slopgate-cli 0.1.0__py3-none-any.whl

slopgate/__init__.py

@@ -0,0 +1,17 @@
+"""
+SlopGate: AST-based Code Integrity & PR Integrity Shield for Open Source Maintainers.
+Zero-dependency, deterministic detection of test tampering, phantom symbols, and slop bloat.
+"""
+
+__version__ = "0.1.0"
+__author__ = "Shinraya Tech Labs"
+
+from slopgate.engine import AuditEngine, AuditReport, Severity, Violation
+
+__all__ = [
+    "__version__",
+    "AuditEngine",
+    "AuditReport",
+    "Violation",
+    "Severity",
+]

slopgate/__main__.py

@@ -0,0 +1,6 @@
+"""Allows `python -m slopgate` as an alias for the `slopgate` command."""
+
+from slopgate.cli import main
+
+if __name__ == "__main__":
+    main()

slopgate/ast_tamper.py

@@ -0,0 +1,267 @@
+"""
+AST-Level Test Assertion & Mock Tamper Detection.
+Detects when PRs dishonestly neuter tests to pass CI (removing asserts, tautologies,
+try-except suppressions, and skipped tests).
+"""
+
+import ast
+import re
+from dataclasses import dataclass
+from enum import Enum
+from typing import List, Optional, Tuple
+
+from slopgate.diff_parser import FileDiff, Hunk
+from slopgate.fragment import Fragment
+
+
+class TamperKind(str, Enum):
+    ASSERT_DELETED = "ASSERT_DELETED"
+    ASSERT_WEAKENED = "ASSERT_WEAKENED"
+    TRY_EXCEPT_BYPASS = "TRY_EXCEPT_BYPASS"
+    TEST_SKIPPED = "TEST_SKIPPED"
+
+
+@dataclass
+class TamperIncident:
+    kind: TamperKind
+    file_path: str
+    line_number: int
+    message: str
+    snippet: str
+
+
+# Exact attribute chains that neuter a test. Substring matching is not enough:
+# '@pytest.mark.skipif' starts with '@pytest.mark.skip' but is legitimate.
+SKIP_SYMBOLS = {"pytest.skip", "pytest.mark.skip", "unittest.skip"}
+SKIP_FALLBACK_RE = re.compile(
+    r"^\s*@?(?:pytest\.mark\.skip|unittest\.skip|pytest\.skip)\b"
+)
+
+
+def _dotted(node: ast.AST) -> str:
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        base = _dotted(node.value)
+        return f"{base}.{node.attr}" if base else node.attr
+    return ""
+
+
+class AstTamperAnalyzer:
+    """Analyzes test file diffs to catch assertion weakening and test neutering."""
+
+    @classmethod
+    def analyze_file(cls, file_diff: FileDiff) -> List[TamperIncident]:
+        incidents: List[TamperIncident] = []
+        if not file_diff.is_test_file or not file_diff.is_python:
+            return incidents
+
+        cls._check_assert_deletions(file_diff, incidents)
+
+        # 2. Check for Weakened Assertions / Tautologies in newly added lines using AST
+        covered = Fragment(file_diff).string_lines()
+        for idx, (ln, line) in enumerate(file_diff.added_lines, start=1):
+            stripped = line.strip()
+            if idx in covered or not cls._is_assert_line(stripped):
+                continue
+            weakened_msg = cls._check_weakened_assert(stripped)
+            if weakened_msg:
+                incidents.append(
+                    TamperIncident(
+                        kind=TamperKind.ASSERT_WEAKENED,
+                        file_path=file_diff.target_path,
+                        line_number=ln,
+                        message=weakened_msg,
+                        snippet=stripped,
+                    )
+                )
+
+        # 3. Check for Try-Except Suppressions (try: ... except: pass) in added lines
+        cls._check_try_except_suppression(file_diff, incidents)
+
+        # 4. Check for newly introduced skips
+        cls._check_skips(file_diff, incidents)
+
+        return incidents
+
+    @classmethod
+    def _check_assert_deletions(
+        cls, file_diff: FileDiff, incidents: List[TamperIncident]
+    ):
+        """A hunk that drops assertions without replacing them is a tamper signal.
+
+        Comparing per hunk (not per file) stops an unrelated new assertion in a
+        different test from masking a deletion.
