pycodegate 0.2.0__tar.gz → 0.5.0__tar.gz

{pycodegate-0.2.0 → pycodegate-0.5.0}/.gitignore

@@ -15,3 +15,4 @@ htmlcov/
 *.so
 .env
 .DS_Store
+benchmarks/.corpus/

{pycodegate-0.2.0 → pycodegate-0.5.0}/AGENTS.md

@@ -63,16 +63,33 @@ src/pycodegate/
   constants.py    — Magic numbers and thresholds
   rules/
     base.py       — Abstract BaseRules with AST parsing
-    security.py   — eval, exec, pickle, yaml, secrets, hashes
-    performance.py — string concat, imports in functions, star imports
+    security.py   — eval, exec, pickle, yaml, secrets, hashes, os.system, shell
+    performance.py — string concat in loops, star imports
     architecture.py — giant modules, nesting, god functions, too many args
+    complexity.py — cyclomatic complexity
     correctness.py — mutable defaults, bare except, assert, return in init
-    django.py     — raw SQL, DEBUG, SECRET_KEY, N+1
-    fastapi.py    — sync endpoints, missing response_model
-    flask.py      — secret key, debug mode, SQL f-strings
+    imports.py    — circular imports (project-level)
+    structure.py  — tests/README/LICENSE/linter/type-checker, type coverage
+    dependencies.py — pip-audit vulnerability scan
     dead_code.py  — Vulture integration
+    django.py / fastapi.py / flask.py — web framework rules
+    pydantic.py / sqlalchemy.py / celery.py / requests_rules.py /
+      logging_rules.py / pandas_rules.py / pytest_rules.py / numpy_rules.py — library rules
   utils/
-    file_discovery.py — Python file discovery (git + fallback)
+    file_discovery.py — Python file discovery (git + fallback), excludes non-source dirs
+    is_test_file.py   — test-file detection (drives test-only rule suppression)
     ast_helpers.py    — Common AST utilities
     diff.py           — Git diff file resolution
 ```
+
+## Precision is the product
+
+PyCodeGate is a quality **gate** — false positives destroy its value. Be precision-first:
+
+- A new rule MUST ship with a negative fixture/test proving it does NOT fire on the
+  idiomatic, correct form of the pattern, not just a positive test.
+- Rules that are idiomatic in tests (asserts, long fixtures) belong in
+  `RULES_SUPPRESSED_IN_TESTS` in `constants.py`; suppression happens centrally in
+  `scan._suppress_test_noise`, keyed on the project-relative path.
+- Validate rule changes against the corpus benchmark: `python benchmarks/run_corpus.py`.
+  A rule lighting up respected codebases needs to be narrowed, suppressed, or removed.

pycodegate-0.5.0/CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+## 0.5.0
+
+- Add opt-in, path-scoped import boundaries to turn architectural constraints into
+  deterministic `imports/boundary` errors with project-specific remediation guidance.
+- Support absolute and relative static imports, aliases, nested imports, and
+  type-checking blocks in conventional flat and `src/` layouts.
+- Integrate boundaries with JSON, SARIF, CI failure thresholds, rule ignores,
+  per-file suppression, and the lint toggle.
+- Reject malformed boundary configuration with a readable CLI error.
+- Enforce separation between PyCodeGate's analysis rules, shared data types, and
+  presentation using the same boundary configuration available to users.
+
+No import restrictions are enabled for projects without boundary configuration.
+Dynamic imports, re-export tracing, and custom import roots are outside the scope
+of this check. See the README for configuration and matching semantics.
+
+This release also includes the precision, scoring, and output fixes already on
+main after the published 0.3.0 release.

{pycodegate-0.2.0 → pycodegate-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: pycodegate
-Version: 0.2.0
+Version: 0.5.0
 Summary: Trust, but verify. The quality gate for AI-generated Python code.
 Project-URL: Homepage, https://github.com/themohitkhare/pycodegate
 Project-URL: Repository, https://github.com/themohitkhare/pycodegate
@@ -53,7 +53,9 @@ AI coding agents ship code fast — but fast doesn't mean safe. Every `eval()` a
 
 PyCodeGate detects your project's context: framework (Django, FastAPI, Flask), Python version, package manager (uv, poetry, pip), and test framework. That context drives which rules are active — Django projects get SQL injection checks, FastAPI projects get async-correctness checks, and so on.
 
-It then runs two analysis passes **in parallel**: a lint pass that evaluates 40+ rules across 8 categories (Security, Correctness, Complexity, Architecture, Performance, Structure, Imports, Dead Code), and a dead-code pass powered by [Vulture](https://github.com/jendrikseipp/vulture) that finds unused functions, classes, imports, and variables.
+It then runs analysis passes **in parallel**: a lint pass across 9 categories (Security, Correctness, Complexity, Architecture, Performance, Structure, Imports, Dependencies, Dead Code), a dead-code pass powered by [Vulture](https://github.com/jendrikseipp/vulture) that finds unused functions, classes, imports, and variables, and an optional dependency-vulnerability pass via [pip-audit](https://github.com/pypa/pip-audit).
+
+PyCodeGate is **precision-first**: it is meant to stay quiet on idiomatic, correct code so that a finding always means something. Test files only receive rules that make sense for tests (asserts, long fixtures, and long test functions are not flagged), and generated or non-source trees — `migrations`, `examples`, `docs`, and vendored directories — are skipped. The rule set is benchmarked against a corpus of respected PyPI packages (see [`benchmarks/`](benchmarks/)) to keep false positives down.
 
 Findings are filtered through your configuration and scored using a **weighted category-budget system**. Each category has a maximum deduction budget proportional to its weight. Within a category the top 3 findings apply at full cost; additional findings apply diminishing returns (10% each), so fixing the worst issues always moves the needle. The final result is a **0–100 health score** with a label: Excellent (90+), Great (75–89), Needs work (50–74), or Critical (<50).
 
@@ -107,7 +109,7 @@ pycodegate . --json
 
