pyproject.toml

[build-system]
requires = ["setuptools>=80.9.0", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "orb-py"
version = "1.6.2"
description = "Open Resource Broker (ORB) — dynamic cloud resource provisioning via CLI and REST API"
readme = "README.md"
license = "Apache-2.0"
authors = [
    {name = "Open Resource Broker Maintainers", email = "open-resource-broker-maintainers@lists.finos.org"},
]
maintainers = [
    {name = "Open Resource Broker Maintainers", email = "open-resource-broker-maintainers@lists.finos.org"},
]
keywords = [
    "aws",
    "ec2",
    "hostfactory",
    "symphony",
    "hpc",
    "cluster",
    "cloud",
    "infrastructure",
]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "Natural Language :: English",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Topic :: Software Development :: Libraries :: Python Modules",
    "Topic :: System :: Clustering",
    "Topic :: System :: Distributed Computing",
]
requires-python = ">=3.10"

dependencies = [
    # Core dependencies (always needed)
    "boto3>=1.42.21",
    "botocore>=1.42.21",
    "pydantic>=2.0.0",
    "pydantic-settings>=2.0.0",
    "sqlalchemy>=2.0.0",
    "urllib3>=2.6.3", # Security: Fix CVE-2025-66471, CVE-2025-66418, CVE-2026-21441
    "PyJWT>=2.8.0",
    "cryptography>=46.0.5", # Security: Fix CVE-2026-26007
    "filelock>=3.20.1", # Security: Fix CVE-2025-68146 race condition
    "requests>=2.31.0",
    "PyYAML>=6.0.0", # Exported API (lazy-loaded)
    "jsonschema>=4.17.0",
]

[project.optional-dependencies]
# CLI enhancements (colored output)
cli = [
    "rich>=13.3.0",
    "rich-argparse>=1.0.0",
]

# API server (for REST API mode)
api = [
    "fastapi>=0.128.0",
    "starlette>=0.49.1", # Security: Fix CVE-2025-62727, CVE-2025-54121, CVE-2024-47874
    "uvicorn>=0.24.0",
    "jinja2>=3.1.0",
]

# Monitoring & observability (for API/production deployments)
monitoring = [
    "opentelemetry-api>=1.20.0",
    "opentelemetry-sdk>=1.20.0",
    "opentelemetry-instrumentation-fastapi>=0.41b0",
    "opentelemetry-instrumentation-boto>=0.41b0",
    "opentelemetry-instrumentation-sqlalchemy>=0.41b0",
    "prometheus-client>=0.17.0",
    "psutil>=5.9.0",
]

