pyproject.toml

# GCO (Global Capacity Orchestrator on AWS) - Python Project Configuration

[build-system]
requires = ["setuptools>=77.0.0", "wheel"]
build-backend = "setuptools.build_meta"

[tool.setuptools.packages.find]
include = ["cli", "cli.*", "gco", "gco.*"]

[tool.setuptools.dynamic]
version = {attr = "gco._version.__version__"}

[project]
name = "gco-cli"
dynamic = ["version"]
description = "CLI for managing GCO multi-region EKS clusters"
readme = "README.md"
requires-python = ">=3.10"
license = "MIT-0"
license-files = ["LICENSE"]
authors = [
    {name = "Jacob Mevorach (@Jmevorach)"}
]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Intended Audience :: Developers",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
]
dependencies = [
    "boto3==1.43.3",
    "click==8.3.3",
    "requests==2.33.1",
    "pyyaml==6.0.3",
    "constructs==10.6.0",
    "kubernetes==35.0.0",
    "fastapi==0.136.1",
    "uvicorn==0.46.0",
    "pydantic==2.13.3",
    "prometheus-client==0.25.0",
    "httpx==0.28.1",
    "urllib3==2.7.0",
]

[project.optional-dependencies]
cdk = [
    "aws-cdk-lib==2.251.0",
    "aws-pdk==0.26.15",
    "cdk-nag==2.37.55",
    "constructs==10.6.0",
]
diagrams = [
    # Dependencies for ``diagrams/code_diagrams/generate.py``. Pinned to
    # match the reproducibility policy used by the rest of this project.
    # ``pyflowchart`` turns Python source into flowchart.js DSL; we emit
    # interactive HTML via its ``output_html`` helper. ``playwright``
    # drives a headless Chromium to rasterise each flowchart.js SVG to
    # a PNG — run ``playwright install chromium`` once to fetch the
    # browser binary. ``ruff`` is invoked by the generator's marker
    # inserter to normalise whitespace around the injected
    # ``# Flowchart:`` comment block so the result is formatter-stable
    # under ``ruff format --check`` (kept at the same pin as the
    # ``lint`` extra to avoid version-drift between the generator and
    # the CI lint gate).
    "pyflowchart==0.6.0",
    "playwright==1.59.0",
    "ruff==0.15.7",
]
inference-monitor = [
    "boto3==1.43.3",
    "kubernetes==35.0.0",
    "pyyaml==6.0.3",
]
mcp = [
    "fastmcp>=3.2.0",
]
lint = [
    "ruff==0.15.7",
    "yamllint==1.38.0",
]
typecheck = [
    "mypy==1.19.1",
    "types-requests==2.32.4.20260107",
    "types-PyYAML==6.0.12.20250915",
]
test = [
    "pytest==9.0.3",
    "pytest-cov==7.1.0",
    "pytest-mock==3.15.1",
    "pytest-asyncio==1.3.0",
    "pytest-xdist[psutil]==3.8.0",
    "moto==5.1.22",
    # moto==5.1.22 lazy-imports its API Gateway backend whenever
    # ``cloudformation.create_stack`` is called (even if the stack template
    # contains no API Gateway resources), and that backend requires
    # ``openapi-spec-validator``. The dependency is declared as "optional"
    # by moto and is not pulled in by ``moto==5.1.22`` alone, so CI
    # environments that install only the core moto wheel blow up with
    # ``ModuleNotFoundError: openapi_spec_validator`` the first time a
    # test seeds a CloudFormation stack for output discovery. Pinning it
    # explicitly keeps test environments reproducible.
    "openapi-spec-validator==0.8.5",
    "hypothesis==6.131.0",
]
security = [
    "bandit==1.9.4",
    "pip-tools==7.5.3",
]
dev = [
    "gco-cli[cdk,diagrams,lint,typecheck,test,security]",
    "pre-commit==4.5.1",
]

[project.scripts]
gco = "cli.main:main"

[project.urls]
Documentation = "https://github.com/awslabs/global-capacity-orchestrator-on-aws/blob/main/docs/CLI.md"
Repository = "https://github.com/awslabs/global-capacity-orchestrator-on-aws"

# =============================================================================
# Tool Configurations
# =============================================================================

# Ruff handles both formatting (``ruff format``) and linting, covering
# pycodestyle, Pyflakes, bugbear, comprehensions, pyupgrade, simplify,
# and isort-style import sorting via the rule selectors below.

