pyproject.toml

[project]
name = "advisoryhub"
version = "0.1.0"
description = "Eclipse Foundation security advisory authoring, review, and publication system"
readme = "README.md"
license = "EPL-2.0"
license-files = ["LICENSE"]
requires-python = ">=3.14,<3.15"
dependencies = [
    "Django>=5.2,<5.3",
    "psycopg[binary]>=3.3.4",
    "mozilla-django-oidc>=4.0",
    "django-htmx>=1.21",
    "celery[redis]>=5.6.3",
    # redis-py is also used directly by Django's RedisCache (CACHE_URL), so keep it
    # explicit — but its upper bound is inherited from kombu via celery[redis]
    # (currently redis<6.5), so the ceiling tracks kombu instead of a hand-pinned number.
    "redis>=5.0",
    "markdown-it-py>=3.0",
    "nh3>=0.3.6",
    "jsonschema>=4.21",
    "cvss>=3.0",
    "django-environ>=0.14.0",
    "django-ratelimit>=4.1",
    "sentry-sdk[django]>=2.64.0",
    "django-prometheus>=2.5.0",
    "requests>=2.34.2",
    "PyJWT[crypto]>=2.8",
    "django-altcha>=1.0",
    "django-csp>=4.0",
    "whitenoise[brotli]>=6.12.0",
    "gunicorn>=23",
]

[tool.setuptools]
packages = [
    "config", "config.settings",
    "common",
    "accounts", "accounts.migrations",
    "projects", "projects.migrations",
    "audit", "audit.migrations", "audit.management", "audit.management.commands",
    "advisories", "advisories.migrations", "advisories.tests",
    "access", "access.migrations",
    "comments", "comments.migrations", "comments.templatetags",
    "notifications", "notifications.migrations",
    "workflows", "workflows.migrations",
    "publication", "publication.migrations", "publication.schemas", "publication.tests",
    "admin_console", "admin_console.management", "admin_console.management.commands",
    "api", "api.tests",
    "ghsa", "ghsa.migrations", "ghsa.management", "ghsa.management.commands", "ghsa.tests",
    "intake", "intake.migrations", "intake.tests",
    "intake.management", "intake.management.commands",
]

[project.optional-dependencies]
dev = [
    "pytest>=9.1.1",
    "pytest-django>=4.8",
    "pytest-cov>=5.0",
    "responses>=0.26.2",
    "ruff>=0.15.20",
    "django-stubs[compatible-mypy]>=6.0.6",
    "zizmor>=1.26.1",
    # docs/specification/openapi.yaml drift guards (api/tests/test_openapi_spec.py)
    "openapi-spec-validator>=0.7",
    "PyYAML>=6.0",
]
# Docs-site toolchain (docs/ -> GitHub Pages, .github/workflows/docs.yml).
# Build-time only — never installed in the production image, so deliberately
# outside the enforced pip-audit scope (which audits the runtime set).
docs = [
    "mkdocs>=1.6",
    "mkdocs-material>=9.6",
    "mike>=2.1",
    "essentials-openapi>=1.4", # renders openapi.yaml via dev/mkdocs_oad_hook.py (OAD tag in api.md)
    # essentials-openapi's openapidocs.mk renderer imports these at module load, yet only
    # declares them under its [full] extra — which also pins click~=8.1.3 and would drag the
    # runtime click down. Pin them directly instead so the single lock leaves runtime untouched.
    "rich~=15.0",  # openapidocs.logs -> rich.logging.RichHandler
    "jinja2~=3.1",  # openapidocs.mk.jinja
    "httpx<1",  # openapidocs.utils.source -> .web
]

[tool.pytest.ini_options]
DJANGO_SETTINGS_MODULE = "config.settings.test"
python_files = ["tests.py", "test_*.py", "*_tests.py"]
addopts = "-q --strict-markers --reuse-db"

[tool.ruff]
line-length = 100
# Deliberately one notch below the 3.14 runtime. ruff's py314 *formatter* strips
# the parentheses from `except (A, B):` (PEP 758) — a 3.14-only spelling that
# reads like the old Python-2 `except A, B` idiom and is an easy misread.
# Targeting py313 stops the formatter from introducing it; no lint (UP) gains are
# lost (there are none for this codebase at py314). mypy/ty still target 3.14.
target-version = "py313"

[tool.ruff.lint]
select = ["E", "F", "W", "I", "B", "UP", "DJ", "LOG", "G", "RET", "RUF100"]
ignore = ["E501"]

[tool.ruff.lint.per-file-ignores]
"*/migrations/*" = ["E", "F", "W", "I", "B", "UP", "DJ"]
"*/tests/*" = ["E402"]
"*/test_*.py" = ["E402"]
"advisories/models.py" = ["DJ012"]

[tool.coverage.run]
branch = true
source = ["."]
omit = [
    ".venv/*",
    "*/migrations/*",
    "*/tests/*",
    "*/tests.py",
    "*/test_*.py",
    "conftest.py",
    "manage.py",
    "config/asgi.py",
    "config/wsgi.py",
]

[tool.mypy]
python_version = "3.14"
plugins = ["mypy_django_plugin.main"]
files = [
    "accounts", "access", "admin_console", "advisories", "api", "audit",
    "comments", "common", "config", "ghsa", "intake", "notifications",
    "projects", "publication", "similarity", "workflows",
]
# Pragmatic baseline: resolve Django ORM dynamics via django-stubs and check
# the bodies of unannotated functions (check_untyped_defs), but don't force
# annotations on every function or chase third-party stub gaps. Tighten over
# time (next candidate: disallow_untyped_defs).
ignore_missing_imports = true
check_untyped_defs = true
warn_unused_ignores = true
warn_return_any = false
exclude = '(/migrations/|/tests/|conftest\.py|test_.*\.py|_test\.py)'

[tool.django-stubs]
django_settings_module = "config.settings.test"

[tool.coverage.report]
show_missing = true
skip_covered = false
# Floor set just below the measured baseline (≈81%) so coverage can only
# ratchet up. The whole suite runs on Postgres, so the trigger/index and
# JSONB paths count toward coverage rather than showing as missed.
fail_under = 80

# --- ty (Astral type checker) ---------------------------------------------
# ty runs as an *advisory* (non-blocking) CI check alongside the enforced
# mypy gate — it's faster and catches some categories mypy doesn't. ty has
# no Django plugin yet and cannot consume django-stubs, so its ORM
# "unresolved-attribute" reports (Model.objects, reverse relations, …) are
# false positives; silence that rule so the remaining categories stay
# actionable. Revisit (and consider promoting to blocking) as ty matures.
[tool.ty.environment]
python-version = "3.14"

[tool.ty.src]
exclude = [
    "**/migrations/**",
    "**/tests/**",
    "**/tests.py",
    "**/test_*.py",
    "**/*_test.py",
    "conftest.py",
    # dev/ holds build/maintenance scripts (e.g. the docs-build hook
    # mkdocs_oad_hook.py, which imports essentials-openapi from the docs-only
    # extra, absent from the dev type-check venv) — outside the type-checked
    # surface, matching mypy's app-only files allowlist.
    "dev/**",
]

[tool.ty.rules]
unresolved-attribute = "ignore"