# All optional features
all = [
    "orb-py[cli,api,monitoring]",
]

# ---------------------------------------------------------------------------
# pip compatibility shims for [dependency-groups] (PEP 735)
#
# pip does not yet support PEP 735 dependency-groups.  The authoritative dev
# dependency lists live in [dependency-groups] below.  These optional-deps
# mirror them so `pip install -e ".[dev]"` keeps working.  When pip gains
# PEP 735 support these shims can be removed.
# ---------------------------------------------------------------------------
ci = [
    # Code Quality Tools
    "ruff>=0.1.0",
    "pathspec>=0.11.0",
    "pyright>=1.1.408,<2.0.0",
    "bandit>=1.7.5,<2.0.0",
    "bandit-sarif-formatter>=1.1.1,<2.0.0",
    # Testing Framework
    "pytest>=7.4.3,<10.0.0",
    "pytest-cov>=4.1.0,<8.0.0",
    "pytest-env>=1.1.1,<2.0.0",
    "pytest-mock>=3.12.0,<4.0.0",
    "pytest-asyncio>=0.21.1,<2.0.0",
    "pytest-timeout>=2.2.0,<3.0.0",
    "pytest-xdist>=3.3.1,<4.0.0",
    "pytest-html>=4.1.1,<5.0.0",
    "pytest-benchmark>=5.1.0,<6.0.0",
    "coverage>=7.3.2,<8.0.0",
    # Test dependencies for API and template tests
    "fastapi>=0.128.0",
    "httpx>=0.27.0",
    "jinja2>=3.1.0",
    # AWS Testing
    "moto[all]>=5.1.19,<6.0.0",
    "responses>=0.24.0,<1.0.0",
    "requests-mock>=1.11.0,<2.0.0",
    "joserfc>=1.6.1",
    "werkzeug>=3.1.6",
    "nltk>=3.9.3",
    # Essential Type Stubs
    "types-PyYAML>=6.0.12.12,<7.0.0",
    "types-python-dateutil>=2.8.19.14,<3.0.0",
    # Build Tools
    "tomli>=2.0.0,<3.0.0",
    # Security Scanning
    "safety>=3.7.0,<4.0.0",
    "pip-audit>=2.6.1,<3.0.0",
    "semgrep>=1.45.0,<2.0.0",
    "cyclonedx-bom>=4.0.0,<8.0.0",
    "peewee>=3.18.3",
    "marshmallow>=4.1.2",
    # Documentation
    "mkdocs>=1.5.0,<2.0.0",
    "mkdocs-material>=9.1.0,<10.0.0",
    "mkdocstrings>=0.22.0,<2.0.0",
    "mkdocstrings-python>=1.1.0,<3.0.0",
    "mkdocs-gen-files>=0.5.0,<1.0.0",
    "mkdocs-literate-nav>=0.6.0,<1.0.0",
    "mkdocs-section-index>=0.3.0,<1.0.0",
    "mike>=1.1.0,<3.0.0",
    # Build and Packaging
    "build>=1.0.3,<2.0.0",
    "wheel>=0.41.3,<1.0.0",
]
dev = [
    "orb-py[ci]",
    "virtualenv>=20.26.6",
    "pre-commit>=3.5.0,<5.0.0",
    "bump2version>=1.0.1,<2.0.0",
    "python-semantic-release>=10.0.0,<11.0.0",
    "line-profiler>=4.1.1,<6.0.0",
    "memory-profiler>=0.61.0,<1.0.0",
    "py-spy>=0.3.14,<1.0.0",
    "py-cpuinfo>=9.0.0,<10.0.0",
    "ipdb>=0.13.13,<1.0.0",
    "ipython>=8.16.1,<9.0.0",
    "radon>=6.0.1,<7.0.0",
    "pip-tools>=7.3.0,<8.0.0",
    "twine>=4.0.0",
    "git-changelog>=2.6.0,<3.0.0",
]

[dependency-groups]
# ---------------------------------------------------------------------------
# Authoritative dev dependency definitions (PEP 735).
# Use: `uv sync --group dev` or `uv sync --group ci`
# The [project.optional-dependencies] ci/dev sections above are pip shims
# that mirror these lists for `pip install -e ".[dev]"` compatibility.
# ---------------------------------------------------------------------------
# CI Dependencies: What CI needs to test, lint, and build docs
ci = [
    # Code Quality Tools (ruff replaces black/isort/flake8/pylint)
    "ruff>=0.1.0",
    "pathspec>=0.11.0",  # For gitignore pattern matching in dev-tools
    "pyright>=1.1.408,<2.0.0",
    "bandit>=1.7.5,<2.0.0",
    "bandit-sarif-formatter>=1.1.1,<2.0.0",

    # Testing Framework
    "pytest>=7.4.3,<10.0.0",
    "pytest-cov>=4.1.0,<8.0.0",
    "pytest-env>=1.1.1,<2.0.0",
    "pytest-mock>=3.12.0,<4.0.0",
    "pytest-asyncio>=0.21.1,<2.0.0",
    "pytest-timeout>=2.2.0,<3.0.0",
    "pytest-xdist>=3.3.1,<4.0.0",
    "pytest-html>=4.1.1,<5.0.0",
    "pytest-benchmark>=5.1.0,<6.0.0",
    "coverage>=7.3.2,<8.0.0",

    # Test dependencies for API and template tests
    "fastapi>=0.128.0",
    "httpx>=0.27.0",  # Required by FastAPI TestClient
    "jinja2>=3.1.0",

