pyproject.toml

# SPDX-FileCopyrightText: 2026-present Arthit Suriyawongkul
# SPDX-License-Identifier: Apache-2.0

[build-system]
# pitloom is listed here so that isolated builds (pip install pitloom) embed the
# SBOM via the Hatchling hook.  For CI and local dev, build with --no-isolation
# so the current checkout is used instead of the PyPI-published version.
requires = ["hatchling>=1.29.0", "pitloom"]
build-backend = "hatchling.build"

[project]
name = "pitloom"
dynamic = ["version"]
description = "Generate SPDX 3 SBOMs for Python projects and AI models with native Hatchling build-hook support."
readme = "README.md"
requires-python = ">=3.10"
license = "Apache-2.0"
keywords = [
    "sbom",
    "software-bill-of-materials",
    "spdx",
    "supply-chain-security",
    "hatchling",
    "poetry",
    "bom",
    "aibom",
    "provenance",
    "transparency",
    "metadata",
    "gguf",
    "onnx",
    "safetensors",
    "ai-sbom",
    "software-supply-chain-security",
    "pep-770",
]
authors = [{ name = "Arthit Suriyawongkul", email = "suriyawa@tcd.ie" }]
classifiers = [
    "Development Status :: 4 - Beta",
    "Environment :: Console",
    "Intended Audience :: Developers",
    "Intended Audience :: Legal Industry",
    "Programming Language :: Python",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3 :: Only",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Programming Language :: Python :: Implementation :: CPython",
    "Topic :: Software Development :: Build Tools",
    "Topic :: Software Development :: Libraries :: Python Modules",
    "Topic :: Security",
    "Typing :: Typed",
]
# hatchling/setuptools/poetry-core/flit_core/pdm-backend: Track A backend
# libs, kept mandatory (lightweight; gate file-discovery accuracy, not
# metadata). Revisit if Track A grows. Track B
# (maturin/scikit-build-core/meson-python) should be an optional extra
# when added -- see roadmap.md "Dependency packaging strategy".
dependencies = [
    "auditwheel>=6.8.2; sys_platform == 'linux'",
    "flit_core>=3.9",
    "hatchling>=1.29.0",
    # 0.8.1: licence URLs read as ids, control and format characters at the
    # ends of a value trimmed, database build v4. 0.8.2: a short text with a
    # "+" that is no operator (`MIT++`) is not matched as a licence text.
    # 0.8.3: `licenses.nuget.org` expression URLs are read as expressions.
    # 0.8.4: a slash between two licences (`MIT/Apache-2.0`) is read as OR.
    "licenseid>=0.8.4,<0.9",
    # 25.0 floor: `packaging.markers.Marker` only accepts the PEP 751
    # `extras`/`dependency_groups` pseudo-environment variable names
    # starting at this release (24.x raises InvalidMarker for them) --
    # required by pitloom.extract.lock.pylock's default-groups filtering.
    "packaging>=25.0",
    "pdm-backend>=2.4.1",
    # 4.2.10 has no macOS arm64 wheel for cp311-abi3 (uploaded 2026-10-27);
    # the source build needs meson-python, which it does not declare.
    "pipdeptree>=4.2.3,!=4.2.10",
    "poetry-core>=2.4.1",
    "pyproject-metadata>=0.12.1",
    "pyyaml>=6.0.3,<7",
    "rfc8785>=0.1.4",
    # No ceiling: a Git URL's clone uses private setuptools pieces; one gone
    # fails that discovery, said (pitloom.core._models_wheel_setuptools_clone).
    "setuptools>=84.0.0",
    "spdx-python-model==0.0.6",
    "tomli>=2.4.1; python_version<'3.11'",
]

[project.entry-points."hatch"]
pitloom = "pitloom.plugins.hatch"

[project.optional-dependencies]
ai = [
    # fasttext-community is a drop-in replacement (still `import fasttext`)
    # with prebuilt wheels for Windows/macOS/Linux across Python 3.9-3.14,
    # unlike fasttext==0.9.3 which has no Windows wheel and fails building
    # from source on CI.
    "fasttext-community>=0.11.8",
    "fickling>=0.1.12",
    "gguf>=0.19.0",
    "h5py>=3.16.0",
    "huggingface_hub>=1.29.0",
    "numpy>=2.2.6,<2.3; python_version<'3.11'", # based on wheel availability
    "numpy>=2.3.5,<3; python_version>='3.11'",  # based on wheel availability
    "onnx>=1.22.0",
    "safetensors[numpy]>=0.8.0",
]
# PyPA build: powers --allow-build's build-and-read file discovery
# (pitloom.core._models_wheel_build_and_read). Optional -- the mechanism
# executes third-party build-time code, and is a categorically heavier,
# opt-in mechanism, unlike the mandatory Track A backend libs above. See
# working-docs/implementation/non-hatchling-file-discovery.md's "Dependency
# packaging strategy". pyproject_hooks comes in transitively via build.
build = ["build>=1.2.2"]
content-type = ["magika>=1.0.3"]

