pyproject.toml

[build-system]
requires = ["setuptools>=61.0", "setuptools_scm[toml]>=8.0"]
build-backend = "setuptools.build_meta"

[project]
name = "gitgalaxy"
dynamic = ["version"]
authors = [
  { name="Joe Esquibel" },
]
description = "An AST-free, LLM-free zero-trust static analysis engine for mapping architectural risk, securing CI/CD pipelines, and modernizing legacy monoliths."
readme = "README.md"
requires-python = ">=3.9"

keywords = [
    "static-analysis", 
    "security", 
    "devsecops", 
    "visualization", 
    "ast", 
    "zero-trust",
    "sbom",
    "legacy-migration"
]

classifiers = [
    "Programming Language :: Python :: 3",
    "Operating System :: OS Independent",
    "Environment :: Console",
    "Topic :: Security",
    "Topic :: Software Development :: Quality Assurance",
    "Topic :: Scientific/Engineering :: Visualization",
    "Intended Audience :: Developers",
    "Intended Audience :: Information Technology",
]

dependencies = []

# PyYAML is NOT a core dependency -- it's only ever imported lazily, inside
# functions, at 3 call sites (config_resolver.py, full_api_network_map.py,
# galaxyscope.py's --config handling), all of which already degrade
# gracefully (a warning + skip, or a clear RuntimeError) when it's absent.
# See #1104: it was a hard install-time dependency by accident, never
# revisited after being added, which broke the "0 dependencies" README claim.
[project.optional-dependencies]
yaml = ["PyYAML>=6.0"]

# Unlike `yaml` above, this extra is never imported by anything under gitgalaxy/ and changes no
# behavior of the shipped engine -- it exists purely so a contributor can
# `pip install -e .[tri-comparison]` instead of a separate manual `pip install
# tree-sitter-language-pack` before running tests/tools/tri_comparison_gatherer.py (which
# verifies GitGalaxy's own extraction against tree-sitter and universal-ctags on the
# language-crucible corpus). universal-ctags itself is a system binary, not a Python package, and
# can't be listed here -- see tests/tools/ctags_reader.py's own module docstring for install
# instructions. Still opt-in like every other extra: a plain `pip install gitgalaxy` installs
# neither, so this doesn't touch the "0 dependencies" claim in README.md's proof strip.
tri-comparison = ["tree-sitter-language-pack"]

[project.urls]
"Homepage" = "https://gitgalaxy.io"
"Documentation" = "https://squid-protocol.github.io/gitgalaxy/"
"Source" = "https://github.com/squid-protocol/gitgalaxy"
"Tracker" = "https://github.com/squid-protocol/gitgalaxy/issues"

[project.scripts]
# --- THE HUB (Core Orchestrators) ---
galaxyscope = "gitgalaxy.galaxyscope:main" 
blast = "gitgalaxy.galaxyscope:main"

# --- THE SPOKES (DevSecOps Tooling) ---
vault-sentinel = "gitgalaxy.tools.supply_chain_security.vault_sentinel:main"
supply-chain-firewall = "gitgalaxy.tools.supply_chain_security.supply_chain_firewall:main"
xray-inspector = "gitgalaxy.tools.supply_chain_security.binary_anomaly_detector:main"
# NOTE: there is deliberately no `zero-trust-sbom` script here. SBOM generation
# stopped being a standalone tool in 638c8a2 (#83), which moved
# gitgalaxy/tools/compliance/sbom_generator.py to
# gitgalaxy/recorders/sbom_recorder.py and turned it into a passive Phase 12
# exit stage, so the manifest is tied to the same finalized in-RAM state as the
# forensic audits. Use `galaxyscope <target> --sbom-only`. The entry point
# outlived the module it pointed at and shipped broken until #1179.
pii-leak-hunter = "gitgalaxy.tools.terabyte_log_scanning.pii_leak_hunter:main"
terabyte-log-scanner = "gitgalaxy.tools.terabyte_log_scanning.terabyte_log_scanner:main"
api-network-map = "gitgalaxy.tools.network_auditing.full_api_network_map:main"