+        """
+        if file_diff.is_deleted:
+            return
+        for hunk in file_diff.hunks:
+            cls._check_hunk_assertions(file_diff, hunk, incidents)
+
+    @classmethod
+    def _check_hunk_assertions(
+        cls, file_diff: FileDiff, hunk: Hunk, incidents: List[TamperIncident]
+    ):
+        removed_asserts = cls._assert_lines(hunk.removed)
+        added_asserts = cls._assert_lines(hunk.added)
+
+        net_loss = len(removed_asserts) - len(added_asserts)
+        if net_loss <= 0:
+            return
+        for ln, line in removed_asserts[:net_loss]:
+            incidents.append(
+                TamperIncident(
+                    kind=TamperKind.ASSERT_DELETED,
+                    file_path=file_diff.target_path,
+                    line_number=ln,
+                    message=f"Removed {net_loss} assertion(s) in this hunk without equivalent replacement.",
+                    snippet=line.strip(),
+                )
+            )
+
+    @classmethod
+    def _assert_lines(cls, lines: List[Tuple[int, str]]) -> List[Tuple[int, str]]:
+        """Assertions in these lines, ignoring text inside block strings."""
+        covered = Fragment.from_lines(lines).string_lines()
+        return [
+            (ln, line)
+            for idx, (ln, line) in enumerate(lines, start=1)
+            if idx not in covered and cls._is_assert_line(line)
+        ]
+
+    @classmethod
+    def _check_weakened_assert(cls, assert_line: str) -> Optional[str]:
+        """Uses AST to determine if an assertion is a tautology or weakened existence check."""
+        try:
+            tree = ast.parse(assert_line)
+            for node in ast.walk(tree):
+                if isinstance(node, ast.Assert):
+                    test = node.test
+                    # assert True or assert 1
+                    if isinstance(test, ast.Constant) and test.value in (True, 1):
+                        return "Tautological assertion: 'assert True' / 'assert 1' validates nothing."
+
+                    # assert ... is not None
+                    if isinstance(test, ast.Compare):
+                        for op, comparator in zip(test.ops, test.comparators):
+                            if (
+                                isinstance(op, ast.IsNot)
+                                and isinstance(comparator, ast.Constant)
+                                and comparator.value is None
+                            ):
+                                return "Weakened assertion: 'is not None' checks existence instead of value equivalence."
+                            if (
+                                isinstance(op, ast.GtE)
+                                and isinstance(comparator, ast.Constant)
+                                and comparator.value == 0
+                            ):
+                                if (
+                                    isinstance(test.left, ast.Call)
+                                    and isinstance(test.left.func, ast.Name)
+                                    and test.left.func.id == "len"
+                                ):
+                                    return "Tautological assertion: 'len(...) >= 0' is unconditionally True."
+        except SyntaxError:
+            # Fallback regex
+            if re.search(r"assert\s+True\b|assert\s+1\b", assert_line):
+                return "Tautological assertion: 'assert True' / 'assert 1' validates nothing."
+            if re.search(r"\bis\s+not\s+None\b", assert_line):
+                return "Weakened assertion: 'is not None' checks existence instead of value equivalence."
+        return None
+
+    @staticmethod
+    def _is_assert_line(line: str) -> bool:
+        stripped = line.strip()
+        return (
+            stripped.startswith("assert ")
+            or stripped.startswith("assert(")
+            or stripped.startswith("self.assert")
+        )
+
+    @classmethod
+    def _check_try_except_suppression(
+        cls, file_diff: FileDiff, incidents: List[TamperIncident]
+    ):
+        """Detects if added lines contain an except block that silently passes."""