[tool.ruff]
line-length = 100
target-version = "py314"
exclude = [
    ".git",
    ".venv",
    ".mypy_cache",
    ".pytest_cache",
    "__pycache__",
    "cdk.out",
    "dist",
    "build",
    "lambda/kubectl-applier-simple-build",
    "lambda/helm-installer-build",
]

[tool.ruff.lint]
select = [
    "E",      # pycodestyle errors
    "W",      # pycodestyle warnings
    "F",      # Pyflakes
    "I",      # isort
    "B",      # flake8-bugbear
    "C4",     # flake8-comprehensions
    "UP",     # pyupgrade
    "ARG",    # flake8-unused-arguments
    "SIM",    # flake8-simplify
]
ignore = [
    "E501",   # line too long (handled by ruff format)
    "B008",   # do not perform function calls in argument defaults
    "ARG001", # unused function argument
    "ARG002", # unused method argument
]

[tool.ruff.lint.isort]
known-first-party = ["gco", "cli"]

[tool.ruff.lint.per-file-ignores]
"tests/*" = ["ARG", "S101"]
"lambda/*" = ["ARG"]

[tool.mypy]
python_version = "3.14"
# --strict equivalent: every option enabled except "warn_unreachable" which has
# false positives on platform-conditional branches. Keep these in sync with CI.
warn_return_any = true
warn_unused_configs = true
check_untyped_defs = true
disallow_untyped_defs = true
disallow_incomplete_defs = true
disallow_untyped_calls = true
disallow_untyped_decorators = true
disallow_any_generics = true
disallow_subclassing_any = true
no_implicit_optional = true
no_implicit_reexport = true
strict_equality = true
extra_checks = true
warn_redundant_casts = true
warn_unused_ignores = true
# Ignore missing imports from untyped third-party libraries (boto3, kubernetes,
# aws_cdk, etc. don't ship type stubs we can rely on). This is NOT a license
# to skip annotating our own code — it only suppresses errors from imports.
ignore_missing_imports = true
disable_error_code = ["import-untyped", "import-not-found"]
exclude = [
    "cdk\\.out",
    "\\.venv",
    "dist",
    "build",
    "lambda/kubectl-applier-simple-build",
    "lambda/helm-installer-build",
]

# gco/stacks/ is type-checked separately by lint:mypy:stacks (with CDK
# installed). When the strict job runs without CDK, aws_cdk.Stack resolves
# to Any, which triggers disallow_subclassing_any, and the type: ignore
# comments that suppress Cluster→ICluster mismatches become "unused"
# because the types are all Any. Relaxing these two flags here avoids
# false positives in the strict job while the stacks job still enforces
# them with real CDK stubs.
[[tool.mypy.overrides]]
module = "gco.stacks.*"
disallow_subclassing_any = false
warn_unused_ignores = false

# Tests can use looser rules — the test runner resolves fixtures at runtime so
# `disallow_untyped_defs` creates too much noise for little real-world benefit.
[[tool.mypy.overrides]]
module = "tests.*"
disallow_untyped_defs = false
disallow_incomplete_defs = false
disallow_untyped_decorators = false
check_untyped_defs = true

[tool.pytest.ini_options]
minversion = "7.0"
addopts = "-ra -q --strict-markers"
testpaths = ["tests"]
python_files = ["test_*.py"]
python_classes = ["Test*"]
python_functions = ["test_*"]
markers = [
    "slow: marks tests as slow (deselect with '-m \"not slow\"')",
    "integration: marks tests as integration tests",
    "unit: marks tests as unit tests",
]
filterwarnings = [
    "ignore::DeprecationWarning",
    "ignore::PendingDeprecationWarning",
]

[tool.coverage.run]
source = ["gco", "cli"]
branch = true
omit = [
    "*/tests/*",
    "*/__pycache__/*",
    "*/cdk.out/*",
    "*/.venv/*",
    "*/__init__.py",
]

[tool.coverage.report]
exclude_lines = [
    "pragma: no cover",
    "def __repr__",
    "raise AssertionError",
    "raise NotImplementedError",
    "if __name__ == .__main__.:",
    "if TYPE_CHECKING:",
    "if typing.TYPE_CHECKING:",
]
fail_under = 85
show_missing = true

[tool.coverage.html]
directory = "htmlcov"

[tool.bandit]
exclude_dirs = ["tests", "cdk.out", ".venv"]
skips = ["B101", "B104", "B113", "B311"]
# B101: assert used in tests and CDK constructs (harmless)
# B104: bind to 0.0.0.0 required for container services
# B113: false positives on dict.get() calls named "requests" (all HTTP calls have timeouts)
# B311: random not used for security purposes