 ```json
 {
-  "version": "0.1.0",
+  "version": "0.3.0",
   "path": ".",
   "score": 87,
   "label": "Great",
@@ -225,26 +227,33 @@ jobs:
 | `--verbose` | off | Show file path and line number per finding |
 | `--score` | off | Print only the numeric score and exit |
 | `--json` | off | Emit structured JSON (for agents and CI) |
+| `--sarif` | off | Emit SARIF 2.1.0 (for GitHub Code Scanning) |
 | `--fix` | off | Run `ruff --fix` before scanning |
 | `--diff TEXT` | — | Scan only files changed vs this base branch |
 | `--fail-on [error\|warning\|none]` | `none` | Exit code 1 when findings at this level exist |
+| `--min-score INT` | — | Exit code 1 when the score is below this threshold |
+| `--profile [cli\|web\|library\|script]` | auto | Override the auto-detected project profile |
+| `--badge` | off | Print a shields.io badge markdown snippet |
+| `--ci` | off | Print a ready-to-use GitHub Actions workflow |
+| `--pre-commit` | off | Install a git pre-commit hook |
 | `-v, --version` | — | Show version and exit |
 | `-h, --help` | — | Show help and exit |
 
 ## What It Checks
 
-| Category | Weight | Max Deduction | What it catches |
-|----------|--------|---------------|-----------------|
-| Security | 5 | ~24 pts | `eval`, `exec`, `pickle.load`, unsafe YAML, hardcoded secrets, weak hashes |
-| Correctness | 4 | ~19 pts | Mutable defaults, bare/broad except, assert in production, bad `__init__` return |
-| Complexity | 3 | ~14 pts | Cyclomatic complexity > 15 (warning) or > 25 (error) |
-| Architecture | 3 | ~14 pts | Giant modules (>500 lines), deep nesting (>5), god functions (>50 lines), too many args (>7) |
-| Performance | 2 | ~10 pts | String concat in loops, imports inside functions, star imports |
-| Structure | 2 | ~10 pts | Missing `__init__.py`, missing tests directory, no type hints |
-| Imports | 1 | ~5 pts | Circular imports, wildcard imports, import order issues |
-| Dead Code | 1 | ~5 pts | Unused functions, classes, variables, and imports via Vulture |
+| Category | Weight | What it catches |
+|----------|--------|-----------------|
+| Security | 5 | `eval`, `exec`, `pickle.load`, unsafe YAML, hardcoded secrets, weak hashes (excluding `usedforsecurity=False`), `os.system`, `shell=True`, `tempfile.mktemp` |
+| Correctness | 4 | Mutable defaults, bare except, assert in production, bad `__init__` return |
+| Complexity | 3 | Cyclomatic complexity > 15 (warning) or > 25 (error) |
+| Architecture | 3 | Giant modules (>500 lines), deep nesting (>5), god functions (>50 lines), too many args (>7) |
+| Performance | 2 | String concatenation in loops, star imports |
+| Structure | 2 | Missing tests, README, LICENSE, linter/type-checker config, low type coverage |
+| Imports | 1 | Circular imports between sibling modules |
+| Dependencies | 1 | Known-vulnerable dependencies (via `pip-audit`, when installed) |
+| Dead Code | 1 | Unused functions, classes, variables, and imports via Vulture |
 
-Framework-specific rules (Django, FastAPI, Flask) are mapped into the Security or Correctness budget.
+Weights are normalized to a 100-point deduction budget. Framework- and library-specific rules (Django, FastAPI, Flask, Pydantic, SQLAlchemy, Celery, requests, logging, pandas, pytest, NumPy) are mapped into the Security or Correctness budget.
 
 ## Scoring
 
@@ -281,8 +290,7 @@ files = ["tests/fixtures/**", "migrations/**", "scripts/**"]
 "src/legacy/*.py" = ["high-complexity", "no-god-function"]
 
 [scoring]
-max-deduction.Security = 20
-max-deduction.Dead Code = 0  # disable dead-code penalty entirely
+max-deduction = { Security = 20, "Dead Code" = 0 }  # 0 disables a category's penalty
 ```
 
