roadmap-cli 0.2.0__tar.gz → 0.3.0__tar.gz

{roadmap_cli-0.2.0 → roadmap_cli-0.3.0}/.gitignore

@@ -254,6 +254,7 @@ test_sync_init/*.lock
 /tmp/test_check_sync/*.tmp
 /tmp/test_check_sync/*.lock
 sync_git_state.txt
+/output.txt
 
 # design notes, AI prompts, etc.
 

{roadmap_cli-0.2.0 → roadmap_cli-0.3.0}/CHANGELOG.md

@@ -6,8 +6,40 @@ All notable changes to Roadmap CLI are recorded here. The format follows
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-09-02
+
+### Changed
+
+- Migrated static type checking from Pyright-only to `ty` running alongside
+  Pyright, both enforced in CI and pre-commit; aligned their configured
+  Python-version floor with the declared `>=3.12` support range.
+- Reduced cyclomatic complexity across the codebase and enforced a
+  xenon B-or-better gate (absolute, per-module, and average) in CI and
+  pre-commit.
+- Raised the enforced test coverage floor from 78% to 85%, backed by a
+  targeted test-coverage sweep (CLI output formatting and issue query
+  presentation) that reached 85.70%.
+- Reduced DRY violations identified during the complexity-reduction pass.
+- Enabled GitHub's native Dependabot vulnerability alerts for the repository.
+
+### Fixed
+
+- Removed the stale, inaccurate `.env.production` file (unverifiable "0 known
+  CVEs" claim, an obsolete `poetry install` reference, and unused
+  environment variables that nothing in the codebase reads).
+- Removed the stale, tracked `output.txt` pytest-output artifact from version
+  control.
+- Fixed a broken `SECURITY.md` reference to a nonexistent developer-notes
+  file; it now points to the ADR that documents credential handling.
+
+### Removed
+
+- Removed `.env.production` and `output.txt` from version control (see
+  Fixed, above).
+
 ## [0.2.0] - 2026-08-27
 
+
 ### Added
 
 - Added explicit `roadmap migrate` preflight, dry-run, confirmed execution,

{roadmap_cli-0.2.0 → roadmap_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: roadmap-cli
-Version: 0.2.0
+Version: 0.3.0
 Summary: Git-native command line tool for local project roadmap management
 Project-URL: Homepage, https://github.com/shanewilkins/roadmap
 Project-URL: Repository, https://github.com/shanewilkins/roadmap
@@ -43,7 +43,8 @@ Requires-Dist: pytest-mock>=3.15.1; extra == 'dev'
 Requires-Dist: pytest-xdist>=3.8.0; extra == 'dev'
 Requires-Dist: pytest>=9.0.3; extra == 'dev'
 Requires-Dist: radon<7.0.0,>=6.0.1; extra == 'dev'
-Requires-Dist: ruff==0.16.4; extra == 'dev'
+Requires-Dist: ruff==0.16.5; extra == 'dev'
+Requires-Dist: ty>=0.0.77; extra == 'dev'
 Requires-Dist: xenon<1.0.0,>=0.9.3; extra == 'dev'
 Description-Content-Type: text/markdown
 
@@ -54,9 +55,11 @@ their planning data in reviewable Markdown and YAML files rather than a hosted
 service. It supports issues, dependencies, comments, projects, milestones,
 daily views, health checks, and machine-readable exports.
 
-The current release is 0.2.0. Its deliberately contracted behavior is defined
+The current release is 0.3.0. Its deliberately contracted behavior is defined
 by an explicit
 [public compatibility contract](docs/architecture/public-contract-0.2.md).
+0.3 is an internal quality-hardening release; the 0.2 CLI and data contract is
+unchanged.
 
 ## What it does
 

{roadmap_cli-0.2.0 → roadmap_cli-0.3.0}/README.md

@@ -5,9 +5,11 @@ their planning data in reviewable Markdown and YAML files rather than a hosted
 service. It supports issues, dependencies, comments, projects, milestones,
 daily views, health checks, and machine-readable exports.
 
-The current release is 0.2.0. Its deliberately contracted behavior is defined
+The current release is 0.3.0. Its deliberately contracted behavior is defined
 by an explicit
 [public compatibility contract](docs/architecture/public-contract-0.2.md).
+0.3 is an internal quality-hardening release; the 0.2 CLI and data contract is
+unchanged.
 
