pyproject.toml

[project]
name = "cja-auto-sdr"
dynamic = ["version"]
description = "Customer Journey Analytics SDR Generator with Data Quality Validation"
readme = "README.md"
license = {text = "MIT"}
requires-python = ">=3.14"
classifiers = [
    "Development Status :: 5 - Production/Stable",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: MIT License",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.14",
    "Topic :: Software Development :: Documentation",
]
dependencies = [
    "cjapy>=0.3.1",
    "numpy>=2.2.0,!=2.4.0",
    "pandas>=2.3.3,<3",
    "xlsxwriter>=3.2.9",
    "tqdm>=4.66.0",
    # Security floors for transitive dependencies (pulled via cjapy->requests and
    # notion-client->httpx). Promoted to direct deps so the secure minimum is enforced
    # in our lockfile and propagated to PyPI installers. Remove once upstream raises floors.
    "idna>=3.15",       # CVE-2026-45409 — idna.encode() bypass (GHSA-65pc-fj4g-8rjx)
    "urllib3>=2.7.0",   # CVE-2026-44431/44432 — cross-origin header leak + decompression bomb
]

[project.urls]
Homepage = "https://github.com/brian-a-au/cja_auto_sdr"
Repository = "https://github.com/brian-a-au/cja_auto_sdr"
Issues = "https://github.com/brian-a-au/cja_auto_sdr/issues"
Changelog = "https://github.com/brian-a-au/cja_auto_sdr/blob/main/CHANGELOG.md"

[project.scripts]
cja_auto_sdr = "cja_auto_sdr.__main__:main"
cja-auto-sdr = "cja_auto_sdr.__main__:main"

[project.optional-dependencies]
clustering = [
    "scipy>=1.14.0",
]
env = [
    "python-dotenv>=1.0.0",
]
completion = [
    "argcomplete>=3.0.0",
]
notion = [
    "notion-client>=3.0.0",
]
full = [
    "scipy>=1.14.0",
    "python-dotenv>=1.0.0",
    "argcomplete>=3.0.0",
    "notion-client>=3.0.0",
]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.version]
path = "src/cja_auto_sdr/core/version.py"

[tool.hatch.build.targets.wheel]
packages = ["src/cja_auto_sdr"]

[tool.hatch.build.targets.sdist]
include = [
    "/src",
    "pyproject.toml",
    "README.md",
    "LICENSE",
]

[dependency-groups]
dev = [
    "pytest>=9.0.3",
    "pytest-cov>=4.1.0",
    "pytest-xdist>=3.6.0",
    "ruff>=0.9.0",
    "openpyxl>=3.1.0",
    "notion-client>=3.0.0",
]

[tool.ruff]
target-version = "py314"
line-length = 120
src = ["src", "tests"]

[tool.ruff.lint]
select = [
    "E",    # pycodestyle errors
    "W",    # pycodestyle warnings
    "F",    # pyflakes
    "I",    # isort
    "UP",   # pyupgrade
    "B",    # flake8-bugbear
    "SIM",  # flake8-simplify
    "RUF",  # ruff-specific rules
    "PERF", # perflint
    "DTZ",  # flake8-datetimez
    "RET",  # flake8-return
    "S",    # flake8-bandit (security)
    "C4",   # flake8-comprehensions
    "PT",   # flake8-pytest-style
    "PIE",  # flake8-pie
    "ISC",  # implicit string concatenation
    "TID",  # tidy imports
    "A",    # flake8-builtins
    "PLE",  # pylint errors
    "RSE",  # unnecessary parens on raise
    "PLW",  # pylint warnings
    "T",    # flake8-print (catch stray print statements)
    "LOG",  # flake8-logging (logging best practices)
    "ARG",  # flake8-unused-arguments
    "FURB", # refurb (modern Python idioms)
    "FLY",  # flynt (f-string conversion)
    "FA",   # flake8-future-annotations
    "YTT",  # flake8-2020 (sys.version checks)
    "PD",   # pandas-vet
    "SLOT", # flake8-slots
    "ICN",  # flake8-import-conventions
    "EXE",  # flake8-executable
    "INT",  # flake8-gettext
    "NPY",  # numpy-specific rules
    "AIR",  # airflow-specific rules
    "ASYNC", # flake8-async
    "INP",  # flake8-no-pep420 (implicit namespace packages)
    "ERA",  # eradicate (commented-out code)
    "Q",    # flake8-quotes
    "COM",  # flake8-commas (trailing commas)
    "TCH",  # flake8-type-checking
]
ignore = [
    "E501",    # line too long (handled by formatter)
    "SIM108",  # ternary operator (readability preference)
    "S101",    # assert (used in tests and src invariant checks)
    "S311",    # random (used for retry jitter, not crypto)
    "S603",    # subprocess call (legitimate CLI tool usage)
    "S606",    # os.startfile (legitimate CLI tool usage)
    "S607",    # partial executable path (legitimate CLI tool usage)
    "PT011",   # pytest.raises too broad (matching messages makes tests brittle)
    "PT012",   # multiline pytest.raises block (common with context managers)
    "PLW1510", # subprocess.run without check (intentional in git helpers)
    "COM812",  # trailing comma (conflicts with ruff formatter)
    "TC001",   # type-checking-only import (false positives on runtime imports)
    "TC002",   # type-checking-only import (false positives on runtime imports)
    "TC003",   # type-checking-only import (false positives on runtime imports)
]