    # AWS Testing
    "moto[all]>=5.1.19,<6.0.0",
    "responses>=0.24.0,<1.0.0",
    "requests-mock>=1.11.0,<2.0.0",
    # Security overrides for vulnerable dependencies
    "joserfc>=1.6.1",
    "werkzeug>=3.1.6",
    # Security override for safety's vulnerable nltk dependency (GHSA-7p94-766c-hgjp)
    "nltk>=3.9.3",

    # Essential Type Stubs
    "types-PyYAML>=6.0.12.12,<7.0.0",
    "types-python-dateutil>=2.8.19.14,<3.0.0",

    # Build Tools
    "tomli>=2.0.0,<3.0.0",  # For pyproject.toml parsing in dev scripts (Python < 3.11)

    # Security Scanning
    "safety>=3.7.0,<4.0.0",
    "pip-audit>=2.6.1,<3.0.0",
    "semgrep>=1.45.0,<2.0.0",
    "cyclonedx-bom>=4.0.0,<8.0.0",
    # Security override for safety's vulnerable peewee dependency
    "peewee>=3.18.3",
    # Security override for safety's vulnerable marshmallow dependency (CVE-2025-68480)
    "marshmallow>=4.1.2",

    # Documentation
    "mkdocs>=1.5.0,<2.0.0",
    "mkdocs-material>=9.1.0,<10.0.0",
    "mkdocstrings>=0.22.0,<2.0.0",
    "mkdocstrings-python>=1.1.0,<3.0.0",
    "mkdocs-gen-files>=0.5.0,<1.0.0",
    "mkdocs-literate-nav>=0.6.0,<1.0.0",
    "mkdocs-section-index>=0.3.0,<1.0.0",
    "mike>=1.1.0,<3.0.0",

    # Build and Packaging
    "build>=1.0.3,<2.0.0",
    "wheel>=0.41.3,<1.0.0",
]

# Dev Dependencies: Additional dev tools (includes all CI deps)
dev = [
    {include-group = "ci"},
    "virtualenv>=20.26.6",  # Security: Fix CVE-2024-53899 command injection
    "pre-commit>=3.5.0,<5.0.0",
    "bump2version>=1.0.1,<2.0.0",
    "python-semantic-release>=10.0.0,<11.0.0",
    "line-profiler>=4.1.1,<6.0.0",
    "memory-profiler>=0.61.0,<1.0.0",
    "py-spy>=0.3.14,<1.0.0",
    "py-cpuinfo>=9.0.0,<10.0.0",
    "ipdb>=0.13.13,<1.0.0",
    "ipython>=8.16.1,<9.0.0",
    "radon>=6.0.1,<7.0.0",
    "pip-tools>=7.3.0,<8.0.0",
    "twine>=4.0.0",
    "git-changelog>=2.6.0,<3.0.0",
]
[project.scripts]
orb = "orb.run:cli_main"

[project.urls]
Homepage = "https://github.com/finos/open-resource-broker"
Documentation = "https://finos.github.io/open-resource-broker/"
Repository = "https://github.com/finos/open-resource-broker"
"Bug Reports" = "https://github.com/finos/open-resource-broker/issues"

[tool.setuptools.packages.find]
where = ["src"]

[tool.setuptools.package-dir]
"" = "src"

[tool.setuptools]
include-package-data = true

[tool.setuptools.package-data]
"*" = ["py.typed"]
"orb.config" = ["default_config.json"]
"orb.providers.aws.config" = ["*.json"]

[tool.setuptools.data-files]
"orb_scripts" = ["src/orb/infrastructure/scheduler/hostfactory/scripts/*.sh", "src/orb/infrastructure/scheduler/hostfactory/scripts/*.bat"]  # keep in sync with .project.yml build.package_root



