pyproject.toml

# https://docs.astral.sh/uv/concepts/projects/config/
[project]
name = "notebooks"
version = "3.4"
description = "Open Data Hub / OpenShift AI Notebook / Workbench images, and tests for the same in Python."
readme = "README.md"
requires-python = ">=3.14,<3.15"

# https://docs.astral.sh/uv/concepts/projects/dependencies/#managing-dependencies
dependencies = []

[dependency-groups]
dev = [
    "prek",
    "pyright",
    "ruff",
    #
    "pytest",
    "pytest-cov",
    "pytest-instafail",
    "allure-pytest",
    "hypothesis",
    #
    "pyfakefs",
    # Python 3.14 changed the internal typing._eval_type() function signature - it now includes a new prefer_fwd_module parameter
    # and so pydantic 2.10+ is required to work with from __future__ import annotations on Python 3.14
    "pydantic>=2.13.0",
    "requests",
    #
    "pyyaml",
    # renovate config is in json5
    "pyjson5",
    "ruamel-yaml",
    "structlog",
    #
    "testcontainers",
    "docker",
    "podman",
    "kubernetes",
    "openshift-python-wrapper",
    # Transitive via openshift-python-wrapper → fastmcp;
    "authlib>=1.7.2",
    "typer",
    # certifi provides CA bundle needed on macOS where Python's bundled OpenSSL
    # does not read from the system Keychain, causing CERTIFICATE_VERIFY_FAILED
    "certifi",
    # keyring provides OS-level secret storage for OAuth tokens (macOS Keychain,
    # GNOME Keyring, KWallet) used by scripts/cve/jira_auth.py
    "keyring",
    # pygments provides syntax highlighting for pretty-printed JSON in log output
    "pygments",
    # rich powers the local live progress table in ci/check-image-availability.py
    "rich>=15.0.0",
    "inline-snapshot>=0.34.2",
]

# Optional SMT backend for Hypothesis (z3 ~37MB). Not installed by default.
#   uv sync --group crosshair
#   make test-crosshair
crosshair = [
    "hypothesis[crosshair]",
]

[tool.uv]
required-version = ">=0.11.8,<0.13"
# Supply-chain hardening: only resolve package versions published ≥3 days ago.
# See https://docs.astral.sh/uv/concepts/resolution/#time-restricted-reproducible-resolutions
exclude-newer = "3 days"
package = true
environments = [
    "sys_platform == 'darwin'",
    "sys_platform == 'linux'",
]
# Assert the lockfile is installable on our two target platforms.
# uv lock will fail if any dependency can't be resolved for these.
required-environments = [
    "sys_platform == 'linux' and platform_machine == 'x86_64'",
    "sys_platform == 'darwin' and platform_machine == 'arm64'",
]
# Reject source distributions — require pre-built wheels for all deps.
# Catches packages that need system libraries to build from source
# (e.g. gssapi needing libkrb5-dev) before they reach CI.
no-build = true
# Workaround for https://github.com/astral-sh/uv/issues/12607 —
# no-build blocks local source trees too
no-binary-package = [
    # exempt our own packages
    "notebooks",
    "copr-rebuild",
    "odh-ci-agent",
    # sdist-only deps (pure Python, no system library requirements)
    "openshift-python-wrapper", "pyhelper-utils", "python-simple-logger", "timeout-sampler",
]
# koji hard-depends on requests-gssapi, but we only use unauthenticated
# XML-RPC calls (koji.ClientSession) — no GSSAPI auth needed.
# gssapi has no Linux wheels and needs libkrb5-dev to build from source.
exclude-dependencies = ["requests-gssapi"]

[tool.uv.workspace]
members = ["base-images/copr", "ci/agentic-reviewer"]

# https://github.com/astral-sh/uv/issues/3957#issuecomment-2659350181
[build-system]
requires = ["uv-build>=0.11.8,<0.13"]
build-backend = "uv_build"

