pyproject.toml

[build-system]
requires = ["setuptools==83.0.0", "wheel==0.47.0"]
build-backend = "setuptools.build_meta"

[project]
name = "cloudsmith-cli"
dynamic = ["version"]
description = "Cloudsmith Command-Line Interface (CLI)"
readme = "README.md"
license = "Apache-2.0"
license-files = ["LICENSE"]
authors = [
    { name = "Cloudsmith Ltd", email = "support@cloudsmith.io" },
]
requires-python = ">=3.10.0"
keywords = ["cloudsmith", "cli", "devops"]
classifiers = [
    # As from http://pypi.python.org/pypi?%3Aaction=list_classifiers
    # 'Development Status :: 1 - Planning',
    # 'Development Status :: 2 - Pre-Alpha',
    # 'Development Status :: 3 - Alpha',
    # 'Development Status :: 4 - Beta',
    "Development Status :: 5 - Production/Stable",
    # 'Development Status :: 6 - Mature',
    # 'Development Status :: 7 - Inactive',
    "Environment :: Console",
    "Intended Audience :: Developers",
    "Intended Audience :: System Administrators",
    "Operating System :: POSIX :: Linux",
    "Programming Language :: Python",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Topic :: Internet",
    "Topic :: System :: Systems Administration",
    "Topic :: Utilities",
]
dependencies = [
    "click>=8.2,!=8.3.0",
    "click-configfile>=0.2.3",
    "click-didyoumean>=0.0.3",
    "click-spinner>=0.1.7",
    "json5>=0.9.0",  # For parsing JSONC (JSON with comments) in VS Code settings
    "cloudsmith-api>=2.0.31,<3.0",  # Compatible up to (but excluding) 3.0+
    "keyring>=25.4.1",
    "keyrings-alt>=5.0.2",
    "keyrings-cryptfile>=1.3.9",
    # Security floors for MCP's runtime dependency graph. Keep these explicit:
    # downstream installers do not consume uv.lock and could otherwise select
    # vulnerable transitive versions allowed by MCP's broader constraints.
    "cryptography>=50.0.0",
    "mcp==1.28.1",
    "pydantic-settings>=2.14.2",
    # The crypto extra must be declared here: the OIDC flow verifies JWT
    # signatures, and a bare PyJWT requirement would let the
    # standalone-binary build resolve without the cryptography wheels.
    "PyJWT[crypto]>=2.13.0",
    "python-toon==0.1.2",
    "requests>=2.18.4",
    "requests_toolbelt>=1.0.0",
    "rich>=13.0.0",
    "semver>=2.7.9",
    "starlette>=1.3.1",
    "urllib3>=2.5",
    "tomlkit>=0.15.0",
]

[project.optional-dependencies]
aws = ["boto3[crt]>=1.26.0"]
all = ["boto3[crt]>=1.26.0"]

[project.scripts]
cloudsmith = "cloudsmith_cli.cli.commands.main:main"
terraform-credentials-cloudsmith = "cloudsmith_cli.wrapper:main_entry"

[project.urls]
Homepage = "https://github.com/cloudsmith-io/cloudsmith-cli"

[dependency-groups]
dev = [
    "boto3[crt]>=1.26.0",
    "pre-commit",
    "pylint",
    "pytest-cov",
    "freezegun",
    "ty",
    "httpretty",
    "bumpversion",
]
binary = [
    "pyinstaller==6.20.0",
    "pyinstaller-hooks-contrib==2026.5",
    "setuptools==83.0.0",
    "wheel==0.47.0",
]
release = [
    "build==1.5.0",
    "check-wheel-contents==0.6.3",
    "setuptools==83.0.0",
    "twine==6.2.0",
    "wheel==0.47.0",
]

[tool.setuptools.dynamic]
version = { file = "cloudsmith_cli/data/VERSION" }

[tool.setuptools]
include-package-data = false

[tool.setuptools.packages.find]
include = ["cloudsmith_cli*"]
exclude = ["cloudsmith_cli.tests*", "cloudsmith_cli.*.tests*", "cloudsmith_cli.*.*.tests*"]
namespaces = false

[tool.setuptools.package-data]
cloudsmith_cli = ["data/*", "templates/*"]

[tool.pytest.ini_options]
addopts = "--strict-markers"
norecursedirs = ["bin", ".git", ".venv"]
testpaths = ["cloudsmith_cli"]
markers = [
    "integration: tests that call the live Cloudsmith service",
]

[tool.coverage.run]
branch = true
source = ["cloudsmith_cli"]
omit = []

[tool.coverage.report]
exclude_lines = [
    "pragma: no cover",
    # Don't complain about missing debug-only code:
    "def __unicode__",
    "def __repr__",
    "if self\\.debug",
    # Don't complain if tests don't hit defensive assertion code:
    "raise AssertionError",
    "raise NotImplementedError",
    # Don't complain if non-runnable code isn't run:
    "if 0:",
    "if __name__ == .__main__.:",
]
omit = [
    "cloudsmith_cli/*/__init__.py",
    "cloudsmith_cli/*/__main__.py",
]
show_missing = true

[tool.coverage.html]
directory = "reports/coverage"

[tool.ruff.lint]
extend-select = ["C4", "FA", "PERF", "TC", "TID253"]
ignore = ["TRY002", "BLE001", "PERF203"]

[tool.ruff.lint.flake8-tidy-imports]
# These modules dominate CLI startup time. Import them inside functions,
# or add the file to the allowlist below when a module is itself loaded
# lazily (see cli/commands/registry.py and cli/tests/test_startup_imports.py).
banned-module-level-imports = [
    "cloudsmith_api",
    "httpx",
    "keyring",
    "mcp",
    "requests",
    "rich",
    "semver",
    "urllib3",
]

[tool.ruff.lint.per-file-ignores]
'__init__.py' = ["F401"]
# Lazy leaves: modules that are only imported when their command or code
# path runs, so module-level imports of heavy modules are free at startup.
'cloudsmith_cli/cli/commands/*' = ["TID253"]
'cloudsmith_cli/cli/saml.py' = ["TID253"]
'cloudsmith_cli/conftest.py' = ["TID253"]
'cloudsmith_cli/core/api/*' = ["TID253"]
'cloudsmith_cli/core/credentials/oidc/exchange.py' = ["TID253"]
'cloudsmith_cli/core/download.py' = ["TID253"]
'cloudsmith_cli/core/mcp/*' = ["TID253"]
'cloudsmith_cli/core/rest.py' = ["TID253"]
'cloudsmith_cli/core/session.py' = ["TID253"]
'cloudsmith_cli/core/sso.py' = ["TID253"]