mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
d9d6335ab3
hunter-learning-loop groups 1-3 (first increment). The feature table is the contract: one row per touched function with diff, source, semantic and taxonomy columns, provenance per producer, labels by the benchmark's rule. Producers read the repository at head only (a planted advisory id and commit text never reach a feature). The hunt program is a DSPy ReAct loop over a signature whose inputs are the unmasked columns in a fixed order; answers outside the closed family list or citing unseen lines score as unknown. The runner writes records the benchmark scorer reads, resumable by change, program id and mask, and refuses the held-out pilot unless the run is a report run. Research extra [hunt] = dspy, pandas; the core install is unchanged. 43 tests on a scripted model, no network. Co-Authored-By: Claude Fable 5.1 <[email protected]>
95 lines
2.7 KiB
TOML
95 lines
2.7 KiB
TOML
[build-system]
|
|
requires = ["uv_build>=0.8.13,<0.9.0"]
|
|
build-backend = "uv_build"
|
|
|
|
[project]
|
|
name = "openultrasast"
|
|
version = "2.0.1"
|
|
description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
|
|
readme = "README.md"
|
|
license = "Apache-2.0"
|
|
license-files = ["LICENSE"]
|
|
requires-python = ">=3.11"
|
|
dependencies = ["pyyaml>=6.0"]
|
|
|
|
[project.optional-dependencies]
|
|
# Hunter learning research only; the core install stays PyYAML.
|
|
hunt = ["dspy>=3.4,<3.5", "pandas>=2.2,<3"]
|
|
# The documentation site (mkdocs.yml, docs/). Mermaid renders client-side through Material's superfences fence.
|
|
docs = [
|
|
"mkdocs>=1.6,<2",
|
|
"mkdocs-material>=9.5,<10",
|
|
]
|
|
# The plane's memory store on an S3-compatible bucket (OUSAST_MEMORY=s3://<bucket>, plane/memory.py; RustFS is the
|
|
# tested server). Imported lazily; the core install and the file store need nothing beyond PyYAML.
|
|
s3 = [
|
|
"boto3>=1.35,<2",
|
|
]
|
|
# Structured parse for overlay (JS/C/C++/Java/Python). Core install stays empty.
|
|
# Wheels are MIT; import is lazy via openultrasast.semantic.extra.
|
|
semantic = [
|
|
"tree-sitter>=0.23,<0.27",
|
|
"tree-sitter-python>=0.23",
|
|
"tree-sitter-javascript>=0.23",
|
|
"tree-sitter-typescript>=0.23",
|
|
"tree-sitter-c>=0.23",
|
|
"tree-sitter-cpp>=0.23",
|
|
"tree-sitter-java>=0.23",
|
|
]
|
|
|
|
[project.scripts]
|
|
ousast = "openultrasast.cli:main"
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
pythonpath = ["src"]
|
|
markers = [
|
|
"docker: requires a docker daemon",
|
|
"semantic: requires openultrasast[semantic] tree-sitter extra",
|
|
"ax: requires the live ax cluster of ops/ax/up.sh (skipped unless `ousast plane doctor` passes)",
|
|
]
|
|
|
|
[tool.ruff]
|
|
line-length = 140
|
|
target-version = "py311"
|
|
# Benchmark fixtures are intentionally vulnerable, unformatted sample corpora;
|
|
# linting/formatting them would flag the planted bugs and shift ground-truth lines.
|
|
extend-exclude = ["benchmarks/fixtures", "benchmarks/pairs"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["B", "E", "F", "I", "SIM", "UP"]
|
|
|
|
[tool.mypy]
|
|
python_version = "3.11"
|
|
files = ["src/openultrasast"]
|
|
check_untyped_defs = true
|
|
disallow_untyped_defs = true
|
|
no_implicit_optional = true
|
|
warn_redundant_casts = true
|
|
warn_return_any = true
|
|
warn_unused_configs = true
|
|
|
|
[[tool.mypy.overrides]]
|
|
module = "tree_sitter"
|
|
ignore_missing_imports = true
|
|
|
|
# boto3 is an optional extra without inline types, absent in the type-check environment (plane/memory.py imports
|
|
# it lazily).
|
|
[[tool.mypy.overrides]]
|
|
module = ["boto3", "botocore.*"]
|
|
ignore_missing_imports = true
|
|
|
|
# PyYAML ships no inline types and types-PyYAML is not a dev dependency.
|
|
[[tool.mypy.overrides]]
|
|
module = "yaml"
|
|
ignore_missing_imports = true
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"dagger-io>=0.21.7",
|
|
"mypy>=2.1.0",
|
|
"pre-commit>=4.6.0",
|
|
"pytest>=8",
|
|
"ruff>=0.15.17",
|
|
]
|