mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5.5
cabdf81ece
On the 501 exp-005 units, repo-held-out folds: logistic pooled within-pair AUC 0.721 vs the LLM programs 0.762 (diff -0.041, CI [-0.116, 0.032], a tie); gradient boosting 0.597 (significantly worse). Per family all differences span 0. Implemented with Codex; fit run by the coordinator (4.2 h on the VM). Co-Authored-By: Claude Opus 5.5 <[email protected]>
94 lines
2.7 KiB
TOML
94 lines
2.7 KiB
TOML
[build-system]
|
|
requires = ["uv_build>=0.8.13,<0.9.0"]
|
|
build-backend = "uv_build"
|
|
|
|
[project]
|
|
name = "openultrasast"
|
|
version = "2.0.1"
|
|
description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
|
|
readme = "README.md"
|
|
license = "Apache-2.0"
|
|
license-files = ["LICENSE"]
|
|
requires-python = ">=3.11"
|
|
dependencies = ["pyyaml>=6.0"]
|
|
|
|
[project.optional-dependencies]
|
|
train = ["numpy>=1.26,<3", "scikit-learn>=1.4,<2"]
|
|
# The documentation site (mkdocs.yml, docs/). Mermaid renders client-side through Material's superfences fence.
|
|
docs = [
|
|
"mkdocs>=1.6,<2",
|
|
"mkdocs-material>=9.5,<10",
|
|
]
|
|
# The plane's memory store on an S3-compatible bucket (OUSAST_MEMORY=s3://<bucket>, plane/memory.py; RustFS is the
|
|
# tested server). Imported lazily; the core install and the file store need nothing beyond PyYAML.
|
|
s3 = [
|
|
"boto3>=1.35,<2",
|
|
]
|
|
# Structured parse for overlay (JS/C/C++/Java/Python). Core install stays empty.
|
|
# Wheels are MIT; import is lazy via openultrasast.semantic.extra.
|
|
semantic = [
|
|
"tree-sitter>=0.23,<0.27",
|
|
"tree-sitter-python>=0.23",
|
|
"tree-sitter-javascript>=0.23",
|
|
"tree-sitter-typescript>=0.23",
|
|
"tree-sitter-c>=0.23",
|
|
"tree-sitter-cpp>=0.23",
|
|
"tree-sitter-java>=0.23",
|
|
]
|
|
|
|
[project.scripts]
|
|
ousast = "openultrasast.cli:main"
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
pythonpath = ["src"]
|
|
markers = [
|
|
"docker: requires a docker daemon",
|
|
"semantic: requires openultrasast[semantic] tree-sitter extra",
|
|
"ax: requires the live ax cluster of ops/ax/up.sh (skipped unless `ousast plane doctor` passes)",
|
|
]
|
|
|
|
[tool.ruff]
|
|
line-length = 140
|
|
target-version = "py311"
|
|
# Benchmark fixtures are intentionally vulnerable, unformatted sample corpora;
|
|
# linting/formatting them would flag the planted bugs and shift ground-truth lines.
|
|
extend-exclude = ["benchmarks/fixtures", "benchmarks/pairs"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["B", "E", "F", "I", "SIM", "UP"]
|
|
|
|
[tool.mypy]
|
|
python_version = "3.11"
|
|
files = ["src/openultrasast"]
|
|
check_untyped_defs = true
|
|
disallow_untyped_defs = true
|
|
no_implicit_optional = true
|
|
warn_redundant_casts = true
|
|
warn_return_any = true
|
|
warn_unused_configs = true
|
|
|
|
[[tool.mypy.overrides]]
|
|
module = ["tree_sitter", "sklearn.*", "numpy"]
|
|
ignore_missing_imports = true
|
|
|
|
# boto3 is an optional extra without inline types, absent in the type-check environment (plane/memory.py imports
|
|
# it lazily).
|
|
[[tool.mypy.overrides]]
|
|
module = ["boto3", "botocore.*"]
|
|
ignore_missing_imports = true
|
|
|
|
# PyYAML ships no inline types and types-PyYAML is not a dev dependency.
|
|
[[tool.mypy.overrides]]
|
|
module = "yaml"
|
|
ignore_missing_imports = true
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"dagger-io>=0.21.7",
|
|
"mypy>=2.1.0",
|
|
"pre-commit>=4.6.0",
|
|
"pytest>=8",
|
|
"ruff>=0.15.17",
|
|
]
|