pycodegate 0.1.3__py3-none-any.whl → 0.3.0__py3-none-any.whl

pycodegate/__init__.py

@@ -1,3 +1,3 @@
 """Python Doctor - Diagnose your Python project's health."""
 
-__version__ = "0.1.3"
+__version__ = "0.2.0"

pycodegate/cli.py

@@ -9,7 +9,7 @@ import click
 
 from pycodegate import __version__
 from pycodegate.config import load_config
-from pycodegate.output import output_json, print_scan_result
+from pycodegate.output import output_json, output_sarif, print_scan_result
 from pycodegate.scan import scan_project
 from pycodegate.types import Severity
 from pycodegate.utils.badge import generate_badge, generate_ci_workflow
@@ -35,6 +35,7 @@ class CliOptions:
     ci_workflow: bool
     precommit: bool
     min_score: int | None
+    sarif_output: bool
 
 
 def _handle_early_exits(opts: CliOptions) -> bool:
@@ -81,7 +82,9 @@ def _output_result(opts: CliOptions, result) -> None:
         click.echo(generate_badge(result.score.value, result.score.label))
         return
 
-    if opts.json_output:
+    if opts.sarif_output:
+        output_sarif(result)
+    elif opts.json_output:
         output_json(result)
     elif opts.score_only:
         click.echo(str(result.score.value))
@@ -152,6 +155,13 @@ def _apply_exit_codes(opts: CliOptions, result) -> None:
     default=None,
     help="Minimum score threshold (exit 1 if below).",
 )
+@click.option(
+    "--sarif",
+    "sarif_output",
+    is_flag=True,
+    default=False,
+    help="Output in SARIF format for GitHub Code Scanning.",
+)
 def main(
     directory: str,
     lint: bool,
@@ -167,6 +177,7 @@ def main(
     ci_workflow: bool,
     precommit: bool,
     min_score: int | None,
+    sarif_output: bool,
 ) -> None:
     """PyCodeGate — Diagnose your Python project's health."""
     opts = CliOptions(
@@ -184,6 +195,7 @@ def main(
         ci_workflow=ci_workflow,
         precommit=precommit,
         min_score=min_score,
+        sarif_output=sarif_output,
     )
 
     if _handle_early_exits(opts):

pycodegate/constants.py

@@ -29,4 +29,12 @@ FRAMEWORK_CATEGORY_MAP: dict = {
     Category.DJANGO: Category.SECURITY,
     Category.FASTAPI: Category.CORRECTNESS,
     Category.FLASK: Category.SECURITY,
+    Category.PYDANTIC: Category.CORRECTNESS,
+    Category.SQLALCHEMY: Category.SECURITY,
+    Category.CELERY: Category.CORRECTNESS,
+    Category.REQUESTS: Category.SECURITY,
+    Category.LOGGING: Category.CORRECTNESS,
+    Category.PANDAS: Category.CORRECTNESS,
+    Category.PYTEST: Category.CORRECTNESS,
+    Category.NUMPY: Category.CORRECTNESS,
 }

pycodegate/discover.py

@@ -23,6 +23,7 @@ def discover_project(project_path: str) -> ProjectInfo:
         test_framework=_detect_test_framework(deps),
         has_type_hints=_detect_type_hints(root),
         source_file_count=len(find_python_files(project_path)),
+        frameworks=_detect_frameworks(deps),
     )
 
 
@@ -76,6 +77,32 @@ def _detect_framework(deps: set[str]) -> str | None:
     return None
 
 
+def _detect_frameworks(deps: set[str]) -> list[str]:
+    """Detect all frameworks and libraries present in project dependencies."""
+    found: list[str] = []
+    if "django" in deps or "django-rest-framework" in deps or "djangorestframework" in deps:
+        found.append("django")
+    if "fastapi" in deps:
+        found.append("fastapi")
+    if "flask" in deps:
+        found.append("flask")
+    if "pydantic" in deps:
+        found.append("pydantic")
+    if "sqlalchemy" in deps:
+        found.append("sqlalchemy")
+    if "celery" in deps:
+        found.append("celery")
+    if "requests" in deps or "httpx" in deps:
+        found.append("requests")
+    if "pandas" in deps:
+        found.append("pandas")
+    if "pytest" in deps:
+        found.append("pytest")
+    if "numpy" in deps:
+        found.append("numpy")
+    return found
+
+
 def _detect_package_manager(root: Path) -> str | None:
     if (root / "uv.lock").exists():
         return "uv"

pycodegate/output.py

@@ -213,6 +213,68 @@ def output_json(result: ScanResult) -> None:
     sys.stdout.write(json.dumps(payload, indent=2) + "\n")
 
