction
+    )
+    score = calculate_score(all_diags, max_deduction_overrides=max_deduction_overrides)
+    elapsed = int((time.monotonic() - start) * 1000)
+
+    return ScanResult(
+        score=score,
+        diagnostics=all_diags,
+        project=project,
+        elapsed_ms=elapsed,
+        profile=profile.name,
+    )
+
+
+def _resolve_files(project_path: str, diff_base: str | None) -> list[Path]:
+    """Determine which files to scan."""
+    if diff_base:
+        files = get_changed_files(project_path, diff_base)
+        if files is not None:
+            return files
+    return find_python_files(project_path)
+
+
+def _run_checks(
+    files: list[Path],
+    framework: str | None,
+    project_path: str,
+    config: Config,
+) -> list[Diagnostic]:
+    """Run lint + dead code + imports + structure + dependency checks in parallel."""
+    str_files = [str(f) for f in files]
+    with ThreadPoolExecutor(max_workers=5) as executor:
+        lint_future = executor.submit(_run_lint, files, framework, config) if config.lint else None
+        dead_code_future = (
+            executor.submit(_run_dead_code, project_path, config) if config.dead_code else None
+        )
+        imports_future = (
+            executor.submit(_run_imports, project_path, str_files) if str_files else None
+        )
+        structure_future = (
+            executor.submit(_run_structure, project_path, str_files)
+            if config.lint and str_files
+            else None
+        )
+        dependencies_future = executor.submit(_run_dependencies, project_path)
+
+        lint_diags = lint_future.result() if lint_future else []
+        dead_code_diags = dead_code_future.result() if dead_code_future else []
+        imports_diags = imports_future.result() if imports_future else []
+        structure_diags = structure_future.result() if structure_future else []
+        dependencies_diags = dependencies_future.result()
+
+    return lint_diags + dead_code_diags + imports_diags + structure_diags + dependencies_diags
+
+
+def _apply_filters(
+    diags: list[Diagnostic],
+    config: Config,
+    project_path: str = ".",
+    suppressed_rules: frozenset[str] | None = None,
+) -> list[Diagnostic]:
+    """Apply ignore_rules, profile suppressed_rules, ignore_files, and per_file_suppress filters."""
+    combined_ignore = set(config.ignore_rules)
+    if suppressed_rules:
+        combined_ignore |= suppressed_rules
+    if combined_ignore:
+        diags = [d for d in diags if d.rule not in combined_ignore]
+    root = Path(project_path).resolve()
+    if config.ignore_files:
+        diags = [d for d in diags if not _matches_ignore(d.file_path, config.ignore_files, root)]
+    if config.per_file_suppress:
+        diags = [
+            d for d in diags if not _matches_per_file_suppress(d, config.per_file_suppress, root)
+        ]
+    return diags
+
+
+def _matches_per_file_suppress(
+    d: Diagnostic, per_file_suppress: dict[str, list[str]], root: Path
+) -> bool:
+    """Check if a diagnostic is suppressed by per_file_suppress config."""
+    p = Path(d.file_path)
+    try:
+        rel = str(p.resolve().relative_to(root))
+    except ValueError:
+        rel = d.file_path
+    return any(
+        d.rule in rules and (fnmatch.fnmatch(rel, pat) or fnmatch.fnmatch(d.file_path, pat))
+        for pat, rules in per_file_suppress.items()
+    )
+
+
+def _build_max_deduction_overrides(
+    profile_overrides: dict[str, int], config_overrides: dict[str, int]
+) -> dict[str, int] | None:
+    """Merge profile and config max_deduction overrides, config takes precedence.
+
+    Profile overrides use title-case keys (e.g. "Security").
+    Config overrides use lowercase keys (e.g. "security") which are title-cased here.
+    """
+    merged: dict[str, int] = dict(profile_overrides)
+    for key, val in config_overrides.items():
+        merged[key.title()] = val
+    return merged or None
+
+
+def _matches_ignore(file_path: str, patterns: list[str], root: Path) -> bool:
+    """Check if a file path matches any ignore pattern (absolute or relative)."""