 ## What it does
 

{roadmap_cli-0.2.0 → roadmap_cli-0.3.0}/pyproject.toml

@@ -13,7 +13,7 @@ build-backend = "hatchling.build"
 #   Installs the locked runtime and development dependency sets.
 # ============================================================================
 name = "roadmap-cli"
-version = "0.2.0"
+version = "0.3.0"
 description = "Git-native command line tool for local project roadmap management"
 readme = "README.md"
 requires-python = ">=3.12,<4.0"
@@ -61,7 +61,7 @@ dev = [
     "pytest-cov>=7.1.0",
     "pytest-asyncio>=1.3.0",
     "pytest-aiohttp>=1.1.0",
-    "ruff==0.16.4",
+    "ruff==0.16.5",
     "pre-commit>=4.6.0",
     "bandit[toml]>=1.9.4",
     "radon>=6.0.1,<7.0.0",
@@ -70,6 +70,7 @@ dev = [
     "pytest-benchmark>=5.2.3",
     "pyright>=1.1.411",
     "pytest-mock>=3.15.1",
+    "ty>=0.0.77",
 ]
 
 [project.urls]
@@ -112,10 +113,19 @@ include = [
 # - ruff.toml: Linting and formatting rules
 # - bandit.toml: Security scanning configuration
 # - .coveragerc: Test coverage thresholds and exclusions
-# - pyrightconfig.json: Type checking configuration
+# - pyrightconfig.json: Type checking configuration (current)
 
-# Type checking is now handled by Pyright
-# Configuration is in pyrightconfig.json
+# ty runs alongside Pyright and is enforced in CI and pre-commit (0.3 quality
+# cleanup, see notes/path_to_1_point_0.md).
+[tool.ty.src]
+include = ["roadmap", "tests"]
+# These fixture trees are synthetic "roadmap" packages used only for the
+# architecture checker's AST scan; they are never actually imported, so
+# ty's import resolution has nothing real to check them against.
+exclude = ["tests/policy/fixtures/architecture"]
+
+[tool.ty.environment]
+python-version = "3.12"
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

{roadmap_cli-0.2.0 → roadmap_cli-0.3.0}/roadmap/__init__.py

@@ -4,10 +4,10 @@ from importlib.metadata import PackageNotFoundError, version
 
 # Installed artifacts read their distribution metadata; source checkouts use the
 # matching fallback without importing the executable adapter as a side effect.
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 try:
     __version__ = version("roadmap-cli")
 except PackageNotFoundError:
-    __version__ = "0.2.0"
+    __version__ = "0.3.0"
 
 __all__ = ["__version__"]

{roadmap_cli-0.2.0 → roadmap_cli-0.3.0}/roadmap/adapters/inbound/cli/__init__.py

@@ -96,21 +96,21 @@ class RoadmapClickGroup(click.Group):
         with formatter.section("Commands"):
             formatter.write_dl(rows)
 
-    def get_command(self, ctx: click.Context, name: str) -> click.Command | None:
+    def get_command(self, ctx: click.Context, cmd_name: str) -> click.Command | None:
         """Load one registered command only when Click requests it."""
-        if (attached := super().get_command(ctx, name)) is not None:
+        if (attached := super().get_command(ctx, cmd_name)) is not None:
             return attached
-        if name in self._command_cache:
-            return self._command_cache[name]
-        location = self._command_registry.get(name)
+        if cmd_name in self._command_cache:
+            return self._command_cache[cmd_name]
+        location = self._command_registry.get(cmd_name)
         if location is None:
             return None
         module_path, attribute, _help = location
         try:
-            self._command_cache[name] = command = getattr(importlib.import_module(module_path), attribute)  # fmt: skip
+            self._command_cache[cmd_name] = command = getattr(importlib.import_module(module_path), attribute)  # fmt: skip
         except Exception as error:
             self._console_factory().print(
-                f"⚠️  Failed to load command '{name}': {error}", style="yellow"
+                f"⚠️  Failed to load command '{cmd_name}': {error}", style="yellow"
             )
             return None
         return command

{roadmap_cli-0.2.0 → roadmap_cli-0.3.0}/roadmap/adapters/inbound/cli/cleanup.py

@@ -11,25 +11,40 @@ import click
 from roadmap.adapters.inbound.cli.cli_command_helpers import require_initialized
 
