[build-system]
requires = ["setuptools>=61.0"]
build-backend = "setuptools.build_meta"

[project]
name = "skilltotal"
# Single source of truth for the version is skilltotal/__init__.py (__version__);
# a hardcoded copy here once drifted (0.1.0 vs 0.3.0) and nearly shipped mislabeled.
dynamic = ["version"]
description = "AI Component Security Platform — static security analysis for AI components (CLI engine)"
readme = "README.md"
requires-python = ">=3.10"
license = { text = "Apache-2.0" }
authors = [{ name = "SkillTotal" }]
keywords = [
    "security", "ai", "mcp", "supply-chain", "static-analysis", "prompt-injection",
    "agentic-ai", "agent-security", "ai-security", "cloud-security-alliance", "csa",
    "maestro", "mitre-atlas", "llm-security",
]
classifiers = [
    "Development Status :: 4 - Beta",
    "Environment :: Console",
    "Intended Audience :: Developers",
    "Intended Audience :: System Administrators",
    "License :: OSI Approved :: Apache Software License",
    "Operating System :: OS Independent",
    "Topic :: Security",
    "Topic :: Software Development :: Quality Assurance",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
]
# Zero runtime dependencies — Python standard library only.
dependencies = []

[project.optional-dependencies]
# Dev-only — the runtime engine stays zero-dependency. jsonschema validates that reports
# conform to docs/report.schema.json (the engine<->consumer contract).
dev = [
    "pytest>=7.0",
    "ruff>=0.4",
    "jsonschema>=4.0",
    "bandit>=1.7",
    "build>=1.0",
    "twine>=5.0",
    "pre-commit>=3.5",
    "detect-secrets>=1.5",
]

[project.scripts]
skilltotal = "skilltotal.cli:main"

[project.urls]
Homepage = "https://www.skilltotal.ai"
Repository = "https://github.com/pezhik/skilltotal"
Documentation = "https://github.com/pezhik/skilltotal/tree/main/docs"
Issues = "https://github.com/pezhik/skilltotal/issues"
Changelog = "https://github.com/pezhik/skilltotal/blob/main/CHANGELOG.md"

[tool.setuptools.packages.find]
include = ["skilltotal*"]

[tool.setuptools.dynamic]
version = { attr = "skilltotal.__version__" }

[tool.pytest.ini_options]
testpaths = ["tests"]
# manual_eval holds the manual calibration harness, generators, and a cloned third-party
# corpus (with its own tests) — none of it should be collected by our test run.
addopts = "-q --ignore=tests/manual_eval"

[tool.bandit]
# Scan the engine package; fixtures/corpus/tests are not shipped code.
exclude_dirs = ["tests", "build", "dist"]

[tool.ruff]
line-length = 100
target-version = "py310"
# The synthetic detection-efficacy samples are inert test DATA, not shipped code; their import
# order / idioms are part of the attack/benign shape and must not be normalized by the linter.
#
# tests/manual_eval/corpus is THIRD-PARTY source fetched by the calibration harness (gitignored,
# absent on a clean checkout). Linting it reports other projects' style as our failures, and it
# would fail lint on any machine that has run calibration.
extend-exclude = ["tests/eval_corpus", "tests/manual_eval/corpus"]

[tool.ruff.lint]
select = ["E", "F", "I", "UP", "B"]
# Scanner regexes intentionally contain detection string literals (e.g. "eval", "exec");
# they are not executable code, so no per-file ignores are needed here.