v0.4.0: Trend analysis, team metrics, CI/CD integrations (SARIF, Checkstyle, JUnit)

Author: rudra496

CODE_OF_CONDUCT.md

@@ -0,0 +1,132 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+[INSERT CONTACT METHOD].
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available
+at [https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

README.md

@@ -60,6 +60,11 @@ Zero external dependencies — pure Python stdlib.
 | `codevista git-stats ./project/` | Git repository statistics |
 | `codevista languages ./project/` | Language distribution breakdown |
 | `codevista complexity ./project/` | Complexity analysis and top functions |
+| `codevista snapshot ./project/` | Save analysis snapshot for trend tracking |
+| `codevista trends ./project/` | Show project health trends over time |
+| `codevista diff-snapshots ./project/ 1 2` | Compare two snapshots |
+| `codevista team ./project/` | Team productivity & collaboration analysis |
+| `codevista ci-output ./project/ -f sarif` | CI/CD output (SARIF, Checkstyle, etc.) |
 
 ## 📊 What It Analyzes
 
@@ -169,6 +174,81 @@ Track file age, change frequency, and identify files most likely to have bugs:
 codevista code-age ./my-project/
 ```
 
+## 📈 Trend Analysis
+
+Track code quality over time with snapshots and trend visualization.
+
+### How It Works
+
+1. **Save snapshots** after each analysis run
+2. **Compare snapshots** to see how your codebase evolves
+3. **Get alerted** when metrics cross critical thresholds
+4. **Track technical debt** ratio over time
+
+```bash
+# Save a snapshot of the current state
+codevista snapshot ./my-project/
+
+# Save with a label
+codevista snapshot ./my-project/ --label "before-refactor"
+
+# View trends
+codevista trends ./my-project/
+
+# Compare two specific snapshots
+codevista diff-snapshots ./my-project/ 1 2
+```
+
+### ASCII Timeline Example
+
+```
+  📈 Health Score Timeline
+  100 ┤████████████████████
+      │████████████████████
+      │████████████████████
+      │████████████████████
+      │████████████████████
+      │████████████████████
+      │████████████████████
+      │████████████████████
+      │████████████████████
+      │████████████████████
+      │████████████████████
+      │████████████████████
+    0 ┤─────────────────────
+  Current: 78/100 ↑
+```
+
+### Features
+
+- **Trend arrows**: ↑ improving, ↓ degrading, → stable
+- **Threshold alerts**: Get warned when health drops or security issues spike
+- **Technical debt tracking**: Monitor debt ratio over time
+- **Review cadence**: Suggests optimal review frequency based on change rate
+- **Code age distribution**: Track how your codebase ages
+
+## 👥 Team Metrics
+
+Analyze developer productivity and collaboration patterns.
+
+```bash
+codevista team ./my-project/
+```
+
+### What It Analyzes
+
+| Metric | Description |
+|--------|-------------|
+| **Lines per Author** | Added/removed/net per developer |
+| **Commit Frequency** | Commits per day, burst vs steady patterns |
+| **Files Touched** | Unique files per author |
+| **Bus Factor** | People needed to understand 50% of code |
+| **Code Ownership** | Pie chart data showing contribution share |
+| **Review Coverage** | Estimate from commit messages |
+| **Pair Programming** | Co-authored commit detection |
+| **Time Zone Distribution** | When the team commits |
+| **Onboarding Complexity** | How hard for a new contributor to ramp up |
+
 ## 📤 Export Formats
 
 Export analysis results in multiple formats for different use cases:
@@ -192,6 +272,55 @@ codevista export ./project/ -f sarif -o results.sarif.json
 codevista export ./project/ -o ./reports/codevista --all
 ```
 
