pycodegate 0.1.3__tar.gz → 0.2.0__tar.gz

{pycodegate-0.1.3 → pycodegate-0.2.0}/.github/workflows/ci.yml

@@ -26,8 +26,8 @@ jobs:
       - name: Run tests
         run: uv run pytest --tb=short -q
 
-      - name: Run py-gate on itself
-        run: uv run py-gate . --fail-on error
+      - name: Run pycodegate on itself
+        run: uv run pycodegate . --fail-on error
 
   lint:
     runs-on: ubuntu-latest

{pycodegate-0.1.3 → pycodegate-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pycodegate
-Version: 0.1.3
+Version: 0.2.0
 Summary: Trust, but verify. The quality gate for AI-generated Python code.
 Project-URL: Homepage, https://github.com/themohitkhare/pycodegate
 Project-URL: Repository, https://github.com/themohitkhare/pycodegate

{pycodegate-0.1.3 → pycodegate-0.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pycodegate"
-version = "0.1.3"
+version = "0.2.0"
 description = "Trust, but verify. The quality gate for AI-generated Python code."
 readme = "README.md"
 requires-python = ">=3.10"

{pycodegate-0.1.3 → pycodegate-0.2.0}/src/pycodegate/__init__.py

@@ -1,3 +1,3 @@
 """Python Doctor - Diagnose your Python project's health."""
 
-__version__ = "0.1.3"
+__version__ = "0.2.0"

{pycodegate-0.1.3 → pycodegate-0.2.0}/src/pycodegate/cli.py

@@ -9,7 +9,7 @@ import click
 
 from pycodegate import __version__
 from pycodegate.config import load_config
-from pycodegate.output import output_json, print_scan_result
+from pycodegate.output import output_json, output_sarif, print_scan_result
 from pycodegate.scan import scan_project
 from pycodegate.types import Severity
 from pycodegate.utils.badge import generate_badge, generate_ci_workflow
@@ -35,6 +35,7 @@ class CliOptions:
     ci_workflow: bool
     precommit: bool
     min_score: int | None
+    sarif_output: bool
 
 
 def _handle_early_exits(opts: CliOptions) -> bool:
@@ -81,7 +82,9 @@ def _output_result(opts: CliOptions, result) -> None:
         click.echo(generate_badge(result.score.value, result.score.label))
         return
 
-    if opts.json_output:
+    if opts.sarif_output:
+        output_sarif(result)
+    elif opts.json_output:
         output_json(result)
     elif opts.score_only:
         click.echo(str(result.score.value))
@@ -152,6 +155,13 @@ def _apply_exit_codes(opts: CliOptions, result) -> None:
     default=None,
     help="Minimum score threshold (exit 1 if below).",
 )
+@click.option(
+    "--sarif",
+    "sarif_output",
+    is_flag=True,
+    default=False,
+    help="Output in SARIF format for GitHub Code Scanning.",
+)
 def main(
     directory: str,
     lint: bool,
@@ -167,6 +177,7 @@ def main(
     ci_workflow: bool,
     precommit: bool,
     min_score: int | None,
+    sarif_output: bool,
 ) -> None:
     """PyCodeGate — Diagnose your Python project's health."""
     opts = CliOptions(
@@ -184,6 +195,7 @@ def main(
         ci_workflow=ci_workflow,
         precommit=precommit,
         min_score=min_score,
+        sarif_output=sarif_output,
     )
 
     if _handle_early_exits(opts):

{pycodegate-0.1.3 → pycodegate-0.2.0}/src/pycodegate/output.py

@@ -213,6 +213,68 @@ def output_json(result: ScanResult) -> None:
     sys.stdout.write(json.dumps(payload, indent=2) + "\n")
 
 
+def _sarif_rules(diagnostics: list[Diagnostic]) -> list[dict]:
+    """Build SARIF rules registry from unique diagnostic rules."""
+    seen: dict[str, Diagnostic] = {}
+    for d in diagnostics:
+        if d.rule not in seen:
+            seen[d.rule] = d
+    return [
+        {
+            "id": rule_id,
+            "name": rule_id,
+            "shortDescription": {"text": diag.message},
+            "helpUri": "",
+            "help": {"text": diag.help},
+        }
+        for rule_id, diag in seen.items()
+    ]
+
+
+def _sarif_results(diagnostics: list[Diagnostic]) -> list[dict]:
+    """Build SARIF results array from diagnostics."""
+    return [
+        {
+            "ruleId": d.rule,
+            "level": "error" if d.severity == Severity.ERROR else "warning",
+            "message": {"text": d.message},
+            "locations": [
+                {
+                    "physicalLocation": {
+                        "artifactLocation": {"uri": d.file_path},
+                        "region": {
+                            "startLine": d.line,
+                            "startColumn": (d.column or 0) + 1,
+                        },
+                    }
+                }
+            ],
+        }
+        for d in diagnostics
+    ]
+
+
+def output_sarif(result: ScanResult) -> None:
+    """Output the scan result in SARIF 2.1.0 format for GitHub Code Scanning."""
+    sarif = {
+        "version": "2.1.0",
+        "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "PyCodeGate",
+                        "version": __version__,
+                        "rules": _sarif_rules(result.diagnostics),
+                    }
+                },
+                "results": _sarif_results(result.diagnostics),
+            }
+        ],
+    }
+    sys.stdout.write(json.dumps(sarif, indent=2) + "\n")
+
+
 def _print_rule_details(
     console: Console,
     rule_diags: list[Diagnostic],

