add compliance agents and YAML support for plot_info files

Author: nikolarobottesla

.github/agents/3m-gai-compliance-labeling.agent.md

@@ -0,0 +1,12 @@
+---
+name: 3m-gai-compliance-labeling
+description: This agent labels generated code to comply with 3M's generative AI conditions of use.
+argument-hint: You can start this agent by prompting 'label'.
+# tools: ['vscode', 'execute', 'read', 'agent', 'edit', 'search', 'web', 'todo'] # specify the tools this agent can use. If not set, all enabled tools are allowed.
+---
+
+<!-- Tip: Use /create-agent in chat to generate content with agent assistance -->
+You are a CODE LABELING AGENT responsible for labeling generated code to ensure compliance with 3M's generative AI conditions of use.
+The generated-log.md file contains a record of all generated content added to the repository, including the file name, string of first and last lines, line numbers where the content was inserted, date, and AI model used. This allows for tracking of generated content and attribution.
+As you label generated content in the source code, mark the record in generated-log.md with the phrase 'labeled in source'.
+Generated Work must be clearly labeled (either for the entire library or sections of the software code) within the comments to distinguish Generated Work from human-authored sections. For example: 1) Code completely authored by Generative AI - “Section created by [ChatGPT, Github Co-Pilot, etc.], [date]” if fully authored by Generative AI, or 2) Code partially authored by Generative AI - “Draft code in section was created by [ChatGPT, Github Co-Pilot, etc.] and reviewed, edited, and revised by [3M human developer], [details on what was added to Generated Work], [date]”.

.github/agents/3m-gai-compliance-source-scan.agent.md

@@ -0,0 +1,11 @@
+---
+name: 3m-gai-compliance-source-scan
+description: This agent performs a source code scan to comply with 3M's generative AI conditions of use.
+argument-hint: You can start this agent by prompting 'scan' or you can ask for a specific scanning tool if you have a preference. You can also specify the type of output you want, such as a detailed report or a summary of findings.
+# tools: ['vscode', 'execute', 'read', 'agent', 'edit', 'search', 'web', 'todo'] # specify the tools this agent can use. If not set, all enabled tools are allowed.
+---
+
+<!-- Tip: Use /create-agent in chat to generate content with agent assistance -->
+You are a COMPLIANCE SOURCE SCAN AGENT responsible for performing a comprehensive source code scan to ensure compliance with 3M's generative AI conditions of use.
+You must install or check if installed the necessary tools to perform a source code scan (from vendors such as Blackduck, Whitesource, or Sonatype). This scan will identify any code security vulnerabilities, as well as ownership and attribution issues related to the Generated Work. The scan will also include a review of the security and license status of all referenced open-source libraries within the project.
+By default you will save your finding to a markdown file in the root of the repository named `compliance-scan-report.md` and also share the findings directly in the chat. The report should include a summary of findings, detailed information on any identified issues, and recommendations for remediation.

.github/copilot-instructions.md

@@ -0,0 +1,11 @@
+## Compliance Enforcement
+
+- For every copilot task in this repository, run the compliance workflow before finishing.
+- Treat compliance review as always-on, even when the user does not explicitly ask for it.
+- Whenever adding generated content to the repository add the first and last lines of the content to the generated-log.md file in the root directory. Label each entry with the file name, line numbers where the content was inserted, date, and AI model. This will allow for tracking of generated content and attribution.
+- generated-log.md contains a table. The column order is | Labeled in Source | Date | Model | File | Lines | First Line | Last Line |. The labeled in source column starts with 'no' and should be updated to 'yes' when the generated content is labeled in the source code with comments.
+
+## When To Use Custom Agents
+
+- Use the `3m-gai-compliance-source-scan` agent for full repository compliance scans, dependency/license review, or when the user asks about compliance. Only do this automatically before commits.
+- Use the `3m-gai-compliance-labeling` agent only if requested. Do not use it automatically, as it adds extra comments to the code which some users may find undesirable especiially during development.

