pyproject.toml

[build-system]
requires = ["setuptools>=45", "wheel", "setuptools_scm>=6.2"]
build-backend = "setuptools.build_meta"

[project]
name = "jobserver"
description = "jobserver"
readme = "README.md"
authors = [{name = "OpenSAFELY", email = "tech@opensafely.org"}]
license = {file = "LICENSE"}
classifiers = [
  "License :: OSI Approved :: GNU General Public License v3 (GPLv3)"
]
requires-python = ">=3.12"
dynamic = ["version"]
dependencies = [
    # Password hasher. django.contrib.auth.hashers.Argon2PasswordHasher in settings.py.
    "argon2-cffi",

    # Simplifies retrieving the correct database URL from env variables
    "dj-database-url",

    # The main Django web framework for building applications.
    # Pin to 5.2.x until we are happy with 6.0 compatibility.
    "django>=5.2,<6.0",

    # Email backend integration for Mailgun, used to send emails in Django. See settings.py.
    "django-anymail[mailgun]",

    # Content Security Policy headers for web app security. Search 'csp' in settings.py.
    "django-csp",

    # Provides additional management commands and utilities for Django projects.
    # See jobserver/jobs.
    "django-extensions",

    # Integration for using HTMX with Django, enabling server-driven interactivity.
    "django-htmx",

    # Adds Permissions-Policy headers for feature policy management in Django.
    # See PERMISSIONS_POLICY in settings.py.
    "django-permissions-policy",

    # Integration of the structlog logging library with Django.
    "django-structlog",

    # Helps integrate Vite.js (frontend tooling) into a Django project.
    "django-vite",

    # Toolkit for building REST APIs in Django. Search "from rest_framework"
    "djangorestframework",

    # URL manipulation and building. Used pervasively.
    "furl",

    # A WSGI HTTP server for running Django in production.
    "gunicorn",

    # Handling markdown. Used in some views and snippets.
    "markdown",

    # HTML sanitization. See jobserver/html_utils.py. clean_html() is used in a few views.
    "nh3",

    # A specific version of the OpenSAFELY Pipeline for health data analysis.
    # Search 'pipeline' in jobserver/
    "opensafely-pipeline[fastparser]@https://github.com/opensafely-core/pipeline/archive/refs/tags/v2026.04.22.171515.zip",

    # OpenTelemetry exporter for sending traces/metrics via OTLP over HTTP.
    "opentelemetry-exporter-otlp-proto-http",

    # Instrumentation for tracing Django applications using OpenTelemetry.
    "opentelemetry-instrumentation-django",

    # Instrumentation for tracing database queries made via psycopg2.
    "opentelemetry-instrumentation-psycopg2",

    # Instrumentation for tracing HTTP requests made with the `requests` library.
    "opentelemetry-instrumentation-requests",

    # SDK for working with OpenTelemetry tracing and metrics.
    "opentelemetry-sdk",

    # PostgreSQL database adapter for Python binary.
    "psycopg[binary]",

    # Syntax highlighter. See jobserver/pipeline_config.py where it's used to convert YAML to HTML.
    "pygments",

    # Generates and parses ULID (Universally Unique Lexicographically Sortable Identifier).
    # https://github.com/ulid/spec
    # Search 'ulid' in jobserver/models/
    "python-ulid",

    # Making HTTP requests. Used pervasively.
    "requests",

    # Client for error reporting and performance monitoring with Sentry.
    "sentry-sdk",

    # Slack SDK for building integrations with Slack (e.g., bots, notifications).
    "slack-sdk",

    # Simplifies building Django templates with Tailwind CSS and Alpine.js.
    "slippers",

    # Integration of social authentication for Django projects.
    "social-auth-app-django",

    # Core library for handling social authentication workflows.
    "social-auth-core",

    # Handling exponential backoff. Used in managing github api call retries.
    "stamina",

    # Structured logging. Used pervasively.
    "structlog",

    # Serves static files. Dependabot wasn't updating past 6.3.0 for
    # unclear reasons, and we want to fix #612 from 6.8.0.
    "whitenoise[brotli]>=6.8.0",

    # Password generator. See jobserver/actions/users.py.
    "xkcdpass",
]

[tool.setuptools.packages.find]
exclude = ["tests*"]  # exclude packages matching these glob patterns (empty by default)

