pyossmtool 0.0.1__py3-none-any.whl

pyossmtool/discovery.py

@@ -0,0 +1,50 @@
+"""Discover check targets from tool file globs under a scan root.
+
+Empty ``ToolDef.files`` (and no check-level ``include``) means the tool accepts a
+directory root — pass ``target`` through unchanged. Non-empty globs expand to
+matching files under ``project_root / target``, filtered by the effective
+gitignore matcher. An empty match set means the check should be skipped
+(silent pass).
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from pyossmtool.ignore import EffectiveIgnores
+from pyossmtool.models import CheckDef, ToolDef
+from pyossmtool.target_expand import expand_include_globs
+
+
+def effective_file_globs(check: CheckDef, tool: ToolDef) -> list[str]:
+    """Check-level include narrows; otherwise use tool files."""
+    if check.include:
+        return list(check.include)
+    return list(tool.files)
+
+
+def argv_targets_for_check(
+    *,
+    project_root: Path,
+    check: CheckDef,
+    tool: ToolDef,
+    target: str,
+    ignores: EffectiveIgnores | None = None,
+) -> list[str] | None:
+    globs = effective_file_globs(check, tool)
+    if not globs:
+        return [target]
+    root = (project_root / target).resolve()
+    matches = expand_include_globs(root, globs)
+    if ignores is not None:
+        matches = [rel for rel in matches if not _is_ignored(target, rel, ignores)]
+    if not matches:
+        return None
+    return [str(Path(target) / rel) for rel in matches]
+
+
+def _is_ignored(target: str, rel: str, ignores: EffectiveIgnores) -> bool:
+    repo_relative = str(Path(target) / rel).replace("\\", "/")
+    if repo_relative.startswith("./"):
+        repo_relative = repo_relative[2:]
+    return ignores.is_ignored(repo_relative)

pyossmtool/gate_config.py

@@ -0,0 +1,119 @@
+"""Load gate policy configuration (paths mode > project file > bundled)."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from pyossmtool.models import CheckDef, ConfigMode, GateConfigSpec, ProjectConfig
+from pyossmtool.registry import BUNDLE_ROOT
+
+BUNDLED_CONFIGS = BUNDLE_ROOT / "defaults" / "configs"
+BUNDLED_ALLOWLISTS = BUNDLE_ROOT / "defaults" / "allowlists"
+
+
+def resolve_gate_config_path(
+    check: CheckDef,
+    project_root: Path,
+    project_config: ProjectConfig | None,
+) -> Path | None:
+    override = _paths_mode_override(check.id, project_root, project_config)
+    if override is not None:
+        return override
+
+    spec = check.config
+    if spec is None:
+        return None
+
+    if spec.project_file:
+        project_path = project_root / spec.project_file
+        if project_path.exists():
+            return project_path.resolve()
+
+    return _bundled_config_path(spec)
+
+
+def load_gate_config(
+    check: CheckDef,
+    project_root: Path,
+    project_config: ProjectConfig | None,
+) -> tuple[Path | None, dict[str, Any]]:
+    path = resolve_gate_config_path(check, project_root, project_config)
+    if path is None or not path.exists():
+        return path, {}
+    data = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+    if not isinstance(data, dict):
+        raise ValueError(f"Gate config must be a mapping: {path}")
+    config = dict(data)
+    _resolve_allowlist_path(check, project_root, config)
+    return path, config
+
+
+def _paths_mode_override(check_id: str, project_root: Path, project_config: ProjectConfig | None) -> Path | None:
+    spec = project_config.configs if project_config else None
+    if not spec or spec.mode != ConfigMode.PATHS:
+        return None
