repofail 0.2.4__tar.gz → 0.2.7__tar.gz

{repofail-0.2.4 → repofail-0.2.7}/.gitignore

@@ -20,3 +20,6 @@ secrets.yaml
 .credentials
 *.pem
 .DS_Store
+
+# Source logo (cropped version committed as docs/logo.png)
+repofail-logo-cropped-upscaled.png

{repofail-0.2.4/homebrew-tap → repofail-0.2.7}/Formula/repofail.rb

@@ -12,8 +12,8 @@ class Repofail < Formula
 
   desc "Deterministic runtime compatibility analyzer"
   homepage "https://github.com/jayvenn21/repofail"
-  url "https://github.com/jayvenn21/repofail/archive/refs/tags/v0.2.4.tar.gz"
-  sha256 "d5558cd419c8d46bdc958064cb97f963d1ea793866414c025906ec15033512ed"
+  url "https://github.com/jayvenn21/repofail/archive/refs/tags/v0.2.5.tar.gz"
+  sha256 "ac1791fcfd24fd9a70df44423f02ac6f70df5df53ee2f2fca7d518a6b639fa86"
   license "MIT"
 
   # App supports Python 3.10+. We use 3.12 for current Homebrew; change to

repofail-0.2.7/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jayanth Vennamreddy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

repofail-0.2.4/README.md → repofail-0.2.7/PKG-INFO

@@ -1,20 +1,39 @@
+Metadata-Version: 2.4
+Name: repofail
+Version: 0.2.7
+Summary: Predict why a repository will fail on your machine before you run it.
+Author: Jayanth
+License-File: LICENSE
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Requires-Python: >=3.10
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: tomli>=2.0; python_version < '3.11'
+Requires-Dist: typer>=0.9.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
 <p align="center">
-  <img src="https://raw.githubusercontent.com/jayvenn21/repofail/main/docs/logo.png" width="180" alt="repofail logo">
+  <img src="docs/logo.png" width="65%" alt="repofail logo">
 </p>
 
-<h1 align="center">repofail</h1>
-
 <p align="center">
   Deterministic runtime compatibility analyzer
 </p>
 
 <p align="center">
-  <a href="https://pypi.org/project/repofail/"><img src="https://img.shields.io/pypi/v/repofail?color=orange" alt="PyPI"></a>
-  <img src="https://img.shields.io/pypi/pyversions/repofail" alt="Python">
-  <img src="https://img.shields.io/pypi/dm/repofail" alt="Downloads">
-  <img src="https://img.shields.io/badge/ci-passing-brightgreen">
-  <img src="https://img.shields.io/badge/runtime-validated-success">
-  <img src="https://img.shields.io/badge/rules-20+-informational">
+  <a href="https://pypi.org/project/repofail/"><img src="https://img.shields.io/pypi/v/repofail?cacheSeconds=60" alt="PyPI"></a>
+  <a href="https://pypi.org/project/repofail/"><img src="https://img.shields.io/pypi/pyversions/repofail?cacheSeconds=60" alt="Python"></a>
+  <a href="https://pypi.org/project/repofail/"><img src="https://img.shields.io/pypi/dm/repofail?cacheSeconds=60" alt="Downloads"></a>
+  <a href="https://github.com/jayvenn21/repofail/actions"><img src="https://img.shields.io/github/actions/workflow/status/jayvenn21/repofail/repofail.yml?branch=main" alt="CI"></a>
+  <img src="https://img.shields.io/badge/runtime-validated-brightgreen" alt="Runtime">
+  <img src="https://img.shields.io/badge/rules-20%2B-blue" alt="Rules">
+  <a href="https://github.com/jayvenn21/repofail/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-lightgrey" alt="License"></a>
 </p>
 
 <p align="center">
@@ -215,6 +234,27 @@ The action installs repofail, runs a compatibility check, comments the Markdown
 
 Exits 1 if HIGH rules fire. Use `--fail-on MEDIUM` to be stricter.
 
