pyproject.toml

[build-system]
requires = ["setuptools>=68"]
build-backend = "setuptools.build_meta"

[project]
name = "traust"
# version must equal the VERSION file — check_docs_consistency.py
# version-sync check fails the pre-push when they drift (and fails
# closed if this field is removed)
version = "0.15.0"
license = "Apache-2.0"
description = "AI agent tooling for automated security audits of Red Hat Hybrid Platforms source code"
requires-python = ">=3.11"
dependencies = [
    "traust-engine",
    # TODO: this should not be here. Declared only because a handful of call
    # sites import traust_ledger DIRECTLY instead of going through
    # traust_engine.ledger.LedgerService, which is the intended seam:
    #   cli/countersign.py            traust_ledger.auth.directory,
    #                                 traust_ledger.cli.identity.actor
    #   cli/check_drift.py            traust_ledger.api.integrity
    #   harnessing/3-audit/compliance-check/scripts/compliance_scope_intake.py
    # Until now it resolved only because traust-engine happens to pull the
    # ledger in transitively — an undeclared dependency that would break at
    # import time (countersign, compliance-check) the moment engine stopped
    # depending on it. Some more restructuring will help alleviate this pain later.
    # Route these through LedgerService and drop this line. countersign.py is
    # itself a candidate for removal, which retires most of the callers.
    "traust-ledger",
    "traust-contracts",
    "jsonschema",
    "referencing",
    "pyyaml",
    "playwright",
    "pytest",
]

[project.optional-dependencies]
graph = [
    "tree-sitter",
    "tree-sitter-go",
    "tree-sitter-python",
    "tree-sitter-typescript",
    "tree-sitter-javascript",
]
signing = ["sigstore>=4.0,<5.0"]
# ledger.yaml with a dsn (Ledger database as the authority) needs the DB backend.
ledger-db = ["traust-ledger[db]"]

[project.scripts]
traust = "traust.cli.__main__:main"

[dependency-groups]
dev = ["ruff>=0.6", "pytest-xdist>=3", "traust-ledger[db]"]

[tool.uv.sources]
traust-contracts = { git = "https://github.com/traust-security/traust-contracts.git", rev = "a1d602b4266be4f8645c1c682d8c3439501167ad" }
traust-engine = { git = "https://github.com/traust-security/traust-engine.git", rev = "b853e6572faa6d5a393e06d3585daf377011812c" }
traust-ledger = { git = "https://github.com/traust-security/traust-ledger.git", rev = "a20ffd476529e50b2e266e3311adbf48d6a8f5f6" }

# Multi-skill CLIs live under src/traust/; harnessing/<skill>/ for single-skill
# scripts. Install for deps + importable path helpers.
[tool.setuptools]
package-dir = { "" = "src" }

[tool.setuptools.packages.find]
where = ["src"]
include = ["traust*"]

[tool.pytest.ini_options]
testpaths = ["tests"]
markers = [
    "requires_git: test creates git repos in tmp dirs (skipped when git init is blocked)",
]

[tool.ruff]
line-length = 100
target-version = "py311"
extend-exclude = ["harnessing/fuzz-harnesses/clones"]

[tool.ruff.lint]
select = ["E", "W", "F", "I", "UP", "B", "SIM", "PTH", "RUF"]
ignore = ["RUF001", "RUF002", "RUF003"]

[tool.ruff.lint.per-file-ignores]
"tests/*" = ["S101", "E741", "E402", "E501", "RUF012"]
# Dashboard/rollup builders and product-index scripts embed HTML, CSS, markdown
# templates and data strings that are inherently wide.
"harnessing/**/build_priv_profile.py" = ["E501"]
"harnessing/**/build_fuzz_rollup.py" = ["E501"]
"harnessing/**/build_loc_dashboard.py" = ["E501"]
"harnessing/**/build_rbac_tenancy_rollup.py" = ["E501"]
"harnessing/**/emit_product_index.py" = ["E501", "PTH123", "SIM102", "RUF012"]
"harnessing/**/collect_harness_metrics.py" = ["E501"]
"harnessing/**/backfill_remediations.py" = ["E501"]
"harnessing/**/build_pqc_dashboard.py" = ["E501"]
"harnessing/**/build_executive_summary.py" = [
    "E501",
    "PTH123",
    "SIM102",
    "PTH118",
    "PTH119",
    "PTH110",
    "PTH112",
    "PTH113",
    "PTH114",
    "PTH120",
    "PTH206",
    "PTH207",
    "SIM115",
    "SIM105",
    "RUF012",
]
"harnessing/**/build_census.py" = [
    "E501",
    "PTH123",
    "SIM102",
    "PTH118",
    "PTH119",
    "PTH110",
    "PTH112",
    "PTH114",
    "PTH120",
    "PTH206",
    "SIM115",
    "RUF012",
]
"harnessing/**/build_validation_fuzz_dashboard.py" = [
    "E501",
    "PTH123",
    "SIM102",
    "SIM115",
    "RUF012",
]
"harnessing/**/build_insecure_patterns.py" = [
    "E501",
    "PTH123",
    "SIM115",
    "SIM102",
    "PTH119",
    "RUF012",
]
"src/**/build_skills_reference.py" = ["E501"]
"src/**/export_public_tree.py" = ["E501"]
# Opengrep fixture files are intentional code patterns — not real Python to execute.
"harnessing/**/opengrep-rules/**" = [
    "F821",
    "F402",
    "F405",
    "UP031",
    "SIM115",
    "PTH123",
    "PTH118",
    "PTH100",
    "E402",
    "E501",
]

[tool.mypy]
# Skill directories under harnessing/ use hyphenated names (e.g. validate-findings)
# which are not valid Python package identifiers. Exclude the whole tree; skills
# are loaded by file path, not imported as packages.
exclude = ["harnessing/"]