 
+def _sarif_rules(diagnostics: list[Diagnostic]) -> list[dict]:
+    """Build SARIF rules registry from unique diagnostic rules."""
+    seen: dict[str, Diagnostic] = {}
+    for d in diagnostics:
+        if d.rule not in seen:
+            seen[d.rule] = d
+    return [
+        {
+            "id": rule_id,
+            "name": rule_id,
+            "shortDescription": {"text": diag.message},
+            "helpUri": "",
+            "help": {"text": diag.help},
+        }
+        for rule_id, diag in seen.items()
+    ]
+
+
+def _sarif_results(diagnostics: list[Diagnostic]) -> list[dict]:
+    """Build SARIF results array from diagnostics."""
+    return [
+        {
+            "ruleId": d.rule,
+            "level": "error" if d.severity == Severity.ERROR else "warning",
+            "message": {"text": d.message},
+            "locations": [
+                {
+                    "physicalLocation": {
+                        "artifactLocation": {"uri": d.file_path},
+                        "region": {
+                            "startLine": d.line,
+                            "startColumn": (d.column or 0) + 1,
+                        },
+                    }
+                }
+            ],
+        }
+        for d in diagnostics
+    ]
+
+
+def output_sarif(result: ScanResult) -> None:
+    """Output the scan result in SARIF 2.1.0 format for GitHub Code Scanning."""
+    sarif = {
+        "version": "2.1.0",
+        "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "PyCodeGate",
+                        "version": __version__,
+                        "rules": _sarif_rules(result.diagnostics),
+                    }
+                },
+                "results": _sarif_results(result.diagnostics),
+            }
+        ],
+    }
+    sys.stdout.write(json.dumps(sarif, indent=2) + "\n")
+
+
 def _print_rule_details(
     console: Console,
     rule_diags: list[Diagnostic],

pycodegate/rules/__init__.py

@@ -1,9 +1,10 @@
-"""Rule registry for python-doctor."""
+"""Rule registry for pycodegate."""
 
 from __future__ import annotations
 
 from pycodegate.rules.architecture import ArchitectureRules
 from pycodegate.rules.base import BaseRules
+from pycodegate.rules.celery import CeleryRules
 from pycodegate.rules.complexity import ComplexityRules
 from pycodegate.rules.correctness import CorrectnessRules
 from pycodegate.rules.dependencies import DependencyRules as DependencyRules
@@ -11,8 +12,15 @@ from pycodegate.rules.django import DjangoRules
 from pycodegate.rules.fastapi import FastAPIRules
 from pycodegate.rules.flask import FlaskRules
 from pycodegate.rules.imports import ImportsRules as ImportsRules
+from pycodegate.rules.logging_rules import LoggingRules
+from pycodegate.rules.numpy_rules import NumpyRules
+from pycodegate.rules.pandas_rules import PandasRules
 from pycodegate.rules.performance import PerformanceRules
+from pycodegate.rules.pydantic import PydanticRules
+from pycodegate.rules.pytest_rules import PytestRules
+from pycodegate.rules.requests_rules import RequestsRules
 from pycodegate.rules.security import SecurityRules
+from pycodegate.rules.sqlalchemy import SQLAlchemyRules
 from pycodegate.rules.structure import StructureRules as StructureRules
 
 
@@ -27,12 +35,21 @@ def get_all_rule_sets() -> list[BaseRules]:
     ]
 