fasttext = [
    # Same rationale as the "ai" extra's fasttext line above -- keep both
    # in sync.
    "fasttext-community>=0.11.8",
]
gguf = ["gguf>=0.19.0"]
hdf5 = ["h5py>=3.16.0"]
huggingface_hub = ["huggingface_hub>=1.29.0"]
numpy = [
    "numpy>=2.2.6,<2.3; python_version<'3.11'",
    "numpy>=2.3.5,<3; python_version>='3.11'",
]
onnx = ["onnx>=1.22.0"]
pytorch = ["fickling>=0.1.12"]
safetensors = ["safetensors[numpy]>=0.8.0"]
validate = ["spdx3-validate>=0.0.7"]

[project.scripts]
loom = "pitloom.__main__:console_main"    # default command-line entry point
pitloom = "pitloom.__main__:console_main"

[project.urls]
homepage = "https://bact.github.io/pitloom/"
source = "https://github.com/bact/pitloom.git"
download = "https://github.com/bact/pitloom/releases"
changelog = "https://github.com/bact/pitloom/blob/main/CHANGELOG.md"
releasenotes = "https://github.com/bact/pitloom/releases"
documentation = "https://github.com/bact/pitloom#readme"
issues = "https://github.com/bact/pitloom/issues"

[dependency-groups]
lint = [
    "bandit>=1.9.4",
    "flake8>=7.3.0",
    "flake8-cognitive-complexity>=0.1.0",
    "pip-audit>=2.10.1",
    "pylint>=4.0.8",
    "ruff>=0.16.7",
]
# Git pins: neither build is on PyPI. spdx3-validate needs the `model_dir`
# (offline) build, which still reports 0.0.7; tests/test_conformance_pins.py
# checks the installed commits equal these.
conformance = [
    "ntia-conformance-checker @ git+https://github.com/bact/ntia-conformance-checker.git@2355afcd7ec9af732f80680928849db6008e6e9a",
    "spdx3-validate @ git+https://github.com/bact/spdx3-validate.git@0e2e3562c4843a46d96eb49ed15de8e672d6ebe7",
]
test = [
    { include-group = "conformance" },
    "build>=1.2.2",                # for the uv_build build-and-read integration test
    "check-wheel-contents>=0.6.3",
    "installer>=1.0.1",
    "pytest>=9.1.1",
    "pytest-cov>=7.1.0",
    "pytest-xdist>=3.8.0",
    "stav>=0.4.1",
]
typecheck = [
    "mypy>=2.3.1",
    "pyrefly>=1.3.0",
    "pyright>=1.1.414",
    "types-PyYAML>=6.0.12.20260906",
    "types-setuptools>=84.0.0.20260812",
]
docs = [
    "mkdocs>=1.6.1",
    "mkdocs-material>=9.7.7",
    "mkdocstrings[python]>=1.0.6",
    "ruff>=0.16.7",
]
dev = [
    { include-group = "lint" },
    { include-group = "test" },
    { include-group = "typecheck" },
    { include-group = "docs" },
]
# Not part of "dev": atheris needs a real (non-Apple) Clang with libFuzzer
# to build, so it doesn't install on macOS or Windows -- see fuzz/README.md.
fuzz = ["atheris>=3.1.0", "gguf>=0.19.0"]

[tool.black]
line-length = 88
target-version = ["py310"]

[tool.hatch.build.hooks.pitloom]
# Need this section to trigger the Pitloom build hook,
# even though it has no config options.

