[build-system]
requires = ["hatchling", "hatch-vcs>=0.4"]
build-backend = "hatchling.build"

[project]
name = "secretscreen"
dynamic = ["version"]
description = "Detect and redact secrets in key-value pairs, dicts, and environment variables. Library and CLI."
readme = "README.md"
license = "MIT"
requires-python = ">=3.11"
authors = [{ name = "Cron", email = "cron@featurecreep.dev" }]
keywords = ["secrets", "redaction", "security", "environment", "docker", "cli", "command-line"]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Environment :: Console",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Security",
    "Topic :: Software Development :: Libraries :: Python Modules",
    "Topic :: Utilities",
    "Typing :: Typed",
]

[project.scripts]
secretscreen = "secretscreen._cli:main"

[project.optional-dependencies]
# Pinned exactly, like every other dependency in these repos. The reason the
# linters previously carried upper bounds still applies and is now covered by
# the pin: an unpinned ruff minor bump (0.15 -> 0.16) silently changed
# formatting rules and broke an unrelated PR.
dev = ["pytest==9.2.0", "pytest-cov==7.1.0", "ruff==0.17.4", "mypy==2.4.1"]

[project.urls]
Homepage = "https://github.com/featurecreep-cron/secretscreen"
Repository = "https://github.com/featurecreep-cron/secretscreen"
Issues = "https://github.com/featurecreep-cron/secretscreen/issues"

[tool.hatch.build.targets.wheel]
packages = ["src/secretscreen"]

[tool.pytest.ini_options]
testpaths = ["tests"]

# Measure the package, not the suite. Bare `pytest --cov` measures everything
# imported, which counts tests/ as covered code and puts patch coverage on the
# test file itself. That penalises exactly the tests worth writing: a branch
# that exists to fail the suite if a bug returns never runs while the code is
# correct, so a passing suite reads as an uncovered line.
#
# Omit rather than `source`: setting a source root rewrites every path in
# coverage.xml relative to it, and codecov matches those paths against the
# repository. Dropping the suite leaves `src/secretscreen/...` exactly as it
# has always been reported.
[tool.coverage.run]
omit = ["tests/*"]

[tool.mypy]
strict = true
warn_return_any = true
warn_unused_configs = true

[tool.ruff]
target-version = "py311"
line-length = 120

[tool.ruff.lint]
select = ["E", "F", "W", "I", "N", "UP", "B", "A", "SIM", "TCH"]
ignore = ["SIM102", "SIM108"]

[tool.hatch.version]
# The git tag is the single source of the version. Nothing writes it into a
# file, so pyproject and the tag cannot drift apart.
source = "vcs"

[tool.semantic_release]
commit_parser = "conventional"
tag_format = "v{version}"
major_on_zero = false
allow_zero_version = true

[tool.semantic_release.commit_parser_options]
minor_tags = ["feat"]
# "deps" is a patch-producing type across our repos. secretscreen has no runtime
# dependencies today so nothing emits it here, but the parser should agree with
# the others the day that changes. allowed_tags must be listed explicitly: its
# default is computed from the class-level defaults, so overriding patch_tags
# alone leaves "deps" unrecognised and silently drops every such commit.
patch_tags = ["fix", "perf", "deps"]
allowed_tags = [
    "feat", "fix", "perf", "deps",
    "build", "chore", "ci", "docs", "style", "refactor", "test",
]

[tool.semantic_release.branches.main]
match = "main"
prerelease = false

[tool.mutmut]
# The architecture tests read the package source to check its shape. Under
# mutmut that source is the instrumented copy, which imports mutmut, so they
# fail on every mutant -- and being static, they could never kill one anyway.
source_paths = ["src/secretscreen"]
pytest_add_cli_args_test_selection = ["tests/"]
pytest_add_cli_args = ["--ignore=tests/test_architecture.py"]