 Or use `pyproject.toml`:
@@ -306,26 +314,70 @@ files = ["tests/fixtures/**"]
 
 If both files exist, `pycodegate.toml` takes precedence. CLI flags always override config values.
 
+## Import boundaries
+
+Turn architectural review feedback into a deterministic check. Import boundaries
+are opt-in: forbid a module (and its submodules) in selected files and provide
+actionable guidance for the developer or agent.
+
+In `pycodegate.toml`:
+
+```toml
+[[import-boundaries]]
+files = ["src/app/domain/*.py"]
+forbidden = ["app.infrastructure", "requests", "fastapi"]
+message = "Keep the domain independent of infrastructure; use a domain port."
+
+[[import-boundaries]]
+files = ["src/app/*.py"]
+forbidden = ["app.legacy_client"]
+message = "Use app.clients instead of adding new legacy dependencies."
+```
+
+For `pyproject.toml`, use `[[tool.pycodegate.import-boundaries]]` with the same
+fields. `files` uses case-sensitive project-relative POSIX path globs; `*` can
+span directories. `forbidden` contains literal dotted module prefixes, so
+`requests` matches `requests.sessions` but not `requests_extra`. Both arrays
+must contain at least one nonempty string. The optional `message` supplies the
+diagnostic's remediation guidance.
+
+Checks cover static `import` and `from ... import ...` statements, including
+aliases, nested functions, and type-checking blocks. Relative imports are resolved
+using the path under the project root, stripping a leading `src/` for conventional
+src layouts. Custom import roots, runtime imports via `importlib` or `__import__`,
+and re-export tracing are not supported. Importing a name from a package is
+treated as importing that dotted name, so avoid forbidden prefixes that collide
+with allowed attributes on the same package.
+
+Violations emit `imports/boundary` errors with the source location and your
+message in terminal, JSON, and SARIF output. Use
+`pycodegate . --fail-on error` to enforce the boundary in CI. Existing rule and
+per-file ignores apply; `--no-lint` disables boundary checks. Without configured
+boundaries, scan behavior is unchanged. Static checks supplement tests and
+runtime verification; a high score alone does not prove behavior is correct.
+
 ## Profiles
 
 PyCodeGate auto-detects a project profile and adjusts rule weights accordingly. You can also set a profile explicitly in config (`profile = "library"`).
 
 | Profile | Auto-detected when | Adjustments |
 |---------|--------------------|-------------|
-| `cli` | `[project.scripts]` in pyproject.toml | Architecture rules weighted up; dead-code weighted down |
-| `web` | Django / FastAPI / Flask detected | Security and correctness weighted up; framework rules active |
-| `library` | No scripts, no framework, has `py.typed` | Public API checks active; dead-code weighted up |
-| `script` | Single-file project or `scripts/` directory | Architecture rules relaxed; complexity thresholds raised |
+| `cli` | `[project.scripts]` or a CLI dependency (click, typer, …) | Security budget relaxed; `subprocess`/`shell` rules suppressed |
+| `web` | Django / FastAPI / Flask / Starlette / aiohttp / … detected | Framework rules active |
+| `library` | Has a `[build-system]` and no scripts | Default budgets |
+| `script` | No package `__init__.py` and ≤ 5 top-level `.py` files | Structure budget relaxed; `no-tests`/`no-license` suppressed |
 
 ## Pre-commit Hook
 
-Use `--pre-commit` to run PyCodeGate as a pre-commit hook. It automatically scans only the staged files:
+`--pre-commit` installs a git `pre-commit` hook (one-time) that scores the project on
+every commit and blocks the commit when the score falls below the threshold:
 