[tool.hatch.build.targets.sdist]
# /docs (curated, public) is not excluded, so it ships in the sdist as-is;
# /working-docs (internal design + implementation notes) does not.
exclude = [
    "/.claude-plugin",
    "/.github",
    "/working-docs",
    ".editorconfig",
    ".gitignore",
    ".markdownlint.json",
    ".markdownlintignore",
    "AGENTS.md",
    "CLAUDE.md",
    "GEMINI.md",
    "tests/fixtures/spdx-model",
    "tests/fixtures/aimodels/crfsuite/*.crfsuite",
    "tests/fixtures/aimodels/crfsuite/*.model",
    "tests/fixtures/aimodels/fasttext/*.bin",
    "tests/fixtures/aimodels/fasttext/*.ftz",
    "tests/fixtures/aimodels/gguf/*.gguf",
    "tests/fixtures/aimodels/hdf5/*.h5",
    "tests/fixtures/aimodels/hdf5/*.hdf5",
    "tests/fixtures/aimodels/hostile/*.h5",
    "tests/fixtures/aimodels/keras/*.keras",
    "tests/fixtures/aimodels/numpy/*.npy",
    "tests/fixtures/aimodels/numpy/*.npz",
    "tests/fixtures/aimodels/onnx/*.onnx",
    "tests/fixtures/aimodels/pytorch/*.pt",
    "tests/fixtures/aimodels/pytorch/*.pth",
    "tests/fixtures/aimodels/pytorch_pt2/*.pt2",
    "tests/fixtures/aimodels/safetensors/*.safetensors",
    "tests/fixtures/croissant/*.json",
    "tests/fixtures/fragments/*.json",
    "tests/fixtures/huggingface-hub/*.txt",
    "tests/fixtures/lfs-pointers/",
    "tests/fixtures/real-world-projects/",
    "tests/fixtures/real-world-locks/",
    "tests/fixtures/real-world-extras/",
]

[tool.hatch.build.targets.wheel]
packages = ["src/pitloom"]
# The agent instruction files stay out of the wheel too, whatever the layout.
exclude = ["tests/fixtures/", "AGENTS.md", "CLAUDE.md", "GEMINI.md"]

[tool.hatch.version]
path = "src/pitloom/__about__.py"

[tool.mypy]
exclude = ["tests/fixtures/"]
pretty = true
python_version = "3.10"
mypy_path = ["src"]
show_column_numbers = true
show_error_code_links = true
show_error_context = true
strict = true
strict_equality_for_none = true
warn_unreachable = true

[[tool.mypy.overrides]]
ignore_missing_imports = true
module = "atheris"

[[tool.mypy.overrides]]
ignore_missing_imports = true
module = ["fasttext", "fasttext.*"]

[[tool.mypy.overrides]]
ignore_missing_imports = true
module = "fickling.*"

[[tool.mypy.overrides]]
ignore_missing_imports = true
module = ["flit_core", "flit_core.*"]

[[tool.mypy.overrides]]
ignore_missing_imports = true
module = "h5py.*"

[[tool.mypy.overrides]]
ignore_missing_imports = true
module = "magika.*"

# safetensors safe_open and sys.modules typing changed across library versions.
# These modules carry type: ignore comments that may be needed on older versions
# but become unused on newer ones; suppress the churn.
[[tool.mypy.overrides]]
warn_unused_ignores = false
module = "pitloom.extract.ai_model.safetensors"

[tool.pitloom]
pretty = true

[tool.pitloom.content-type]
enabled = true

[[tool.pitloom.creator]]
name = "Arthit Suriyawongkul"
email = "suriyawa@tcd.ie"
type = "person"

[tool.pylint.main]
ignore-paths = ["^tests/fixtures/.*$"]
init-hook = "import sys; sys.path.insert(0, 'src'); sys.path.insert(0, 'examples/sentimentdemo-aibom/src')"
# "." names test modules in tests/ subfolders (no __init__.py) by dotted path,
# so their relative imports resolve -- for directory arguments only; a single
# file argument still gets a bare name (false E0402). Pylint does not descend
# from the tests/ package into those subfolders: pass them too
# (`pylint ... tests/ tests/*/`).
source-roots = ["src", "examples/sentimentdemo-aibom/src", "."]