+    override = spec.paths.get(check_id)
+    return (project_root / override).resolve() if override else None
+
+
+def _bundled_config_path(spec: GateConfigSpec) -> Path | None:
+    if not spec.bundled:
+        return None
+    path = BUNDLED_CONFIGS / spec.bundled
+    return path.resolve() if path.exists() else None
+
+
+def _resolve_allowlist_path(check: CheckDef, project_root: Path, config: dict[str, Any]) -> None:
+    raw = config.get("allowlist_file")
+    if not raw:
+        return
+    path = _allowlist_path(project_root, raw)
+    if path.exists():
+        config["allowlist_file"] = str(path.resolve())
+        return
+    bundled = _bundled_allowlist(check)
+    config["allowlist_file"] = str(bundled.resolve() if bundled else path.resolve())
+
+
+def _allowlist_path(project_root: Path, raw: Any) -> Path:
+    path = Path(str(raw))
+    if path.is_absolute():
+        return path
+    return project_root / path
+
+
+def _bundled_allowlist(check: CheckDef) -> Path | None:
+    if check.config is None or not check.config.allowlist_bundled:
+        return None
+    bundled = BUNDLED_ALLOWLISTS / check.config.allowlist_bundled
+    return bundled if bundled.exists() else None
+
+
+def gate_env_from_config(config: dict[str, Any], project_root: Path) -> dict[str, str]:
+    env: dict[str, str] = {}
+    for key, value in config.items():
+        if value is None:
+            continue
+        env[f"GATE_{key.upper()}"] = _gate_env_value(value)
+    allowlist = config.get("allowlist_file")
+    if allowlist:
+        env["GATE_ALLOWLIST_FILE"] = str(_allowlist_env_path(allowlist, project_root))
+    return env
+
+
+def _allowlist_env_path(allowlist: Any, project_root: Path) -> Path:
+    path = Path(str(allowlist))
+    if not path.is_absolute():
+        path = project_root / path
+    return path.resolve()
+
+
+def _gate_env_value(value: Any) -> str:
+    if isinstance(value, list):
+        return " ".join(str(item) for item in value)
+    if isinstance(value, bool):
+        return "1" if value else "0"
+    return str(value)

pyossmtool/gates.py

@@ -0,0 +1,102 @@
+"""Script gate scaffolding and library path resolution."""
+
+from __future__ import annotations
+
+import re
+import stat
+from pathlib import Path
+
+from pyossmtool.registry import BUNDLE_ROOT
+
+GATES_LIB = BUNDLE_ROOT / "defaults" / "gates" / "lib.sh"
+PROJECT_GATES_DIR = ".pyossmtool/gates"
+PROJECT_CHECKS_DIR = ".pyossmtool/catalog/checks"
+
+
+def lib_path() -> Path:
+    return GATES_LIB
+
+
+def default_report_path(check_id: str) -> str:
+    return f".pyossmtool/reports/{check_id}.json"
+
+
+def gate_check_id(name: str) -> str:
+    slug = re.sub(r"[^a-z0-9]+", "-", name.lower()).strip("-")
+    return f"gate.{slug}"
+
+
+def gate_script_path(name: str) -> str:
+    slug = re.sub(r"[^a-z0-9]+", "-", name.lower()).strip("-")
+    return f"{PROJECT_GATES_DIR}/{slug}.sh"
+
+
+def gate_catalog_path(name: str) -> Path:
+    return Path(PROJECT_CHECKS_DIR) / f"{gate_check_id(name)}.yaml"
+
+
+def render_gate_script(name: str, description: str) -> str:
+    slug = re.sub(r"[^a-z0-9]+", "-", name.lower()).strip("-")
+    return f"""#!/usr/bin/env bash
+# {description}
+set -euo pipefail
+
+# shellcheck source=/dev/null
+source "$(pyossmtool gates lib-path)"
+
+gate_init "{slug}"
+
+# Example: fail when a scan root is missing
+if [[ ! -d "${{PYOSSMTOOL_TARGET:-.}}" ]]; then
+\tgate_fail "missing-target" "Scan target not found: ${{PYOSSMTOOL_TARGET:-.}}"
+fi
+
+# Add your policy checks here, e.g.:
+# gate_fail "module-size" "src/foo.py exceeds line limit" "src/foo.py" "1"