CHANGELOG.md

@@ -5,6 +5,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## [1.5.0] - 2026-04-11
+
+### Added
+- ability to use yaml for plot_info files as well as json
+
 ## [1.4.0] - 2025-12-29
 
 ### Added

README.md

@@ -2,13 +2,13 @@
 scatter plot all the things in all the folders automatically but only if there have been changes
 
 ## Description
-Plotme takes tabular data (e.g. excel) and outputs interactive scatter plots. It is a command line tool written in python. It uses json files to configure the plots. It is for technical and non-techncial folks.
+Plotme takes tabular data (e.g. excel) and outputs interactive scatter plots. It is a command line tool written in python. It uses json or yaml files to configure the plots. It is for technical and non-techncial folks.
 
 ## Features
 * specify data_root using argument or current directory
 * save the plot's configuration/definition with the data (plot_info.json)
 * finds plot_info files at any depth in the folder tree
-* validation plot_info.json using jsonschema
+* validation plot_info.json/yml/yaml using jsonschema
 * pass-through to plotly
   * scatter plot
     * `trace_mode` (markers or lines) 
@@ -92,10 +92,9 @@ in this example
 0. sign exe and add to releases
 1. create better tests
 2. Hierarchical plot_info based on folder structure
-3. yml support
-4. pkl data file support
-5. 3D plots
-6. plot_info linter
+3. pkl data file support
+4. 3D plots
+5. plot_info linter
 
