pyproject.toml

[build-system]
requires = ["setuptools>=68", "wheel", "setuptools_scm>=8"]
build-backend = "setuptools.build_meta"

[project]
name = "dev-health-ops"
dynamic = ["version"]
description = "Open Source Development Team Operation Analytics"
readme = "README.md"
authors = [{ name = "Chris Geo", email = "chris@example.com" }]
license = { file = "LICENSE.md" }
classifiers = [
  "Development Status :: 4 - Beta",
  "Intended Audience :: Developers",
  "Programming Language :: Python :: 3",
  "Programming Language :: Python :: 3.14",
  "License :: Other/Proprietary License",
  "Operating System :: OS Independent",
]
keywords = ["metrics", "git", "analytics", "developer-experience"]
requires-python = ">=3.14"
dependencies = [
  "tqdm>=4.67.3",
  "sqlalchemy[asyncio]>=2.0.49",
  "clickhouse-connect>=0.15.1",
  "numpy>=2.4.4",
  # Cap < 0.137: fastapi 0.137.0 changed include_router to leave _IncludedRouter
  # entries (no `.path`) in app.routes, which prometheus-fastapi-instrumentator
  # (incl. the latest 8.0.0) crashes on in _get_route_name. Raise the cap once a
  # prometheus-fastapi-instrumentator release handles _IncludedRouter. The >=
  # floor stays for the starlette >=1.0.1 security fix (CHAOS-1772).
  "fastapi>=0.136.1,<0.137",
  "slowapi>=0.1.9",
  "httpx>=0.28.1",
  "psycopg2-binary>=2.9.12",
  "asyncpg>=0.31.0",
  "aiosqlite>=0.22.1",
  "python-gitlab>=8.3.0",
  "GitPython>=3.1.47",
  "PyGithub>=2.1.0,<3.0.0",
  "requests>=2.34.0",
  "pydantic>=2.7.0",
  "PyYAML>=6.0.3",
  "typing_extensions>=4.15.0",
  "jira>=3.10.5",
  "alembic>=1.18.4",
  "uvicorn>=0.46.0",
  "radon>=6.0.1",
  # Multi-language cyclomatic complexity (TS/JS/Go/Java/...); radon stays for Python.
  "lizard>=1.17.10",
  "openai>=2.36.0",
  "anthropic>=0.101.0",
  "strawberry-graphql[fastapi]>=0.315.4",
  "celery[redis]>=5.3.0",
  "croniter>=1.3.0",
  "tzlocal>=5.0",
  "valkey>=6.0.0",
  # Shared Atlassian client library (Jira REST/GraphQL)
  "atlassian-gen-client>=0.1.0b3",
  # Authentication
  "PyJWT>=2.8.0",
  "bcrypt>=4.0.0",
  "email-validator>=2.0.0",
  "cryptography>=41.0.0",
  # Used by licensing Ed25519 signing/verification; do not remove with credential hardening.
  "PyNaCl>=1.5.0",
  "defusedxml>=0.7.0",
  "stripe>=7.0.0",
  "resend>=2.5.0",
  # Observability
  "python-json-logger>=2.0.7",
  "sentry-sdk[fastapi,celery]>=2.0.0",
  # prometheus-fastapi-instrumentator 8.x supports starlette 1.x natively
  # (requires starlette >=1.0,<2.0) and handles `include_router` _IncludedRouter
  # entries that lack `.path` — earlier 6.x/7.x crashed in _get_route_name on
  # starlette >=1.1 (`AttributeError: '_IncludedRouter' object has no attribute
  # 'path'`). The old version-pin dance is no longer required.
  "prometheus-fastapi-instrumentator>=8.0.0",
  # CHAOS-1772 / PYSEC-2026-161 (GHSA-86qp-5c8j-p5mr): starlette < 1.0.1 has a
  # Host-header validation flaw that can bypass path-based auth; stay current.
  "starlette>=1.3.1",
  "prometheus-client>=0.20.0",
  "opentelemetry-api>=1.41.1",
  "opentelemetry-sdk>=1.41.1",
  "opentelemetry-exporter-otlp-proto-grpc>=1.41.1",
  "opentelemetry-instrumentation-fastapi>=0.45b0",
  "opentelemetry-instrumentation-httpx>=0.45b0",
  "opentelemetry-instrumentation-sqlalchemy>=0.45b0",
  "opentelemetry-instrumentation-celery>=0.45b0",
]

[project.optional-dependencies]
dev = [
  "mypy",
  "ruff",
  "pytest",
  "pytest-asyncio",
  "pytest-cov",
  "pytest-xdist>=3.8.0,<4.0.0",
  "fakeredis[valkey]",
  "pip-audit>=2.7.0",
  "mako>=1.3.12",
  "pandas-stubs>=3.0.3.260530",
  # CHAOS-3479: grpc arrives transitively via opentelemetry-exporter-otlp-proto-grpc;
  # stubs needed for tests/workers/test_celery_otel_export.py's direct `import grpc`.
  "types-grpcio>=1.83.0.20260730",
  # CHAOS-3034 compatibility probe only. Production Python code must enqueue
  # through the worker_job_outbox fallback unless a compatible client ships.
  "riverqueue==0.7.0",
]
enterprise-sso = ["signxml>=3.0.0"]

