tox.ini

[tox]
envlist = python310

[testenv]
usedevelop = true
extras = dev
allowlist_externals = sh
commands =
    pytest
    ruff format --check --line-length 120 .
    ruff check .
    mypy --strict --ignore-missing-imports .
    bandit -c pyproject.toml -r -q .

[testenv:placeholders]
# Fail if pyproject.toml still has the template's placeholder strings.
# Covers every field the README setup walks through: name, authors,
# description, tool.setuptools.packages.find.include, tool.pytest.ini_options.testpaths.
# Run in CI for scaffolded plugins; skipped on the template repo itself.
skip_install = true
allowlist_externals = sh
commands =
    sh -c 'if grep -nE "placeholder-my-plugin|Your Name placeholder|placeholder@placeholder[.]com|TEMPLATE PLACEHOLDER|\"placeholder[*]\"|\"placeholder\"" pyproject.toml; then echo; echo "ERROR: pyproject.toml still contains template placeholder strings."; echo "Update name, authors, description, tool.setuptools.packages.find.include, and tool.pytest.ini_options.testpaths before publishing."; exit 1; fi'

[testenv:security]
# CVE scanning environment - builds and scans the local package
usedevelop = true
extras = dev
deps =
    pip-audit
allowlist_externals = sh, mkdir
commands =
    mkdir -p security-reports

    sh -c "pip list"

    # Run CVE scan on installed dependencies
    sh -c "pip-audit --desc --format=json --output=security-reports/pip-audit.json || pip-audit --desc"

    # Display summary
    sh -c "echo '=== CVE Scan Summary ==='"
    sh -c "echo 'Tool: pip-audit (Apache 2.0 licensed)'"
    sh -c "echo 'Report: security-reports/pip-audit.json'"