+**Option C — Lock + verify (enforcement)**
+
+Pin the runtime once, then fail CI on drift:
+
+```bash
+repofail lock          # generates repofail.lock.json (python, node, arch, os, cuda, docker_base)
+repofail verify        # exit 1 if host doesn't match lock
+```
+
+Commit `repofail.lock.json`. In CI, run `repofail verify` so builds only pass on the locked environment.
+
+**Fleet compliance**
+
+Scan many repos and get violations, most common drift, and risk clusters:
+
+```bash
+repofail fleet scan ~/org --policy org.policy.yaml
+```
+
+Policy YAML (optional): `fail_on: HIGH`, `max_repos: 500`, `max_depth: 4`. With `fail_on: HIGH`, exit code is 1 if any repo has a HIGH finding.
+
 ## Contracts
 
 ```bash
@@ -331,3 +371,9 @@ pytest tests/ -v
 ```
 
 **Quick checks:** `bash -n install.sh` (syntax). The GitHub Action runs on every PR in this repo (see [.github/workflows/repofail.yml](.github/workflows/repofail.yml)); to test the reusable action, use it in another repo’s workflow on a PR.
+
+---
+
+## License
+
+MIT — see [LICENSE](LICENSE).

repofail-0.2.4/PKG-INFO → repofail-0.2.7/README.md

@@ -1,38 +1,19 @@
-Metadata-Version: 2.4
-Name: repofail
-Version: 0.2.4
-Summary: Predict why a repository will fail on your machine before you run it.
-Author: Jayanth
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Requires-Python: >=3.10
-Requires-Dist: pyyaml>=6.0
-Requires-Dist: tomli>=2.0; python_version < '3.11'
-Requires-Dist: typer>=0.9.0
-Provides-Extra: dev
-Requires-Dist: pytest>=7.0; extra == 'dev'
-Description-Content-Type: text/markdown
-
 <p align="center">
-  <img src="https://raw.githubusercontent.com/jayvenn21/repofail/main/docs/logo.png" width="180" alt="repofail logo">
+  <img src="docs/logo.png" width="65%" alt="repofail logo">
 </p>
 
-<h1 align="center">repofail</h1>
-
 <p align="center">
   Deterministic runtime compatibility analyzer
 </p>
 
 <p align="center">
-  <a href="https://pypi.org/project/repofail/"><img src="https://img.shields.io/pypi/v/repofail?color=orange" alt="PyPI"></a>
-  <img src="https://img.shields.io/pypi/pyversions/repofail" alt="Python">
-  <img src="https://img.shields.io/pypi/dm/repofail" alt="Downloads">
-  <img src="https://img.shields.io/badge/ci-passing-brightgreen">
-  <img src="https://img.shields.io/badge/runtime-validated-success">
-  <img src="https://img.shields.io/badge/rules-20+-informational">
+  <a href="https://pypi.org/project/repofail/"><img src="https://img.shields.io/pypi/v/repofail?cacheSeconds=60" alt="PyPI"></a>
+  <a href="https://pypi.org/project/repofail/"><img src="https://img.shields.io/pypi/pyversions/repofail?cacheSeconds=60" alt="Python"></a>
+  <a href="https://pypi.org/project/repofail/"><img src="https://img.shields.io/pypi/dm/repofail?cacheSeconds=60" alt="Downloads"></a>
+  <a href="https://github.com/jayvenn21/repofail/actions"><img src="https://img.shields.io/github/actions/workflow/status/jayvenn21/repofail/repofail.yml?branch=main" alt="CI"></a>
+  <img src="https://img.shields.io/badge/runtime-validated-brightgreen" alt="Runtime">
+  <img src="https://img.shields.io/badge/rules-20%2B-blue" alt="Rules">
+  <a href="https://github.com/jayvenn21/repofail/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-lightgrey" alt="License"></a>
 </p>
 
 <p align="center">
@@ -233,6 +214,27 @@ The action installs repofail, runs a compatibility check, comments the Markdown
 
 Exits 1 if HIGH rules fire. Use `--fail-on MEDIUM` to be stricter.
 
+**Option C — Lock + verify (enforcement)**
+
+Pin the runtime once, then fail CI on drift:
+
+```bash
+repofail lock          # generates repofail.lock.json (python, node, arch, os, cuda, docker_base)
+repofail verify        # exit 1 if host doesn't match lock
+```
+
+Commit `repofail.lock.json`. In CI, run `repofail verify` so builds only pass on the locked environment.
+
+**Fleet compliance**
+
+Scan many repos and get violations, most common drift, and risk clusters:
+
+```bash
+repofail fleet scan ~/org --policy org.policy.yaml
+```
+
+Policy YAML (optional): `fail_on: HIGH`, `max_repos: 500`, `max_depth: 4`. With `fail_on: HIGH`, exit code is 1 if any repo has a HIGH finding.
+
 ## Contracts
 
 ```bash
@@ -349,3 +351,9 @@ pytest tests/ -v
 ```
 
 **Quick checks:** `bash -n install.sh` (syntax). The GitHub Action runs on every PR in this repo (see [.github/workflows/repofail.yml](.github/workflows/repofail.yml)); to test the reusable action, use it in another repo’s workflow on a PR.
+
+---
+
+## License
+
+MIT — see [LICENSE](LICENSE).

