mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Fable 5.1
51d064e381
The plane's memory store no longer names one vendor. `MinioStore`/`SdkClient`/ `minio_settings`/`MINIO_KEYS` become `S3Store`/`S3Client`/`s3_settings`/`S3_KEYS`; the URL scheme is `s3://<bucket>[/<prefix>]` (`s3://` alone uses `S3_BUCKET`); the settings are `S3_ENDPOINT` (a full URL), `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, optional `AWS_SESSION_TOKEN` and `S3_REGION`. The client is boto3 (extra `s3`, imported lazily): SigV4, path-style addressing, SDK checksum trailers off, paginated listing, versions and delete markers listed and deleted by version (`purge`, used by the contract tests' teardown so the bucket keeps nothing of a run). Behaviour is unchanged: the store never configures its bucket and verifies versioning, the `runs/` expiry rule, S3 Select and tag reads at startup; no local fallback; every row carries every queryable field with "" placeholders. The admin hints read `--endpoint-url "$S3_ENDPOINT"`. The fake client still reproduces RustFS's two Select failures (unbound leading-row field, null-typed column). Docs: rustfs.md stays the tested server's setup page (policy JSON unchanged, env names updated, any S3-compatible store with versioning, lifecycle, tags and Select works); memory.md, ops/ax/README.md, README.md, steering and the two current spec designs use the S3 naming. Retired specs and committed measurements are untouched. Real server (RustFS, OUSAST_MEMORY_TEST_S3=1): test_plane_memory + test_learn_compile 75 passed, 1 skipped. Store copy of the live local store to a temporary prefix: every count matched (776 row objects, 2982 rows, 22 facts, 788 excerpts, 2601 responses, 2 programs, 1793 index entries), 4190 versions purged afterwards. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
91 lines
2.6 KiB
TOML
91 lines
2.6 KiB
TOML
[build-system]
|
|
requires = ["uv_build>=0.8.13,<0.9.0"]
|
|
build-backend = "uv_build"
|
|
|
|
[project]
|
|
name = "openultrasast"
|
|
version = "1.2.0a1"
|
|
description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
|
|
readme = "README.md"
|
|
requires-python = ">=3.11"
|
|
dependencies = ["pyyaml>=6.0"]
|
|
|
|
[project.optional-dependencies]
|
|
# The documentation site (mkdocs.yml, docs/). Mermaid renders client-side through Material's superfences fence.
|
|
docs = [
|
|
"mkdocs>=1.6,<2",
|
|
"mkdocs-material>=9.5,<10",
|
|
]
|
|
# The plane's memory store on an S3-compatible bucket (OUSAST_MEMORY=s3://<bucket>, plane/memory.py; RustFS is the
|
|
# tested server). Imported lazily; the core install and the file store need nothing beyond PyYAML.
|
|
s3 = [
|
|
"boto3>=1.35,<2",
|
|
]
|
|
# Structured parse for overlay (JS/C/C++/Java/Python). Core install stays empty.
|
|
# Wheels are MIT; import is lazy via openultrasast.semantic.extra.
|
|
semantic = [
|
|
"tree-sitter>=0.23,<0.27",
|
|
"tree-sitter-python>=0.23",
|
|
"tree-sitter-javascript>=0.23",
|
|
"tree-sitter-typescript>=0.23",
|
|
"tree-sitter-c>=0.23",
|
|
"tree-sitter-cpp>=0.23",
|
|
"tree-sitter-java>=0.23",
|
|
]
|
|
|
|
[project.scripts]
|
|
ousast = "openultrasast.cli:main"
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
pythonpath = ["src"]
|
|
markers = [
|
|
"docker: requires a docker daemon",
|
|
"semantic: requires openultrasast[semantic] tree-sitter extra",
|
|
"ax: requires the live ax cluster of ops/ax/up.sh (skipped unless `ousast plane doctor` passes)",
|
|
]
|
|
|
|
[tool.ruff]
|
|
line-length = 140
|
|
target-version = "py311"
|
|
# Benchmark fixtures are intentionally vulnerable, unformatted sample corpora;
|
|
# linting/formatting them would flag the planted bugs and shift ground-truth lines.
|
|
extend-exclude = ["benchmarks/fixtures", "benchmarks/pairs"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["B", "E", "F", "I", "SIM", "UP"]
|
|
|
|
[tool.mypy]
|
|
python_version = "3.11"
|
|
files = ["src/openultrasast"]
|
|
check_untyped_defs = true
|
|
disallow_untyped_defs = true
|
|
no_implicit_optional = true
|
|
warn_redundant_casts = true
|
|
warn_return_any = true
|
|
warn_unused_configs = true
|
|
|
|
[[tool.mypy.overrides]]
|
|
module = "tree_sitter"
|
|
ignore_missing_imports = true
|
|
|
|
# boto3 is an optional extra without inline types, absent in the type-check environment (plane/memory.py imports
|
|
# it lazily).
|
|
[[tool.mypy.overrides]]
|
|
module = ["boto3", "botocore.*"]
|
|
ignore_missing_imports = true
|
|
|
|
# PyYAML ships no inline types and types-PyYAML is not a dev dependency.
|
|
[[tool.mypy.overrides]]
|
|
module = "yaml"
|
|
ignore_missing_imports = true
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"dagger-io>=0.21.7",
|
|
"mypy>=2.1.0",
|
|
"pre-commit>=4.6.0",
|
|
"pytest>=8",
|
|
"ruff>=0.15.17",
|
|
]
|