{pycodegate-0.1.3 → pycodegate-0.2.0}/src/pycodegate/rules/security.py

@@ -33,6 +33,9 @@ class SecurityRules(BaseRules):
         diags.extend(self._check_yaml(tree, filename))
         diags.extend(self._check_hardcoded_secrets(tree, filename))
         diags.extend(self._check_weak_hash(tree, filename))
+        diags.extend(self._check_os_system(tree, filename))
+        diags.extend(self._check_subprocess_shell(tree, filename))
+        diags.extend(self._check_tempfile_mktemp(tree, filename))
         return diags
 
     def _check_eval_exec(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
@@ -142,6 +145,97 @@ class SecurityRules(BaseRules):
                     )
         return diags
 
+    def _check_os_system(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            if not isinstance(node.func, ast.Attribute):
+                continue
+            if node.func.attr != "system":
+                continue
+            if not isinstance(node.func.value, ast.Name):
+                continue
+            if node.func.value.id != "os":
+                continue
+            diags.append(
+                Diagnostic(
+                    file_path=filename,
+                    rule="no-os-system",
+                    severity=Severity.ERROR,
+                    category=Category.SECURITY,
+                    message="os.system() is vulnerable to shell injection",
+                    help="Use subprocess.run() with a list of arguments instead",
+                    line=node.lineno,
+                    column=node.col_offset,
+                    cost=4.0,
+                )
+            )
+        return diags
+
+    def _check_subprocess_shell(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        _subprocess_funcs = {"run", "Popen", "call", "check_call", "check_output"}
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            if not isinstance(node.func, ast.Attribute):
+                continue
+            if node.func.attr not in _subprocess_funcs:
+                continue
+            if not isinstance(node.func.value, ast.Name):
+                continue
+            if node.func.value.id != "subprocess":
+                continue
+            shell_true = any(
+                kw.arg == "shell" and isinstance(kw.value, ast.Constant) and kw.value.value is True
+                for kw in node.keywords
+            )
+            if not shell_true:
+                continue
+            diags.append(
+                Diagnostic(
+                    file_path=filename,
+                    rule="no-subprocess-shell",
+                    severity=Severity.ERROR,
+                    category=Category.SECURITY,
+                    message="subprocess called with shell=True is a security risk",
+                    help="Pass arguments as a list and remove shell=True",
+                    line=node.lineno,
+                    column=node.col_offset,
+                    cost=4.0,
+                )
+            )
+        return diags
+
+    def _check_tempfile_mktemp(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            if not isinstance(node.func, ast.Attribute):
+                continue
+            if node.func.attr != "mktemp":
+                continue
+            if not isinstance(node.func.value, ast.Name):
+                continue
+            if node.func.value.id != "tempfile":
+                continue
+            diags.append(
+                Diagnostic(
+                    file_path=filename,
+                    rule="no-tempfile-race",
+                    severity=Severity.WARNING,
+                    category=Category.SECURITY,
+                    message="tempfile.mktemp() is deprecated and vulnerable to race conditions",
+                    help="Use tempfile.mkstemp() or tempfile.NamedTemporaryFile()",
+                    line=node.lineno,
+                    column=node.col_offset,
+                    cost=2.0,
+                )
+            )
+        return diags
+
     def _check_weak_hash(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
         diags: list[Diagnostic] = []
         for node in ast.walk(tree):

pycodegate-0.2.0/tests/rules/test_security_new.py

@@ -0,0 +1,32 @@
+"""Tests for new security rules: os.system, subprocess shell=True, tempfile.mktemp."""
+
+from pycodegate.rules.security import SecurityRules
+
+
+def test_os_system_detected():
+    diags = SecurityRules().check("import os\nos.system('ls')\n", "app.py")
+    assert any(d.rule == "no-os-system" for d in diags)
+
+
+def test_subprocess_shell_true():
+    source = "import subprocess\nsubprocess.run('ls', shell=True)\n"
+    diags = SecurityRules().check(source, "app.py")
+    assert any(d.rule == "no-subprocess-shell" for d in diags)
+
+
+def test_subprocess_shell_false_ok():
+    source = "import subprocess\nsubprocess.run(['ls'], shell=False)\n"
+    diags = SecurityRules().check(source, "app.py")
+    assert not any(d.rule == "no-subprocess-shell" for d in diags)
+
+
+def test_tempfile_mktemp():
+    source = "import tempfile\ntempfile.mktemp()\n"
+    diags = SecurityRules().check(source, "app.py")
+    assert any(d.rule == "no-tempfile-race" for d in diags)
+
+
+def test_tempfile_mkstemp_ok():
+    source = "import tempfile\ntempfile.mkstemp()\n"
+    diags = SecurityRules().check(source, "app.py")
+    assert not any(d.rule == "no-tempfile-race" for d in diags)

{pycodegate-0.1.3 → pycodegate-0.2.0}/tests/test_cli.py

@@ -124,3 +124,14 @@ def test_ci_workflow(tmp_path):
     assert result.exit_code == 0
     assert "name: Py Gate Score" in result.output
     assert "pycodegate" in result.output
+
+
+def test_cli_sarif_output(tmp_path):
+    (tmp_path / "app.py").write_text("x = 1\n")
+    runner = CliRunner()
+    result = runner.invoke(main, [str(tmp_path), "--sarif"])
+    assert result.exit_code == 0
+    data = json.loads(result.output)
+    assert data["version"] == "2.1.0"
+    assert "runs" in data
+    assert data["runs"][0]["tool"]["driver"]["name"] == "PyCodeGate"