[tool.coverage.run]
branch = true
relative_files = true
dynamic_context = "test_function"
omit = [
  "*/migrations/*",
  "applications/management/commands/fix_truncated_data.py",
  "jobserver/asgi.py",
  "jobserver/jobs/*",
  "jobserver/management/commands/count_rows.py",
  "jobserver/management/commands/ensure_backends.py",
  "jobserver/management/commands/get_all_projects.py",
  "jobserver/management/commands/get_transitional_projects.py",
  "jobserver/management/commands/inflate_release_files.py",
  "jobserver/management/commands/list_missing_repos.py",
  "jobserver/management/commands/publish_files.py",
  "jobserver/management/commands/release.py",
  "jobserver/settings.py",
  "jobserver/wsgi.py",
]
parallel = true
source = [
  "airlock",
  "applications",
  "jobserver",
  "redirects",
  "services",
  "staff",
  "tests",
]

[tool.coverage.report]
fail_under = 100
show_missing = true
skip_covered = true

[tool.coverage.html]
show_contexts = true

[tool.pytest.ini_options]
addopts = "--disable-socket --tb=native --maxprocesses=6 --strict-markers"
DJANGO_SETTINGS_MODULE = "jobserver.settings"
env = [
  "JOBSERVER_GITHUB_TOKEN=empty",
  "PASSWORD_HASHERS=django.contrib.auth.hashers.MD5PasswordHasher",
  "SECRET_KEY=12345",
  "SOCIAL_AUTH_GITHUB_KEY=test",
  "SOCIAL_AUTH_GITHUB_SECRET=test",
  "DEFAULT_OUTPUT_CHECKING_REPO=test-repo",
  "DEFAULT_OUTPUT_CHECKING_SLACK_CHANNEL=test-channel",
]
filterwarnings = [
    # Turn warnings into errors.
    "error",
    # See issue #5540 for the test fixes required to remove
    # PytestUnraisableExceptionWarning from filtering.
    "ignore::pytest.PytestUnraisableExceptionWarning:",
    # The FORMS_URLFIELD_ASSUME_HTTPS and associated warning
    # can both be removed when we upgrade to Django >= 6.0.
    # See the FORMS_URLFIELD_ASSUME_HTTPS setting in jobserver/settings.py
    # for more information.
    "ignore:The FORMS_URLFIELD_ASSUME_HTTPS transitional setting is deprecated.:django.utils.deprecation.RemovedInDjango60Warning:",
    # Ignore project.yaml end-user warnings from the opensafely-pipeline library
    "ignore:ProjectWarning:UserWarning:pipeline.*:",
    "ignore:ProjectWarning:UserWarning:tests.*:",
]
markers = [
  "slow_test: mark test as being slow running",
  "verification: tests that verify fakes",
  "functional: tests that use Playwright in functional tests",
]

[tool.ruff]
line-length = 88
exclude = [
  ".direnv",
  ".git",
  ".github",
  ".ipynb_checkpoints",
  ".pytest_cache",
  ".venv",
  "__pycache__",
  "assets",
  "coverage",
  "docker",
  "docs",
  "htmlcov",
  "node_modules",
  "outputs",
  "releases",
  "snippets",
  "static",
  "staticfiles",
  "uploads",
  "venv",
]

[tool.ruff.lint]
isort.lines-after-imports = 2
extend-select = [
  "A",  # flake8-builtins
  "I",  # isort
  "INP",  # flake8-no-pep420
  "ISC",  # flake8-implicit-str-concat
  "UP",  # pyupgrade
  "W",  # pycodestyle warning
]
extend-ignore = [
  "A005", # ignore stdlib-module-shadowing. Would need to re-name services.logging.
  "E501", # ignore line-length. We judge case-by-case.
]

[tool.ruff.lint.per-file-ignores]
"gunicorn.conf.py" = ["INP001"]
"manage.py" = ["INP001"]
"sitecustomize.py" = ["INP001"]

# Note: any `exclude-newer-package` timestamps should be removed if > 7 days old.
# See https://github.com/opensafely-core/repo-template/blob/main/DEVELOPERS.md for details.
[tool.uv]
required-version = ">=0.9"

[dependency-groups]
dev = [
    "coverage[toml]",
    "django-debug-toolbar",
    "django-upgrade",
    "djhtml",
    "factory-boy",
    "pre-commit",
    "pytest-django",
    "pytest-env",
    "pytest-freezer",
    "pytest-icdiff",
    "pytest-mock",
    "pytest-playwright",
    "pytest-socket",
    "pytest-xdist[psutil]",
    "responses",
    "ruff",
    # setuptools is not an explicit dependency,
    # but is pulled in via ruyaml (because of using opensafely-pipeline).
    # This is an attempt to have Dependabot not fail on updating it,
    # which could relate to https://github.com/dependabot/dependabot-core/issues/14118
    "setuptools",
]