 
-def _candidates(
-    backups_dir: Path, keep: int, days: int | None, now: datetime
-) -> tuple[Path, ...]:
+def _validate_retention_options(keep: int, days: int | None) -> None:
     if keep < 0:
         raise click.BadParameter("keep must be non-negative", param_hint="--keep")
     if days is not None and days < 0:
         raise click.BadParameter("days must be non-negative", param_hint="--days")
+
+
+def _group_backups(backups_dir: Path) -> dict[str, list[Path]]:
     grouped: dict[str, list[Path]] = defaultdict(list)
     for path in backups_dir.glob("*.backup.md") if backups_dir.exists() else ():
         parts = path.stem.split("_")
         grouped["_".join(parts[:-1])].append(path)
+    return grouped
+
+
+def _stale_paths(paths: list[Path], keep: int, cutoff: datetime | None) -> list[Path]:
+    ordered = sorted(paths, key=lambda path: (-path.stat().st_mtime, path.name))
+    stale: list[Path] = []
+    for index, path in enumerate(ordered):
+        modified = datetime.fromtimestamp(path.stat().st_mtime, tz=UTC)
+        if index >= keep or (cutoff is not None and modified < cutoff):
+            stale.append(path)
+    return stale
+
+
+def _candidates(
+    backups_dir: Path, keep: int, days: int | None, now: datetime
+) -> tuple[Path, ...]:
+    _validate_retention_options(keep, days)
+    grouped = _group_backups(backups_dir)
     cutoff = now - timedelta(days=days) if days is not None else None
     selected: list[Path] = []
     for paths in grouped.values():
-        ordered = sorted(paths, key=lambda path: (-path.stat().st_mtime, path.name))
-        for index, path in enumerate(ordered):
-            modified = datetime.fromtimestamp(path.stat().st_mtime, tz=UTC)
-            if index >= keep or (cutoff is not None and modified < cutoff):
-                selected.append(path)
+        selected.extend(_stale_paths(paths, keep, cutoff))
     return tuple(sorted(selected))
 
 
@@ -40,6 +55,39 @@ def _diagnostic_matches(core, finding_id: str) -> tuple[str, ...]:
     )
 
 
+def _selected_diagnostic_check(
+    check_folders: bool, check_duplicates: bool, check_malformed: bool
+) -> str | None:
+    checks = {
+        "canonical.noncanonical-path": check_folders,
+        "canonical.duplicate-id": check_duplicates,
+        "canonical.invalid": check_malformed,
+    }
+    selected = [name for name, enabled in checks.items() if enabled]
+    if len(selected) > 1:
+        raise click.UsageError("select only one --check-* option")
+    return selected[0] if selected else None
+
+
+def _report_diagnostic_matches(core, finding_id: str) -> None:
+    matches = _diagnostic_matches(core, finding_id)
+    click.echo("\n".join(matches) + ("\n" if matches else "No findings.\n"), nl=False)
+
+
+def _remove_backups(candidates: tuple[Path, ...], relative: tuple[str, ...]) -> None:
+    failures: list[str] = []
+    for path, label in zip(candidates, relative, strict=True):
+        try:
+            path.unlink()
+        except OSError as error:
+            failures.append(f"{label}: {error}")
+    if failures:
+        raise click.ClickException(
+            "Backup cleanup was incomplete:\n" + "\n".join(failures)
+        )
+    click.echo(f"Removed {len(candidates)} backup file(s).")
+
+
 @click.command()
 @click.option("--keep", type=int, default=10, show_default=True)
 @click.option("--days", type=int)
@@ -66,19 +114,11 @@ def cleanup(
 ) -> None:
     """Preview or remove only retention-qualified legacy backup files."""
     del backups_only, verbose
-    checks = {
-        "canonical.noncanonical-path": check_folders,
-        "canonical.duplicate-id": check_duplicates,
-        "canonical.invalid": check_malformed,
-    }
-    selected_checks = [name for name, enabled in checks.items() if enabled]
-    if len(selected_checks) > 1:
-        raise click.UsageError("select only one --check-* option")
-    if selected_checks:
-        matches = _diagnostic_matches(ctx.obj["core"], selected_checks[0])
-        click.echo(
-            "\n".join(matches) + ("\n" if matches else "No findings.\n"), nl=False
-        )
+    diagnostic_check = _selected_diagnostic_check(
+        check_folders, check_duplicates, check_malformed
+    )
+    if diagnostic_check is not None:
+        _report_diagnostic_matches(ctx.obj["core"], diagnostic_check)
         return
     roadmap_dir = ctx.obj["core"].roadmap_dir
     candidates = _candidates(roadmap_dir / "backups", keep, days, datetime.now(UTC))
@@ -94,14 +134,4 @@ def cleanup(
         return
     if not force:
         click.confirm("Remove exactly these backup files?", abort=True, default=False)
-    failures: list[str] = []
-    for path, label in zip(candidates, relative, strict=True):
-        try:
-            path.unlink()
-        except OSError as error:
-            failures.append(f"{label}: {error}")
-    if failures:
-        raise click.ClickException(
-            "Backup cleanup was incomplete:\n" + "\n".join(failures)
-        )
-    click.echo(f"Removed {len(candidates)} backup file(s).")
+    _remove_backups(candidates, relative)