{repofail-0.2.4 → repofail-0.2.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "repofail"
-version = "0.2.4"
+version = "0.2.7"
 description = "Predict why a repository will fail on your machine before you run it."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -20,6 +20,7 @@ classifiers = [
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: Implementation :: CPython",
 ]
 
 [project.scripts]

{repofail-0.2.4 → repofail-0.2.7}/repofail/cli.py

@@ -1,5 +1,6 @@
 """CLI entry point — scan repo, run rules, output clearly."""
 
+import json
 import sys
 from pathlib import Path
 from typing import Optional
@@ -13,7 +14,7 @@ def _err(msg: str) -> None:
     raise click.BadParameter(msg)
 
 # Subcommands (short names so "repofail gen" works)
-_SUBCOMMANDS = {"gen", "s", "a", "sim", "check"}
+_SUBCOMMANDS = {"gen", "s", "a", "sim", "check", "lock", "verify", "fleet"}
 
 
 def _preprocess_argv():
@@ -45,7 +46,9 @@ def _preprocess_argv():
 from .scanner import scan_repo, inspect_host
 from .engine import run_rules
 from .contract import generate_contract, validate_contract, EnvironmentContract
+from .lock import generate_lock, verify_lock, LOCK_FILENAME
 from .telemetry import save_report, get_stats
+from .fleet import audit, fleet_scan
 from .rules.base import Severity
 from .rules.registry import RULE_INFO
 from .risk import estimate_success_probability
@@ -53,6 +56,49 @@ from .format import format_human
 
 app = typer.Typer(help="Predict why a repository will fail on your machine.")
 
+fleet_app = typer.Typer(help="Fleet-wide compliance and scanning.")
+
+
+@fleet_app.command("scan")
+def fleet_scan_cmd(
+    path: Path = typer.Argument(Path("."), exists=True, file_okay=False, dir_okay=True, resolve_path=True, help="Root dir to scan (e.g. ~/org)"),
+    policy: Optional[Path] = typer.Option(None, "--policy", "-P", path_type=Path, help="Policy YAML (fail_on, max_repos, max_depth)"),
+    json_out: bool = typer.Option(False, "--json", "-j", help="Output JSON"),
+) -> None:
+    """Scan all repos under path; report violations, most common drift, risk clusters."""
+    if not path.exists() or not path.is_dir():
+        _err(f"Directory not found: {path}")
+    summary = fleet_scan(path, policy_path=policy)
+    if json_out:
+        typer.echo(json.dumps(summary, indent=2))
+        if summary.get("violations", 0) > 0 and summary.get("policy", {}).get("fail_on") == "HIGH":
+            high_count = sum(1 for r in summary.get("repos", []) if r.get("has_high"))
+            if high_count > 0:
+                raise typer.Exit(1)
+        return
+    total = summary["total_repos_scanned"]
+    violations = summary["violations"]
+    typer.echo(f"Total repos scanned: {total}")
+    typer.echo(f"Violations: {violations}")
+    drift = summary.get("most_common_drift") or {}
+    if drift:
+        typer.echo("Most common drift:")
+        for rule_id, count in list(drift.items())[:8]:
+            typer.echo(f"  {rule_id}: {count}")
+    clusters = summary.get("risk_clusters") or []
+    if clusters:
+        typer.echo("Risk cluster:")
+        for c in clusters[:6]:
+            typer.echo(f"  {c['category']}: {c['count']} finding(s)")
+    if summary.get("policy", {}).get("fail_on") == "HIGH":
+        high_count = sum(1 for r in summary.get("repos", []) if r.get("has_high"))
+        if high_count > 0:
+            typer.echo(f"\n{high_count} repo(s) with HIGH severity (policy fail_on=HIGH).", err=True)
+            raise typer.Exit(1)
+
+
+app.add_typer(fleet_app, name="fleet")
+
 