+    p = Path(file_path)
+    # Try relative path from project root
+    try:
+        rel = str(p.resolve().relative_to(root))
+    except ValueError:
+        rel = file_path
+    return any(fnmatch.fnmatch(rel, pat) or fnmatch.fnmatch(file_path, pat) for pat in patterns)
+
+
+def _run_lint(
+    files: list[Path],
+    framework: str | None,
+    config: Config,
+) -> list[Diagnostic]:
+    """Run all rule sets against all files."""
+    rule_sets = get_all_rule_sets() + get_framework_rules(framework)
+    diags: list[Diagnostic] = []
+
+    for file_path in files:
+        try:
+            source = file_path.read_text(encoding="utf-8", errors="ignore")
+        except (OSError, UnicodeDecodeError):
+            continue
+
+        for rules in rule_sets:
+            diags.extend(rules.check(source, str(file_path)))
+
+    return diags
+
+
+def _run_dead_code(project_path: str, config: Config) -> list[Diagnostic]:
+    """Run dead code detection."""
+    return DeadCodeRules().check_project(project_path)
+
+
+def _run_imports(project_path: str, source_files: list[str]) -> list[Diagnostic]:
+    """Run circular import detection."""
+    return ImportsRules().check_project(project_path, source_files)
+
+
+def _run_structure(project_path: str, source_files: list[str]) -> list[Diagnostic]:
+    """Run project-level structure checks."""
+    return StructureRules().check_project(project_path, source_files)
+
+
+def _run_dependencies(project_path: str) -> list[Diagnostic]:
+    """Run dependency vulnerability checks."""
+    return DependencyRules().check_project(project_path)

pycodegate/score.py

@@ -0,0 +1,69 @@
+"""Score calculation from diagnostics using weighted category-budget scoring."""
+
+from __future__ import annotations
+
+from collections import defaultdict
+
+from pycodegate.constants import (
+    CATEGORY_WEIGHTS,
+    FRAMEWORK_CATEGORY_MAP,
+    LABEL_CRITICAL,
+    LABEL_EXCELLENT,
+    LABEL_GREAT,
+    LABEL_NEEDS_WORK,
+)
+from pycodegate.types import Diagnostic, Score
+
+
+def calculate_score(
+    diagnostics: list[Diagnostic], max_deduction_overrides: dict | None = None
+) -> Score:
+    """Calculate a 0-100 health score from diagnostics using category budgets.
+
+    Each category has a weight that determines its maximum deduction budget.
+    Within a category, the top 3 findings are counted at full cost; additional
+    findings apply diminishing returns (10% each) to reward fixing top issues.
+    """
+    # 1. Compute max_deduction per category from weights
+    total_weight = sum(CATEGORY_WEIGHTS.values())
+    max_deductions = {cat: round(w / total_weight * 100) for cat, w in CATEGORY_WEIGHTS.items()}
+
+    # Fix rounding: adjust highest-weight category so sum == 100
+    diff = 100 - sum(max_deductions.values())
+    if diff != 0:
+        highest = max(CATEGORY_WEIGHTS, key=CATEGORY_WEIGHTS.get)
+        max_deductions[highest] += diff
+
+    # Apply overrides
+    if max_deduction_overrides:
+        for cat, val in max_deduction_overrides.items():
+            if cat in max_deductions:
+                max_deductions[cat] = val
+
+    # 2. Group diagnostics by resolved category
+    by_category: dict = defaultdict(list)
+    for d in diagnostics:
+        resolved = FRAMEWORK_CATEGORY_MAP.get(d.category, d.category)
+        by_category[resolved].append(d)
+
+    # 3. Calculate deduction per category with diminishing returns
+    total_deduction = 0.0
+    for cat, diags in by_category.items():
+        costs = sorted([d.cost for d in diags], reverse=True)
+        # Top 3 at full cost, rest at 10%
+        cat_total = sum(c if i < 3 else c * 0.1 for i, c in enumerate(costs))
+        cap = max_deductions.get(cat, 10)
+        total_deduction += min(cat_total, cap)
+
+    value = max(0, round(100 - total_deduction))
+
+    if value >= 90:
+        label = LABEL_EXCELLENT
+    elif value >= 75:
+        label = LABEL_GREAT
+    elif value >= 50:
+        label = LABEL_NEEDS_WORK
+    else:
+        label = LABEL_CRITICAL
+
+    return Score(value=value, label=label)