{roadmap_cli-0.2.0 → roadmap_cli-0.3.0}/roadmap/adapters/inbound/cli/cli_command_helpers.py

@@ -9,17 +9,67 @@ Provides decorators and functions to reduce duplication in CLI commands:
 
 import functools
 import sys
-from collections.abc import Callable
+from collections.abc import Callable, Sequence
 from typing import Any, TypeVar
 
 import click  # type: ignore[import-not-found]
 from rich.console import Console  # type: ignore[import-not-found]
 
+from roadmap.application.failures import ApplicationFailure
+from roadmap.domain.failures import DomainFailure
+
 console = Console()
 
 F = TypeVar("F", bound=Callable[..., Any])
 
 
+def invoke(operation: Callable[[], Any]) -> Any:
+    """Translate stable application/domain failures into Click failures."""
+    try:
+        return operation()
+    except (ApplicationFailure, DomainFailure, ValueError) as error:
+        raise click.ClickException(str(error)) from error
+
+
+def projection_warning(result: Any) -> None:
+    if getattr(result, "projection_stale", False):
+        click.echo("Warning: SQLite projection is stale; canonical Markdown was saved.")
+
+
+def echo_batch_result(
+    noun: str,
+    items: Sequence[Any],
+    dry_run: bool,
+    *,
+    action: str,
+    label: Callable[[Any], str] = lambda item: str(item.name),
+) -> None:
+    """Echo the "<verb> <noun> <id>: <label>" summary shared by batch
+    archive/restore commands. ``action`` is the base verb (e.g. "archive",
+    "restore"); both currently used verbs conjugate regularly to their past
+    tense for the non-dry-run wording.
+    """
+    past_tense = action + ("d" if action.endswith("e") else "ed")
+    verb = f"Would {action}" if dry_run else past_tense.capitalize()
+    for item in items:
+        click.echo(f"{verb} {noun} {item.id}: {label(item)}")
+    if not items:
+        click.echo(f"No matching {noun}s.")
+
+
+def echo_archived_list(
+    noun: str,
+    values: Sequence[Any],
+    label: Callable[[Any], str] = lambda item: str(item.name),
+) -> None:
+    """Echo the archived-entity listing shared by the "--list" branch of
+    the project/milestone archive commands."""
+    if not values:
+        click.echo(f"No archived {noun}s.")
+    for item in values:
+        click.echo(f"{item.id}  {label(item)}")
+
+
 def require_initialized(func: Callable) -> Callable:
     """Require roadmap to be initialized before command execution.
 

{roadmap_cli-0.2.0 → roadmap_cli-0.3.0}/roadmap/adapters/inbound/cli/data/commands.py

@@ -74,40 +74,62 @@ def export(
     click.echo(f"Exported {len(records)} issues to {output}", err=True)
 
