wardcat 1.0.0__tar.gz

wardcat-1.0.0/.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default owner for everything in the repo.
+*       @oguzhantopcu0

wardcat-1.0.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,44 @@
+name: Bug report
+description: Something in wardcat behaves incorrectly
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ⚠️ **Do not paste real PII.** Redact or use fake values in your examples.
+        For security vulnerabilities, use the [security advisory](../security/advisories/new) flow instead.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: What did you expect, and what happened instead?
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Minimal reproduction
+      description: A short code snippet (with fake data) that reproduces it.
+      render: python
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: wardcat version
+      placeholder: "0.5.0"
+    validations:
+      required: true
+  - type: input
+    id: python
+    attributes:
+      label: Python version
+      placeholder: "3.12"
+    validations:
+      required: true
+  - type: dropdown
+    id: layers
+    attributes:
+      label: Which detection layer(s)?
+      multiple: true
+      options: [regex, ner, llm, "not sure"]

wardcat-1.0.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/oguzhantopcu0/wardcat/security/advisories/new
+    about: Report security issues privately — never in a public issue.

wardcat-1.0.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,20 @@
+name: Feature request
+description: Suggest an entity type, layer, action, or capability
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / use case
+      description: What are you trying to do that wardcat doesn't support today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What would the API or behaviour look like?
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

wardcat-1.0.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,13 @@
+<!-- Thanks for contributing to wardcat! -->
+
+## What & why
+
+<!-- What does this change and why? Link any related issue. -->
+
+## Checklist
+
+- [ ] Tests added/updated and `uv run pytest tests/unit tests/integration` passes
+- [ ] `uv run ruff check .` and `uv run mypy` are clean
+- [ ] Docs updated if behaviour/API changed (`uv run --group docs mkdocs build --strict`)
+- [ ] `CHANGELOG.md` `[Unreleased]` updated for user-facing changes
+- [ ] No raw PII, secrets, or salts committed

wardcat-1.0.0/.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  # Python dependencies (pyproject.toml / uv.lock)
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      python-deps:
+        patterns: ["*"]
+
+  # GitHub Actions used in the workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

wardcat-1.0.0/.github/workflows/ci.yml

@@ -0,0 +1,109 @@
+name: CI
+
+on:
+  # Post-merge verification on the trunk.
+  push:
+    branches: ["main"]
+  # The gate: run on every pull request (any base branch) so nothing reaches
+  # main without a green lint + test + build run.
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint & type-check
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Ruff lint
+        run: uv run ruff check .
+
+      - name: Ruff format check
+        run: uv run ruff format --check .
+
+      - name: Mypy type check
+        run: uv run mypy
+
+  test:
+    name: Test (${{ matrix.os }}, Python ${{ matrix.python-version }})
+    runs-on: ${{ matrix.os }}
+    needs: lint
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        python-version: ["3.11", "3.12", "3.13"]
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --python ${{ matrix.python-version }} --dev
+
+      - name: Run tests
+        run: |
+          uv run pytest tests/unit/ tests/integration/ tests/benchmark/ \
+            --tb=short \
+            -q \
+            --cov=src/wardcat \
+            --cov-report=term-missing \
+            --cov-fail-under=80
+
+  build:
+    name: Build & check wheel
+    runs-on: ubuntu-latest
+    needs: test
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Build wheel and sdist
+        run: uv build
+
+      - name: Check distribution
+        run: uv run --with twine twine check dist/*
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+          retention-days: 7
+
+  docs:
+    name: Docs build (strict)
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Build docs (strict — fails on broken links/refs)
+        run: uv run --group docs mkdocs build --strict

wardcat-1.0.0/.github/workflows/publish.yml

@@ -0,0 +1,59 @@
+name: Release
+
+# On a `v*` tag: build + validate the distribution, publish to PyPI via Trusted
+# Publishing, and cut a GitHub Release with the wheel/sdist attached.
+#
+# NOTE: before pushing the first release tag, a Trusted Publisher must be
+# configured for `wardcat` on PyPI (Publishing → Add a new pending publisher:
+# owner `oguzhantopcu0`, repository `wardcat`, workflow `publish.yml`,
+# environment `pypi`) — otherwise the publish step will fail.
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  release:
+    name: Build, publish to PyPI & GitHub Release
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write # PyPI Trusted Publishing (OIDC)
+      contents: write # create the GitHub Release
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run tests before releasing
+        run: |
+          uv run pytest tests/unit/ tests/integration/ tests/benchmark/ \
+            --tb=short \
+            -q \
+            --cov=src/wardcat \
+            --cov-fail-under=80
+
+      - name: Build wheel and sdist
+        run: uv build
+
+      - name: Check distribution
+        run: uv run --with twine twine check dist/*
+
+      - name: Publish to PyPI (Trusted Publishing)
+        run: uv publish --trusted-publishing always
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: >
+          gh release create "${{ github.ref_name }}"
+          --title "${{ github.ref_name }}"
+          --notes "See [CHANGELOG.md](https://github.com/oguzhantopcu0/wardcat/blob/main/CHANGELOG.md) for release notes."
+          dist/*