+
+gate_finish
+"""
+
+
+def render_gate_catalog(name: str, description: str) -> str:
+    check_id = gate_check_id(name)
+    script = gate_script_path(name)
+    report = default_report_path(check_id)
+    title = name.replace("-", " ").title()
+    slug = re.sub(r"[^a-z0-9]+", "-", name.lower()).strip("-")
+    return f"""id: {check_id}
+tool: script
+name: {title}
+description: {description}
+script: {script}
+parser: gate_json
+output_file: {report}
+argv: []
+config:
+  bundled: gates/{slug}.yaml
+  project_file: .pyossmtool/configs/gates/{check_id}.yaml
+success:
+  exit_codes: [0]
+remediation:
+  suggested_commands:
+    - "./{script}"
+"""
+
+
+def scaffold_gate(project_root: Path, name: str, description: str) -> tuple[Path, Path]:
+    script_rel = gate_script_path(name)
+    script_path = project_root / script_rel
+    catalog_path = project_root / gate_catalog_path(name)
+
+    script_path.parent.mkdir(parents=True, exist_ok=True)
+    catalog_path.parent.mkdir(parents=True, exist_ok=True)
+
+    if script_path.exists():
+        raise FileExistsError(f"Gate script already exists: {script_path}")
+    if catalog_path.exists():
+        raise FileExistsError(f"Gate catalog entry already exists: {catalog_path}")
+
+    script_path.write_text(render_gate_script(name, description), encoding="utf-8")
+    script_path.chmod(script_path.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+    catalog_path.write_text(render_gate_catalog(name, description), encoding="utf-8")
+    return script_path, catalog_path

pyossmtool/ignore.py

@@ -0,0 +1,270 @@
+"""Resolve and apply unified ignore profiles and paths for quality checks."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from pathlib import Path
+
+import pathspec
+import yaml
+
+from pyossmtool.models import CheckDef, IgnoreSpec, ProjectConfig, SuiteCheckRef, SuiteDef, ToolDef
+
+
+@dataclass
+class ToolIgnoreMaterial:
+    """Tool-specific ignore materialization output."""
+
+    argv: list[str] = field(default_factory=list)
+    config_path: Path | None = None
+    skip_file: Path | None = None
+    post_subcommand: bool = False
+
+
+@dataclass
+class EffectiveIgnores:
+    """Merged ignore patterns for a single check run."""
+
+    profile_files: list[str] = field(default_factory=list)
+    path_patterns: list[str] = field(default_factory=list)
+    _matcher: pathspec.PathSpec | None = field(default=None, repr=False)
+
+    def matcher(self) -> pathspec.PathSpec:
+        if self._matcher is None:
+            patterns = list(self.path_patterns)
+            for profile in self.profile_files:
+                patterns.extend(_load_profile_patterns(Path(profile)))
+            self._matcher = pathspec.PathSpec.from_lines("gitignore", patterns)
+        return self._matcher
+
+    def is_ignored(self, repo_relative_path: str) -> bool:
+        normalized = _normalize_repo_path(repo_relative_path)
+        if not normalized:
+            return False
+        return self.matcher().match_file(normalized)
+
+
+def merge_ignore_specs(*specs: IgnoreSpec | None) -> IgnoreSpec:
+    profiles: list[str] = []
+    paths: list[str] = []
+    seen_profiles: set[str] = set()
+    seen_paths: set[str] = set()
+    for spec in specs:
+        if spec is None:
+            continue
+        _extend_unique(profiles, seen_profiles, spec.ignore_profile)
+        _extend_unique(paths, seen_paths, spec.ignore_paths)
+    return IgnoreSpec(ignore_profile=profiles, ignore_paths=paths)
+
+
+def _extend_unique(target: list[str], seen: set[str], values: list[str]) -> None:
+    for item in values:
+        if item in seen:
+            continue
+        seen.add(item)
+        target.append(item)
+
+
+def resolve_effective_ignores(
+    project_root: Path,
+    *,
+    suite: SuiteDef | None = None,
+    project_config: ProjectConfig | None = None,
+    check_ref: SuiteCheckRef | None = None,
+    check: CheckDef | None = None,
+    bundled_patterns: list[str] | None = None,
+) -> EffectiveIgnores:
+    merged = merge_ignore_specs(
+        IgnoreSpec(ignore_profile=[".gitignore"], ignore_paths=bundled_patterns or []),
+        _ignore_spec_from(suite),
+        _ignore_spec_from(project_config),
+        _ignore_spec_from(check),
+        _ignore_spec_from(check_ref),
+    )
+    return _effective_from_merged(merged, project_root)
+
+
+def _ignore_spec_from(source) -> IgnoreSpec:
+    if source is None:
+        return IgnoreSpec()
+    return IgnoreSpec(ignore_profile=source.ignore_profile, ignore_paths=source.ignore_paths)
+
+
+def _effective_from_merged(merged: IgnoreSpec, project_root: Path) -> EffectiveIgnores:
+    profile_files = [
+        str((project_root / rel).resolve()) for rel in merged.ignore_profile if (project_root / rel).resolve().is_file()
+    ]
+    path_patterns = [_normalize_pattern(pattern) for pattern in merged.ignore_paths]
+    return EffectiveIgnores(profile_files=profile_files, path_patterns=path_patterns)
+
+
+def filter_findings(findings: list, ignores: EffectiveIgnores) -> list:
+
+    return [finding for finding in findings if _keep_finding(finding, ignores)]
+
+
+def _keep_finding(finding, ignores: EffectiveIgnores) -> bool:
+    from pyossmtool.models import Finding
+
+    if not isinstance(finding, Finding):
+        return True
+    if not finding.location or not finding.location.file:
+        return True
+    return not ignores.is_ignored(finding.location.file)
+
+
+def materialize_for_tool(
+    tool: ToolDef,
+    ignores: EffectiveIgnores,
+    *,
+    project_root: Path,
+    check_id: str,
+    base_config_path: Path | None = None,
+) -> ToolIgnoreMaterial:
+    from pyossmtool.ignore_materialize import materialize_for_tool as _materialize
+
+    return _materialize(
+        tool,
+        ignores,
+        project_root=project_root,
+        check_id=check_id,
+        base_config_path=base_config_path,
+    )
+
+
+def ignore_env(ignores: EffectiveIgnores, project_root: Path) -> dict[str, str]:
+    profiles = [str((project_root / rel).resolve()) for rel in _profile_rel_paths(ignores, project_root)]
+    env: dict[str, str] = {}
+    if profiles:
+        env["PYOSSMTOOL_IGNORE_PROFILES"] = "\n".join(profiles)
+    if ignores.path_patterns:
+        env["PYOSSMTOOL_IGNORE_PATHS"] = "\n".join(ignores.path_patterns)
+    return env
+
+
+def _profile_rel_paths(ignores: EffectiveIgnores, project_root: Path) -> list[str]:
+    rels: list[str] = []
+    for path in ignores.profile_files:
+        try:
+            rels.append(str(Path(path).resolve().relative_to(project_root.resolve())))
+        except ValueError:
+            rels.append(path)
+    return rels
+
+
+def _all_patterns(ignores: EffectiveIgnores) -> list[str]:
+    patterns = list(ignores.path_patterns)
+    for profile in ignores.profile_files:
+        patterns.extend(_load_profile_patterns(Path(profile)))
+    deduped: list[str] = []
+    seen: set[str] = set()
+    for pattern in patterns:
+        normalized = _normalize_pattern(pattern)
+        if normalized and normalized not in seen:
+            seen.add(normalized)
+            deduped.append(normalized)
+    return deduped
+
+