[tool.ruff.lint.per-file-ignores]
"src/cja_auto_sdr/generator.py" = ["F401", "E402", "RUF001", "RUF003", "SIM115", "S105", "PLW2901", "T201"]  # F401: re-exports; E402: optional imports; RUF001/3: intentional Unicode symbols; SIM115: NamedTemporaryFile with delete=False; S105: token_name false positive; PLW2901: line=line.strip() pattern; T201: intentional CLI console output
"src/cja_auto_sdr/__main__.py" = ["T201"]  # intentional CLI console output
"src/cja_auto_sdr/core/credentials.py" = ["PLW2901"]  # line=line.strip() pattern
"src/cja_auto_sdr/inventory/calculated_metrics.py" = ["ERA001"]  # section header comments
"src/cja_auto_sdr/org/__init__.py" = ["ERA001"]  # section header comments
"src/cja_auto_sdr/org/writers/__init__.py" = ["F401", "ERA001", "RUF001", "RUF003"]  # F401: re-exports from submodules; ERA001: section header comments; RUF001/3: intentional Unicode symbols
"src/cja_auto_sdr/org/writers/common.py" = ["RUF001"]  # intentional Unicode ↔ in recommendation context
"src/cja_auto_sdr/org/writers/trending.py" = ["T201", "RUF001", "RUF003"]  # T201: intentional CLI console output; RUF001/3: intentional Unicode symbols
"src/cja_auto_sdr/org/writers/console.py" = ["T201", "RUF001", "RUF003"]  # T201: intentional CLI console output; RUF001/3: intentional Unicode symbols
"src/cja_auto_sdr/core/exit_codes.py" = ["T201"]  # intentional CLI console output
"src/cja_auto_sdr/core/logging.py" = ["PLW0603", "T201"]  # legitimate global state for logging init; T201: fallback console output before logger is ready
"src/cja_auto_sdr/api/quality_policy.py" = ["T201"]  # intentional CLI console output (quality report to stdout)
"src/cja_auto_sdr/api/*.py" = ["F822"]       # lazy forwarding modules (resolved via __getattr__)
"src/cja_auto_sdr/cli/*.py" = ["F822"]       # lazy forwarding modules
"src/cja_auto_sdr/core/profiles.py" = ["F822"]  # lazy forwarding module
"src/cja_auto_sdr/diff/*.py" = ["F822"]      # lazy forwarding modules
"src/cja_auto_sdr/diff/snapshot.py" = ["F822", "T201"]  # lazy forwarding + intentional CLI progress output
"src/cja_auto_sdr/inventory/*.py" = ["F822"] # lazy forwarding modules
"src/cja_auto_sdr/output/**/*.py" = ["F822"] # lazy forwarding modules
"src/cja_auto_sdr/output/inventory/summary.py" = ["T201"]  # intentional CLI console output (inventory summary display)
"src/cja_auto_sdr/output/writers/notion.py" = ["T201", "RUF001", "RUF003"]  # T201: stderr error messages before logger is wired; RUF001/3: intentional Unicode emoji (ℹ ⚠ 🔴)
"src/cja_auto_sdr/output/run_summary.py" = ["T201"]  # intentional CLI console output (run summary to stdout)
"src/cja_auto_sdr/output/diff/console.py" = ["RUF001", "RUF003"]  # intentional Unicode box-drawing characters
"src/cja_auto_sdr/output/diff/grouped.py" = ["RUF001"]  # intentional Unicode arrow (→) in output
"src/cja_auto_sdr/output/diff/pr_comment.py" = ["RUF001", "RUF003", "PERF401"]  # intentional Unicode emoji (➕➖✏️); PERF401: append-in-slice-loop pattern preserved from generator.py
"src/cja_auto_sdr/output/sdr/__init__.py" = ["F822", "ERA001", "RUF001", "RUF003"]  # F822: lazy forwarding; ERA001: section header comments; RUF001/3: intentional Unicode symbols
"src/cja_auto_sdr/pipeline/*.py" = ["F822"]  # lazy forwarding modules
"tests/**" = ["B", "SIM", "RUF012", "PERF", "DTZ", "S105", "S108", "S110", "S314", "PT017", "PT018", "PT019", "ARG", "T201", "ERA001", "PD011", "FLY002"]
"tests/test_notion_writer.py" = ["RUF001", "RUF003"]  # intentional Unicode emoji (ℹ ⚠ 🔴) in severity-icon assertions
"scripts/orchestrator.py" = ["T201"]  # intentional CLI output in standalone script
"scripts/create_sample_outputs.py" = ["T201"]  # intentional CLI output in standalone script
"scripts/stress_test.py" = ["T201"]  # intentional CLI output in standalone script
"scripts/smoke_test_production.py" = ["T201"]  # intentional CLI output in standalone script
"examples/**" = ["INP001", "T201"]  # INP001: not a package; T201: example scripts use print

[tool.ruff.lint.isort]
known-first-party = ["cja_auto_sdr"]