mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 4.8
5e206df166
Wire HarnessX as an optional, SHA-pinned extra with a lazy capability guard, keeping the core install zero-dependency. - pyproject: add [project.optional-dependencies] harnessx pinned to commit 274c512 (Darwin-Agent/HarnessX). Core dependencies stays []. uv_build emits `Requires-Dist: harnessx @ git+...@<sha> ; extra == 'harnessx'` + `Provides-Extra: harnessx` (verified via uv build); release ships to GitHub Releases, not PyPI, so the direct-reference is fine. - harness_ext.py: the capability seam. has_harnessx() probes via find_spec (never imports harnessx); require_harnessx() imports lazily on demand and raises HarnessXUnavailableError with install guidance when absent. Every Phase 3+ HarnessX path routes through here so heavy imports stay cold by default. - uv.lock refreshed: the universal lock now resolves the harnessx tree (149 pkgs) but `uv sync --group dev` installs only 57 — harnessx is NOT importable in the default/CI venv (verified), so CI stays lean and never re-locks. - Tests: core deps empty; the extra is a 40-hex SHA-pinned git URL; importing openultrasast.cli does not import harnessx; has_harnessx probes without importing; require_harnessx raises with guidance when absent. 98 tests pass; ruff + mypy clean; detection gate 93.6%/0% intact. Spec task 5 (5.1 + 5.2) checked off; next is task 6 (build_sast hunter sub-harness). Co-Authored-By: Claude Opus 4.8 <[email protected]>
59 lines
1.7 KiB
TOML
59 lines
1.7 KiB
TOML
[build-system]
|
|
requires = ["uv_build>=0.8.13,<0.9.0"]
|
|
build-backend = "uv_build"
|
|
|
|
[project]
|
|
name = "openultrasast"
|
|
version = "0.1.0"
|
|
description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
|
|
readme = "README.md"
|
|
requires-python = ">=3.11"
|
|
dependencies = []
|
|
|
|
[project.optional-dependencies]
|
|
# HarnessX is the optional agentic plane (LLM hunter/verifier + self-improvement).
|
|
# SHA-pinned for reproducibility; the heavy transitive footprint (see
|
|
# .kiro/specs/harnessx-self-improving-rulesets/dependency-audit.md) lands ONLY when
|
|
# this extra is installed. The core install stays zero-dependency and every HarnessX
|
|
# import is guarded by openultrasast.harness_ext (lazy). pip does not pull the
|
|
# recipe/verl_harnessX submodule (it is outside the packaged harnessx* modules).
|
|
harnessx = [
|
|
"harnessx @ git+https://github.com/Darwin-Agent/HarnessX.git@274c512eea67c64701f992d3b6fe06f0fd590ef0",
|
|
]
|
|
|
|
[project.scripts]
|
|
ousast = "openultrasast.cli:main"
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
pythonpath = ["src"]
|
|
|
|
[tool.ruff]
|
|
line-length = 140
|
|
target-version = "py311"
|
|
# Benchmark fixtures are intentionally vulnerable, unformatted sample corpora;
|
|
# linting/formatting them would flag the planted bugs and shift ground-truth lines.
|
|
extend-exclude = ["benchmarks/fixtures"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["B", "E", "F", "I", "SIM", "UP"]
|
|
|
|
[tool.mypy]
|
|
python_version = "3.11"
|
|
files = ["src/openultrasast"]
|
|
check_untyped_defs = true
|
|
disallow_untyped_defs = true
|
|
no_implicit_optional = true
|
|
warn_redundant_casts = true
|
|
warn_return_any = true
|
|
warn_unused_configs = true
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"dagger-io>=0.21.7",
|
|
"mypy>=2.1.0",
|
|
"pre-commit>=4.6.0",
|
|
"pytest>=8",
|
|
"ruff>=0.15.17",
|
|
]
|