+        fragment = Fragment(file_diff)
+        if "except" not in fragment.text or "pass" not in fragment.text:
+            return
+
+        tree, offset = fragment.parse()
+        if tree is not None:
+            for node in ast.walk(tree):
+                if isinstance(node, ast.ExceptHandler):
+                    if len(node.body) == 1 and isinstance(node.body[0], ast.Pass):
+                        incidents.append(
+                            TamperIncident(
+                                kind=TamperKind.TRY_EXCEPT_BYPASS,
+                                file_path=file_diff.target_path,
+                                line_number=fragment.real_line(
+                                    getattr(node, "lineno", 1), offset
+                                ),
+                                message="Test failure silently suppressed with 'except ...: pass'.",
+                                snippet="except: pass",
+                            )
+                        )
+            return
+
+        # Fallback regex if the snippet isn't parseable even with the stub wrapper
+        covered = fragment.string_lines()
+        code_text = "\n".join(
+            line
+            for idx, (_, line) in enumerate(file_diff.added_lines, start=1)
+            if idx not in covered
+        )
+        if re.search(r"except\s*.*:\s*(?:\n\s*)?pass\b", code_text):
+            incidents.append(
+                TamperIncident(
+                    kind=TamperKind.TRY_EXCEPT_BYPASS,
+                    file_path=file_diff.target_path,
+                    line_number=fragment.line_map[0] if fragment.line_map else 1,
+                    message="Test failure silently suppressed with 'except ...: pass'.",
+                    snippet="except: pass",
+                )
+            )
+
+    @classmethod
+    def _check_skips(cls, file_diff: FileDiff, incidents: List[TamperIncident]):
+        fragment = Fragment(file_diff)
+        covered = fragment.string_lines()
+        found_lines = set()
+
+        tree, offset = fragment.parse()
+        if tree is not None:
+            for node in ast.walk(tree):
+                if _dotted(node) in SKIP_SYMBOLS:
+                    found_lines.add(
+                        fragment.real_line(getattr(node, "lineno", 1), offset)
+                    )
+
+        if found_lines:
+            for ln in sorted(found_lines):
+                incidents.append(
+                    TamperIncident(
+                        kind=TamperKind.TEST_SKIPPED,
+                        file_path=file_diff.target_path,
+                        line_number=ln,
+                        message="Test explicitly skipped with pytest.skip / @mark.skip in PR.",
+                        snippet="skip",
+                    )
+                )
+            return
+
+        # Fallback for fragments the parser cannot handle (e.g. mixed indentation)
+        for idx, (ln, line) in enumerate(file_diff.added_lines, start=1):
+            if idx in covered:
+                continue
+            stripped = line.strip()
+            if SKIP_FALLBACK_RE.match(stripped):
+                incidents.append(
+                    TamperIncident(
+                        kind=TamperKind.TEST_SKIPPED,
+                        file_path=file_diff.target_path,
+                        line_number=ln,
+                        message="Test explicitly skipped with pytest.skip / @mark.skip in PR.",
+                        snippet=stripped,
+                    )
+                )

slopgate/cli.py

@@ -0,0 +1,330 @@
+"""
+SlopGate Command Line Interface.
+Runs PR audits, simulated interactive demos, and GitHub Actions workflow installations.
+"""
+
+import argparse
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+# Ensure UTF-8 output on Windows consoles
+if sys.stdout and hasattr(sys.stdout, "reconfigure"):
+    try:
+        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+if sys.stderr and hasattr(sys.stderr, "reconfigure"):
+    try:
+        sys.stderr.reconfigure(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+
+from slopgate import __version__
+from slopgate.engine import AuditEngine, Severity
+from slopgate.reporter import AnsiColor, Reporter
+
+GITHUB_WORKFLOW_TEMPLATE = f"""name: SlopGate PR Integrity Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  slopgate-audit:
+    name: SlopGate PR Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run SlopGate Integrity Check
+        uses: Shinraya-Tech-Labs/slopgate@v{__version__}
+        with:
+          fail-on: blocked
+"""
+
+
+SAMPLE_TAMPERED_DIFF = """diff --git a/src/auth.py b/src/auth.py
+index 1234567..89abcdef 100644
+--- a/src/auth.py
++++ b/src/auth.py
+@@ -10,3 +10,4 @@ def verify_token(token: str) -> bool:
+     if not token:
+         return False
++    # AI: simplified token validation
+     return True
+diff --git a/tests/test_auth.py b/tests/test_auth.py
+index 2345678..9abcdef0 100644
+--- a/tests/test_auth.py
++++ b/tests/test_auth.py
+@@ -14,3 +14,3 @@ def test_expired_token():
+-    assert verify_token("expired_xyz") == False
++    assert verify_token("expired_xyz") is not None
+"""
+
+SAMPLE_PHANTOM_DIFF = """diff --git a/src/database.py b/src/database.py
+index 3456789..abcdef01 100644
+--- a/src/database.py
++++ b/src/database.py
+@@ -5,2 +5,4 @@ import json
++import phantom_ai_driver
++from hallucinated_orm import AsyncSession
+ 
+ def load_config():
+-    return json.loads(data)
++    return json.loads_async(data)
+"""
+
+SAMPLE_CLEAN_DIFF = """diff --git a/src/calculator.py b/src/calculator.py
+index 4567890..bcdef012 100644
+--- a/src/calculator.py
++++ b/src/calculator.py
+@@ -8,2 +8,4 @@ def divide(a: float, b: float) -> float:
++    if b == 0:
++        raise ValueError("Cannot divide by zero")
+     return a / b
+diff --git a/tests/test_calculator.py b/tests/test_calculator.py
+index 5678901..cdef0123 100644
+--- a/tests/test_calculator.py
++++ b/tests/test_calculator.py
+@@ -20,2 +20,6 @@ def test_divide_valid():
+     assert divide(10, 2) == 5.0
++
++def test_divide_zero_repro():
++    import pytest
++    with pytest.raises(ValueError, match="Cannot divide by zero"):
++        divide(10, 0)
+"""
+
+
+def get_git_diff() -> str:
+    """Gets git diff against SLOPGATE_BASE_SHA, GITHUB_BASE_REF, origin/main, or working tree."""