 ```bash
-pycodegate . --pre-commit --fail-on error
+pycodegate . --pre-commit --min-score 80
 ```
 
-Add to `.pre-commit-config.yaml`:
+If you use the [pre-commit framework](https://pre-commit.com), add it to
+`.pre-commit-config.yaml` instead:
 
 ```yaml
 repos:
@@ -333,7 +385,7 @@ repos:
     hooks:
       - id: pycodegate
         name: PyCodeGate quality check
-        entry: pycodegate . --pre-commit --fail-on error
+        entry: pycodegate . --fail-on error
         language: system
         types: [python]
         pass_filenames: false

{pycodegate-0.2.0 → pycodegate-0.5.0}/README.md

@@ -19,7 +19,9 @@ AI coding agents ship code fast — but fast doesn't mean safe. Every `eval()` a
 
 PyCodeGate detects your project's context: framework (Django, FastAPI, Flask), Python version, package manager (uv, poetry, pip), and test framework. That context drives which rules are active — Django projects get SQL injection checks, FastAPI projects get async-correctness checks, and so on.
 
-It then runs two analysis passes **in parallel**: a lint pass that evaluates 40+ rules across 8 categories (Security, Correctness, Complexity, Architecture, Performance, Structure, Imports, Dead Code), and a dead-code pass powered by [Vulture](https://github.com/jendrikseipp/vulture) that finds unused functions, classes, imports, and variables.
+It then runs analysis passes **in parallel**: a lint pass across 9 categories (Security, Correctness, Complexity, Architecture, Performance, Structure, Imports, Dependencies, Dead Code), a dead-code pass powered by [Vulture](https://github.com/jendrikseipp/vulture) that finds unused functions, classes, imports, and variables, and an optional dependency-vulnerability pass via [pip-audit](https://github.com/pypa/pip-audit).
+
+PyCodeGate is **precision-first**: it is meant to stay quiet on idiomatic, correct code so that a finding always means something. Test files only receive rules that make sense for tests (asserts, long fixtures, and long test functions are not flagged), and generated or non-source trees — `migrations`, `examples`, `docs`, and vendored directories — are skipped. The rule set is benchmarked against a corpus of respected PyPI packages (see [`benchmarks/`](benchmarks/)) to keep false positives down.
 
 Findings are filtered through your configuration and scored using a **weighted category-budget system**. Each category has a maximum deduction budget proportional to its weight. Within a category the top 3 findings apply at full cost; additional findings apply diminishing returns (10% each), so fixing the worst issues always moves the needle. The final result is a **0–100 health score** with a label: Excellent (90+), Great (75–89), Needs work (50–74), or Critical (<50).
 
