pyproject.toml

# pyproject.toml — single source of truth for tooling configuration.
#
# This template carries the [tool.*] config that CI and local runs share, so the
# gates are identical on a developer machine and in the pipeline. It does NOT
# declare a [project]/build section: a kit project is a set of scripts, not a
# published package. Add [project] only if you later publish to an index.
#
# Pins are exact-version on purpose (determinism + exact CI<->local parity).
# Bump them at instantiation; Dependabot does not touch pip pins unless a pinned
# manifest (requirements.txt) exists.

[tool.ruff]
target-version = "py312"
line-length = 100
# Linated and formatted across the whole repository (including tooling/).
extend-exclude = [".venv"]

[tool.ruff.lint]
# A modest, high-signal default. Widen per project as needed.
select = ["E", "F", "I", "UP", "B"]

[tool.ruff.format]
quote-style = "double"

[tool.bandit]
# Scanned across the whole repository (bandit -c pyproject.toml -r .).
# Deliberate, documented skips — never a blanket silence:
#   B404  importing the subprocess module (we use it, in safe form)
#   B603  subprocess call without shell — SAFE form only: a fixed argument
#         list, never a shell string. (B602 shell=True stays ACTIVE below.)
#   B607  starting a process with a partial path — trusted PATH on a dev box.
# B602 (shell=True) is intentionally NOT skipped: it must keep failing.
#   B101  assert used — legitimate: pytest floors assert by design, and the
#         production checkers raise exceptions / return codes, never assert.
#   B406  xml.sax.saxutils.escape — escapes text for safe XML *output* in
#         gen_diagram; it parses nothing. A bandit false positive, and the
#         only XML skip that remains.
# The xml.etree PARSE channel is gone: check_diagram now parses with
# defusedxml, so B405/B314 are no longer skipped — there is nothing to flag.
skips = ["B101", "B404", "B603", "B607", "B406"]
# Local runs scan from the repo root, where the developer .venv lives under
# the tree; CI checks out fresh and has no .venv, so `-r .` there only sees
# project sources. Excluding .venv restores local/CI parity at the source —
# ruff already auto-excludes it, bandit does not.
# Keep this value BARE (no leading "./", no slashes): bandit excludes a path
# when the entry is a plain substring of it. A bare ".venv" matches both the
# POSIX "./.venv/..." and the Windows ".\\.venv\\..." form; any "/"-prefixed
# variant silently fails on Windows backslash paths and re-admits the venv.
exclude_dirs = [".venv"]

[tool.pytest.ini_options]
testpaths = ["tests"]

[dependency-groups]
lint = ["ruff==0.15.18"]
security = ["bandit[toml]==1.9.4"]
runtime = ["defusedxml==0.7.1"]
test = ["pytest==9.1.1", {include-group = "runtime"}]
dev = [{include-group = "lint"}, {include-group = "security"}, {include-group = "test"}, "tzdata; platform_system == 'Windows'"]