pyproject.toml

# SPDX-FileCopyrightText: Copyright (c) 2026 provide.io llc. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

#
# pyvider-rpcplugin/pyproject.toml
#
# Pyvider RPC Plugin - gRPC-based plugin protocol implementation
#

[build-system]
requires = ["setuptools>=75.0", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "pyvider-rpcplugin"
description = "Pyvider RPC Plugin"
dynamic = ["version"]
requires-python = ">=3.11"
readme = "README.md"
license = "Apache-2.0"
authors = [
    { name = "Tim Perkins", email = "code@tim.life" }
]
maintainers = [
    { name = "provide.io", email = "code@provide.io" },
]
keywords = ["pyvider", "rpc", "grpc", "plugin", "terraform", "provider"]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Intended Audience :: Developers",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Typing :: Typed",
]
dependencies = [
    "attrs>=25.4.0",
    "cryptography>=45.0.7",
    "google>=3.0.0",
    "grpcio>=1.78.0",
    "grpcio-health-checking>=1.78.0",
    "protobuf>=5.29.3",
    # 0.4.6 emits an IP subject alternative name for an address. Below it the
    # server certificate's alt names become DNS entries spelled like addresses,
    # which no client matches when dialling one -- the certificate looks right
    # and fails every handshake.
    "provide-foundation>=0.4.6",
]

[project.urls]
Homepage = "https://foundry.provide.io/pyvider-rpcplugin/"
Documentation = "https://foundry.provide.io/pyvider-rpcplugin/"
Repository = "https://github.com/provide-io/pyvider-rpcplugin"
Issues = "https://github.com/provide-io/pyvider-rpcplugin/issues"

[project.optional-dependencies]
test = [
    "grpc-stubs>=1.53.0.6",
    "grpcio-tools>=1.73.0",
    "types-grpcio>=1.0.0.20250603",
    "types-protobuf>=6.30.2.20250516",
]
all = [
    "pyvider-rpcplugin[test]",
]

[dependency-groups]
dev = [
    "mkdocs-autorefs>=1.4.3",
    "provide-testkit[standard,typecheck,advanced-testing,build,profiling,utils]>=0.4.5",
    "pyvider-rpcplugin[test]",
]
docs = [
    "mkdocs-gen-files>=0.5.0",
    "provide-testkit[docs]>=0.4.5",
]

################################################################################
# Build Configuration
################################################################################

[tool.setuptools]
package-dir = {"" = "src"}

[tool.setuptools.packages.find]
where = ["src"]

[tool.setuptools.package-data]
"pyvider.rpcplugin" = ["py.typed"]

[tool.setuptools.dynamic]
version = {file = "VERSION"}

################################################################################
# Testing
################################################################################

[tool.pytest.ini_options]
log_cli = true
# log_cli_level = "DEBUG"

asyncio_mode = "auto"
asyncio_default_fixture_loop_scope = "function"

testpaths = ["tests"]
pythonpath = ["src", "."]
python_files = ["test_*.py"]

markers = [
    "integration: marks tests as integration tests (deselect with -m \"not integration\")",
    "long_running: marks tests as long_running (deselect with -m \"not long_running\")",
    "slow: marks tests as slow (deselect with -m \"not slow\")",
    "memray: memory profiling stress tests (run with -m memray)",
]

filterwarnings = [
    "ignore:cannot collect test class .* because it has a __init__ constructor:pytest.PytestCollectionWarning",
    "ignore:.* KqueueSelector constructor:pytest.PytestCollectionWarning",
    # Python 3.13 asyncio cleanup ordering issue - not a bug in our code
    "ignore:Exception ignored in.*_SelectorTransport.__del__:pytest.PytestUnraisableExceptionWarning",
    # provide-testkit>=0.4.0 is auto-discovered and loaded before conftest imports - not an issue
    "ignore:Module already imported so cannot be rewritten; provide:pytest.PytestAssertRewriteWarning",
]

norecursedirs = [
    "build",
    "dist",
    "*.egg-info",
    ".venv",
    "**/*pb2*.py",
    "tests/memray",
]
addopts = ""
# Parallel execution: pytest -n <workers> (range: 2-16, recommend: CPU cores or 8, max: 16 to avoid xdist hang)

################################################################################
# Code Quality
################################################################################

[tool.ruff]
line-length = 111
indent-width = 4
target-version = "py311"
# ruff format touches Python code blocks embedded in Markdown; docs prose is not the formatter's to restyle.
exclude = ["tests/*", "**/*pb2*.py", "**/*.md"]