@@ -73,7 +75,7 @@ pycodegate . --json
 
 ```json
 {
-  "version": "0.1.0",
+  "version": "0.3.0",
   "path": ".",
   "score": 87,
   "label": "Great",
@@ -191,26 +193,33 @@ jobs:
 | `--verbose` | off | Show file path and line number per finding |
 | `--score` | off | Print only the numeric score and exit |
 | `--json` | off | Emit structured JSON (for agents and CI) |
+| `--sarif` | off | Emit SARIF 2.1.0 (for GitHub Code Scanning) |
 | `--fix` | off | Run `ruff --fix` before scanning |
 | `--diff TEXT` | — | Scan only files changed vs this base branch |
 | `--fail-on [error\|warning\|none]` | `none` | Exit code 1 when findings at this level exist |
+| `--min-score INT` | — | Exit code 1 when the score is below this threshold |
+| `--profile [cli\|web\|library\|script]` | auto | Override the auto-detected project profile |
+| `--badge` | off | Print a shields.io badge markdown snippet |
+| `--ci` | off | Print a ready-to-use GitHub Actions workflow |
+| `--pre-commit` | off | Install a git pre-commit hook |
 | `-v, --version` | — | Show version and exit |
 | `-h, --help` | — | Show help and exit |
 
 ## What It Checks
 
-| Category | Weight | Max Deduction | What it catches |
-|----------|--------|---------------|-----------------|
-| Security | 5 | ~24 pts | `eval`, `exec`, `pickle.load`, unsafe YAML, hardcoded secrets, weak hashes |
-| Correctness | 4 | ~19 pts | Mutable defaults, bare/broad except, assert in production, bad `__init__` return |
-| Complexity | 3 | ~14 pts | Cyclomatic complexity > 15 (warning) or > 25 (error) |
-| Architecture | 3 | ~14 pts | Giant modules (>500 lines), deep nesting (>5), god functions (>50 lines), too many args (>7) |
-| Performance | 2 | ~10 pts | String concat in loops, imports inside functions, star imports |
-| Structure | 2 | ~10 pts | Missing `__init__.py`, missing tests directory, no type hints |
-| Imports | 1 | ~5 pts | Circular imports, wildcard imports, import order issues |
-| Dead Code | 1 | ~5 pts | Unused functions, classes, variables, and imports via Vulture |
+| Category | Weight | What it catches |
+|----------|--------|-----------------|
+| Security | 5 | `eval`, `exec`, `pickle.load`, unsafe YAML, hardcoded secrets, weak hashes (excluding `usedforsecurity=False`), `os.system`, `shell=True`, `tempfile.mktemp` |
+| Correctness | 4 | Mutable defaults, bare except, assert in production, bad `__init__` return |
+| Complexity | 3 | Cyclomatic complexity > 15 (warning) or > 25 (error) |
+| Architecture | 3 | Giant modules (>500 lines), deep nesting (>5), god functions (>50 lines), too many args (>7) |
+| Performance | 2 | String concatenation in loops, star imports |
+| Structure | 2 | Missing tests, README, LICENSE, linter/type-checker config, low type coverage |
+| Imports | 1 | Circular imports between sibling modules |
+| Dependencies | 1 | Known-vulnerable dependencies (via `pip-audit`, when installed) |
+| Dead Code | 1 | Unused functions, classes, variables, and imports via Vulture |
 
-Framework-specific rules (Django, FastAPI, Flask) are mapped into the Security or Correctness budget.
+Weights are normalized to a 100-point deduction budget. Framework- and library-specific rules (Django, FastAPI, Flask, Pydantic, SQLAlchemy, Celery, requests, logging, pandas, pytest, NumPy) are mapped into the Security or Correctness budget.
 
 ## Scoring
 
@@ -247,8 +256,7 @@ files = ["tests/fixtures/**", "migrations/**", "scripts/**"]
 "src/legacy/*.py" = ["high-complexity", "no-god-function"]
 
 [scoring]
-max-deduction.Security = 20
-max-deduction.Dead Code = 0  # disable dead-code penalty entirely
+max-deduction = { Security = 20, "Dead Code" = 0 }  # 0 disables a category's penalty
 ```
 
 Or use `pyproject.toml`:
@@ -272,26 +280,70 @@ files = ["tests/fixtures/**"]
 
 If both files exist, `pycodegate.toml` takes precedence. CLI flags always override config values.
 