 
-def _query(value: str | None) -> IssueListQuery:
-    if value is None:
-        return IssueListQuery(scope=IssueScope.ALL)
+def _validate_filter_string(value: str) -> tuple[str, str]:
     if "=" not in value:
         raise click.BadParameter("filter must use key=value", param_hint="--filter")
     key, expected = (part.strip() for part in value.split("=", 1))
     if not key or not expected:
         raise click.BadParameter("filter must use key=value", param_hint="--filter")
-    if key == "status":
-        return IssueListQuery(
-            scope=IssueScope.ALL,
-            open_only=expected == "open",
-            status=None if expected == "open" else expected,
-        )
-    if key == "priority":
-        return IssueListQuery(scope=IssueScope.ALL, priority=expected)
-    if key == "issue_type":
-        return IssueListQuery(scope=IssueScope.ALL, issue_type=expected)
-    if key == "assignee":
-        return IssueListQuery(scope=IssueScope.ALL, assignee=expected)
-    if key == "retention":
-        try:
-            return IssueListQuery(scope=IssueScope(expected))
-        except ValueError as error:
-            raise click.BadParameter(
-                "retention must be visible, closed, archived, or all",
-                param_hint="--filter",
-            ) from error
-    raise click.BadParameter(
-        "supported filter keys are status, priority, issue_type, assignee, and retention",
-        param_hint="--filter",
+    return key, expected
+
+
+def _retention_query(expected: str) -> IssueListQuery:
+    try:
+        return IssueListQuery(scope=IssueScope(expected))
+    except ValueError as error:
+        raise click.BadParameter(
+            "retention must be visible, closed, archived, or all",
+            param_hint="--filter",
+        ) from error
+
+
+def _status_query(expected: str) -> IssueListQuery:
+    return IssueListQuery(
+        scope=IssueScope.ALL,
+        open_only=expected == "open",
+        status=None if expected == "open" else expected,
     )
 
 
+_FILTER_BUILDERS = {
+    "status": _status_query,
+    "priority": lambda expected: IssueListQuery(
+        scope=IssueScope.ALL, priority=expected
+    ),
+    "issue_type": lambda expected: IssueListQuery(
+        scope=IssueScope.ALL, issue_type=expected
+    ),
+    "assignee": lambda expected: IssueListQuery(
+        scope=IssueScope.ALL, assignee=expected
+    ),
+    "retention": _retention_query,
+}
+
+
+def _query(value: str | None) -> IssueListQuery:
+    if value is None:
+        return IssueListQuery(scope=IssueScope.ALL)
+    key, expected = _validate_filter_string(value)
+    builder = _FILTER_BUILDERS.get(key)
+    if builder is None:
+        raise click.BadParameter(
+            "supported filter keys are status, priority, issue_type, assignee, "
+            "and retention",
+            param_hint="--filter",
+        )
+    return builder(expected)
+
+
 def _timestamp(value: Any) -> str | None:
     return None if value is None else value.value.isoformat()
 
@@ -157,38 +179,39 @@ def _issue_record(record: IssueQueryRecord) -> dict[str, Any]:
     }
 
 
-def _render(records: tuple[IssueQueryRecord, ...], format_name: str) -> str:
-    rows = [_issue_record(record) for record in records]
-    if format_name == "json":
-        return (
-            json.dumps(
-                {
-                    "schema_version": EXPORT_SCHEMA_VERSION,
-                    "kind": "roadmap.issue-export",
-                    "issues": rows,
-                },
-                ensure_ascii=False,
-                indent=2,
-                sort_keys=True,
-            )
-            + "\n"
+def _render_json(rows: list[dict[str, Any]]) -> str:
+    return (
+        json.dumps(
+            {
+                "schema_version": EXPORT_SCHEMA_VERSION,
+                "kind": "roadmap.issue-export",
+                "issues": rows,
+            },
+            ensure_ascii=False,
+            indent=2,
+            sort_keys=True,
+        )
+        + "\n"
+    )
+
+
+def _render_csv(rows: list[dict[str, Any]]) -> str:
+    stream = io.StringIO(newline="")
+    writer = csv.DictWriter(stream, fieldnames=CSV_FIELDS, lineterminator="\n")
+    writer.writeheader()
+    for row in rows:
+        writer.writerow(
+            {
+                field: json.dumps(row[field], ensure_ascii=False, separators=(",", ":"))
+                if field in {"labels", "depends_on", "blocks"}
+                else row[field]
+                for field in CSV_FIELDS
+            }
         )
-    if format_name == "csv":
-        stream = io.StringIO(newline="")
-        writer = csv.DictWriter(stream, fieldnames=CSV_FIELDS, lineterminator="\n")
-        writer.writeheader()
-        for row in rows:
-            writer.writerow(
-                {
-                    field: json.dumps(
-                        row[field], ensure_ascii=False, separators=(",", ":")
-                    )
-                    if field in {"labels", "depends_on", "blocks"}
-                    else row[field]
-                    for field in CSV_FIELDS
-                }
-            )
-        return stream.getvalue()
+    return stream.getvalue()
+
+
+def _render_markdown(rows: list[dict[str, Any]]) -> str:
     lines = [
         "---",
         f"schema_version: {EXPORT_SCHEMA_VERSION}",
@@ -211,5 +234,13 @@ def _render(records: tuple[IssueQueryRecord, ...], format_name: str) -> str:
     return "\n".join(lines) + "\n"
 
