pyproject.toml

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "data-safe-haven"
dynamic = ["version"]
description = "An open-source framework for creating secure environments to analyse sensitive data."
authors = [
  { name = "Data Safe Haven development team", email = "safehavendevs@turing.ac.uk" },
]
readme = "README.md"
requires-python = "==3.12.*"
classifiers = [
  "Development Status :: 5 - Production/Stable",
  "Environment :: Console",
  "Intended Audience :: Science/Research",
  "License :: OSI Approved :: BSD License",
  "Operating System :: OS Independent",
  "Programming Language :: Python :: 3",
  "Programming Language :: Python :: 3.12",
  "Topic :: Security",
  "Topic :: System :: Systems Administration",
]
license = { text = "BSD-3-Clause" }
dependencies = [
  "appdirs==1.4.4",
  "azure-core==1.32.0",
  "azure-identity==1.19.0",
  "azure-keyvault-certificates==4.9.0",
  "azure-keyvault-keys==4.10.0",
  "azure-keyvault-secrets==4.9.0",
  "azure-mgmt-compute==33.0.0",
  "azure-mgmt-containerinstance==10.1.0",
  "azure-mgmt-dns==8.2.0",
  "azure-mgmt-keyvault==10.3.1",
  "azure-mgmt-msi==7.0.0",
  "azure-mgmt-rdbms==10.1.0",
  "azure-mgmt-resource==23.2.0",
  "azure-mgmt-storage==21.2.1",
  "azure-storage-blob==12.24.0",
  "azure-storage-file-datalake==12.18.0",
  "azure-storage-file-share==12.20.0",
  "chevron==0.14.0",
  "cryptography==43.0.3",
  "fqdn==1.5.1",
  "psycopg[binary]==3.1.19", # needed for installation on older MacOS versions
  "pulumi-azure-native==2.73.1",
  "pulumi-azuread==6.0.1",
  "pulumi-random==4.16.7",
  "pulumi==3.141.0",
  "pydantic==2.10.1",
  "pyjwt[crypto]==2.10.0",
  "pytz==2024.2",
  "pyyaml==6.0.2",
  "rich==13.9.4",
  "simple-acme-dns==3.2.0",
  "typer==0.13.1",
  "websocket-client==1.8.0",
]

[project.urls]
Documentation = "https://data-safe-haven.readthedocs.io"
Issues = "https://github.com/alan-turing-institute/data-safe-haven/issues"
Source = "https://github.com/alan-turing-institute/data-safe-haven"

[project.optional-dependencies]
docs = [
  "emoji==2.14.0",
  "myst-parser==4.0.0",
  "pydata-sphinx-theme==0.16.0",
  "sphinx-togglebutton==0.3.2",
  "sphinx==8.1.3",
]
lint = [
  "ansible-dev-tools==24.11.0",
  "ansible==11.0.0",
  "black==24.10.0",
  "mypy==1.13.0",
  "pandas-stubs==2.2.3.241009",
  "pydantic==2.10.1",
  "ruff==0.8.0",
  "types-appdirs==1.4.3.5",
  "types-chevron==0.14.2.20240310",
  "types-pytz==2024.2.0.20241003",
  "types-pyyaml==6.0.12.20240917",
  "types-requests==2.32.0.20241016",
]
test = [
  "coverage==7.6.8",
  "freezegun==1.5.1",
  "pytest-mock==3.14.0",
  "pytest==8.3.3",
  "requests-mock==1.12.1",
]

[project.scripts]
dsh = "data_safe_haven.commands.cli:main"

[tool.black]
target-version = ["py312"]

[tool.coverage.paths]
source = ["data_safe_haven/"]

[tool.coverage.run]
relative_files = true
omit= [
  "tests/*",
  "data_safe_haven/resources/*",
]

[tool.hatch.env]
requires = ["hatch-pip-compile"]

[tool.hatch.envs.default]
type = "pip-compile"
lock-filename = ".hatch/requirements.txt"

[tool.hatch.envs.docs]
type = "pip-compile"
lock-filename = ".hatch/requirements-docs.txt"
detached = true
features = ["docs"]