 @app.callback(invoke_without_command=True)
 def main(
@@ -310,7 +356,6 @@ def audit_cmd(
     json_out: bool = typer.Option(False, "-j", help="JSON output"),
 ) -> None:
     """Scan all repos in directory — fleet-wide compatibility check."""
-    from .fleet import audit
     if not path.exists() or not path.is_dir():
         _err(f"Directory not found: {path}\nUse a path that exists, e.g. repofail a .")
     results = audit(path)
@@ -361,6 +406,38 @@ def sim_cmd(
     raise typer.Exit(1)
 
 
+@app.command("lock")
+def lock_cmd(
+    path: Path = typer.Option(Path("."), "--path", "-p", exists=True, file_okay=False, dir_okay=True, resolve_path=True, help="Repo path"),
+    output: Optional[Path] = typer.Option(None, "-o", help="Output file (default: repofail.lock.json in repo)"),
+) -> None:
+    """Generate repofail.lock.json from current host (and repo Dockerfile base). CI can then use repofail verify."""
+    try:
+        lock = generate_lock(path)
+    except NotADirectoryError as e:
+        _err(str(e))
+    out = output or path / LOCK_FILENAME
+    out.write_text(json.dumps(lock, indent=2))
+    typer.echo(f"Wrote {out}", err=True)
+
+
+@app.command("verify")
+def verify_cmd(
+    path: Path = typer.Option(Path("."), "--path", "-p", exists=True, file_okay=False, dir_okay=True, resolve_path=True, help="Repo path"),
+    lock_file: Optional[Path] = typer.Option(None, "-f", help="Lock file path (default: repofail.lock.json in repo)"),
+) -> None:
+    """Verify current host matches repofail.lock.json. Exit 1 on drift (for CI)."""
+    lock_path = lock_file or path / LOCK_FILENAME
+    failures = verify_lock(lock_path)
+    if not failures:
+        typer.echo("OK: Host matches lock.")
+        return
+    typer.echo("Runtime drift detected:", err=True)
+    for field, expected, actual in failures:
+        typer.echo(f"  {field}: expected {expected}, host {actual}", err=True)
+    raise typer.Exit(1)
+
+
 @app.command("check")
 def check_cmd(
     contract_path: Path = typer.Argument(..., exists=True, path_type=Path, help="Contract JSON path"),

{repofail-0.2.4 → repofail-0.2.7}/repofail/fleet.py

@@ -1,18 +1,43 @@
-"""Stage 5 — Fleet/enterprise: audit, simulate."""
+"""Stage 5 — Fleet/enterprise: audit, simulate, fleet scan."""
 
 from __future__ import annotations
 
 import json
-from dataclasses import asdict
+from collections import Counter
 from pathlib import Path
+from typing import Any
 
 from .models import HostProfile, RepoProfile
 from .scanner import scan_repo, inspect_host
 from .engine import run_rules
 
+try:
+    import yaml
+except ImportError:
+    yaml = None  # type: ignore[assignment]
 
 SKIP_AUDIT_DIRS = {".git", "__pycache__", ".venv", "venv", "node_modules", ".tox", "build", "dist", "eggs"}
 
+# Rule ID -> short category for risk clusters
+RULE_CATEGORIES: dict[str, str] = {
+    "torch_cuda_mismatch": "ML/CUDA",
+    "python_version_mismatch": "Python",
+    "python_eol": "Python",
+    "spec_drift": "Spec drift",
+    "abi_wheel_mismatch": "ML/ARM",
+    "apple_silicon_wheels": "ML/ARM",
+    "node_engine_mismatch": "Node",
+    "node_eol": "Node",
+    "node_lock_file_missing": "Node",
+    "native_toolchain_missing": "Native build",
+    "gpu_memory_risk": "ML/RAM",
+    "node_native_windows": "Node/Windows",
+    "missing_system_libs": "System libs",
+    "docker_only": "Docker",
+    "lock_file_missing": "Lock file",
+}
+DEFAULT_CATEGORY = "Other"
+
 
 def _is_repo(p: Path) -> bool:
     """Check if path looks like a repo (has .git or deps file)."""
@@ -25,6 +50,21 @@ def _is_repo(p: Path) -> bool:
     )
 