# https://docs.astral.sh/uv/concepts/build-backend/#modules
[tool.uv.build-backend]
module-name = ["ntb"]
module-root = ""

# https://coverage.readthedocs.io/en/latest/config.html
[tool.coverage.run]
source = ["ntb", "ci", "scripts"]
branch = true
omit = ["tests/*", "*/__pycache__/*"]

[tool.coverage.report]
show_missing = true
skip_empty = true

# inspired from https://github.com/red-hat-data-services/ods-ci/blob/master/pyproject.toml

# https://15r10nk.github.io/inline-snapshot/configuration/
[tool.inline-snapshot]
format-command = "ruff format --stdin-filename {filename}"

# https://microsoft.github.io/pyright/#/configuration
[tool.pyright]
typeCheckingMode = "basic"
reportMissingImports = "error"
reportUnboundVariable = "error"
reportGeneralTypeIssues = "error"
reportUnnecessaryTypeIgnoreComment = "error"
reportPossiblyUnboundVariable = "warning"
reportOptionalMemberAccess = "none"
reportOptionalSubscript = "none"
include = ["ci/", "tests/", "base-images/", "ci/agentic-reviewer/"]
ignore = [ ]
pythonVersion = "3.14"
pythonPlatform = "Linux"

# docker/podman exec() stubs type output as Iterator[bytes]; runtime returns bytes.
[[tool.pyright.executionEnvironments]]
root = "tests/containers"
reportAttributeAccessIssue = "none"

# https://docs.astral.sh/ruff/configuration
[tool.ruff]
include = [
    "pyproject.toml",
    "ci/**/*.py",
    "ntb/**/*.py",
    "scripts/**/*.py",
    "tests/**/*.py",
    "base-images/**/*.py",
    "jupyter/**/*.ipynb",
]
exclude = [ ]
target-version = "py314"
line-length = 120

# https://docs.astral.sh/ruff/rules
[tool.ruff.lint]
preview = true
select = [
    "B", # flake8-bugbear
    "C4", # flake8-comprehensions
    "COM", # flake8-commas
    "E", "W", # pycodestyle errors/warnings
    "F", # Pyflakes
    "FA", # flake8-future-annotations
    "FLY", # flynt
    "G", # flake8-logging-format
    "I", # isort
    "INP", # flake8-no-pep420
    "INT", # flake8-gettext
    "ISC", # flake8-implicit-str-concat
    "N", # pep8-naming
    "numpy-legacy-random",
    "PERF", # Perflint
    "PGH", # pygrep-hooks
    "PIE", # misc lints
    "PL", # pylint
    "PYI", # flake8-pyi
    "Q", # flake8-quotes
    "RET", # flake8-return
    "RUF", # Ruff-specific
    "S", # flake8-bandit: security checks
    "T10", # flake8-debugger
    "TCH", # type-checking imports
    "TID", # flake8-tidy-imports
    "UP", # pyupgrade
    "YTT", # flake8-2020
]
ignore = [
    # intentionally disabled
    "whitespace-before-punctuation", # needed for how black formats slicing
    "single-line-implicit-string-concatenation", # ruff format wants this disabled
    "logging-f-string", # convenient, and we don't care about performance too much
    # various limits and unimportant warnings
    "line-too-long",
    "ambiguous-variable-name",
    "too-many-public-methods",
    "too-many-branches",
    "too-many-arguments",
    "too-many-statements",
    "too-many-positional-arguments",
    "too-many-return-statements",
    "too-many-locals",
    "magic-value-comparison",
    # "W503", # not yet implemented; line break before binary operator
    # "W504", # not yet implemented; line break after binary operator
    "too-many-nested-blocks",
    # flake8-bandit: noisy, low-value rules
    "suspicious-subprocess-import", # flagging `import subprocess` is too noisy
    "start-process-with-partial-path", # flags well-known executables (git, make, kubectl)
    # TODO
    "mutable-argument-default",
    "missing-trailing-comma",
    "implicit-namespace-package",
    "non-lowercase-variable-in-function",
    "camelcase-imported-as-lowercase",
    "mixed-case-variable-in-global-scope",
    "invalid-module-name",
    "manual-list-comprehension",
    "compare-to-empty-string",
    "literal-membership",
    "no-self-use",
    "unspecified-encoding",
    "redefined-loop-name",
    "unnecessary-return-none",
    "unnecessary-assign",
    "superfluous-else-return",
    "redundant-open-modes",
    "printf-string-formatting",
    "f-string",
    "superfluous-else-continue",
    "superfluous-else-break",
    # ruff 0.15.18+ preview rules — too noisy for existing try/contextmanager patterns
    "too-many-statements-in-try-clause",
    "fallible-context-manager",
]