 
-def get_framework_rules(framework: str | None) -> list[BaseRules]:
-    """Return framework-specific rule sets."""
-    _framework_map: dict[str, type[BaseRules]] = {
-        "django": DjangoRules,
-        "fastapi": FastAPIRules,
-        "flask": FlaskRules,
-    }
-    cls = _framework_map.get(framework or "")
-    return [cls()] if cls else []
+_FRAMEWORK_MAP: dict[str, type[BaseRules]] = {
+    "django": DjangoRules,
+    "fastapi": FastAPIRules,
+    "flask": FlaskRules,
+    "pydantic": PydanticRules,
+    "sqlalchemy": SQLAlchemyRules,
+    "celery": CeleryRules,
+    "requests": RequestsRules,
+    "logging": LoggingRules,
+    "pandas": PandasRules,
+    "pytest": PytestRules,
+    "numpy": NumpyRules,
+}
+
+
+def get_framework_rules(frameworks: list[str]) -> list[BaseRules]:
+    """Return framework/library-specific rule sets for all detected frameworks."""
+    return [_FRAMEWORK_MAP[f]() for f in frameworks if f in _FRAMEWORK_MAP]

pycodegate/rules/celery.py

@@ -0,0 +1,177 @@
+"""Celery-specific rules: missing bind, retry without exc, broad autoretry, direct call."""
+
+from __future__ import annotations
+
+import ast
+
+from pycodegate.rules.base import BaseRules
+from pycodegate.types import Category, Diagnostic, Severity
+
+_TASK_DECORATOR_ATTRS = {"task"}
+_TASK_DECORATOR_NAMES = {"shared_task"}
+_TASK_CALLER_PREFIXES = {"app", "celery"}
+
+
+def _is_task_decorator(dec: ast.expr) -> bool:
+    """Return True if *dec* looks like @app.task, @celery.task, or @shared_task."""
+    if isinstance(dec, ast.Attribute) and dec.attr in _TASK_DECORATOR_ATTRS:
+        if isinstance(dec.value, ast.Name) and dec.value.id in _TASK_CALLER_PREFIXES:
+            return True
+    if isinstance(dec, ast.Name) and dec.id in _TASK_DECORATOR_NAMES:
+        return True
+    if isinstance(dec, ast.Call):
+        return _is_task_decorator(dec.func)
+    return False
+
+
+def _decorator_call(dec: ast.expr) -> ast.Call | None:
+    """Return the Call node if the decorator is called, else None."""
+    if isinstance(dec, ast.Call):
+        return dec
+    return None
+
+
+class CeleryRules(BaseRules):
+    """Celery framework-specific checks."""
+
+    def check(self, source: str, filename: str) -> list[Diagnostic]:
+        tree = self._parse(source)
+        if tree is None:
+            return []
+
+        diags: list[Diagnostic] = []
+
+        # First pass: collect task function names for direct-call detection.
+        task_names: set[str] = set()
+        for node in ast.walk(tree):
+            if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                for dec in node.decorator_list:
+                    if _is_task_decorator(dec):
+                        task_names.add(node.name)
+
+        # Second pass: all checks.
+        for node in ast.walk(tree):
+            if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                diags.extend(self._check_task_func(node, filename))
+            elif isinstance(node, ast.ExceptHandler):
+                diags.extend(self._check_retry_no_exc(node, filename))
+            elif isinstance(node, ast.Call):
+                diags.extend(self._check_direct_call(node, task_names, filename))
+
+        return diags
+
+    def _check_task_func(self, node, filename) -> list[Diagnostic]:
+        """Run task-decorator checks on a single function node."""
+        diags: list[Diagnostic] = []
+        for dec in node.decorator_list:
+            if not _is_task_decorator(dec):
+                continue
+            diags.extend(self._check_missing_bind(node, dec, filename))
+            call = _decorator_call(dec)
+            if call is not None:
+                diags.extend(self._check_broad_autoretry(node, call, filename))
+        return diags
+
+    # ------------------------------------------------------------------
+    # Rule: celery-missing-bind
+    # ------------------------------------------------------------------
+    def _check_missing_bind(self, func_node, decorator, filename) -> list[Diagnostic]:
+        args = func_node.args
+        first_arg = args.args[0].arg if args.args else None
+        if first_arg != "self":
+            return []
+
+        call = _decorator_call(decorator)
+        if call is not None and any(
+            kw.arg == "bind" and isinstance(kw.value, ast.Constant) and kw.value.value is True
