Open_Ultra_SAST/pyproject.toml

[build-system]
requires = ["uv_build>=0.8.13,<0.9.0"]
build-backend = "uv_build"

[project]
name = "openultrasast"
version = "1.2.0a1"
description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
readme = "README.md"
requires-python = ">=3.11"
dependencies = ["pyyaml>=6.0"]

[project.optional-dependencies]
# The documentation site (mkdocs.yml, docs/). Mermaid renders client-side through Material's superfences fence.
docs = [
    "mkdocs>=1.6,<2",
    "mkdocs-material>=9.5,<10",
]
# The plane's memory store on MinIO (OUSAST_MEMORY=minio://<bucket>, plane/memory.py). Imported lazily; the
# core install and the file store need nothing beyond PyYAML.
minio = [
    "minio>=7.2,<8",
]
# Structured parse for overlay (JS/C/C++/Java/Python). Core install stays empty.
# Wheels are MIT; import is lazy via openultrasast.semantic.extra.
semantic = [
    "tree-sitter>=0.23,<0.27",
    "tree-sitter-python>=0.23",
    "tree-sitter-javascript>=0.23",
    "tree-sitter-typescript>=0.23",
    "tree-sitter-c>=0.23",
    "tree-sitter-cpp>=0.23",
    "tree-sitter-java>=0.23",
]

[project.scripts]
ousast = "openultrasast.cli:main"

[tool.pytest.ini_options]
testpaths = ["tests"]
pythonpath = ["src"]
markers = [
    "docker: requires a docker daemon",
    "semantic: requires openultrasast[semantic] tree-sitter extra",
    "ax: requires the live ax cluster of ops/ax/up.sh (skipped unless `ousast plane doctor` passes)",
]

[tool.ruff]
line-length = 140
target-version = "py311"
# Benchmark fixtures are intentionally vulnerable, unformatted sample corpora;
# linting/formatting them would flag the planted bugs and shift ground-truth lines.
extend-exclude = ["benchmarks/fixtures", "benchmarks/pairs"]

[tool.ruff.lint]
select = ["B", "E", "F", "I", "SIM", "UP"]

[tool.mypy]
python_version = "3.11"
files = ["src/openultrasast"]
check_untyped_defs = true
disallow_untyped_defs = true
no_implicit_optional = true
warn_redundant_casts = true
warn_return_any = true
warn_unused_configs = true

[[tool.mypy.overrides]]
module = "tree_sitter"
ignore_missing_imports = true

# The minio SDK is an optional extra, absent in the type-check environment (plane/memory.py imports it lazily).
[[tool.mypy.overrides]]
module = ["minio", "minio.*"]
ignore_missing_imports = true

# PyYAML ships no inline types and types-PyYAML is not a dev dependency.
[[tool.mypy.overrides]]
module = "yaml"
ignore_missing_imports = true

[dependency-groups]
dev = [
    "dagger-io>=0.21.7",
    "mypy>=2.1.0",
    "pre-commit>=4.6.0",
    "pytest>=8",
    "ruff>=0.15.17",
]