 
+_RENDERERS = {"json": _render_json, "csv": _render_csv, "markdown": _render_markdown}
+
+
+def _render(records: tuple[IssueQueryRecord, ...], format_name: str) -> str:
+    rows = [_issue_record(record) for record in records]
+    return _RENDERERS[format_name](rows)
+
+
 def _markdown(value: object) -> str:
     return str(value).replace("|", "\\|").replace("\n", "<br>")

roadmap_cli-0.3.0/roadmap/adapters/inbound/cli/exception_handler.py

@@ -0,0 +1,37 @@
+"""Centralized exception handling for CLI commands.
+
+This module provides error handling and formatting for all exceptions
+raised by CLI commands, ensuring consistent user-facing error messages
+and proper stderr output with correct exit codes.
+"""
+
+import click
+
+from roadmap.adapters.inbound.cli.console import get_console_stderr
+from roadmap.application.failures import ApplicationFailure
+from roadmap.domain.failures import DomainFailure
+
+
+def handle_cli_exception(
+    ctx: click.Context, error: Exception, show_traceback: bool = False
+) -> None:
+    """Centralized exception handler for CLI commands.
+
+    Catches RoadmapException instances and formats them for user output,
+    directing errors to stderr with proper exit codes. Other exceptions
+    are re-raised or logged as needed.
+
+    Args:
+        ctx: Click context
+        error: The exception to handle
+        show_traceback: Whether to show full traceback (for debugging)
+    """
+    stderr_console = get_console_stderr()
+
+    if isinstance(error, ApplicationFailure | DomainFailure | ValueError):
+        stderr_console.print(f"Error: {error}")
+    else:
+        stderr_console.print(f"Error: {error}")
+        if show_traceback:
+            stderr_console.print_exception()
+    ctx.exit(1)

{roadmap_cli-0.2.0 → roadmap_cli-0.3.0}/roadmap/adapters/inbound/cli/health/commands.py

@@ -62,7 +62,7 @@ def _render(
         writer = csv.DictWriter(stream, fieldnames=fields, lineterminator="\n")
         writer.writeheader()
         if not summary_only:
-            writer.writerows(payload["findings"])  # type: ignore[arg-type]
+            writer.writerows(payload["findings"])  # type: ignore[arg-type, ty:invalid-argument-type]
         return stream.getvalue()
     lines = [f"Roadmap health: {payload['status']}"]
     if summary_only:
@@ -79,6 +79,30 @@ def _render(
     return "\n".join(lines) + "\n"
 
 
+def _filter_by_entity(findings: tuple, entities: tuple[str, ...]) -> tuple:
+    if not entities:
+        return findings
+    selected = {value.casefold() for value in entities}
+    return tuple(
+        item for item in findings if item.scope.split("/", 1)[0].rstrip("s") in selected
+    )
+
+
+def _filter_by_severity(findings: tuple, severities: tuple[str, ...]) -> tuple:
+    if not severities:
+        return findings
+    selected = {value.casefold() for value in severities}
+    return tuple(item for item in findings if item.severity.value in selected)
+
+
+def _filter_dependencies(findings: tuple, *, dependencies: bool) -> tuple:
+    if dependencies:
+        return findings
+    return tuple(
+        item for item in findings if item.finding_id != "canonical.broken-reference"
+    )
+
+
 def _filtered(
     report: HealthReport,
     entities: tuple[str, ...] = (),
@@ -87,20 +111,9 @@ def _filtered(
     dependencies: bool = True,
 ) -> HealthReport:
     findings = report.findings
-    if entities:
-        selected = {value.casefold() for value in entities}
-        findings = tuple(
-            item
-            for item in findings
-            if item.scope.split("/", 1)[0].rstrip("s") in selected
-        )
-    if severities:
-        selected = {value.casefold() for value in severities}
-        findings = tuple(item for item in findings if item.severity.value in selected)
-    if not dependencies:
-        findings = tuple(
-            item for item in findings if item.finding_id != "canonical.broken-reference"
-        )
+    findings = _filter_by_entity(findings, entities)
+    findings = _filter_by_severity(findings, severities)
+    findings = _filter_dependencies(findings, dependencies=dependencies)
     return HealthReport(findings)