+            for kw in call.keywords
+        ):
+            return []
+
+        return [
+            Diagnostic(
+                file_path=filename,
+                rule="celery-missing-bind",
+                severity=Severity.ERROR,
+                category=Category.CELERY,
+                message=f"Task '{func_node.name}' uses 'self' but decorator is missing bind=True",
+                help="Add bind=True to the task decorator",
+                line=func_node.lineno,
+                column=func_node.col_offset,
+                cost=2.0,
+            )
+        ]
+
+    # ------------------------------------------------------------------
+    # Rule: celery-retry-no-exc
+    # ------------------------------------------------------------------
+    def _check_retry_no_exc(self, handler: ast.ExceptHandler, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(handler):
+            if not isinstance(node, ast.Call):
+                continue
+            if isinstance(node.func, ast.Attribute) and node.func.attr == "retry":
+                if isinstance(node.func.value, ast.Name) and node.func.value.id == "self":
+                    has_exc = any(kw.arg == "exc" for kw in node.keywords)
+                    if not has_exc:
+                        diags.append(
+                            Diagnostic(
+                                file_path=filename,
+                                rule="celery-retry-no-exc",
+                                severity=Severity.WARNING,
+                                category=Category.CELERY,
+                                message="self.retry() called without exc keyword — original traceback is lost",
+                                help="Pass exc=exc to self.retry() to preserve the traceback",
+                                line=node.lineno,
+                                column=node.col_offset,
+                                cost=1.0,
+                            )
+                        )
+        return diags
+
+    # ------------------------------------------------------------------
+    # Rule: celery-broad-autoretry
+    # ------------------------------------------------------------------
+    def _check_broad_autoretry(self, func_node, call: ast.Call, filename: str) -> list[Diagnostic]:
+        for kw in call.keywords:
+            if kw.arg != "autoretry_for":
+                continue
+            if isinstance(kw.value, ast.Tuple):
+                for elt in kw.value.elts:
+                    if isinstance(elt, ast.Name) and elt.id in {"Exception", "BaseException"}:
+                        return [
+                            Diagnostic(
+                                file_path=filename,
+                                rule="celery-broad-autoretry",
+                                severity=Severity.WARNING,
+                                category=Category.CELERY,
+                                message=f"Task '{func_node.name}' uses autoretry_for with broad {elt.id}",
+                                help="Narrow autoretry_for to specific exception types",
+                                line=kw.value.lineno,
+                                column=kw.value.col_offset,
+                                cost=1.0,
+                            )
+                        ]
+        return []
+
+    # ------------------------------------------------------------------
+    # Rule: celery-direct-call
+    # ------------------------------------------------------------------
+    def _check_direct_call(
+        self, node: ast.Call, task_names: set[str], filename: str
+    ) -> list[Diagnostic]:
+        if isinstance(node.func, ast.Name) and node.func.id in task_names:
+            return [
+                Diagnostic(
+                    file_path=filename,
+                    rule="celery-direct-call",
+                    severity=Severity.WARNING,
+                    category=Category.CELERY,
+                    message=f"Task '{node.func.id}' called directly — runs synchronously, not via worker",
+                    help="Use .delay() or .apply_async() to dispatch to a Celery worker",
+                    line=node.lineno,
+                    column=node.col_offset,
+                    cost=0.5,
+                )
+            ]
+        return []