[tool.ruff.lint]
select = ["E", "F", "W", "I", "UP", "ANN", "B", "BLE", "C90", "PIE", "PLR", "S", "SIM", "PTH", "RUF"]
ignore = [
    "ANN401",   # any-type (too restrictive)
    "BLE001",   # blind-except (too restrictive for cleanup patterns)
    "B008",     # function-call-in-default-argument (Click uses this pattern)
    "E501",     # line-too-long (handled by formatter)
    "S101",     # assert (valid in tests)
    "S104",     # binding-to-all-interfaces (intentional for servers)
    "S108",     # hardcoded-temp-file (/tmp is fine for our use cases)
    "S110",     # try-except-pass (legitimate for cleanup)
    "S310",     # suspicious-url-open-for-protocol (URLs are controlled)
    "S311",     # random (not for crypto)
    "S603",     # subprocess-without-shell-equals-true (trusted input)
    "S607",     # start-process-with-partial-path (trusted executables)
    "PLR0911",  # too-many-return-statements (refactor later)
    "PLR0912",  # too-many-branches (refactor later)
    "PLR0913",  # too-many-arguments (common in config classes)
    "PLR0917",  # too-many-positional-arguments (same rationale as PLR0913)
    "PLR0915",  # too-many-statements (refactor later)
    "PLR2004",  # magic-value-comparison (too noisy)
]

[tool.ruff.lint.isort]
known-first-party = ["pyvider", "tests"]
force-sort-within-sections = true
combine-as-imports = true

[tool.ruff.lint.per-file-ignores]
"tests/**" = ["ANN001", "ANN002", "ANN003", "ANN201", "ANN202", "ANN204", "B017", "C901", "E402", "PLR0124", "PLR1714", "S102", "S105", "S106", "S110", "S307", "S311", "S324", "S602", "SIM105", "SIM108", "SIM117"]
"examples/**" = ["ANN001", "ANN002", "ANN003", "ANN201", "ANN202", "ANN204", "S311"]

[tool.ruff.format]
quote-style = "double"
indent-style = "space"
skip-magic-trailing-comma = false
line-ending = "auto"

[tool.mypy]
python_version = "3.11"
mypy_path = "src"
strict = true
pretty = true
show_error_codes = true
show_column_numbers = true
warn_unused_ignores = true
warn_unused_configs = true
disallow_untyped_decorators = false

[[tool.mypy.overrides]]
module = [
    "google.protobuf.*",
    "grpc.*",
    "pytest.*",
    "opentelemetry.*",
]
ignore_missing_imports = true

[[tool.mypy.overrides]]
# Proto-generated bindings lack .pyi stubs; protobuf populates class attrs
# dynamically at module-load time, so mypy cannot see ConnInfo / StdioData /
# Empty etc. statically. follow_imports='skip' makes them Any at import sites.
module = [
    "pyvider.rpcplugin.protocol.*",
    "pyvider.rpcplugin.health_servicer",
]
follow_imports = "skip"
ignore_errors = true
ignore_missing_imports = true

[[tool.mypy.overrides]]
# telemetry.py has type: ignore for OTEL fallback that only runs when OTEL is missing
module = "pyvider.rpcplugin.telemetry"
warn_unused_ignores = false

# Newly-imported upstream modules with type drift — address after v0.4.0 cut.
[[tool.mypy.overrides]]
module = [
    "pyvider.rpcplugin.transport.tcp",
    "pyvider.rpcplugin.transport.unix.transport",
    "pyvider.rpcplugin.types",
    "pyvider.rpcplugin.server.network",
    "pyvider.rpcplugin.server.core",
    "pyvider.rpcplugin.client.process",
]
ignore_errors = true

################################################################################
# Coverage
################################################################################

[tool.coverage.run]
source = ["pyvider.rpcplugin"]
omit = [
    "**/*pb2*.py",
]
branch = true
parallel = true

[tool.coverage.report]
fail_under = 70
show_missing = true
skip_covered = false  # Show all lines, even if 100% covered
precision = 2  # Decimal places in report output

[tool.coverage.html]
directory = "htmlcov"  # Output directory for HTML coverage reports

[tool.coverage.xml]
output = "coverage.xml"  # Output XML for CI/CD tools

[tool.coverage.annotate]
directory = "cover"  # Annotate files with coverage info

################################################################################
# Static Analysis
################################################################################

[tool.pyre]
source_directories = ["src"]
exclude = [
    "tests/*",
    "**/*pb2.py",       # Generated protobuf Python
    "**/*pb2.pyi",      # Generated protobuf stubs
    "**/*pb2_grpc.py"   # Generated gRPC service stubs
]
strict = true

[tool.bandit]
exclude_dirs = [".venv", "tests", "workenv"]

################################################################################
# Security Scanning Allowlist
################################################################################

[tool.security]
# Paths to exclude from secret scanning (TruffleHog, GitGuardian, Gitleaks)
description = "Test fixtures and example credentials - intentionally committed"
allowed_paths = [
    # Test certificates and keys for mTLS testing
    "tests/certs/*.key",
    "tests/fixtures/crypto.py",
    "tests/server/test_server_tls.py",
    # Example keys for documentation/demos
    "examples/**/*.key",
    "examples/grpc/server.key",
    "examples/grpc/env.sh",
    "example_certs_output/*.key",
    # Documentation with example credentials/keys
    "docs/**/*.md",
    # Test output/debug files
    "tests/rpcplugin-tests.txt",
    "tests/bfiles-*.txt",
]

# 🐍🏗️📋