[project.urls]
Repository = "https://github.com/chrisgeo/dev-health-ops"
Issues = "https://github.com/chrisgeo/dev-health-ops/issues"
Documentation = "https://github.com/chrisgeo/dev-health-ops/blob/main/docs/architecture/licensing.md"
License = "https://github.com/chrisgeo/dev-health-ops/blob/main/LICENSE.md"

[project.scripts]
dev-health-ops = "dev_health_ops.cli:main"
dev-hops = "dev_health_ops.cli:main"


[tool.setuptools_scm]
version_scheme = "post-release"
local_scheme = "dirty-tag"

[tool.setuptools]
package-dir = { "" = "src" }
packages = { find = { where = [
  "src",
], exclude = [
  "tests*",
  "docs*",
  "examples*",
  "data*",
  "grafana*",
  "docker*",
  "dist*",
  "build*",
] } }
py-modules = ["cli", "investment_taxonomy", "storage", "utils"]
include-package-data = true

[tool.setuptools.package-data]
"*" = [
  "**/*.sql",
  "**/*.yaml",
  "**/*.yml",
  "**/*.json",
  "**/*.mako",
  "**/*.html",
  "**/*.txt",
]

[tool.setuptools.data-files]
"contracts/jobs/v1" = [
  "contracts/jobs/v1/*.json",
  "contracts/jobs/v1/*.md",
]
"contracts/jobs/v1/examples" = ["contracts/jobs/v1/examples/*.json"]
"contracts/jobs/v1/schemas" = ["contracts/jobs/v1/schemas/*.json"]

[tool.ruff]
line-length = 88
# Intentionally lagging the shipped interpreter (3.14, see requires-python
# below and docker/Dockerfile). Bumping this to py314 surfaces ~2880
# pyupgrade findings across 624 files (2793 auto-fixable; the format check
# also reformats 94 files for PEP 758) plus 87 non-mechanical UP042/046/047/
# 040 modernizations that need per-site review (UP042 str-enum in particular
# changes __str__ semantics, not just syntax). That's a codebase change, not
# a CI-config change — tracked separately as CHAOS-3420. Do not bump this
# without landing that cleanup first, or lint.yml breaks repo-wide.
target-version = "py310"
exclude = [
  ".git",
  ".venv",
  "venv",
  "__pycache__",
  "docs",
  # Non-source documentation trees. Ruff 0.16 formats Python code fences in
  # Markdown; .planning holds internal planning notes.
  ".planning",
  "build",
  "dist",
  "migrations",
  "site",
]

[tool.ruff.lint]
select = ["E", "F", "W", "I", "UP"]
ignore = ["E203", "E501"]
per-file-ignores = { "__init__.py" = [
  "F401",
], "src/dev_health_ops/api/main.py" = [
  "E402",
], "tests/test_ingest_streams.py" = [
  "E402",
], "tests/api/test_external_ingest_streams.py" = [
  "E402",
], "tests/api/test_external_ingest_consumer.py" = [
  "E402",
], "tests/api/test_external_ingest_stream_health.py" = [
  "E402",
] }

[tool.ruff.format]
quote-style = "double"
indent-style = "space"

[tool.mypy]
python_version = "3.14"
files = ["src", "tests", "scripts"]
plugins = ["pydantic.mypy"]
mypy_path = "$MYPY_CONFIG_FILE_DIR/src"
namespace_packages = true
explicit_package_bases = true
show_error_codes = true
pretty = true
follow_imports = "silent"
warn_unused_configs = true
warn_unused_ignores = true
warn_redundant_casts = true
no_implicit_optional = true
check_untyped_defs = true
disallow_untyped_defs = false
disallow_incomplete_defs = false

[[tool.mypy.overrides]]
module = [
  "celery",
  "celery.*",
  "billiard",
  "billiard.*",
  "kombu",
  "kombu.*",
  "atlassian",
  "atlassian.*",
  "radon",
  "radon.*",
  "lizard",
  "lizard.*",
  "croniter",
  "croniter.*",
  "defusedxml",
  "defusedxml.*",
  "signxml",
  "signxml.*",
  "yaml",
  "yaml.*",
  "tabulate",
  "tabulate.*",
  "clickhouse_connect",
  "clickhouse_connect.*",
  "riverqueue",
  "riverqueue.*",
  "motor",
  "motor.*",
]
ignore_missing_imports = true

# Sibling test modules imported by ``tests/api/graphql/test_resolver_sql_explain.py``
# under pytest's rootdir/sys.path discovery (no ``tests/api/graphql/__init__.py``).
# Mypy can't resolve them as top-level modules but pytest can.
[[tool.mypy.overrides]]
module = [
  "_sql_explain_helpers",
  "sql_explain_fixtures",
]
ignore_missing_imports = true