+## 🔌 CI/CD Integration
+
+CodeVista provides dedicated CI output formats with threshold-based pass/fail.
+
+### Supported Formats
+
+| Format | Platform | Command |
+|--------|----------|---------|
+| **SARIF** | GitHub Code Scanning | `codevista ci-output . -f sarif` |
+| **GitLab Code Quality** | GitLab | `codevista ci-output . -f gitlab` |
+| **Checkstyle XML** | Jenkins, GitHub Actions | `codevista ci-output . -f checkstyle` |
+| **JUnit XML** | Any CI with JUnit support | `codevista ci-output . -f junit` |
+| **Markdown** | PR comments | `codevista ci-output . -f markdown` |
+| **Terminal** | Quick terminal output | `codevista ci-output . -f terminal` |
+
+### Exit Codes
+
+| Code | Meaning | Description |
+|------|---------|-------------|
+| `0` | Clean | All thresholds passed |
+| `1` | Warnings | Medium-severity threshold violations |
+| `2` | Errors | High-severity violations (health, complexity) |
+| `3` | Critical | Critical security issues or severe degradation |
+
+### Threshold Configuration
+
+Create `.codevista.json` in your project root:
+
+```json
+{
+  "max_security_critical": 0,
+  "max_security_high": 0,
+  "max_security_medium": 5,
+  "max_security_total": 10,
+  "max_avg_complexity": 10,
+  "max_technical_debt_ratio": 0.25,
+  "min_health_score": 60,
+  "max_duplicates": 10,
+  "max_circular_deps": 0,
+  "max_todo_count": 50
+}
+```
+
+```bash
+# Run with exit codes (CI will fail if thresholds violated)
+codevista ci-output ./project/ -f sarif -o results.sarif.json
+echo "Exit code: $?"  # 0=clean, 1=warnings, 2=errors, 3=critical
+```
+
 ## 🐳 Docker
 
 ```bash
@@ -263,6 +392,9 @@ codevista/
 ├── security.py       # Secret/vulnerability scanning
 ├── dependencies.py   # Dependency parsing & analysis
 ├── git_analysis.py   # Git stats extraction
+├── trends.py         # Trend analysis & snapshot tracking
+├── team.py           # Team metrics & collaboration analysis
+├── integrations.py   # CI/CD output (SARIF, Checkstyle, JUnit, GitLab)
 ├── languages.py      # Language definitions & colors
 ├── config.py         # Configuration & ignore patterns
 ├── utils.py          # Utilities & color schemes

SECURITY.md

@@ -0,0 +1,70 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.0.x   | :white_check_mark: |
+| < 1.0   | :x:                |
+
+## Reporting a Vulnerability
+
+We take the security of CodeVista seriously. If you believe you have found a
+security vulnerability, please report it responsibly.
+
+### How to Report
+
+1. **Do not** open a public issue for the vulnerability.
+2. Send an email to [INSERT SECURITY EMAIL] with the subject line
+   `[Security] CodeVista Vulnerability Report`.
+3. Include as much information as possible:
+   - Description of the vulnerability
+   - Steps to reproduce
+   - Potential impact
+   - Any suggested fixes (optional)
+
+### What to Expect
+
+- We will acknowledge receipt of your report within **48 hours**.
+- We will provide an initial assessment within **7 business days**.
+- We will keep you updated on the progress of the fix.
+- If the vulnerability is accepted, we will release a fix as soon as possible.
+
+### Disclosure Policy
+
+- We follow **Coordinated Disclosure** — we will work with you to determine a
+  timeline for public disclosure.
+- Credit will be given to the reporter (unless anonymity is requested).
+- We will not disclose the vulnerability publicly until a fix is released.
+
+## Security Best Practices
+
+When using CodeVista, follow these best practices:
+
+### Input Files
+- Only analyze codebases you trust or have permission to analyze.
+- CodeVista reads source files — be aware of what you're pointing it at.
+
+### Output Files
+- HTML reports contain code excerpts — do not share reports publicly if the
+  codebase contains sensitive information.
+- JSON exports may contain security findings — handle with care.
+
+### Snapshots
+- Snapshots are stored in `~/.codevista/snapshots/` — they contain analysis
+  metadata but not source code content.
+- Review snapshot content before sharing.
+
+### CI/CD Integration
+- SARIF output may contain file paths and line numbers from your codebase.
+- Ensure CI/CD logs are properly secured if your codebase is private.
+
+## Security Features
+
+CodeVista itself includes security scanning capabilities:
+
+- **Secret Detection**: Identifies hardcoded API keys, passwords, tokens
+- **Dangerous Function Detection**: Flags `eval()`, `exec()`, `pickle`, etc.
+- **Private Key Detection**: Finds private keys committed to source
+
+These features help you secure **your** codebase, not CodeVista itself.