secretscreen/pyproject.toml at develop · featurecreep-cron/secretscreen · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
[build-system]
requires = ["hatchling", "hatch-vcs>=0.4"]
build-backend = "hatchling.build"

[project]
name = "secretscreen"
dynamic = ["version"]
description = "Detect and redact secrets in key-value pairs, dicts, and environment variables. Library and CLI."
readme = "README.md"
license = "MIT"
requires-python = ">=3.11"
authors = [{ name = "Cron", email = "cron@featurecreep.dev" }]
keywords = ["secrets", "redaction", "security", "environment", "docker", "cli", "command-line"]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Environment :: Console",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Security",
    "Topic :: Software Development :: Libraries :: Python Modules",
    "Topic :: Utilities",
    "Typing :: Typed",
]

[project.scripts]
secretscreen = "secretscreen._cli:main"

[project.optional-dependencies]
# Pinned exactly, like every other dependency in these repos. The reason the
# linters previously carried upper bounds still applies and is now covered by
# the pin: an unpinned ruff minor bump (0.15 -> 0.16) silently changed
# formatting rules and broke an unrelated PR.
dev = ["pytest==9.1.1", "pytest-cov==7.1.0", "ruff==0.17.1", "mypy==2.4.0"]

[project.urls]
Homepage = "https://github.com/featurecreep-cron/secretscreen"
Repository = "https://github.com/featurecreep-cron/secretscreen"
Issues = "https://github.com/featurecreep-cron/secretscreen/issues"

[tool.hatch.build.targets.wheel]
packages = ["src/secretscreen"]

[tool.pytest.ini_options]
testpaths = ["tests"]

# Measure the package, not the suite. Bare `pytest --cov` measures everything
# imported, which counts tests/ as covered code and puts patch coverage on the
# test file itself. That penalises exactly the tests worth writing: a branch
# that exists to fail the suite if a bug returns never runs while the code is
# correct, so a passing suite reads as an uncovered line.
#
# Omit rather than `source`: setting a source root rewrites every path in
# coverage.xml relative to it, and codecov matches those paths against the
# repository. Dropping the suite leaves `src/secretscreen/...` exactly as it
# has always been reported.
[tool.coverage.run]
omit = ["tests/*"]

[tool.mypy]
strict = true
warn_return_any = true
warn_unused_configs = true

[tool.ruff]
target-version = "py311"
line-length = 120

[tool.ruff.lint]
select = ["E", "F", "W", "I", "N", "UP", "B", "A", "SIM", "TCH"]
ignore = ["SIM102", "SIM108"]

[tool.hatch.version]
# The git tag is the single source of the version. Nothing writes it into a
# file, so pyproject and the tag cannot drift apart.
source = "vcs"

[tool.semantic_release]
commit_parser = "conventional"
tag_format = "v{version}"
major_on_zero = false
allow_zero_version = true

[tool.semantic_release.commit_parser_options]
minor_tags = ["feat"]
# "deps" is a patch-producing type across our repos. secretscreen has no runtime
# dependencies today so nothing emits it here, but the parser should agree with
# the others the day that changes. allowed_tags must be listed explicitly: its
# default is computed from the class-level defaults, so overriding patch_tags
# alone leaves "deps" unrecognised and silently drops every such commit.
patch_tags = ["fix", "perf", "deps"]
allowed_tags = [
    "feat", "fix", "perf", "deps",
    "build", "chore", "ci", "docs", "style", "refactor", "test",
]

[tool.semantic_release.branches.main]
match = "main"
prerelease = false