 ### Develop
 1. clone 

compliance-scan-report.md

@@ -0,0 +1,174 @@
+# Compliance Source Code Scan Report
+
+**Project:** plotme  
+**Version:** 1.4.0  
+**Repository:** 3M-Cloud/vibedemo26-milo  
+**Scan Date:** 2026-03-26  
+**Scan Tools:** pip-audit 2.10.0, bandit 1.x, pip-licenses 5.5.1  
+
+---
+
+## Executive Summary
+
+| Category | Status | Finding Count |
+|----------|--------|---------------|
+| Source Code Security (Bandit) | ✅ PASS | 0 issues |
+| Dependency Vulnerabilities (pip-audit) | ⚠️ ACTION REQUIRED | 2 CVEs found |
+| License Compliance | ⚠️ REVIEW REQUIRED | 1 proprietary + 2 MPL-2.0 packages |
+| Open-Source Attribution | ✅ PASS | All deps identified |
+
+---
+
+## 1. Source Code Security Analysis
+
+**Tool:** Bandit (static analysis)  
+**Scope:** `plotme/` package (633 lines of code across 7 files)  
+**Result:** **PASS – No security issues found**
+
+| File | Lines of Code | Issues |
+|------|--------------|--------|
+| `plotme/__init__.py` | 3 | 0 |
+| `plotme/__main__.py` | 48 | 0 |
+| `plotme/helper.py` | 64 | 0 |
+| `plotme/load_data.py` | 223 | 0 |
+| `plotme/plotting.py` | 183 | 0 |
+| `plotme/read.py` | 9 | 0 |
+| `plotme/schema.py` | 103 | 0 |
+
+No HIGH, MEDIUM, or LOW severity vulnerabilities detected (OWASP Top 10 categories checked: injection, insecure deserialization, use of known-vulnerable components, sensitive data exposure, etc.).
+
+---
+
+## 2. Dependency Vulnerability Scan
+
+**Tool:** pip-audit 2.10.0 (backed by PyPI Advisory Database)  
+**Result:** ⚠️ **2 known CVEs found — action required**
+
+### CVE Findings
+
+| Package | Version | CVE ID | GHSA | Fix Version | Severity | Description |
+|---------|---------|--------|------|-------------|----------|-------------|
+| **pip** | 25.3 | CVE-2026-1703 | GHSA-6vgw-5pg2-w6jp | 26.0 | MEDIUM | Path traversal during wheel archive extraction. Files may be extracted outside the installation directory. Only exploitable with a maliciously crafted wheel. |
+| **pygments** | 2.19.2 | CVE-2026-4539 | GHSA-5239-wwwm-4pmq | None available | LOW | Inefficient regex in `AdlLexer` (`pygments/lexers/archetype.py`) can cause ReDoS under local access conditions. |
+
+> **Note:** `pygments` is an indirect/dev dependency (used by `rich` and other tooling). It is **not** a direct dependency of `plotme`.
+
+> **Note:** `pip` itself is the package manager, not a runtime dependency of `plotme`.
+
+### Recommendations
+
+1. **pip (CVE-2026-1703):** Upgrade `pip` to version `26.0` or later.
+   ```
+   pip install --upgrade pip
+   ```
+2. **pygments (CVE-2026-4539):** No fix version is currently available. Monitor the [pygments issue tracker](https://github.com/pygments/pygments) for a patch. Consider pinning to this version and adding a waiver with justification (local-only exploit, low severity).
+
+### Skip Notice
+
+`plotme` (1.4.0) itself was not found on PyPI and could not be audited against the PyPI advisory database. This is expected for an internal/proprietary package.
+
+---
+
+## 3. Open-Source Dependency Licenses
+
+**Tool:** pip-licenses 5.5.1  
+**Result:** ⚠️ **Review required for MPL-2.0 and proprietary license entries**
+
+### License Summary
+
+| License | Count | Notes |
+|---------|-------|-------|
+| MIT / MIT License | 30 | ✅ Permissive – generally acceptable |
+| Apache-2.0 / Apache Software License | 11 | ✅ Permissive – generally acceptable |
+| BSD License / BSD-2-Clause / BSD-3-Clause | 9 | ✅ Permissive – generally acceptable |
+| Mozilla Public License 2.0 (MPL 2.0) | 2 | ⚠️ Weak copyleft – file-level copyleft applies |
+| Python Software Foundation License | 1 | ✅ Permissive |
+| LicenseRef-Proprietary | 1 | ⚠️ plotme itself – internal project |
+
+### MPL-2.0 Packages (Weak Copyleft)
+
+| Package | Version | URL |
+|---------|---------|-----|
+| certifi | 2026.2.25 | https://github.com/certifi/python-certifi |
+| pathspec | 1.0.4 | N/A |
+
+MPL-2.0 is file-level copyleft: modifications to MPL-licensed files must be released under MPL-2.0. Since `certifi` and `pathspec` are used as-is (unmodified), this does not impose redistribution obligations on `plotme`. **No immediate action required**, but document usage in your third-party notices file.