# Allow unused variables when underscore-prefixed.
dummy-variable-rgx = "^(_+|(_+[a-zA-Z0-9_]*[a-zA-Z0-9]+?))$"

# Don't suggest moving types used in Pydantic models into `if TYPE_CHECKING` import blocks
# https://docs.astral.sh/ruff/settings/#lint_flake8-type-checking_runtime-evaluated-base-classes
flake8-type-checking.runtime-evaluated-base-classes = ["pydantic.BaseModel"]

# https://docs.astral.sh/ruff/settings/#lint_pep8-naming_classmethod-decorators
pep8-naming.classmethod-decorators = ["pydantic.validator"]

[tool.ruff.lint.per-file-ignores]
# Inner functions are serialized and executed inside containers, so imports must be local.
"tests/containers/workbenches/gpu_library_loading_test.py" = ["import-outside-top-level"]
# Ignore many stylistic and formatting rules for notebooks, but keep Pylint rules like PLW0128
"jupyter/**/*.ipynb" = [
    "unreliable-callable-check",
    "E",       # pycodestyle errors (formatting handled by ruff format)
    "F",       # Pyflakes (undefined names common in notebook cell-split execution)
    "W",       # pycodestyle warnings
    "Q",       # flake8-quotes (notebooks use mixed quoting styles)
    "I",       # isort (import ordering not enforced in notebooks)
    "useless-import-alias",
    "import-outside-top-level", # notebooks import inside cells
    "manual-from-import",
    "unnecessary-lambda",
    "unused-noqa",
    "assert",    # notebooks use assert for inline checks
    "subprocess-popen-with-shell-equals-true",
    "subprocess-without-shell-equals-true",
    "call-with-shell-equals-true",
]
"jupyter/**/test/test_notebook.ipynb" = [
    "import-private-name", # %%writefile creates _-prefixed modules
    "subprocess-run-without-check", # subprocess usage in tests only
]
# Tests, CI scripts, and build helpers legitimately use assert and subprocess with shell=True
"tests/**/*.py" = ["assert", "subprocess-popen-with-shell-equals-true", "subprocess-without-shell-equals-true", "call-with-shell-equals-true"]
"ci/**/*.py" = ["assert", "subprocess-popen-with-shell-equals-true", "subprocess-without-shell-equals-true", "call-with-shell-equals-true"]
"scripts/**/*.py" = ["assert", "subprocess-popen-with-shell-equals-true", "subprocess-without-shell-equals-true", "call-with-shell-equals-true"]
# Test assertion helpers use assert by design
"ntb/**/*.py" = ["assert"]
# Copr client wraps CLI commands via subprocess with controlled arguments
"base-images/**/*.py" = ["subprocess-popen-with-shell-equals-true", "subprocess-without-shell-equals-true", "call-with-shell-equals-true"]

# https://docs.astral.sh/ruff/formatter
[tool.ruff.format]
exclude = ["*.ipynb"]
line-ending = "lf"
quote-style = "double"
indent-style = "space"
skip-magic-trailing-comma = false

docstring-code-format = true
docstring-code-line-length = "dynamic"