wardcat-1.0.0/.github/workflows/real-model-tests.yml

@@ -0,0 +1,56 @@
+name: Real-model tests
+
+# Model-based backends are mock-only in the fast PR suite, so a bug in the real
+# pipeline path (like the dtype/torch_dtype kwarg regression) is invisible there.
+# This job installs the heavy extras and runs the `slow` tests against real
+# models. It runs:
+#   • nightly — to catch drift from a new transformers/torch release, and
+#   • on PRs/pushes that touch the model backend or its deps — to gate the exact
+#     code whose mock-only tests let the dtype bug through.
+# It stays off the default PR path filter, so day-to-day CI stays fast.
+on:
+  schedule:
+    - cron: "0 6 * * *" # daily 06:00 UTC
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "src/wardcat/llm/backends/transformers_backend.py"
+      - "tests/integration/test_transformers_live.py"
+      - "pyproject.toml"
+      - ".github/workflows/real-model-tests.yml"
+  push:
+    branches: [main]
+    paths:
+      - "src/wardcat/llm/backends/transformers_backend.py"
+      - "pyproject.toml"
+
+# A newer commit on the same ref supersedes an in-flight (slow) run.
+concurrency:
+  group: real-model-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  slow-tests:
+    name: Real-model slow tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Cache HuggingFace models
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/huggingface
+          key: hf-${{ runner.os }}-smollm2-135m
+          restore-keys: hf-${{ runner.os }}-
+
+      - name: Install with the transformers extra
+        run: uv sync --extra transformers --dev
+
+      - name: Run slow tests (real models; auto-skip what's unavailable)
+        run: uv run pytest -m slow tests/integration/ --tb=short -q

wardcat-1.0.0/.gitignore

@@ -0,0 +1,22 @@
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv
+.coverage
+
+# Generated test/scan outputs (manual harness runs)
+*_results.txt
+filter_coverage_results.txt
+live_test_results.txt
+
+# MkDocs build output
+site/
+
+# Local Claude Code config / agents (machine-local, not part of the package)
+.claude/

wardcat-1.0.0/.idea/.gitignore

@@ -0,0 +1,3 @@
+# Default ignored files
+/shelf/
+/workspace.xml

wardcat-1.0.0/.idea/ai-guard.iml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module type="PYTHON_MODULE" version="4">
+  <component name="NewModuleRootManager">
+    <content url="file://$MODULE_DIR$" />
+    <orderEntry type="inheritedJdk" />
+    <orderEntry type="sourceFolder" forTests="false" />
+  </component>
+</module>

wardcat-1.0.0/.idea/inspectionProfiles/profiles_settings.xml

@@ -0,0 +1,6 @@
+<component name="InspectionProjectProfileManager">
+  <settings>
+    <option name="USE_PROJECT_PROFILE" value="false" />
+    <version value="1.0" />
+  </settings>
+</component>

wardcat-1.0.0/.idea/material_theme_project_new.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="MaterialThemeProjectNewConfig">
+    <option name="metadata">
+      <MTProjectMetadataState>
+        <option name="migrated" value="true" />
+        <option name="pristineConfig" value="false" />
+        <option name="userId" value="-4d90f355:198cc5aa17c:-7ffe" />
+      </MTProjectMetadataState>
+    </option>
+  </component>
+</project>

wardcat-1.0.0/.idea/modules.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ProjectModuleManager">
+    <modules>
+      <module fileurl="file://$PROJECT_DIR$/.idea/wardcat.iml" filepath="$PROJECT_DIR$/.idea/wardcat.iml" />
+    </modules>
+  </component>
+</project>

wardcat-1.0.0/.idea/vcs.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="VcsDirectoryMappings">
+    <mapping directory="" vcs="Git" />
+  </component>
+</project>

wardcat-1.0.0/.pre-commit-config.yaml

@@ -0,0 +1,27 @@
+# Run `pre-commit install` once, then ruff + mypy run automatically on commit.
+# Mirrors the CI "Lint & type-check" job so failures surface locally first.
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.14.0
+    hooks:
+      - id: ruff
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+      - id: check-yaml
+      - id: check-toml
+      - id: check-merge-conflict
+
+  - repo: local
+    hooks:
+      - id: mypy
+        name: mypy
+        entry: uv run mypy
+        language: system
+        pass_filenames: false
+        types: [python]

wardcat-1.0.0/.python-version

@@ -0,0 +1 @@
+3.13