[tool.pytest.ini_options]
testpaths = ["tests"]
norecursedirs = ["tests/onaws"]
python_files = ["test_*.py"]
python_classes = ["Test*"]
python_functions = ["test_*"]
asyncio_mode = "strict"
asyncio_default_fixture_loop_scope = "function"
junit_family = "legacy"
addopts = "--tb=short --strict-markers --disable-warnings --cov=src/orb --cov-report=term-missing --cov-branch"
filterwarnings = [
    "ignore::DeprecationWarning",
    "ignore::PendingDeprecationWarning",
]
markers = [
    "unit: Unit tests",
    "integration: Integration tests",
    "e2e: marks end-to-end tests",
    "mcp: MCP server tests",
    "slow: Slow running tests (docker builds, stress loops, subprocess spawning)",
    "aws: Tests requiring AWS credentials",
    "manual_aws: Live AWS integration tests that must be run manually with --run-manual-aws",
    "rest_api: REST API integration tests",
    "application: Application layer tests",
    "architecture: Architecture compliance tests",
    "domain: Domain layer tests",
    "infrastructure: Infrastructure layer tests",
    "patterns: Design pattern tests",
    "providers: Provider implementation tests",
    "performance: Performance benchmark tests",
    "provider_contract: Part of the provider contract test suite",
    "simulator_limitation: Assertion weakened due to known simulator gap",
    "requires_real_provider: Skipped unless --run-real-provider flag passed",
    "moto: Tests using moto-mocked AWS (no real credentials required)",
    "sdk: Tests exercising the ORBClient SDK interface",
    "cli: marks CLI integration tests",
    "benchmark: marks benchmark/performance tests",
    "api: marks API tests",
    "security: marks security tests",
]
env = [
    "AWS_DEFAULT_REGION=us-east-1",
    "AWS_ACCESS_KEY_ID=testing",
    "AWS_SECRET_ACCESS_KEY=testing",
    "AWS_SECURITY_TOKEN=testing",
    "AWS_SESSION_TOKEN=testing",
]

[tool.coverage.run]
source = ["src/orb"]
branch = true

[tool.coverage.report]
precision = 2
show_missing = true
skip_covered = false
ignore_errors = true
exclude_lines = [
    "pragma: no cover",
    "pragma: nocover",
    "def __repr__",
    "def __str__",
    "if self.debug:",
    "raise AssertionError",
    "raise NotImplementedError",
    "if 0:",
    "if __name__ == .__main__.:",
    "class .*\\bProtocol\\):",
    "@(abc\\.)?abstractmethod",
    "pass",
    "raise ImportError",
    "except ImportError:",
    "if TYPE_CHECKING:",
    "\\.\\.\\.$",
]

[tool.coverage.html]
directory = "htmlcov"
title = "Open Resource Broker Coverage Report"

[tool.coverage.xml]
output = "coverage.xml"

[tool.ruff]
target-version = "py39"
line-length = 100
exclude = [
    ".eggs",
    ".git",
    ".hg",
    ".tox",
    ".venv",
    "build",
    "dist",
]

[tool.ruff.lint]
# ENFORCED: These rules fail CI (replace black/isort/flake8)
select = ["E", "W", "F", "I"]
# OPTIONAL: These warn but don't fail CI (replace pylint functionality)
extend-select = ["N", "UP", "B", "PL", "C90", "RUF"]
ignore = [
    "E501",  # Line too long (handled by formatter)
    "PLR0913",  # Too many arguments
    "PLR0912",  # Too many branches
    "PLR0915",  # Too many statements
    "PLR2004",  # Magic value used in comparison - acceptable in tests
    "PLR0911",  # Too many return statements - acceptable for complex logic
    "PLW2901",  # Loop variable overwritten - acceptable pattern
    "PLW0603",  # Using global statement - acceptable for singletons
    # Non-critical violations that don't break functionality
    "C901",   # Function complexity - doesn't break functionality
    "E402",   # Module imports not at top - acceptable in scripts/tests
    "E712",   # Equality comparisons to True - style preference
    "E721",   # Type comparisons - style preference
    "B009",   # getattr with constant — used intentionally after hasattr guards for duck-typing
    "B007",   # Unused loop variables - cosmetic
    "B904",   # Missing exception chaining - important but large effort
    "B024",   # Abstract base class without abstract methods - design choice
    "B023",   # Function definition does not bind loop variable - acceptable pattern
    "B019",   # lru_cache on methods - acceptable for performance
    "B004",   # hasattr callable check - acceptable pattern
    "I001",   # Import block formatting - handled by formatter
    "N818",   # Exception naming conventions
    "N802",   # Function naming conventions
    "N804",   # First argument of class method should be cls — false positive with Pydantic @model_validator
    # Pyupgrade and modernization - non-critical style issues
    "UP006",  # Use built-in types for type annotations - style preference
    "UP024",  # Replace aliased errors - style preference
    "UP035",  # typing.Dict is deprecated - style preference
    "UP045",  # Use X | None for type annotations - style preference
    "RUF013", # PEP 484 prohibits implicit Optional - style preference
    "RUF059", # Unpacked variable is never used - acceptable in tests
    "RUF012", # Mutable class attributes should use ClassVar - design choice
    "RUF022", # __all__ is not sorted - style preference
    "RUF006", # Store reference to asyncio.create_task - acceptable pattern
    "RUF005", # Consider unpacking instead of concatenation - style preference
    "RUF003", # Comment contains ambiguous character - style issue
    "PLW1508", # Invalid type for environment variable default - acceptable
    "PLW0602", # Using global but no assignment - acceptable pattern
    "PLW1641", # Object does not implement __hash__ - design choice
    "PLC0415", # Import should be at top-level - used to avoid circular imports
    "PLC0414", # Import alias does not rename - acceptable pattern
]