+
+### Full Dependency License Table
+
+| Name | Version | License | Author |
+|------|---------|---------|--------|
+| CacheControl | 0.14.4 | Apache-2.0 | Eric Larson et al. |
+| GitPython | 3.1.41 | BSD License | Sebastian Thiel, Michael Trier |
+| PyYAML | 6.0.3 | MIT License | Kirill Simonov |
+| Pygments | 2.19.2 | BSD License | Georg Brandl |
+| attrs | 26.1.0 | MIT | Hynek Schlawack |
+| boolean.py | 5.0 | BSD-2-Clause | Sebastian Kraemer |
+| certifi | 2026.2.25 | MPL-2.0 | Kenneth Reitz |
+| charset-normalizer | 3.4.6 | MIT | Ahmed R. TAHRI |
+| cyclonedx-python-lib | 11.7.0 | Apache-2.0 | Paul Horton |
+| defusedxml | 0.7.1 | PSF License | Christian Heimes |
+| dirhash | 0.5.0 | MIT | Anders Huss |
+| et_xmlfile | 2.0.0 | MIT License | See AUTHORS.txt |
+| filelock | 3.25.2 | MIT | (see project) |
+| gitdb | 4.0.12 | BSD License | Sebastian Thiel |
+| idna | 3.11 | BSD-3-Clause | Kim Davies |
+| iniconfig | 2.3.0 | MIT | Ronny Pfannschmidt et al. |
+| jsonschema | 4.26.0 | MIT | Julian Berman |
+| jsonschema-specifications | 2025.9.1 | MIT | Julian Berman |
+| license-expression | 30.4.4 | Apache-2.0 | nexB. Inc. and others |
+| markdown-it-py | 4.0.0 | MIT License | Chris Sewell |
+| mdurl | 0.1.2 | MIT License | Taneli Hukkinen |
+| msgpack | 1.1.2 | Apache-2.0 | Inada Naoki |
+| narwhals | 2.18.1 | MIT License | Marco Gorelli |
+| numpy | 2.4.3 | BSD-3-Clause + 0BSD + MIT + Zlib + CC0-1.0 | Travis E. Oliphant et al. |
+| openpyxl | 3.1.5 | MIT License | See AUTHORS |
+| packageurl-python | 0.17.6 | MIT License | the purl authors |
+| packaging | 26.0 | Apache-2.0 OR BSD-2-Clause | Donald Stufft |
+| pandas | 3.0.1 | BSD License | The Pandas Development Team |
+| pathspec | 1.0.4 | MPL-2.0 | Caleb P. Burns |
+| pip-api | 0.0.34 | Apache Software License | Dustin Ingram |
+| pip-requirements-parser | 32.0.1 | MIT | nexB. Inc. and others |
+| pip_audit | 2.10.0 | Apache Software License | Alex Cameron |
+| platformdirs | 4.9.4 | MIT | (see project) |
+| plotly | 6.6.0 | MIT License | Chris P |
+| plotme | 1.4.0 | Proprietary | Milo Oien-Rochat, Daniel Garcia |
+| pluggy | 1.6.0 | MIT License | Holger Krekel |
+| py-serializable | 2.1.0 | Apache Software License | Paul Horton |
+| pyparsing | 3.3.2 | MIT | Paul McGuire |
+| pytest | 9.0.2 | MIT | Holger Krekel et al. |
+| python-dateutil | 2.9.0.post0 | Apache + BSD | Gustavo Niemeyer |
+| referencing | 0.37.0 | MIT | Julian Berman |
+| requests | 2.33.0 | Apache Software License | Kenneth Reitz |
+| rich | 14.3.3 | MIT License | Will McGugan |
+| rpds-py | 0.30.0 | MIT | Julian Berman |
+| scandir | 1.10.0 | BSD License | Ben Hoyt |
+| scantree | 0.0.4 | MIT | Anders Huss |
+| six | 1.17.0 | MIT License | Benjamin Peterson |
+| smmap | 5.0.3 | BSD License | Sebastian Thiel |
+| sortedcontainers | 2.4.0 | Apache Software License | Grant Jenks |
+| tomli | 2.4.1 | MIT | Taneli Hukkinen |
+| tomli_w | 1.2.0 | MIT License | Taneli Hukkinen |
+| urllib3 | 2.6.3 | MIT | Andrey Petrov |
+
+---
+
+## 4. Project License & Attribution
+
+- **Project License:** MIT License (Copyright © 2022 3M Company) — see `LICENSE`  
+- **pyproject.toml declares:** `LicenseRef-Proprietary` (mismatch with the `LICENSE` file which contains MIT text)  
+  ⚠️ **Recommendation:** Align the `license` field in `pyproject.toml` with the actual `LICENSE` file. Change `license = "LicenseRef-Proprietary"` to `license = {file = "LICENSE"}` or `license = "MIT"`.
+
+---
+
+## 5. Remediation Summary
+
+| Priority | Action | Package | Details |Resolution|
+|----------|--------|---------|---------|------|
+| HIGH | Upgrade pip | pip 25.3 | Upgrade to ≥ 26.0 to fix CVE-2026-1703 path traversal | version not managed by plotme|
+| MEDIUM | Monitor / accept risk | pygments 2.19.2 | CVE-2026-4539 – no fix yet; low severity, local access only |version not managed by plotme|
+| LOW | Fix pyproject.toml | plotme | Align `license` field with actual MIT `LICENSE` file |fixed|
+| LOW | Document MPL-2.0 usage | certifi, pathspec | Add to third-party notices; no modification made, no redistribution obligation | none needed|
+
+---
+*Report generated by GitHub Copilot Compliance Scan Agent on 2026-03-26.*