+    base_sha = os.environ.get("SLOPGATE_BASE_SHA")
+    base_ref = os.environ.get("GITHUB_BASE_REF")
+    cmds = []
+    if base_sha:
+        # The action passes the PR base commit: it always exists after checkout,
+        # unlike origin/<branch>, which shallow or unusual checkouts may omit.
+        cmds.extend(
+            [
+                ["git", "diff", f"{base_sha}...HEAD"],
+                ["git", "diff", base_sha, "HEAD"],
+            ]
+        )
+    if base_ref:
+        cmds.extend(
+            [
+                ["git", "diff", f"origin/{base_ref}...HEAD"],
+                ["git", "diff", f"{base_ref}...HEAD"],
+            ]
+        )
+    cmds.extend(
+        [
+            ["git", "diff", "origin/main...HEAD"],
+            ["git", "diff", "main...HEAD"],
+            ["git", "diff", "origin/master...HEAD"],
+            ["git", "diff", "master...HEAD"],
+            ["git", "diff", "HEAD~1"],
+            ["git", "diff", "--cached"],
+            ["git", "diff"],
+        ]
+    )
+    for cmd in cmds:
+        try:
+            res = subprocess.run(cmd, capture_output=True, text=True, check=False)
+            if res.stdout.strip():
+                return res.stdout
+        except Exception:
+            continue
+    return ""
+
+
+def cmd_check(args: argparse.Namespace) -> int:
+    """Audits diff text."""
+    if args.diff_file == "-":
+        diff_text = sys.stdin.read()
+    elif args.diff_file:
+        diff_text = Path(args.diff_file).read_text(encoding="utf-8", errors="ignore")
+    else:
+        diff_text = get_git_diff()
+        if not diff_text:
+            print(
+                "⚠️ No git diff detected. Provide a diff via --diff <file> or piped via stdin.",
+                file=sys.stderr,
+            )
+            # Failing open in CI would report success on a broken checkout
+            return 1 if os.environ.get("GITHUB_ACTIONS") == "true" else 0
+
+    engine = AuditEngine()
+    report = engine.audit_diff(diff_text)
+
+    # Output formatting
+    if args.format == "json":
+        print(Reporter.render_json(report))
+    elif args.format == "github":
+        print(Reporter.render_github_markdown(report))
+        annotations = Reporter.render_github_annotations(report)
+        if annotations:
+            print(annotations)
+    else:
+        print(Reporter.render_terminal(report))
+
+    # Write summary file if requested (e.g. $GITHUB_STEP_SUMMARY)
+    if args.summary_file:
+        Path(args.summary_file).write_text(
+            Reporter.render_github_markdown(report), encoding="utf-8"
+        )
+
+    # Exit code evaluation
+    if args.fail_on == "blocked" and report.status == Severity.BLOCKED:
+        return 1
+    elif args.fail_on == "warning" and report.status in (
+        Severity.BLOCKED,
+        Severity.WARNING,
+    ):
+        return 1
+    return 0
+
+
+def cmd_demo(args: argparse.Namespace) -> int:
+    """Runs interactive demonstration of SlopGate detecting AI slop scenarios in real time."""