+def _load_profile_patterns(path: Path) -> list[str]:
+    if not path.is_file():
+        return []
+    return [
+        pattern
+        for line in path.read_text(encoding="utf-8").splitlines()
+        if (pattern := _profile_line_pattern(line)) is not None
+    ]
+
+
+def _profile_line_pattern(line: str) -> str | None:
+    stripped = line.strip()
+    if not stripped or stripped.startswith("#") or stripped.startswith("!"):
+        return None
+    return stripped
+
+
+def _normalize_pattern(pattern: str) -> str:
+    pattern = pattern.strip().replace("\\", "/")
+    if pattern.startswith("./"):
+        pattern = pattern[2:]
+    return pattern.rstrip("/") if not pattern.endswith("/") else pattern
+
+
+def _normalize_repo_path(path: str) -> str:
+    normalized = path.strip().replace("\\", "/")
+    if normalized.startswith("./"):
+        normalized = normalized[2:]
+    return normalized
+
+
+def _patterns_as_yaml_block(patterns: list[str]) -> str:
+    return "\n".join(patterns) + ("\n" if patterns else "")
+
+
+def _merge_yaml_config(base_path: Path | None, overlay: dict) -> dict:
+    merged = _load_yaml_dict(base_path)
+    for key, value in overlay.items():
+        merged[key] = _merge_yaml_value(merged, key, value)
+    return merged
+
+
+def _load_yaml_dict(base_path: Path | None) -> dict:
+    if not base_path or not base_path.exists():
+        return {}
+    loaded = yaml.safe_load(base_path.read_text(encoding="utf-8")) or {}
+    return loaded if isinstance(loaded, dict) else {}
+
+
+def _merge_yaml_value(merged: dict, key: str, value) -> object:
+    if key == "ignore" and "ignore" in merged:
+        return _merge_ignore_block(merged["ignore"], value)
+    if key == "exclude" and "exclude" in merged:
+        return _merge_exclude_list(merged["exclude"], value)
+    return value
+
+
+def _merge_ignore_block(existing_value, value) -> str:
+    existing = str(existing_value).strip().splitlines()
+    new_lines = str(value).strip().splitlines()
+    return _patterns_as_yaml_block(list(dict.fromkeys([*existing, *new_lines])))
+
+
+def _merge_exclude_list(existing_value, value) -> list:
+    existing = list(existing_value) if isinstance(existing_value, list) else []
+    new_items = value if isinstance(value, list) else [value]
+    return list(dict.fromkeys([*existing, *new_items]))
+
+
+def bundled_tool_ignore_patterns(tool_id: str) -> list[str]:
+    """Static bundled defaults merged before suite/project ignores."""
+    if tool_id == "deadcode":
+        return ["**/models.py"]
+    return []
+
+
+def ignores_from_env(project_root: Path | None = None) -> EffectiveIgnores:
+    """Build ignores from PYOSSMTOOL_IGNORE_* environment variables (script gates)."""
+    import os
+
+    root = (project_root or Path.cwd()).resolve()
+    profile_files = _resolve_env_profiles(root, os.environ.get("PYOSSMTOOL_IGNORE_PROFILES", ""))
+    path_patterns = _env_path_patterns(os.environ.get("PYOSSMTOOL_IGNORE_PATHS", ""))
+    return EffectiveIgnores(profile_files=profile_files, path_patterns=path_patterns)
+
+
+def _env_path_patterns(text: str) -> list[str]:
+    return [_normalize_pattern(item) for item in text.splitlines() if item.strip()]
+
+
+def _resolve_env_profiles(root: Path, text: str) -> list[str]:
+    resolved: list[str] = []
+    for item in text.splitlines():
+        profile = item.strip()
+        if not profile:
+            continue
+        path = Path(profile)
+        if not path.is_absolute():
+            path = root / path
+        if path.is_file():
+            resolved.append(str(path.resolve()))
+    return resolved