 
+def _load_policy(policy_path: Path | None) -> dict[str, Any]:
+    """Load optional policy YAML: fail_on (HIGH/MEDIUM/LOW), max_repos, max_depth."""
+    if not policy_path or not policy_path.exists() or not yaml:
+        return {}
+    try:
+        data = yaml.safe_load(policy_path.read_text()) or {}
+        return {
+            "fail_on": data.get("fail_on", "HIGH"),
+            "max_repos": data.get("max_repos", 500),
+            "max_depth": data.get("max_depth", 4),
+        }
+    except Exception:
+        return {}
+
+
 def _find_repos(base_path: Path, max_depth: int = 4, max_repos: int = 50) -> list[Path]:
     """Find repo roots recursively (nested repos)."""
     found: list[Path] = []
@@ -87,6 +127,63 @@ def audit(base_path: Path) -> list[dict]:
     return results
 
 
+def fleet_scan(
+    base_path: Path,
+    policy_path: Path | None = None,
+) -> dict[str, Any]:
+    """
+    Scan all repos under base_path; optionally apply policy.
+    Returns: total_repos, violations (count), repos (list), by_rule (most common drift), risk_clusters.
+    """
+    base_path = Path(base_path).resolve()
+    policy = _load_policy(policy_path)
+    max_repos = int(policy.get("max_repos", 500))
+    max_depth = int(policy.get("max_depth", 4))
+
+    dirs = _find_repos(base_path, max_depth=max_depth, max_repos=max_repos)
+    host = inspect_host()
+    repos: list[dict[str, Any]] = []
+    rule_counter: Counter[str] = Counter()
+    category_counter: Counter[str] = Counter()
+
+    for d in dirs:
+        try:
+            repo = scan_repo(d)
+            rule_results = run_rules(repo, host)
+            rule_ids = [r.rule_id for r in rule_results]
+            for rid in rule_ids:
+                rule_counter[rid] += 1
+                category_counter[RULE_CATEGORIES.get(rid, DEFAULT_CATEGORY)] += 1
+            high_count = sum(1 for r in rule_results if r.severity.value == "HIGH")
+            med_count = sum(1 for r in rule_results if r.severity.value in ("MEDIUM", "LOW"))
+            score = __import__("repofail.risk", fromlist=["estimate_success_probability"]).estimate_success_probability(rule_results)
+            repos.append({
+                "path": str(d),
+                "name": repo.name or d.name,
+                "rule_count": len(rule_results),
+                "rules": rule_ids,
+                "has_high": high_count > 0,
+                "high_count": high_count,
+                "medium_count": med_count,
+                "score": score,
+            })
+        except Exception:
+            pass
+
+    violations = sum(1 for r in repos if r["rule_count"] > 0)
+    by_rule = dict(rule_counter.most_common(15))
+    risk_clusters = [{"category": k, "count": v} for k, v in category_counter.most_common(10)]
+
+    return {
+        "total_repos_scanned": len(repos),
+        "violations": violations,
+        "repos": repos,
+        "most_common_drift": by_rule,
+        "risk_clusters": risk_clusters,
+        "policy": policy,
+    }
+
+
 def host_from_dict(data: dict) -> HostProfile:
     """Build HostProfile from dict (e.g. from JSON file)."""
     return HostProfile(