[tool.pylint.design]
max-args = 6                 # Target: 5
max-attributes = 12          # Target: 10
max-branches = 12            # Target: 12
max-locals = 17              # Target: 15
max-nested-blocks = 5        # Target: 4
max-positional-arguments = 6 # Track max-args
max-public-methods = 20      # Target: 20
max-returns = 6              # Target: 6
max-statements = 50          # Target: 50

[tool.pylint.format]
max-line-length = 88

[tool.pytest.ini_options]
addopts = [
    "--import-mode=importlib",
    "-n",
    "auto",
    "--dist=worksteal",
    "--strict-markers",
    "--strict-config",
]
pythonpath = ["src"]
testpaths = ["tests"]
markers = [
    "network: reaches a real remote host, directly or via a subprocess/library; skips on a network failure (opts out of conftest's default socket block); not run in the default CI job",
    "platform: the test file depends on the operating system (tests/_platform.py); CI runs only these on Windows and macOS in a pull request",
    "loopback: talks only to a server the test starts on this machine; runs everywhere (an in-process connection to any other host is refused)",
]
# OpenSSF Best Practices "warnings_strict": promote every runtime warning
# (DeprecationWarning, ResourceWarning, pytest's own internal warnings,
# etc.) to a hard test failure instead of a silently-printed summary line.
# A specific, scoped "ignore" entry (not a blanket one) is the fix for a
# genuine can't-avoid-it warning.
filterwarnings = [
    "error",
    # rdflib's own JSON-LD parser (invoked by spdx3-validate, exercised by
    # `loom fragment validate`'s tests) instantiates the deprecated
    # ConjunctiveGraph internally; nothing Pitloom-side to fix.
    "ignore:ConjunctiveGraph is deprecated:DeprecationWarning:rdflib.plugins.parsers.jsonld",
]

[tool.pylint.messages_control]
disable = [
    "duplicate-code",             # boilerplate in tests is expected
    "fixme",                      # TODO comments are tracked intentionally
    "missing-function-docstring", # not required in test files
    "too-many-lines",             # test modules grow long, one function per case
]

[tool.pylint.typecheck]
# Optional extra dependencies; not always installed when pylint runs
ignored-modules = ["gguf", "magika"]

[tool.pyrefly]
project-excludes = ["**/tests/fixtures/"]
# "src" before ".": a module under src/ must resolve as pitloom.x, never also
# as src.pitloom.x (two identities for one class -> false bad-argument-type).
# scripts/manual_cli_checks holds bare sibling imports (`import _harness`).
search-path = [
    "src",
    ".",
    "examples/sentimentdemo-aibom/src",
    "scripts/manual_cli_checks",
]
python-version = "3.10.0"

# spdx-python-model uses SHACL-based dynamic class generation: its enum-like
# values (RelationshipType.trainedOn, PresenceType.yes, etc.) are xsd:string
# at runtime. Pyrefly finds the installed package, infers str for those values,
# then rejects assignments to the declared spdx3.* type annotations. Forcing
# the whole package to Any avoids all of these false positives.
replace-imports-with-any = ["spdx_python_model.*"]
ignore-missing-imports = [
    "fasttext",
    "fasttext.*",
    "stav.*",
    "fickling.*",
    "h5py.*",
    "hatchling.*",
    "safetensors",
    "safetensors.*",
    "gguf",
    "gguf.*",
    "huggingface_hub",
    "huggingface_hub.*",
    "numpy",
    "numpy.*",
    "onnx",
    "onnx.*",
    "magika",
    "magika.*",
]

[tool.pyright]
# spdx-python-model uses SHACL-based dynamic class generation whose
# attributes (enum values, spdxId type) are invisible to static analysis.
# mypy (strict) is the primary type checker; pyright serves as a second opinion.
reportAttributeAccessIssue = "none"
reportArgumentType = "none"
reportAssignmentType = "none"
reportOperatorIssue = "none"

[tool.ruff]
exclude = ["tests/fixtures"]
line-length = 88
target-version = "py310"

[tool.ruff.lint]
select = [
    "E",   # pycodestyle errors
    "W",   # pycodestyle warnings
    "F",   # pyflakes
    "I",   # isort
    "B",   # flake8-bugbear
    "C4",  # flake8-comprehensions
    "UP",  # pyupgrade
    "C90", # mccabe complexity -- see [tool.ruff.lint.mccabe] below
]

[tool.ruff.lint.isort]
known-first-party = ["pitloom"]

[tool.ruff.lint.flake8-bugbear]
# Frozen dataclass: safe as a shared default argument (B008).
extend-immutable-calls = [
    "pitloom.core.build_options.BuildOptions",
    "pitloom.core.fetch_policy.RemoteFetchPolicy",
]

[tool.ruff.lint.mccabe]
# Ratchet ceiling lowered to 14. AGENTS.md target is 10.
max-complexity = 14

[tool.coverage.run]
branch = true
source = ["pitloom"]

[tool.coverage.report]
show_missing = true
skip_covered = false
fail_under = 97      # Hard floor minimum threshold; we try to keep it higher