pycodegate/rules/dead_code.py

@@ -10,6 +10,7 @@ except ImportError:
     vulture = None  # type: ignore[assignment]
 
 from pycodegate.types import Category, Diagnostic, Severity
+from pycodegate.utils.file_discovery import IGNORE_DIRS
 
 
 class DeadCodeRules:
@@ -23,11 +24,13 @@ class DeadCodeRules:
         v = vulture.Vulture()
 
         py_files = list(Path(project_path).rglob("*.py"))
-        ignore = {".venv", "venv", "node_modules", "__pycache__", ".git", "dist", "build"}
         py_files = [
             f
             for f in py_files
-            if not any(part in ignore for part in f.relative_to(project_path).parts)
+            if not any(
+                part in IGNORE_DIRS or part.endswith(".egg-info")
+                for part in f.relative_to(project_path).parts
+            )
         ]
 
         if not py_files:

pycodegate/rules/imports.py

@@ -32,7 +32,7 @@ class ImportsRules:
             return
         file_map[module_name] = filepath
 
-        for node in ast.walk(tree):
+        for node in ast.iter_child_nodes(tree):
             if isinstance(node, ast.Import):
                 for alias in node.names:
                     graph[module_name].add(alias.name)

pycodegate/rules/logging_rules.py

@@ -0,0 +1,124 @@
+"""Logging rules: f-string formatting, root logger, missing exc_info."""
+
+from __future__ import annotations
+
+import ast
+
+from pycodegate.rules.base import BaseRules
+from pycodegate.types import Category, Diagnostic, Severity
+
+_LOG_LEVELS = {"debug", "info", "warning", "error", "critical", "exception"}
+
+
+class LoggingRules(BaseRules):
+    """Logging-related checks."""
+
+    def check(self, source: str, filename: str) -> list[Diagnostic]:
+        tree = self._parse(source)
+        if tree is None:
+            return []
+
+        diags: list[Diagnostic] = []
+        diags.extend(self._check_fstring(tree, filename))
+        diags.extend(self._check_root_logger(tree, filename))
+        diags.extend(self._check_error_no_exc_info(tree, filename))
+        return diags
+
+    def _check_fstring(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            if not isinstance(node.func, ast.Attribute):
+                continue
+            if node.func.attr not in _LOG_LEVELS:
+                continue
+            if not node.args:
+                continue
+            first_arg = node.args[0]
+            is_fstring = isinstance(first_arg, ast.JoinedStr)
+            is_format_call = (
+                isinstance(first_arg, ast.Call)
+                and isinstance(first_arg.func, ast.Attribute)
+                and first_arg.func.attr == "format"
+                and isinstance(first_arg.func.value, (ast.Constant, ast.JoinedStr))
+            )
+            if is_fstring or is_format_call:
+                diags.append(
+                    Diagnostic(
+                        file_path=filename,
+                        rule="logging-fstring",
+                        severity=Severity.WARNING,
+                        category=Category.LOGGING,
+                        message="f-string in logging call defeats lazy evaluation and breaks log aggregation",
+                        help="Use %-style: logger.info('User %s logged in', user_id)",
+                        line=node.lineno,
+                        column=node.col_offset,
+                        cost=1.0,
+                    )
+                )
+        return diags
+
+    def _check_root_logger(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            if not isinstance(node.func, ast.Attribute):
+                continue
+            if node.func.attr not in _LOG_LEVELS:
+                continue
+            if not isinstance(node.func.value, ast.Name):
+                continue
+            if node.func.value.id != "logging":
+                continue
+            diags.append(
+                Diagnostic(
+                    file_path=filename,
+                    rule="logging-root-logger",
+                    severity=Severity.WARNING,
+                    category=Category.LOGGING,
+                    message="Using root logger directly — cannot be independently configured",
+                    help="Use logger = logging.getLogger(__name__) and call logger.info() instead",
+                    line=node.lineno,
+                    column=node.col_offset,
+                    cost=0.5,
+                )
+            )
+        return diags
+
+    def _check_error_no_exc_info(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.ExceptHandler):
+                continue
+            for child in ast.walk(node):
+                if not isinstance(child, ast.Call):
+                    continue
+                if not isinstance(child.func, ast.Attribute):
+                    continue
+                if child.func.attr not in ("error", "warning"):
+                    continue
+                # If method is .exception(), it already includes exc_info
+                # but .exception() is not "error" or "warning", so skip check
+                has_exc_info = any(
+                    kw.arg == "exc_info"
+                    and isinstance(kw.value, ast.Constant)
+                    and kw.value.value is True
+                    for kw in child.keywords
+                )
+                if not has_exc_info:
+                    diags.append(
+                        Diagnostic(
+                            file_path=filename,
+                            rule="logging-error-no-exc-info",
+                            severity=Severity.WARNING,
+                            category=Category.LOGGING,
+                            message="logger.error() in except block without exc_info=True loses the traceback",
+                            help="Use logger.exception() or add exc_info=True",
+                            line=child.lineno,
+                            column=child.col_offset,
+                            cost=1.0,
+                        )
+                    )
+        return diags