repofail-0.2.7/repofail/lock.py

@@ -0,0 +1,78 @@
+"""Runtime lock — pin host + optional docker base for CI enforcement."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+from . import __version__
+from .scanner import inspect_host, scan_repo
+
+
+LOCK_FILENAME = "repofail.lock.json"
+
+
+def generate_lock(repo_path: Path) -> dict[str, Any]:
+    """Build lock dict from current host and repo (docker base if present)."""
+    host = inspect_host()
+    lock: dict[str, Any] = {
+        "repofail_lock": "1",
+        "generated_by": f"repofail {__version__}",
+        "python": host.python_version,
+        "node": host.node_version,
+        "cuda": host.cuda_version if host.cuda_available else None,
+        "arch": host.arch,
+        "os": host.os,
+        "docker_base": None,
+    }
+    try:
+        repo = scan_repo(repo_path)
+        if repo.raw.get("dockerfile"):
+            # First Dockerfile parsed may have base_image
+            df = repo.raw["dockerfile"]
+            if isinstance(df, dict) and df.get("base_image"):
+                lock["docker_base"] = df["base_image"]
+        # Also check first Dockerfile on disk if not in merged raw
+        if lock["docker_base"] is None and repo.has_dockerfile:
+            for p in (repo_path / "Dockerfile",):
+                if p.exists():
+                    from .scanner.parsers import parse_dockerfile
+                    data = parse_dockerfile(p)
+                    if data.get("base_image"):
+                        lock["docker_base"] = data["base_image"]
+                        break
+    except Exception:
+        pass
+    return lock
+
+
+def verify_lock(lock_path: Path) -> list[tuple[str, str, str]]:
+    """
+    Compare current host to lock. Returns list of (field, expected, actual) for mismatches.
+    """
+    if not lock_path.exists():
+        return [("_lock", "file exists", str(lock_path) + " not found")]
+    data = json.loads(lock_path.read_text())
+    host = inspect_host()
+
+    failures: list[tuple[str, str, str]] = []
+
+    def _cmp(field: str, expected: Any, actual: Any) -> None:
+        if expected is None:
+            return
+        if expected != actual:
+            failures.append((field, str(expected), str(actual) if actual is not None else "missing"))
+
+    _cmp("python", data.get("python"), host.python_version)
+    _cmp("node", data.get("node"), host.node_version)
+    _cmp("arch", data.get("arch"), host.arch)
+    _cmp("os", data.get("os"), host.os)
+
+    if data.get("cuda") is not None:
+        if not host.cuda_available:
+            failures.append(("cuda", str(data.get("cuda")), "not available"))
+        elif host.cuda_version and data.get("cuda") != host.cuda_version:
+            failures.append(("cuda", str(data.get("cuda")), str(host.cuda_version)))
+
+    return failures

{repofail-0.2.4 → repofail-0.2.7}/repofail/scanner/parsers.py

@@ -255,13 +255,27 @@ def parse_cargo_toml(path: Path) -> dict[str, Any]:
 
 def parse_dockerfile(path: Path) -> dict[str, Any]:
     """Parse Dockerfile for base image, platform, Python."""
-    result: dict[str, Any] = {"has_cuda": False, "python_version": None, "platform_amd64": False}
+    result: dict[str, Any] = {
+        "has_cuda": False,
+        "python_version": None,
+        "platform_amd64": False,
+        "base_image": None,
+    }
     if not path.exists():
         return result
 
     content = path.read_text(errors="replace")
     result["has_cuda"] = "cuda" in content.lower() or "nvidia" in content.lower()
     for line in content.splitlines():
+        stripped = line.strip()
+        if stripped.upper().startswith("FROM "):
+            # FROM image[:tag] [AS name]; skip --platform= and ARG
+            rest = stripped[5:].strip()
+            if rest and not result.get("base_image"):
+                base = rest.split()[0] if rest.split() else rest
+                if "AS " in base.upper():
+                    base = base.upper().split(" AS ")[0].strip()
+                result["base_image"] = base
         if "python:" in line.lower() or "python=" in line.lower():
             m = re.search(r"python[:\s]*([\d.]+)", line, re.I)
             if m:

repofail-0.2.4/.github/actions/repofail/README.md

@@ -1,45 +0,0 @@
-# repofail GitHub Action
-
-Run repofail on every PR: get a Markdown report as a comment and fail CI when compatibility violations exceed the threshold.
-
-## Usage
-
-In your repo, create `.github/workflows/repofail.yml`:
-
-```yaml
-name: repofail
-on:
-  pull_request:
-    branches: [main, master]
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: jayvenn21/repofail/.github/actions/repofail@main
-        with:
-          path: .
-          fail_on: HIGH
-          comment: 'true'
-          upload_artifact: 'true'
-          pr_number: ${{ github.event.pull_request.number }}
-```
-
-## Inputs
-
-| Input | Default | Description |
-|-------|---------|-------------|
-| `path` | `.` | Repository path to scan |
-| `fail_on` | `HIGH` | Fail CI when severity is HIGH, MEDIUM, or LOW |
-| `comment` | `true` | Comment on PR with Markdown report |
-| `upload_artifact` | `true` | Upload JSON report as workflow artifact |
-| `pr_number` | (empty) | Set to `${{ github.event.pull_request.number }}` for PR comments |
-
-## Behavior
-
-1. Installs repofail from PyPI
-2. Runs `repofail -m` and saves the report
-3. Runs `repofail -j` for machine-readable output
-4. Comments on the PR with the Markdown report (if `comment: true` and `pr_number` set)
-5. Uploads `repofail.json` as an artifact (if `upload_artifact: true`)
-6. Runs `repofail --ci` and fails the job if violations meet or exceed `fail_on`