+## Import boundaries
+
+Turn architectural review feedback into a deterministic check. Import boundaries
+are opt-in: forbid a module (and its submodules) in selected files and provide
+actionable guidance for the developer or agent.
+
+In `pycodegate.toml`:
+
+```toml
+[[import-boundaries]]
+files = ["src/app/domain/*.py"]
+forbidden = ["app.infrastructure", "requests", "fastapi"]
+message = "Keep the domain independent of infrastructure; use a domain port."
+
+[[import-boundaries]]
+files = ["src/app/*.py"]
+forbidden = ["app.legacy_client"]
+message = "Use app.clients instead of adding new legacy dependencies."
+```
+
+For `pyproject.toml`, use `[[tool.pycodegate.import-boundaries]]` with the same
+fields. `files` uses case-sensitive project-relative POSIX path globs; `*` can
+span directories. `forbidden` contains literal dotted module prefixes, so
+`requests` matches `requests.sessions` but not `requests_extra`. Both arrays
+must contain at least one nonempty string. The optional `message` supplies the
+diagnostic's remediation guidance.
+
+Checks cover static `import` and `from ... import ...` statements, including
+aliases, nested functions, and type-checking blocks. Relative imports are resolved
+using the path under the project root, stripping a leading `src/` for conventional
+src layouts. Custom import roots, runtime imports via `importlib` or `__import__`,
+and re-export tracing are not supported. Importing a name from a package is
+treated as importing that dotted name, so avoid forbidden prefixes that collide
+with allowed attributes on the same package.
+
+Violations emit `imports/boundary` errors with the source location and your
+message in terminal, JSON, and SARIF output. Use
+`pycodegate . --fail-on error` to enforce the boundary in CI. Existing rule and
+per-file ignores apply; `--no-lint` disables boundary checks. Without configured
+boundaries, scan behavior is unchanged. Static checks supplement tests and
+runtime verification; a high score alone does not prove behavior is correct.
+
 ## Profiles
 
 PyCodeGate auto-detects a project profile and adjusts rule weights accordingly. You can also set a profile explicitly in config (`profile = "library"`).
 
 | Profile | Auto-detected when | Adjustments |
 |---------|--------------------|-------------|
-| `cli` | `[project.scripts]` in pyproject.toml | Architecture rules weighted up; dead-code weighted down |
-| `web` | Django / FastAPI / Flask detected | Security and correctness weighted up; framework rules active |
-| `library` | No scripts, no framework, has `py.typed` | Public API checks active; dead-code weighted up |
-| `script` | Single-file project or `scripts/` directory | Architecture rules relaxed; complexity thresholds raised |
+| `cli` | `[project.scripts]` or a CLI dependency (click, typer, …) | Security budget relaxed; `subprocess`/`shell` rules suppressed |
+| `web` | Django / FastAPI / Flask / Starlette / aiohttp / … detected | Framework rules active |
+| `library` | Has a `[build-system]` and no scripts | Default budgets |
+| `script` | No package `__init__.py` and ≤ 5 top-level `.py` files | Structure budget relaxed; `no-tests`/`no-license` suppressed |
 
 ## Pre-commit Hook
 
-Use `--pre-commit` to run PyCodeGate as a pre-commit hook. It automatically scans only the staged files:
+`--pre-commit` installs a git `pre-commit` hook (one-time) that scores the project on
+every commit and blocks the commit when the score falls below the threshold:
 
 ```bash
-pycodegate . --pre-commit --fail-on error
+pycodegate . --pre-commit --min-score 80
 ```
 