generated-log.md

@@ -0,0 +1,10 @@
+# Generated Content Log
+
+| Labeled in Source | Date | Model | File | Lines | First Line | Last Line |
+|-------------------|------|-------|------|-------|------------|-----------|
+| no | 2026-03-26 | Claude Sonnet 4.6 | plotme/plotting.py | 7 | `import yaml` | `import yaml` |
+| no | 2026-03-26 | Claude Sonnet 4.6 | plotme/plotting.py | 35-44 | `    plot_info_files = (` | `    )` |
+| no | 2026-03-26 | Claude Sonnet 4.6 | plotme/plotting.py | 67-72 | `            with open(file) as plot_info_file_handle:` | `                    plot_info = json.load(plot_info_file_handle)` |
+| no | 2026-03-26 | Claude Sonnet 4.6 | tests/test_plotme.py | 7 | `import yaml` | `import yaml` |
+| no | 2026-03-26 | Claude Sonnet 4.6 | tests/test_plotme.py | 69-88 | `def test_yaml_plot_info():` | `    os.remove(data_file_name)` |
+| no | 2026-03-26 | Claude Sonnet 4.6 | pyproject.toml | 25 | `  'pyyaml',` | `  'pyyaml',` |

plotme/__init__.py

@@ -1,5 +1,5 @@
 import os
 
-__version__ = '1.4.0'
+__version__ = '1.5.0'
 
 os.environ['PLOTME_VERSION'] = __version__

plotme/plotting.py

@@ -4,6 +4,8 @@
 import os
 from pathlib import Path
 
+import yaml
+
 import plotly.graph_objects as go
 import plotly.io as pio
 from dirhash import dirhash
@@ -32,7 +34,11 @@ def plot_all(args_dict={}):
     plot_info_file = args_dict.get('plot_info_file', plot_info_id)
 
     data_root = Path(args_dict.get('data_root', os.getcwd()))
-    plot_info_files = list(data_root.glob(f"**/*{plot_info_file}.json"))
+    plot_info_files = (
+        list(data_root.glob(f"**/*{plot_info_file}.json")) +
+        list(data_root.glob(f"**/*{plot_info_file}.yaml")) +
+        list(data_root.glob(f"**/*{plot_info_file}.yml"))
+    )
 
     # save template plot_info.json
     if len(plot_info_files) == 0 or args_dict.get('template'):
@@ -65,8 +71,11 @@ def plot_all(args_dict={}):
             logging.info(f"no changes detected, skipping {file}")
         else:
             logging.info(f'loading plot settings from {file}')
-            with open(file) as json_file:
-                plot_info = json.load(json_file)
+            with open(file) as plot_info_file_handle:
+                if file.suffix.lower() in ('.yaml', '.yml'):
+                    plot_info = yaml.safe_load(plot_info_file_handle)
+                else:
+                    plot_info = json.load(plot_info_file_handle)
             validate(instance=plot_info, schema=schema)
             plot_info['plot_dir'] = dir_path
             plot_info['plot_info_file'] = file

pyproject.toml

@@ -13,7 +13,7 @@ authors = [
   {name = "Daniel Garcia", email = "dgarcia7654@users.noreply.github.com"}
 ]
 requires-python = ">=3.8"
-license = "LicenseRef-Proprietary"
+license = {file = "LICENSE"}
 keywords = ["plotting", "data", "plotly", "cli"]
 dependencies = [
   'dirhash',