repofail-0.2.4/.github/actions/repofail/action.yml

@@ -1,73 +0,0 @@
-name: repofail
-description: Deterministic runtime compatibility check — fail CI or comment on PR with report
-inputs:
-  path:
-    description: Repository path to scan (default .)
-    required: false
-    default: .
-  fail_on:
-    description: Severity threshold to fail CI (HIGH, MEDIUM, LOW)
-    required: false
-    default: HIGH
-  comment:
-    description: Comment on PR with Markdown report
-    required: false
-    default: 'true'
-  upload_artifact:
-    description: Upload JSON report as artifact
-    required: false
-    default: 'true'
-  pr_number:
-    description: Pull request number (for commenting). Set to ${{ github.event.pull_request.number }}
-    required: false
-    default: ''
-outputs:
-  markdown_file:
-    description: Path to Markdown report file (repofail-report.md)
-runs:
-  using: composite
-  steps:
-    - name: Install repofail
-      shell: bash
-      run: pip install repofail
-
-    - name: Run repofail (Markdown)
-      id: md
-      shell: bash
-      run: |
-        repofail -p "${{ inputs.path }}" -m > repofail-report.md || true
-        echo "markdown_file=repofail-report.md" >> $GITHUB_OUTPUT
-
-    - name: Run repofail (JSON)
-      if: inputs.upload_artifact == 'true'
-      shell: bash
-      run: repofail -p "${{ inputs.path }}" -j > repofail.json || true
-
-    - name: Comment on PR with report
-      if: inputs.comment == 'true' && inputs.pr_number != ''
-      uses: actions/github-script@v7
-      with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-        script: |
-          const fs = require('fs');
-          const body = fs.existsSync('repofail-report.md')
-            ? fs.readFileSync('repofail-report.md', 'utf8')
-            : 'repofail report not available.';
-          const comment = `## repofail · compatibility report\n\n\`\`\`\n${body}\n\`\`\``;
-          await github.rest.issues.createComment({
-            issue_number: ${{ inputs.pr_number }},
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: comment,
-          });
-
-    - name: Upload repofail JSON artifact
-      if: inputs.upload_artifact == 'true' && always()
-      uses: actions/upload-artifact@v4
-      with:
-        name: repofail-report
-        path: repofail.json
-
-    - name: Run repofail (CI — fail if threshold exceeded)
-      shell: bash
-      run: repofail -p "${{ inputs.path }}" --ci --fail-on "${{ inputs.fail_on }}"