-Add to `.pre-commit-config.yaml`:
+If you use the [pre-commit framework](https://pre-commit.com), add it to
+`.pre-commit-config.yaml` instead:
 
 ```yaml
 repos:
@@ -299,7 +351,7 @@ repos:
     hooks:
       - id: pycodegate
         name: PyCodeGate quality check
-        entry: pycodegate . --pre-commit --fail-on error
+        entry: pycodegate . --fail-on error
         language: system
         types: [python]
         pass_filenames: false

pycodegate-0.5.0/benchmarks/README.md

@@ -0,0 +1,31 @@
+# Precision benchmark
+
+A quality gate is only useful if it stays quiet on good code. This benchmark runs
+PyCodeGate against the source of widely used, idiomatic PyPI packages and reports
+the findings per rule. A rule that fires heavily here is a false-positive suspect.
+
+```bash
+python benchmarks/run_corpus.py                 # default corpus, lint only
+python benchmarks/run_corpus.py --with-dead-code
+python benchmarks/run_corpus.py flask django    # a custom package list
+```
+
+Source distributions are fetched from PyPI into `benchmarks/.corpus/` (git-ignored)
+and cached between runs. No GitHub access is required.
+
+## How to read the output
+
+The per-package table shows the score and finding count; the tail aggregates
+findings by rule across the whole corpus. When triaging a rule with a high count,
+open a few of the flagged files — if the pattern is idiomatic and correct, the rule
+needs to be narrowed, suppressed in the relevant context (e.g. test files), or
+removed. Genuine issues (a 100-branch function, `verify=False`) should remain.
+
+The precision fixes derived from this benchmark are locked in by
+`tests/test_precision.py` and the per-rule unit tests under `tests/rules/`.
+
+## Release validation
+
+[0.5.0 validation](results/0.5.0.md) records the Python test matrix, packaging
+checks, configured boundary checks, and an exact baseline comparison across the
+29-package corpus. Machine-readable results are saved alongside the report.

pycodegate-0.5.0/benchmarks/results/0.5.0.json

@@ -0,0 +1,227 @@
+{
+  "release": "0.5.0",
+  "date": "2026-11-15",
+  "baseline_commit": "2a294b180daefe0511e253905b685de68d761175",
+  "candidate_code_commit": "8960979",
+  "packages": {
+    "requests": {
+      "files": 35,
+      "score": 68,
+      "findings": 169,
+      "matches_baseline": true,
+      "source_distribution": "requests-2.34.2"
+    },
+    "flask": {
+      "files": 65,
+      "score": 74,
+      "findings": 61,
+      "matches_baseline": true,
+      "source_distribution": "flask-3.1.3"
+    },
+    "click": {
+      "files": 76,
+      "score": 72,
+      "findings": 102,
+      "matches_baseline": true,
+      "source_distribution": "click-8.5.1"
+    },
+    "rich": {
+      "files": 100,
+      "score": 58,
+      "findings": 273,
+      "matches_baseline": true,
+      "source_distribution": "rich-15.0.0"
+    },
+    "httpx": {
+      "files": 60,
+      "score": 74,
+      "findings": 110,
+      "matches_baseline": true,
+      "source_distribution": "httpx-0.28.1"
+    },
+    "sqlalchemy": {
+      "files": 603,
+      "score": 22,
+      "findings": 2256,
+      "matches_baseline": true,
+      "source_distribution": "sqlalchemy-2.1.8"
+    },
+    "fastapi": {
+      "files": 738,
+      "score": 53,
+      "findings": 2383,
+      "matches_baseline": true,
+      "source_distribution": "fastapi-0.163.1"
+    },
+    "starlette": {
+      "files": 84,
+      "score": 71,
+      "findings": 162,
+      "matches_baseline": true,
+      "source_distribution": "starlette-1.10.0"
+    },
+    "pydantic": {
+      "files": 324,
+      "score": 35,
+      "findings": 720,
+      "matches_baseline": true,
+      "source_distribution": "pydantic-2.14.3"
+    },
+    "jinja2": {
