mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
c95b9241d8
openultrasast.stats: Wilson intervals (statsmodels), exact McNemar, a repository-clustered percentile bootstrap and its paired form with one quantile convention, grouped folds (GroupKFold, leave-one-group-out), and per-column separation (ROC AUC) for the leak audit and the signal screen. Checked against the benchmark scorer's Wilson and the learn harness's McNemar. hunt/features.py turns the feature table into the engineered frame (distances, counts, flags) and keeps the map from every engineered feature to the annotation the model is shown, so an ablation mask drops both, and screen() says which annotation carries signal before a model call is spent. The [hunt] extra now carries the libraries; the core install is unchanged. The learn harness's own copies stay until that line is revived. Co-Authored-By: Claude Fable 5.1 <[email protected]>
101 lines
2.8 KiB
TOML
101 lines
2.8 KiB
TOML
[build-system]
|
|
requires = ["uv_build>=0.8.13,<0.9.0"]
|
|
build-backend = "uv_build"
|
|
|
|
[project]
|
|
name = "openultrasast"
|
|
version = "2.0.1"
|
|
description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
|
|
readme = "README.md"
|
|
license = "Apache-2.0"
|
|
license-files = ["LICENSE"]
|
|
requires-python = ">=3.11"
|
|
dependencies = ["pyyaml>=6.0"]
|
|
|
|
[project.optional-dependencies]
|
|
# Hunter learning research only; the core install stays PyYAML.
|
|
hunt = [
|
|
"dspy>=3.4,<3.5",
|
|
"pandas>=2.2,<3",
|
|
"scipy>=1.13,<2",
|
|
"scikit-learn>=1.6,<2",
|
|
"statsmodels>=0.14,<1",
|
|
]
|
|
# The documentation site (mkdocs.yml, docs/). Mermaid renders client-side through Material's superfences fence.
|
|
docs = [
|
|
"mkdocs>=1.6,<2",
|
|
"mkdocs-material>=9.5,<10",
|
|
]
|
|
# The plane's memory store on an S3-compatible bucket (OUSAST_MEMORY=s3://<bucket>, plane/memory.py; RustFS is the
|
|
# tested server). Imported lazily; the core install and the file store need nothing beyond PyYAML.
|
|
s3 = [
|
|
"boto3>=1.35,<2",
|
|
]
|
|
# Structured parse for overlay (JS/C/C++/Java/Python). Core install stays empty.
|
|
# Wheels are MIT; import is lazy via openultrasast.semantic.extra.
|
|
semantic = [
|
|
"tree-sitter>=0.23,<0.27",
|
|
"tree-sitter-python>=0.23",
|
|
"tree-sitter-javascript>=0.23",
|
|
"tree-sitter-typescript>=0.23",
|
|
"tree-sitter-c>=0.23",
|
|
"tree-sitter-cpp>=0.23",
|
|
"tree-sitter-java>=0.23",
|
|
]
|
|
|
|
[project.scripts]
|
|
ousast = "openultrasast.cli:main"
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
pythonpath = ["src"]
|
|
markers = [
|
|
"docker: requires a docker daemon",
|
|
"semantic: requires openultrasast[semantic] tree-sitter extra",
|
|
"ax: requires the live ax cluster of ops/ax/up.sh (skipped unless `ousast plane doctor` passes)",
|
|
]
|
|
|
|
[tool.ruff]
|
|
line-length = 140
|
|
target-version = "py311"
|
|
# Benchmark fixtures are intentionally vulnerable, unformatted sample corpora;
|
|
# linting/formatting them would flag the planted bugs and shift ground-truth lines.
|
|
extend-exclude = ["benchmarks/fixtures", "benchmarks/pairs"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["B", "E", "F", "I", "SIM", "UP"]
|
|
|
|
[tool.mypy]
|
|
python_version = "3.11"
|
|
files = ["src/openultrasast"]
|
|
check_untyped_defs = true
|
|
disallow_untyped_defs = true
|
|
no_implicit_optional = true
|
|
warn_redundant_casts = true
|
|
warn_return_any = true
|
|
warn_unused_configs = true
|
|
|
|
[[tool.mypy.overrides]]
|
|
module = "tree_sitter"
|
|
ignore_missing_imports = true
|
|
|
|
# boto3 is an optional extra without inline types, absent in the type-check environment (plane/memory.py imports
|
|
# it lazily).
|
|
[[tool.mypy.overrides]]
|
|
module = ["boto3", "botocore.*"]
|
|
ignore_missing_imports = true
|
|
|
|
# PyYAML ships no inline types and types-PyYAML is not a dev dependency.
|
|
[[tool.mypy.overrides]]
|
|
module = "yaml"
|
|
ignore_missing_imports = true
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"dagger-io>=0.21.7",
|
|
"mypy>=2.1.0",
|
|
"pre-commit>=4.6.0",
|
|
"pytest>=8",
|
|
"ruff>=0.15.17",
|
|
]
|