repofail-0.2.4/Formula/repofail.rb

@@ -1,66 +0,0 @@
-# Homebrew formula for repofail
-# To use: copy to your tap repo (e.g. homebrew-tap/Formula/repofail.rb)
-# Then: brew tap jayvenn21/tap && brew install jayvenn21/tap/repofail
-#
-# Homebrew uses --no-deps when installing the main package, so all Python
-# dependencies must be declared as resources below.
-# If SHA256 fails after pushing a new tag, get the correct hash with:
-#   curl -sL https://github.com/jayvenn21/repofail/archive/refs/tags/vX.Y.Z.tar.gz | shasum -a 256
-
-class Repofail < Formula
-  include Language::Python::Virtualenv
-
-  desc "Deterministic runtime compatibility analyzer"
-  homepage "https://github.com/jayvenn21/repofail"
-  url "https://github.com/jayvenn21/repofail/archive/refs/tags/v0.2.4.tar.gz"
-  sha256 "d5558cd419c8d46bdc958064cb97f963d1ea793866414c025906ec15033512ed"
-  license "MIT"
-
-  # App supports Python 3.10+. We use 3.12 for current Homebrew; change to
-  # python@3.10 or python@3.11 if you need an older interpreter.
-  depends_on "libyaml"
-  depends_on "python@3.12"
-
-  resource "click" do
-    url "https://files.pythonhosted.org/packages/3d/fa/656b739db8587d7b5dfa22e22ed02566950fbfbcdc20311993483657a5c0/click-8.3.1.tar.gz"
-    sha256 "12ff4785d337a1bb490bb7e9c2b1ee5da3112e94a8622f26a6c77f5d2fc6842a"
-  end
-
-  resource "typer" do
-    url "https://files.pythonhosted.org/packages/ac/0a/d55af35db5f50f486e3eda0ada747eed773859e2699d3ce570b682a9b70a/typer-0.12.3.tar.gz"
-    sha256 "49e73131481d804288ef62598d97a1ceef3058905aa536a1134f90891ba35482"
-  end
-
-  resource "rich" do
-    url "https://files.pythonhosted.org/packages/ab/3a/0316b28d0761c6734d6bc14e770d85506c986c85ffb239e688eeaab2c2bc/rich-13.9.4.tar.gz"
-    sha256 "439594978a49a09530cff7ebc4b5c7103ef57baf48d5ea3184f21d9a2befa098"
-  end
-
-  resource "shellingham" do
-    url "https://files.pythonhosted.org/packages/58/15/8b3609fd3830ef7b27b655beb4b4e9c62313a4e8da8c676e142cc210d58e/shellingham-1.5.4.tar.gz"
-    sha256 "8dbca0739d487e5bd35ab3ca4b36e11c4078f3a234bfce294b0a0291363404de"
-  end
-
-  resource "typing-extensions" do
-    url "https://files.pythonhosted.org/packages/df/db/f35a00659bc03fec321ba8bce9420de607a1d37f8342eee1863174c69557/typing_extensions-4.12.2.tar.gz"
-    sha256 "1a7ead55c7e559dd4dee8856e3a88b41225abfe1ce8df57b7c13915fe121ffb8"
-  end
-
-  resource "tomli" do
-    url "https://files.pythonhosted.org/packages/35/b9/de2a5c0144d7d75a57ff355c0c24054f965b2dc3036456ae03a51ea6264b/tomli-2.0.2.tar.gz"
-    sha256 "d46d457a85337051c36524bc5349dd91b1877838e2979ac5ced3e710ed8a60ed"
-  end
-
-  resource "pyyaml" do
-    url "https://github.com/yaml/pyyaml/archive/refs/tags/6.0.1.tar.gz"
-    sha256 "57314c984aaa84318eed00cf5a8365afc49f87954969e295efe2ba99f3b21f7a"
-  end
-
-  def install
-    virtualenv_install_with_resources
-  end
-
-  test do
-    assert_match "repofail", shell_output("#{bin}/repofail --help", 0)
-  end
-end

repofail-0.2.4/docs/QUICKSTART.md

@@ -1,42 +0,0 @@
-# repofail — 30-second quickstart
-
-## What it does
-
-Answers one question: **Will this repository run on this machine?**
-
-It does **not** install your project. It reads configs and your environment, then reports compatibility issues (Node version, Python range, CUDA, lock file, spec drift, etc.) with a single score and clear evidence.
-
-## Install
-
-```bash
-pip install repofail
-```
-
-Or: `pipx install repofail` | [install.sh](https://raw.githubusercontent.com/jayvenn21/repofail/main/install.sh) | Homebrew (see README).
-
-## Run
-
-```bash
-cd /path/to/any/repo
-repofail
-```
-
-You get:
-
-- A **compatibility score** (0–100%)
-- **HARD FAILURES** (deterministic blockers) with evidence and suggested fixes
-- Optional: **RUNTIME RISKS**, **STRUCTURAL PROFILE**
-
-## CI
-
-```bash
-repofail --ci
-```
-
-Exits 1 if HIGH (or configured) severity violations are found. Use in GitHub Actions or any CI.
-
-## Next
-
-- `repofail -e list` — list all rules  
-- `repofail -e spec_drift` — explain a rule  
-- [README](https://github.com/jayvenn21/repofail#readme) — full docs, FAQ, when not to use

repofail-0.2.4/install.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-# Install repofail — deterministic runtime compatibility analyzer
-# Usage: curl -sSL https://raw.githubusercontent.com/jayvenn21/repofail/main/install.sh | bash
-
-set -e
-
-if command -v pipx &>/dev/null; then
-  echo "Installing repofail via pipx (isolated)..."
-  pipx install repofail
-elif command -v pip3 &>/dev/null; then
-  echo "Installing repofail via pip..."
-  pip3 install repofail
-elif command -v pip &>/dev/null; then
-  echo "Installing repofail via pip..."
-  pip install repofail
-else
-  echo "Error: need pip or pipx. Install Python 3.10+ and run: pip install repofail"
-  exit 1
-fi
-
-echo "Done. Run: repofail --help"