[tool.ruff.lint.pep8-naming]
# Treat Pydantic decorators as classmethod-like so N805 ("first arg should be self")
# does not fire on @field_validator / @model_validator(mode="before"/"after") methods.
classmethod-decorators = [
    "classmethod",
    "pydantic.field_validator",
    "pydantic.model_validator",
    "validator",          # pydantic v1 compat
]

[tool.ruff.lint.per-file-ignores]
"tests/**/*.py" = ["PLC0415"]  # Allow conditional imports in tests for optional dependencies

[tool.ruff.format]
quote-style = "double"
indent-style = "space"
skip-magic-trailing-comma = false
line-ending = "auto"

[tool.ruff.lint.isort]
known-first-party = ["orb"]
combine-as-imports = true

[tool.pyright]
pythonVersion = "3.12"
pythonPlatform = "Linux"
include = ["src/orb", "tests"]
exclude = [
    ".venv", "build", "dist",
    # These tests intentionally import non-existent modules to verify deleted code is gone
    "tests/unit/test_asg_stack_deleted.py",
    "tests/unit/application/test_application_comprehensive.py",
    "tests/unit/infrastructure/test_infrastructure_comprehensive.py",
    "tests/unit/providers/test_providers_comprehensive.py",
]
extraPaths = ["."]
typeCheckingMode = "basic"
reportMissingImports = true
reportMissingTypeStubs = false
reportUnusedVariable = true
reportUnusedImport = true
reportPrivateUsage = false
venvPath = "."
venv = ".venv"

[tool.semantic_release]
version_toml = ["pyproject.toml:project.version"]
version_variables = [".project.yml:version"]
build_command = "make semantic-release-build"
major_on_zero = true
allow_zero_version = true
tag_format = "v{version}"
commit_parser = "conventional"

[tool.semantic_release.branches.main]
match = "(main|master)"
prerelease_token = "rc"
prerelease = false

[tool.semantic_release.branches.release]
match = "release/.*"
prerelease_token = "rc"
prerelease = false

[tool.semantic_release.branches.feature]
match = "fix/.*|feature/.*"
prerelease_token = "alpha"
prerelease = true

[tool.semantic_release.changelog]
exclude_commit_patterns = [
    '''chore(?:\([^)]*?\))?:.+''',
    '''ci(?:\([^)]*?\))?:.+''',
    '''refactor(?:\([^)]*?\))?:.+''',
    '''style(?:\([^)]*?\))?:.+''',
    '''test(?:\([^)]*?\))?:.+''',
    '''build\((?!deps\):.+)''',
    '''Initial [Cc]ommit.*''',
]

[tool.semantic_release.changelog.default_templates]
changelog_file = "CHANGELOG.md"
output_format = "md"

[tool.semantic_release.commit_parser_options]
minor_tags = ["feat"]
patch_tags = ["fix", "perf"]
major_tags = ["release"]
default_bump_level = 2

[tool.semantic_release.remote]
name = "origin"
type = "github"

[tool.semantic_release.publish]
dist_glob_patterns = ["dist/*"]
upload_to_vcs_release = true