stride-gpt/pyproject.toml at master · mrwadams/stride-gpt · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
[project]
name = "stride-gpt"
version = "0.19.0"
description = "AI-powered threat modeling using the STRIDE methodology"
readme = "README.md"
license = "MIT"
requires-python = ">=3.12"
authors = [{name = "Matt Adams", email = "mrwadams@gmail.com"}]
keywords = ["threat-modeling", "stride", "security", "owasp", "ai-security", "llm"]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Information Technology",
    "Topic :: Security",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
]
dependencies = [
    "httpx>=0.27",
    "litellm>=1.40",
    "pydantic>=2.0",
    "python-dotenv>=1.0",
    "typer>=0.15",
    "rich>=13.0",
    "prompt_toolkit>=3.0",
    "defusedxml>=0.7.1",
]

[project.urls]
Homepage = "https://github.com/mrwadams/stride-gpt"
Issues = "https://github.com/mrwadams/stride-gpt/issues"
Repository = "https://github.com/mrwadams/stride-gpt"

[project.scripts]
stride-gpt = "stride_gpt.cli:main"

[dependency-groups]
dev = [
    "pytest>=8.4",
    "ruff==0.15.21",
]
# Streamlit web-app deps (apps/web). Kept out of [project.dependencies] so the
# published CLI wheel stays lean; a dependency-group is local/deploy-only and is
# never shipped in the wheel. Streamlit Community Cloud, the Docker UI image
# (Dockerfile.ui), and the security-scan workflow all install these from
# uv.lock, which is the single source of truth for every dependency. Deps
# already in [project.dependencies] (httpx, litellm, pydantic, python-dotenv,
# defusedxml) are not repeated here.
web = [
    "streamlit>=1.58.0",
    "openai",
    "anthropic",
    "groq",
    "pyGithub",
    "tiktoken",
    "requests>=2.34.2",
]

[tool.uv]
# `uv sync` (used by SCC, CI, and release) installs these groups by default, so
# the web app has its deps in every environment without extra flags.
default-groups = ["dev", "web"]
# Security floors for transitive deps not directly imported. Applied at lock
# time and baked into uv.lock, which is the single source of truth for these
# pins (the old requirements.txt duplication has been retired).
# (No tornado floor: Streamlit >=1.59 runs on Starlette/Uvicorn, not Tornado.)
constraint-dependencies = [
    "urllib3>=2.7.0",
    "anyio>=4.14.2",
    "zipp>=4.1.0",
    "h11>=0.16.0",
]

[build-system]
requires = ["setuptools>=68.0"]
build-backend = "setuptools.build_meta"

[tool.setuptools.packages.find]
include = ["stride_gpt*"]

[tool.setuptools.package-data]
"stride_gpt.core.prompts.threat_model" = ["*.md"]

[tool.pytest.ini_options]
testpaths = ["tests"]
pythonpath = [".", "apps/web"]

[tool.black]
line-length = 100
target-version = ['py312']
include = '\.pyi?$'

[tool.ruff]
line-length = 100
target-version = "py312"

[tool.ruff.lint]
select = [
    "E",     # pycodestyle errors
    "W",     # pycodestyle warnings
    "F",     # pyflakes
    "I",     # isort
    "C4",    # flake8-comprehensions (C901 mccabe complexity intentionally excluded)
    "B",     # flake8-bugbear
    "UP",    # pyupgrade
    "N",     # pep8-naming
    "SIM",   # flake8-simplify
    "RET",   # flake8-return
    "PTH",   # flake8-use-pathlib
    "PERF",  # perflint
    "RUF",   # ruff-specific rules
]
ignore = [
    "E501",  # Line too long (handled by black)
]

[tool.ruff.lint.per-file-ignores]
"__init__.py" = ["F401"]  # Unused imports in __init__.py
"utils.py" = ["F401"]  # Backward-compatible re-exports
# load_dotenv() must run before importing modules that read env at import time
"stride_gpt/cli.py" = ["E402"]
# Streamlit sets page config / sys.path before its imports
"apps/web/main.py" = ["E402"]

[tool.isort]
profile = "black"
line_length = 100
multi_line_output = 3
include_trailing_comma = true
force_grid_wrap = 0
use_parentheses = true
ensure_newline_before_comments = true

[tool.mypy]
python_version = "3.12"
warn_return_any = true
warn_unused_configs = true
disallow_untyped_defs = false
disallow_incomplete_defs = false
check_untyped_defs = true
no_implicit_optional = true
warn_redundant_casts = true
warn_unused_ignores = true
warn_no_return = true
strict_optional = true