code-review-graph/pyproject.toml at staging · tirth8205/code-review-graph · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "code-review-graph"
version = "2.3.9"
description = "Local-first knowledge graph for token-efficient code review through MCP and CLI"
readme = {file = "README.md", content-type = "text/markdown"}
license = "MIT"
requires-python = ">=3.10"
authors = [
    { name = "Tirth" },
]
keywords = ["code-review", "knowledge-graph", "tree-sitter", "mcp", "ai-coding-tools"]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Software Development :: Quality Assurance",
]
dependencies = [
    "mcp>=1.0.0,<3",
    # fastmcp >=3.2.4 is required for Message-based prompts and includes the
    # CVE-2025-62800/62801/66416 fixes; <4 prevents the next major release
    # from breaking the server the way fastmcp 3.0 did. See: #488
    "fastmcp>=3.2.4,<4",
    # main.py imports anyio directly: the MCP tool offload has to use the
    # same thread limiter FastMCP dispatches sync tool bodies through, not
    # asyncio's smaller default executor. A direct import gets a direct
    # dependency rather than relying on fastmcp to keep pulling it in.
    "anyio>=4.0,<5",
    "tree-sitter>=0.23.0,<1",
    "tree-sitter-language-pack>=0.3.0,<1",
    "pyyaml>=6.0,<7",
    "networkx>=3.2,<4",
    "watchdog>=4.0.0,<7",
    "tomli>=2.0.0,<3; python_version < '3.11'",
]

[project.urls]
Homepage = "https://code-review-graph.com"
Repository = "https://github.com/tirth8205/code-review-graph"
Documentation = "https://github.com/tirth8205/code-review-graph/blob/main/docs/INDEX.md"
Changelog = "https://github.com/tirth8205/code-review-graph/blob/main/CHANGELOG.md"
Issues = "https://github.com/tirth8205/code-review-graph/issues"

[project.scripts]
code-review-graph = "code_review_graph.cli:main"
crg-daemon = "code_review_graph.daemon_cli:main"

[project.optional-dependencies]
embeddings = [
    "sentence-transformers>=3.0.0,<7",
    "numpy>=1.26,<3",
]
google-embeddings = [
    "google-genai>=1.0.0,<3",
]
communities = [
    "igraph>=0.11.0",
]
eval = [
    "matplotlib>=3.7.0",
    "pyyaml>=6.0",
]
wiki = [
    "ollama>=0.1.0",
]
all = [
    "code-review-graph[embeddings]",
    "code-review-graph[google-embeddings]",
    "code-review-graph[communities]",
    "code-review-graph[enrichment]",
    "code-review-graph[eval]",
    "code-review-graph[wiki]",
]
enrichment = [
    "jedi>=0.19.2",
]
dev = [
    "mypy>=1.10,<3",
    "pytest>=8.0,<9",
    "pytest-asyncio>=0.23,<2",
    "pytest-cov>=4.0,<8",
    "ruff>=0.3.0,<1",
    "tomli>=2.0; python_version < '3.11'",
]
# Real-browser tests for the generated visualization page
# (tests/test_visualization_browser.py, `pytest -m browser`). Deliberately
# NOT part of "all": it pulls a ~150 MB Chromium download that nothing at
# runtime needs, and the browser build has to be fetched separately with
# `python -m playwright install chromium`.
browser-test = [
    "playwright>=1.45,<2",
    "pytest-playwright>=0.5,<1",
]

[tool.hatch.build.targets.wheel]
packages = ["code_review_graph"]

[tool.hatch.build.targets.wheel.force-include]
"skills" = "code_review_graph/_bundled_skills"

[tool.hatch.build.targets.sdist]
include = [
    "code_review_graph/",
    "skills/",
    "docs/",
    "hooks/",
    "LICENSE",
    "README.md",
    "pyproject.toml",
]
# Hatch adds readme- and licence-named files from anywhere in the tree on top
# of `include`, which pulled the issue tracker's hooks and the VS Code
# extension's own README and LICENSE into the source distribution. (Hatchling
# always ships `.gitignore`; that one cannot be excluded.)
exclude = [
    ".beads/",
    "code-review-graph-vscode/",
]

[tool.ruff]
line-length = 100
target-version = "py310"
exclude = [
    "diagrams/",  # diagram DSL scripts — intentionally compact, non-standard style
    "tests/fixtures/sample_databricks_notebook.ipynb",  # SQL/R/Scala cells are not valid Python
]

[tool.ruff.lint]
select = ["E", "F", "I", "N", "W"]

[tool.ruff.lint.per-file-ignores]
"code_review_graph/visualization.py" = ["E501"]  # embedded HTML/JS template
"code_review_graph/_legacy_instructions.py" = ["E501"]  # verbatim past output, must not be reflowed
"tests/fixtures/sample_databricks_export.py" = ["F841", "W292"]  # intentional fixture patterns
"tests/fixtures/sample_notebook.ipynb" = ["F401", "I001"]  # fixture imports: intentionally unused, split across cells
"tests/test_multilang.py" = ["E501"]  # long assertions with explanatory comments

[tool.bandit]
# B101: assert used (fine in non-security code)
# B404: import subprocess (we need git interaction)
# B603: subprocess without shell=True (we use list args, not shell)
# B607: partial executable path (calling "git" by name is standard)
# B608: SQL f-string — false positive, we use parameterized "?" placeholders on a local SQLite DB
skips = ["B101", "B404", "B603", "B607", "B608"]

[tool.pytest.ini_options]
asyncio_mode = "auto"
testpaths = ["tests"]
norecursedirs = ["tests/fixtures"]
# Browser tests are opt-in: they need the "browser-test" extra and a
# Chromium build (`python -m playwright install chromium`). CI runs them in
# the separate "viz-browser" job; the coverage job excludes them.
markers = [
    "e2e: end-to-end tests that drive the real pipeline, MCP server or CLI as a subprocess",
    "browser: drives the generated visualization page in a real headless browser",
    "action_e2e: drives the composite GitHub Action's own steps against scratch repositories",
    "platform_lifecycle: drives install/reinstall/uninstall for every supported platform",
    "packaging: builds the distribution artefacts and smoke-tests them from a clean install",
    "determinism: rebuilds one corpus many ways and compares every table (minutes)",
    "upgrade: installs released versions from PyPI, builds a graph with each, and upgrades it with the current code (needs uv and network; minutes and hundreds of MB)",
    "surface: drives every registered MCP tool and prompt through a real client over stdio",
    "corpus: builds the graph over pinned real repositories and compares recorded baselines",
    "exports: slow conformance checks for every artefact the tool writes (visualize --format html/json/graphml/cypher/obsidian/svg, and wiki)",
    "action_e2e: drives the composite GitHub Action's own steps against scratch repositories",
    "cli_surface: enumerates the whole CLI and its failure modes as subprocesses (slow)",
    "concurrency: cross-process database contention, interrupted builds, daemon lifecycle and watcher stress (opt-in, slow)",
]

[dependency-groups]
dev = [
    "pytest>=8.4.2",
    "pytest-asyncio>=0.23,<2",
]