[tool.hatch.envs.docs.scripts]
build = "sphinx-build -M html docs/source/ docs/build/ --fail-on-warning"
clean = "rm -r docs/build"
lint = "mdl --style .mdlstyle.rb ./docs/source"

[tool.hatch.envs.lint]
type = "pip-compile"
lock-filename = ".hatch/requirements-lint.txt"
detached = true
features = ["lint"]

[tool.hatch.envs.lint.scripts]
all = [
  "style",
  "typing",
  "ansible",
]
ansible = "ansible-lint {args:data_safe_haven/resources/workspace/ansible/}"
fmt = [
  "black {args:data_safe_haven tests}",
  "ruff check --fix {args:data_safe_haven tests}",
  "style",
]
style = [
  "ruff check {args:data_safe_haven tests}",
  "black --check --diff {args:data_safe_haven tests}",
]
typing = "mypy {args:data_safe_haven}"

[tool.hatch.envs.test]
type = "pip-compile"
lock-filename = ".hatch/requirements-test.txt"
pip-compile-constraint = "default"
features = ["test"]

[tool.hatch.envs.test.scripts]
test = "coverage run -m pytest {args:} ./tests"
test-report = "coverage report {args:}"
test-coverage = ["test", "test-report"]

[tool.hatch.version]
path = "data_safe_haven/version.py"

[tool.mypy]
disallow_subclassing_any = false  # allow subclassing of types from third-party libraries
files = "data_safe_haven"         # run mypy over this directory
mypy_path = "typings"             # use this directory for stubs
plugins = ["pydantic.mypy"]       # enable the pydantic plugin
strict = true                     # enable all optional error checking flags

[[tool.mypy.overrides]]
module = [
    "acme.*",
    "azure.core.*",
    "azure.identity.*",
    "azure.keyvault.*",
    "azure.mgmt.*",
    "azure.storage.*",
    "dns.*",
    "jwt.*",
    "numpy.*",
    "psycopg.*",
    "pulumi_azure_native.*",
    "pulumi_azuread.*",
    "pulumi_random.*",
    "pulumi.*",
    "pymssql.*",
    "simple_acme_dns.*",
    "sklearn.*",
    "websocket.*",
]
ignore_missing_imports = true

[tool.pytest.ini_options]
addopts = [
    "-vvv",
    "--import-mode=importlib",
    "--disable-warnings",
    "--ignore=data_safe_haven/resources/*",
]

[tool.ruff.lint]
select = [
  # See https://beta.ruff.rs/docs/rules/
  "A",   # flake8-builtins
  "ARG", # flake8-unused-arguments
  "B",   # flake8-bugbear
  "C",   # complexity, mcabe and flake8-comprehensions
  "DTZ", # flake8-datetimez
  "E",   # pycodestyle errors
  "EM",  # flake8-errmsg
  "F",   # pyflakes
  "FBT", # flake8-boolean-trap
  "I",   # isort
  "ICN", # flake8-import-conventions
  "ISC", # flake8-implicit-str-concat
  "N",   # pep8-naming
  "PLC", # pylint convention
  "PLE", # pylint error
  "PLR", # pylint refactor
  "PLW", # pylint warning
  "Q",   # flake8-quotes
  "RUF", # ruff rules
  "S",   # flake8-bandits
  "T",   # flake8-debugger and flake8-print
  "TID", # flake8-tidy-imports
  "UP",  # pyupgrade
  "W",   # pycodestyle warnings
  "YTT", # flake8-2020
]
ignore = [
  "E501",     # ignore line length
  "S106",     # ignore check for possible passwords
  "S603",     # allow subprocess with shell=False, this is lower severity than those with shell=True
  "C901",     # ignore complex-structure
  "PLR0912",  # ignore too-many-branches
  "PLR0913",  # ignore too-many-arguments
  "PLR0915",  # ignore too-many-statements
]

[tool.ruff.lint.flake8-tidy-imports]
ban-relative-imports = "parents"

[tool.ruff.lint.isort]
combine-as-imports = true
known-first-party = ["data_safe_haven"]

[tool.ruff.lint.per-file-ignores]
# Ignore the following for tests only
"tests/**/*" = [
  "PLR2004",  # magic values
  "S101",     # assertions
  "TID252",   # relative imports
]