+      "files": 49,
+      "score": 64,
+      "findings": 104,
+      "matches_baseline": true,
+      "source_distribution": "jinja2-3.1.6"
+    },
+    "werkzeug": {
+      "files": 84,
+      "score": 59,
+      "findings": 156,
+      "matches_baseline": true,
+      "source_distribution": "werkzeug-3.1.9"
+    },
+    "urllib3": {
+      "files": 80,
+      "score": 71,
+      "findings": 144,
+      "matches_baseline": true,
+      "source_distribution": "urllib3-2.8.0"
+    },
+    "django": {
+      "files": 2592,
+      "score": 33,
+      "findings": 969,
+      "matches_baseline": true,
+      "source_distribution": "django-6.1.3"
+    },
+    "celery": {
+      "files": 406,
+      "score": 37,
+      "findings": 472,
+      "matches_baseline": true,
+      "source_distribution": "celery-5.7.0"
+    },
+    "black": {
+      "files": 366,
+      "score": 35,
+      "findings": 392,
+      "matches_baseline": true,
+      "source_distribution": "black-26.10.1"
+    },
+    "isort": {
+      "files": 110,
+      "score": 70,
+      "findings": 144,
+      "matches_baseline": true,
+      "source_distribution": "isort-9.0.2"
+    },
+    "pytest": {
+      "files": 253,
+      "score": 35,
+      "findings": 1168,
+      "matches_baseline": true,
+      "source_distribution": "pytest-9.2.0"
+    },
+    "attrs": {
+      "files": 53,
+      "score": 77,
+      "findings": 54,
+      "matches_baseline": true,
+      "source_distribution": "attrs-26.1.0"
+    },
+    "typer": {
+      "files": 339,
+      "score": 66,
+      "findings": 155,
+      "matches_baseline": true,
+      "source_distribution": "typer-0.29.1"
+    },
+    "pyyaml": {
+      "files": 44,
+      "score": 58,
+      "findings": 127,
+      "matches_baseline": true,
+      "source_distribution": "pyyaml-6.0.3"
+    },
+    "redis": {
+      "files": 267,
+      "score": 43,
+      "findings": 1143,
+      "matches_baseline": true,
+      "source_distribution": "redis-8.1.0"
+    },
+    "scrapy": {
+      "files": 538,
+      "score": 45,
+      "findings": 417,
+      "matches_baseline": true,
+      "source_distribution": "scrapy-2.20.0"
+    },
+    "beautifulsoup4": {
+      "files": 38,
+      "score": 72,
+      "findings": 90,
+      "matches_baseline": true,
+      "source_distribution": "beautifulsoup4-4.15.0"
+    },
+    "loguru": {
+      "files": 19,
+      "score": 67,
+      "findings": 60,
+      "matches_baseline": true,
+      "source_distribution": "loguru-0.8.0"
+    },
+    "pandas": {
+      "files": 1448,
+      "score": 20,
+      "findings": 3210,
+      "matches_baseline": true,
+      "source_distribution": "pandas-3.1.1"
+    },
+    "numpy": {
+      "files": 1046,
+      "score": 22,
+      "findings": 2930,
+      "matches_baseline": true,
+      "source_distribution": "numpy-2.5.4"
+    },
+    "pillow": {
+      "files": 292,
+      "score": 45,
+      "findings": 666,
+      "matches_baseline": true,
+      "source_distribution": "pillow-13.0.0"
+    },
+    "tornado": {
+      "files": 77,
+      "score": 41,
+      "findings": 309,
+      "matches_baseline": true,
+      "source_distribution": "tornado-6.6.1"
+    },
+    "aiohttp": {
+      "files": 144,
+      "score": 44,
+      "findings": 430,
+      "matches_baseline": true,
+      "source_distribution": "aiohttp-3.14.5"
+    }
+  },
+  "files": 10330,
+  "diagnostic_regressions": 0,
+  "configured_boundary_checks": {
+    "requests": {
+      "forbidden_dependency": "urllib3",
+      "expected_violations": 28
+    },
+    "flask": {
+      "forbidden_dependency": "werkzeug",
+      "expected_violations": 79
+    },
+    "fastapi": {
+      "forbidden_dependency": "starlette",
+      "expected_violations": 115
+    }
+  }
+}