# --- THE SPOKES (Legacy Modernization Controllers) ---
cobol-refractor = "gitgalaxy.cobol_refractor_controller:main"
cobol-to-java = "gitgalaxy.cobol_to_java_controller:main"
batch-test-harness = "gitgalaxy.tools.cobol_to_java.batch_test_harness:main"

# --- THE SPOKES (Individual Legacy Forges) ---
cobol-compiler-forge = "gitgalaxy.tools.cobol_to_cobol.cobol_compiler_forge:main"
cobol-dag-architect = "gitgalaxy.tools.cobol_to_cobol.cobol_dag_architect:main"
cobol-etl-unpacker = "gitgalaxy.tools.cobol_to_cobol.cobol_etl_unpacker:main"
cobol-graveyard-finder = "gitgalaxy.tools.cobol_to_cobol.cobol_graveyard_finder:main"
cobol-jcl-forge = "gitgalaxy.tools.cobol_to_cobol.cobol_jcl_forge:main"
cobol-microservice-slicer = "gitgalaxy.tools.cobol_to_cobol.cobol_microservice_slicer:main"
cobol-schema-forge = "gitgalaxy.tools.cobol_to_cobol.cobol_schema_forge:main"
cobol-system-limits = "gitgalaxy.tools.cobol_to_cobol.cobol_system_limits_reporter:main"


# --- THE FIX: Explicitly allow only the package, block the heavy folders ---
[tool.setuptools.packages.find]
include = ["gitgalaxy", "gitgalaxy.*"]
exclude = [
    "archive*", 
    "airgap_observatory*", 
    "docs*", 
    "docs_build*", 
    "site*", 
    "updated_results*", 
    "utilities*"
]

[tool.setuptools_scm]
# This tells it to expect tags like "v2.0.5" instead of just "2.0.5"
tag_regex = '^v?(?P<version>[vV]?\d+(?:\.\d+){0,2}[^\+]*)(?:\+.*)?$'

[tool.ruff]
# Ignore legacy/messy fixture code so it doesn't pollute linting results
exclude = [
    "tests/fixtures/*",
]
line-length = 120
target-version = "py39"

[tool.ruff.lint]
# Deliberately scoped, not `ALL` -- see #469 for the measured rationale behind
# each inclusion/exclusion. In short: BLE/TRY were excluded because they
# overwhelmingly flag this codebase's *deliberate* `except Exception:`
# fault-isolation pattern (continue processing other files if one throws),
# not real bugs; D/T20/G were excluded as noisy style debates with no clear
# right answer for a prose-docstring, CLI-heavy, f-string-logging codebase;
# ANN was excluded as redundant with the mypy epic (#429).
select = [
    "E", "W",   # pycodestyle
    "F",        # pyflakes
    "B",        # flake8-bugbear (real bug patterns)
    "C4",       # flake8-comprehensions
    "SIM",      # flake8-simplify
    "I",        # isort (import sorting)
    "ARG",      # flake8-unused-arguments
    "UP",       # pyupgrade
    "S",        # flake8-bandit (security -- dogfooding, since this project IS a security scanner)
    "PERF",     # perflint
    "DTZ",      # flake8-datetimez (naive datetime bugs)
    "A",        # flake8-builtins
    "RSE",      # flake8-raise
    "RUF",      # ruff-specific rules
]
# E741 (ambiguous short variable names like `l`, `I`) is a long-accepted
# convention in this codebase's math-heavy code (spatial_mapper.py, etc.).
# E501 (line-too-long) was already explicitly ignored in the old .flake8
# config -- `ruff format` wraps what it safely can; what's left is mostly
# long regex patterns, URLs, and prose strings that don't benefit from
# forced wrapping, and it would otherwise be ~66% of the entire baseline,
# drowning out the other 27 rule families' genuinely diverse findings.
extend-ignore = ["E741", "E501"]

[tool.pytest.ini_options]
testpaths = [
    "tests",
]
markers = [
    "smoke: quick core engine tests for CI/CD pipelines",
    "golden_crucible: opt-in end-to-end regression test against the language-crucible corpus; needs a local checkout. Run explicitly via `pytest -m golden_crucible`.",
]
addopts = "-m 'not golden_crucible'"
norecursedirs = ["tests/fixtures"]