pyproject.toml

[project]
name = "libre-devops-helpers"
version = "0.8.1"
description = "Libre DevOps Helpers: a fast, read-only CLI and importable helpers for Entra ID, Defender XDR, Intune, Azure, Graph, PIM, Logic Apps and ServiceNow, also shipped as a container image."
# The README, for PyPI with its relative links made absolute; see fancy-pypi-readme below.
dynamic = ["readme"]
license = "MIT"
license-files = ["LICENSE"]
authors = [{ name = "Craig Thacker" }]
requires-python = ">=3.11"
keywords = [
    "azure",
    "azure-cli",
    "entra-id",
    "defender-for-endpoint",
    "defender-xdr",
    "intune",
    "key-vault",
    "log-analytics",
    "logic-apps",
    "microsoft-graph",
    "microsoft-sentinel",
    "pim",
    "servicenow",
]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Environment :: Console",
    "Intended Audience :: System Administrators",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3 :: Only",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Topic :: Security",
    "Topic :: System :: Systems Administration",
    "Typing :: Typed",
]
# Standard library first. Runtime dependencies are deliberately few; the Azure CLI
# itself is an external prerequisite, not a Python dependency.
dependencies = [
    "requests>=2.31",
    "typer>=0.12",
]

[project.optional-dependencies]
# token_cache = "keychain" on macOS and Linux (Windows uses DPAPI, which needs nothing).
keychain = ["keyring>=25"]

[project.urls]
Homepage = "https://github.com/libre-devops/python-helpers"
Documentation = "https://github.com/libre-devops/python-helpers/tree/main/docs"
Changelog = "https://github.com/libre-devops/python-helpers/blob/main/CHANGELOG.md"
Issues = "https://github.com/libre-devops/python-helpers/issues"

[project.scripts]
ldo = "libre_devops_helpers.cli:main"

[dependency-groups]
dev = [
    "mypy>=1.18",
    "pytest>=8",
    "pytest-cov>=6",
    # Tests only: reads back the YAML that core/yaml_text.py writes, to prove it round-trips.
    "pyyaml>=6",
    "ruff>=0.6",
    "rust-just>=1.30",
    # Tests only: a throwaway certificate authority, for real TLS servers and proxies in
    # tests/core/test_probe.py.
    "trustme>=1.2",
    # Tests only: exported custom detection rules are checked against the Terraform
    # module's own JSON schema (tests/fakes/schemas).
    "jsonschema>=4.23",
]

[build-system]
requires = ["hatchling>=1.26", "hatch-fancy-pypi-readme>=24"]
build-backend = "hatchling.build"

# PyPI shows the README away from the repository, where its relative links (docs/,
# LICENSE) would lead nowhere, so the copy PyPI gets points them at GitHub. The README
# in the repository keeps its relative links, which a test checks resolve.
[tool.hatch.metadata.hooks.fancy-pypi-readme]
content-type = "text/markdown"

[[tool.hatch.metadata.hooks.fancy-pypi-readme.fragments]]
path = "README.md"

[[tool.hatch.metadata.hooks.fancy-pypi-readme.substitutions]]
pattern = '\]\((?![a-z]+:|#)([^)\s]+)\)'
replacement = '](https://github.com/libre-devops/python-helpers/blob/main/\1)'

[tool.hatch.build.targets.wheel]
packages = ["src/libre_devops_helpers"]

[tool.ruff]
line-length = 100
target-version = "py311"
src = ["src", "tests"]

[tool.ruff.lint]
select = [
    "E", "W", "F", "I", "B", "UP", "SIM", "RUF", "PT",
    "C90",  # complexity: see max-complexity below
    "S",  # security (bandit's rules)
    # A docstring on every public module, class, method and function: say what it gives.
    "D100", "D101", "D102", "D103", "D104",
]
ignore = [
    # S105 to S107 flag any string given to a name like "token" or "secret". Here those
    # are names of settings and environment variables; gitleaks scans for real secrets.
    "S105",
    "S106",
    "S107",
]

[tool.ruff.lint.mccabe]
# Past ten paths through it, a function no longer fits in a reader's head: split it.
max-complexity = 10

[tool.ruff.lint.per-file-ignores]
# Tests assert, run the tools they test, pick random inputs, and name made-up paths that
# are never written to. A fake API is a routing table, read top to bottom, so the
# complexity limit is for the package, not its fakes.
"tests/**" = ["S101", "S108", "S311", "S603", "C901", "D1"]
# The scripts run the project's own tools (uv, git), with arguments they build themselves.
"scripts/**" = ["S603"]

[tool.mypy]
# Type hints are checked, not only read: strictly, on the package. The tests are checked
# by running them.
files = ["src"]
python_version = "3.11"
strict = true

[tool.pytest.ini_options]
testpaths = ["tests"]
# The tests mirror src/, so several share a file name (test_client.py); importlib mode
# keeps them apart. The shared fakes are imported as the "fakes" package.
addopts = ["-ra", "--import-mode=importlib"]
pythonpath = ["tests"]

[tool.coverage.run]
source = ["libre_devops_helpers"]
branch = true

[tool.coverage.report]
# CI fails below this. Raise it as coverage grows; never lower it to get a change in.
fail_under = 93
show_missing = true
skip_covered = true
exclude_also = [
    "if TYPE_CHECKING:",
    'if __name__ == "__main__":',
    "@overload",
]