release: v0.3.0

.devcontainer/devcontainer.json

@@ -0,0 +1,39 @@
+{
+  "name": "Xelo Dev",
+  "build": {
+    "dockerfile": "../Dockerfile",
+    "context": ".."
+  },
+  "features": {
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "installZsh": "false",
+      "upgradePackages": "true",
+      "username": "root",
+      "packages": "git,curl"
+    },
+    "ghcr.io/devcontainers/features/node:1": {
+      "version": "lts"
+    }
+  },
+  "overrideCommand": true,
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "ms-python.python",
+        "ms-python.vscode-pylance",
+        "charliermarsh.ruff"
+      ],
+      "settings": {
+        "python.defaultInterpreterPath": "${containerWorkspaceFolder}/.venv/bin/python",
+        "python.testing.pytestEnabled": true,
+        "python.testing.pytestArgs": [
+          "tests"
+        ],
+        "python.linting.enabled": false,
+        "editor.formatOnSave": true
+      }
+    }
+  },
+  "postCreateCommand": "python -m venv .venv && . .venv/bin/activate && python -m pip install --upgrade pip && python -m pip install -e '.[dev]' && npm install -g @anthropic-ai/claude-code",
+  "remoteUser": "root"
+}

.env.example

@@ -1,98 +1,31 @@
-# =============================================================================
-# AI SBOM - LLM Enrichment Configuration
-# =============================================================================
-# Copy this file to .env and fill in your credentials.
-# Only required when using ExtractionConfig(deterministic_only=False).
-#
-# litellm model string examples:
-#   "gpt-4o-mini"                              → OpenAI
-#   "azure/gpt-4.1"                            → Azure OpenAI (deployment name)
-#   "anthropic/claude-3-haiku-20240307"        → Anthropic
-#   "vertex_ai/gemini-2.5-flash"               → Vertex AI
-#   "gemini/gemini-2.5-flash"                  → Gemini API
-#   "ollama/mistral"                           → local Ollama
-# =============================================================================
+# xelo environment variables
+# Copy this file to .env and fill in values (never commit .env)
 
-# -----------------------------------------------------------------------------
-# Default LLM model and budget
-# Used by ExtractionConfig when not explicitly set by the caller.
-# -----------------------------------------------------------------------------
-AISBOM_LLM_MODEL=gpt-4o-mini
-AISBOM_LLM_BUDGET_TOKENS=50000
+# ── LLM enrichment ────────────────────────────────────────────────────────────
+# Set XELO_LLM=true (or pass --llm to the CLI) to enable LLM enrichment.
+# Enrichment calls litellm, so any litellm-supported provider works.
+# Examples: "gpt-4o-mini", "anthropic/claude-3-haiku-20240307", "ollama/mistral"
 
-# -----------------------------------------------------------------------------
-# Verification / confidence tuning
-# -----------------------------------------------------------------------------
-AISBOM_ENABLE_VERIFICATION=true
-AISBOM_VERIFICATION_CONFIDENCE_MIN=0.60
-AISBOM_VERIFICATION_CONFIDENCE_MAX=0.85
-AISBOM_VERIFICATION_COST_BUDGET=0.05
-AISBOM_MAX_VERIFICATIONS=20
+XELO_LLM=false
+XELO_LLM_MODEL=gpt-4o-mini
+XELO_LLM_API_KEY=
+XELO_LLM_API_BASE=
+XELO_LLM_BUDGET_TOKENS=50000
 
-# Enable per-asset LLM summary refinement (slower, costs more tokens)
-AISBOM_ENABLE_ASSET_SUMMARY_LLM=false
+# ── Provider API keys ─────────────────────────────────────────────────────────
+# Set the key for whichever provider your XELO_LLM_MODEL uses.
+# litellm reads these automatically — you only need XELO_LLM_API_KEY if you
+# want to override the provider-specific env var.
 
-# Confidence threshold — nodes below this are dropped after aggregation
-AISBOM_CONFIDENCE_THRESHOLD=0.40
+# OpenAI / Azure OpenAI
+# OPENAI_API_KEY=sk-proj-...
 