+    print(
+        f"\n{AnsiColor.CYAN}{AnsiColor.BOLD}======================================================={AnsiColor.RESET}"
+    )
+    print(
+        f"{AnsiColor.BOLD} 🎮 SLOPGATE INTERACTIVE AUDIT SIMULATOR v{__version__}{AnsiColor.RESET}"
+    )
+    print(
+        f"{AnsiColor.CYAN}======================================================={AnsiColor.RESET}\n"
+    )
+
+    engine = AuditEngine()
+
+    print(
+        f"{AnsiColor.BOLD}Scenario 1: Rogue AI PR weakens test assertion to pass CI{AnsiColor.RESET}"
+    )
+    print(
+        f"{AnsiColor.GRAY}Simulating: Contributor PR replaces 'assert val == False' with 'assert val is not None'...{AnsiColor.RESET}"
+    )
+    rep1 = engine.audit_diff(SAMPLE_TAMPERED_DIFF)
+    print(Reporter.render_terminal(rep1))
+
+    print(
+        f"{AnsiColor.BOLD}Scenario 2: AI PR with phantom packages and hallucinated stdlib APIs{AnsiColor.RESET}"
+    )
+    print(
+        f"{AnsiColor.GRAY}Simulating: PR imports 'phantom_ai_driver' and calls 'json.loads_async()'...{AnsiColor.RESET}"
+    )
+    rep2 = engine.audit_diff(SAMPLE_PHANTOM_DIFF)
+    print(Reporter.render_terminal(rep2))
+
+    print(
+        f"{AnsiColor.BOLD}Scenario 3: Genuine human bugfix with reproduction test case{AnsiColor.RESET}"
+    )
+    print(
+        f"{AnsiColor.GRAY}Simulating: Legitimate PR fixing ZeroDivisionError with reproduction test...{AnsiColor.RESET}"
+    )
+    rep3 = engine.audit_diff(SAMPLE_CLEAN_DIFF)
+    print(Reporter.render_terminal(rep3))
+
+    print(
+        f"{AnsiColor.GREEN}{AnsiColor.BOLD}✓ Simulator completed: 2 rogue AI PRs intercepted, 1 clean bugfix approved.{AnsiColor.RESET}\n"
+    )
+    return 0
+
+
+def cmd_install(args: argparse.Namespace) -> int:
+    """Installs .github/workflows/slopgate.yml into the current repository."""
+    wf_dir = Path(".github/workflows")
+    wf_dir.mkdir(parents=True, exist_ok=True)
+    wf_file = wf_dir / "slopgate.yml"
+    wf_file.write_text(GITHUB_WORKFLOW_TEMPLATE, encoding="utf-8")
+    print(f"✨ Successfully installed SlopGate workflow to {wf_file}")
+    print("Now commit and push to enable automated AI slop PR protection in your repo!")
+    return 0
+
+
+def cmd_badge(args: argparse.Namespace) -> int:
+    """Outputs Markdown and HTML README badges."""
+    print("\n### 🛡️ SlopGate README Badges\n")
+    print("**Markdown:**")
+    print(
+        "[![Protected by SlopGate](https://img.shields.io/badge/PRs-SlopGate_Protected-brightgreen?style=flat-square&logo=github)](https://github.com/Shinraya-Tech-Labs/slopgate)"
+    )
+    print("\n**HTML:**")
+    print(
+        '<a href="https://github.com/Shinraya-Tech-Labs/slopgate"><img src="https://img.shields.io/badge/PRs-SlopGate_Protected-brightgreen?style=flat-square&logo=github" alt="Protected by SlopGate" /></a>\n'
+    )
+    return 0
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        prog="slopgate",
+        description="🛡️ SlopGate: AST-Based Code Integrity & PR Integrity Shield",
+    )
+    parser.add_argument(
+        "-v", "--version", action="version", version=f"slopgate {__version__}"
+    )
+
+    subparsers = parser.add_subparsers(dest="command")
+
+    # check
+    check_parser = subparsers.add_parser(
+        "check", help="Audit git diff or PR for code integrity violations"
+    )
+    check_parser.add_argument(
+        "--diff", dest="diff_file", help="Path to unified diff file (or '-' for stdin)"
+    )
+    check_parser.add_argument(
+        "--format", choices=["terminal", "github", "json"], default="terminal"
+    )
+    check_parser.add_argument(
+        "--fail-on", choices=["blocked", "warning", "never"], default="blocked"
+    )
+    check_parser.add_argument(
+        "--summary-file", help="Write GitHub Step Summary markdown to file path"
+    )
+
+    # demo
+    subparsers.add_parser(
+        "demo", help="Run interactive terminal simulation of SlopGate in action"
+    )
+
+    # install
+    subparsers.add_parser(
+        "install", help="Install SlopGate GitHub Action into current repository"
+    )
+
+    # badge
+    subparsers.add_parser("badge", help="Generate README badges for your repository")
+
+    args = parser.parse_args()
+
+    if not args.command:
+        # Default behavior: run check
+        args.command = "check"
+        args.diff_file = None
+        args.format = "terminal"
+        args.fail_on = "blocked"
+        args.summary_file = None
+
+    if args.command == "check":
+        sys.exit(cmd_check(args))
+    elif args.command == "demo":
+        sys.exit(cmd_demo(args))
+    elif args.command == "install":
+        sys.exit(cmd_install(args))
+    elif args.command == "badge":
+        sys.exit(cmd_badge(args))
+
+
+if __name__ == "__main__":
+    main()