mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Fable 5.1
4063fd1562
Java parsed already, but the producer failed every Java row because no obligation facts existed for the language and that failure took roles and def_use down with it. PHP had no grammar. Now: tree-sitter-php in the semantic extra with PHP node kinds in the CST reader; obligation facts for Jenkins/Stapler, Spring Security and Servlet code (java.toml) and for Laravel, WordPress and Symfony (php.toml), each header naming the training clones and references the names were checked against; a language with an IR but no obligation facts keeps roles and def_use and records obligations as unchecked (None), which the engineered features treat as missing, never as zero. Proven on the committed pool: 6 of 6 Java rows and 33 of 33 PHP rows of one fix change each now carry semantic features. Implemented by Codex; gated here with ruff, mypy and the full suite. Co-Authored-By: Claude Fable 5.1 <[email protected]>
115 lines
3.7 KiB
TOML
115 lines
3.7 KiB
TOML
[build-system]
|
|
requires = ["uv_build>=0.8.13,<0.9.0"]
|
|
build-backend = "uv_build"
|
|
|
|
[project]
|
|
name = "openultrasast"
|
|
version = "2.0.1"
|
|
description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
|
|
readme = "README.md"
|
|
license = "Apache-2.0"
|
|
license-files = ["LICENSE"]
|
|
requires-python = ">=3.11"
|
|
dependencies = ["pyyaml>=6.0"]
|
|
|
|
[project.optional-dependencies]
|
|
# Hunter learning research only; the core install stays PyYAML.
|
|
hunt = [
|
|
"dspy>=3.4,<3.5",
|
|
"pandas>=2.2,<3",
|
|
"scipy>=1.13,<2",
|
|
"scikit-learn>=1.6,<2",
|
|
"statsmodels>=0.14,<1",
|
|
]
|
|
# The documentation site (mkdocs.yml, docs/). Mermaid renders client-side through Material's superfences fence.
|
|
docs = [
|
|
"mkdocs>=1.6,<2",
|
|
"mkdocs-material>=9.5,<10",
|
|
]
|
|
# The plane's memory store on an S3-compatible bucket (OUSAST_MEMORY=s3://<bucket>, plane/memory.py; RustFS is the
|
|
# tested server). Imported lazily; the core install and the file store need nothing beyond PyYAML.
|
|
s3 = [
|
|
"boto3>=1.35,<2",
|
|
]
|
|
# Structured parse for overlay (JS/C/C++/Java/PHP/Python). Core install stays empty.
|
|
# Wheels are MIT; import is lazy via openultrasast.semantic.extra.
|
|
semantic = [
|
|
"tree-sitter>=0.23,<0.27",
|
|
"tree-sitter-python>=0.23",
|
|
"tree-sitter-javascript>=0.23",
|
|
"tree-sitter-typescript>=0.23",
|
|
"tree-sitter-c>=0.23",
|
|
"tree-sitter-cpp>=0.23",
|
|
"tree-sitter-java>=0.23",
|
|
"tree-sitter-php>=0.23",
|
|
]
|
|
|
|
[project.scripts]
|
|
ousast = "openultrasast.cli:main"
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
pythonpath = ["src"]
|
|
markers = [
|
|
"docker: requires a docker daemon",
|
|
"semantic: requires openultrasast[semantic] tree-sitter extra",
|
|
"sandbox: needs bubblewrap isolation; skipped where the isolation preflight fails (CI's container has no bwrap)",
|
|
"ax: requires the live ax cluster of ops/ax/up.sh (skipped unless `ousast plane doctor` passes)",
|
|
]
|
|
|
|
[tool.ruff]
|
|
line-length = 140
|
|
target-version = "py311"
|
|
# Benchmark fixtures are intentionally vulnerable, unformatted sample corpora;
|
|
# linting/formatting them would flag the planted bugs and shift ground-truth lines.
|
|
extend-exclude = ["benchmarks/fixtures", "benchmarks/pairs"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["B", "E", "F", "I", "SIM", "UP"]
|
|
|
|
[tool.mypy]
|
|
python_version = "3.11"
|
|
files = ["src/openultrasast"]
|
|
check_untyped_defs = true
|
|
disallow_untyped_defs = true
|
|
no_implicit_optional = true
|
|
warn_redundant_casts = true
|
|
warn_return_any = true
|
|
warn_unused_configs = true
|
|
|
|
[[tool.mypy.overrides]]
|
|
module = "tree_sitter"
|
|
ignore_missing_imports = true
|
|
|
|
# boto3 is an optional extra without inline types, absent in the type-check environment (plane/memory.py imports
|
|
# it lazily).
|
|
[[tool.mypy.overrides]]
|
|
module = ["boto3", "botocore.*"]
|
|
ignore_missing_imports = true
|
|
|
|
# PyYAML ships no inline types and types-PyYAML is not a dev dependency.
|
|
[[tool.mypy.overrides]]
|
|
module = "yaml"
|
|
ignore_missing_imports = true
|
|
|
|
# dspy, pandas, statsmodels and scikit-learn ship no py.typed marker and no stub packages are dev dependencies;
|
|
# numpy, pydantic and litellm arrive with them and are absent in the type-check environment of CI.
|
|
[[tool.mypy.overrides]]
|
|
module = ["dspy", "dspy.*", "pandas", "pandas.*", "statsmodels.*", "sklearn.*", "numpy", "numpy.*", "pydantic", "pydantic.*", "litellm", "litellm.*"]
|
|
ignore_missing_imports = true
|
|
|
|
# The hunt package reaches the benchmark scorers and manifests lazily. benchmarks/ is not in `files` and has never
|
|
# been type-checked; src stays strict against its signatures while errors inside benchmarks/ are not reported.
|
|
[[tool.mypy.overrides]]
|
|
module = "benchmarks.*"
|
|
follow_imports = "silent"
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"dagger-io>=0.21.7",
|
|
"mypy>=2.1.0",
|
|
"pre-commit>=4.6.0",
|
|
"pytest>=8",
|
|
"ruff>=0.15.17",
|
|
]
|