-# -----------------------------------------------------------------------------
-# OpenAI
-# https://platform.openai.com/api-keys
-# -----------------------------------------------------------------------------
-OPENAI_API_KEY=sk-proj-...
-
-# -----------------------------------------------------------------------------
 # Anthropic
-# https://console.anthropic.com/settings/keys
-# -----------------------------------------------------------------------------
-ANTHROPIC_API_KEY=sk-ant-...
-
-# -----------------------------------------------------------------------------
-# Azure OpenAI
-# litellm model string: "azure/<deployment-name>"  e.g. "azure/gpt-4.1"
-# https://learn.microsoft.com/azure/ai-services/openai/
-# -----------------------------------------------------------------------------
-AZURE_API_KEY=<your-azure-openai-key>
-AZURE_API_BASE=https://<your-resource>.cognitiveservices.azure.com/
-AZURE_API_VERSION=2024-02-01
-# Default deployment name (used when AISBOM_LLM_MODEL=azure/<name>)
-AZURE_OPENAI_DEPLOYMENT=gpt-4.1
-
-# Azure AI Foundry — additional deployments (Kimi K2, etc.)
-# litellm model string: "azure/<deployment-name>"
-AZURE_KIMI_K2_ENDPOINT=https://<your-resource>.services.ai.azure.com/openai/v1/
-AZURE_KIMI_K2_KEY=<your-kimi-k2-key>
-AZURE_KIMI_K2_DEPLOYMENT_NAME=Kimi-K2-Thinking
-
-# Azure-hosted Anthropic (Claude via Azure AI Foundry)
-# litellm model string: "azure/claude-sonnet-4-5"
-AZURE_ANTHROPIC_ENDPOINT=https://<your-resource>.services.ai.azure.com/anthropic/
-AZURE_ANTHROPIC_KEY=<your-azure-anthropic-key>
-AZURE_ANTHROPIC_DEPLOYMENT=claude-sonnet-4-5
-
-# -----------------------------------------------------------------------------
-# Google Vertex AI
-# litellm model string: "vertex_ai/gemini-2.5-flash"
-# Requires either GOOGLE_APPLICATION_CREDENTIALS (service account JSON) or
-# gcloud ADC (run: gcloud auth application-default login).
-# https://cloud.google.com/vertex-ai/docs/authentication
-# -----------------------------------------------------------------------------
-VERTEXAI_PROJECT=<your-gcp-project-id>
-VERTEXAI_LOCATION=us-central1
-# Service account key file path (alternative to ADC)
-# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
+# ANTHROPIC_API_KEY=sk-ant-...
 
-# -----------------------------------------------------------------------------
-# Google Gemini API (direct, not via Vertex)
-# litellm model string: "gemini/gemini-2.5-flash"
-# https://aistudio.google.com/apikey
-# -----------------------------------------------------------------------------
-GEMINI_API_KEY=<your-gemini-api-key>
-# Also accepted by litellm:
-# GOOGLE_API_KEY=<your-gemini-api-key>
+# Google Gemini
+# GEMINI_API_KEY=...
 
-# -----------------------------------------------------------------------------
-# GitHub — used by SbomExtractor.extract_from_repo() to clone private repos
-# https://github.com/settings/tokens  (scope: repo)
-# -----------------------------------------------------------------------------
-GITHUB_TOKEN=ghp_...
+# ── Source access ─────────────────────────────────────────────────────────────
+# GitHub token — used by AiSbomExtractor.extract_from_repo() for private repos
+# GITHUB_TOKEN=ghp_...

.gitattributes

@@ -0,0 +1,6 @@
+* text=auto eol=lf
+
+# Windows-native scripts keep CRLF for compatibility.
+*.bat text eol=crlf
+*.cmd text eol=crlf
+

.github/workflows/release.yml

@@ -14,3 +14,21 @@ jobs:
           python-version: "3.11"
       - run: pip install build
       - run: python -m build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: python-dist
+          path: dist/
+
+  publish:
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      id-token: write
+    environment:
+      name: pypi
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: python-dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

.gitignore

@@ -24,3 +24,9 @@ htmlcov/
 .idea/
 .vscode/
 *.swp
+
+# tmp files
+output/
+tmp/
+# Generated eval run outputs
+tests/test-results/

.pypirc

@@ -0,0 +1,8 @@
+[distutils]
+index-servers =
+    xelo
+
+[xelo]
+repository = https://upload.pypi.org/legacy/
+username = __token__
+password = ${PYPI_API_TOKEN}