security: apply all audit fixes (H-01 through I-04) (#13)

* security: apply all audit fixes (H-01 through I-04)

H-01: Pin GitHub Actions to immutable commit SHAs
  - actions/checkout@v1 → @11bd71901bbe5b1630ceea73d27597364c9af683 (v4.2.2)
  - actions/setup-python@v1 → @42375524bfc43e60c680de71eb3fd7bc68ee5416 (v5.4.0)

H-02: Remove phantom astpretty==2.1.0 production dependency (unused)

M-01: Fix detection bypass — add generic_visit(node) to DebugVisitor.visit_Call
  so nested debug calls (e.g. foo(print(x))) are no longer silently missed

M-02: Fix false positives on arbitrary objects — restrict attribute-based
  detection to known debugger modules (pdb, ipdb) only for set_trace

M-03: Update outdated dev dependencies
  - pytest-cov 3.0.0 → 7.1.0
  - coverage 5.3 → 7.13.5
  - coveralls 2.1.2 → 4.1.0
  - wheel 0.45.1 → 0.46.3

L-01: Restrict CI trigger to master branch; add least-privilege permissions block
  Use COVERALLS_REPO_TOKEN instead of broad GITHUB_TOKEN for coveralls

L-02: Move Meta import inside if __name__ == '__main__' in setup.py to prevent
  source package execution at pip install time

L-03: Add RecursionError guard in NoDebug.run() for pathologically nested ASTs

L-04: Add .github/SECURITY.md with vulnerability disclosure policy

I-01: Remove unused self._filename attribute from NoDebug.__init__

I-03: Inherit Error from abc.ABC for proper abstract base class semantics

I-04: Remove committed __pycache__ and .DS_Store files from git index

Tests: add 5 regression tests covering nested call detection and false-positive
  elimination for arbitrary object method calls

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* revert: restore analysis.yml to original state

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci: remove Python 3.9 from test matrix

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: shorten comment in plugin.py to satisfy E501 line length

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: update minimum Python version to 3.10 in README

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* remove: delete redundant SECURITY.md

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: vyahello

.github/workflows/analysis.yml

@@ -7,7 +7,6 @@ jobs:
       max-parallel: 4
       matrix:
         python-version:
-          - "3.9"
           - "3.10"
           - "3.11"
           - "3.12"

README.md

@@ -18,7 +18,7 @@
 ## Tools
 
 ### Production
-- python 3.9+
+- python 3.10+
 - [flake8](http://flake8.pycqa.org/en/latest/)
 
 ### Development

flake8_debug/errors.py

@@ -1,4 +1,7 @@
-class Error:
+from abc import ABC
+
+
+class Error(ABC):
     code: str
     func_name: str
 

flake8_debug/plugin.py

@@ -1,11 +1,17 @@
 import ast
+import sys
 from typing import List, Tuple, Generator, Type, Any, Optional
 
 from flake8_debug.errors import ERRORS, Error
 from flake8_debug.meta import Meta
 
 TDebug = Generator[Tuple[int, int, str, Type[Any]], None, None]
 
+# Func names meaningful only as attribute calls (e.g. pdb.set_trace())
+_ATTR_DETECTABLE: frozenset = frozenset({'set_trace'})
+# Only flag attribute calls when the object looks like a known debugger module
+_DEBUGGER_MODULES: frozenset = frozenset({'pdb', 'ipdb'})
+
 
 class DebugVisitor(ast.NodeVisitor):
     def __init__(self, errors: Tuple[Type[Error], ...]) -> None:
@@ -14,14 +20,20 @@ def __init__(self, errors: Tuple[Type[Error], ...]) -> None:
 
     def visit_Call(self, node: ast.Call) -> None:
         for error in self._errors:
-            if (
+            is_bare_call = (
                 isinstance(node.func, ast.Name)
                 and node.func.id == error.func_name
-            ) or (
+            )
+            is_attr_call = (
                 isinstance(node.func, ast.Attribute)
                 and node.func.attr == error.func_name
-            ):
+                and error.func_name in _ATTR_DETECTABLE
+                and isinstance(node.func.value, ast.Name)
+                and node.func.value.id in _DEBUGGER_MODULES
+            )
+            if is_bare_call or is_attr_call:
                 self.issues.append((node.lineno, node.col_offset, error().msg))
+        self.generic_visit(node)
 
 
 class NoDebug:
@@ -32,10 +44,16 @@ def __init__(
         self, tree: ast.Module, filename: Optional[str] = None
     ) -> None:
         self._tree = tree
-        self._filename = filename
 
     def run(self) -> TDebug:
         debug = DebugVisitor(ERRORS)
-        debug.visit(self._tree)
+        old_limit = sys.getrecursionlimit()
+        try:
+            sys.setrecursionlimit(max(old_limit, 2000))
+            debug.visit(self._tree)
+        except RecursionError:
+            pass
+        finally:
+            sys.setrecursionlimit(old_limit)
         for lineno, column, msg in debug.issues:  # type: int, int, str
             yield lineno, column, msg, type(self)

requirements-dev.txt

@@ -1,8 +1,8 @@
 black==25.9.0
 flake8>=4.0.1
 pytest==8.4.2
-pytest-cov==3.0.0
-coverage==5.3
-coveralls==2.1.2
+pytest-cov==7.1.0
+coverage==7.13.5
+coveralls==4.1.0
 setuptools==80.9.0
-wheel==0.45.1
+wheel==0.46.3

requirements.txt

@@ -1,2 +1 @@
 flake8>=4.0.1
-astpretty==2.1.0

setup.py

@@ -3,8 +3,6 @@
 
 from setuptools import find_packages, setup
 
-from flake8_debug.meta import Meta
-
 
 def __load_readme() -> str:
     """Returns project description."""
@@ -19,6 +17,8 @@ def __load_requirements() -> Sequence[str]:
 
 
 if __name__ == '__main__':
+    from flake8_debug.meta import Meta
+
     setup(
         name=Meta.name,
         version=Meta.version,

tests/flake8_debug_test.py

@@ -94,3 +94,27 @@ def test_present_bare_set_trace():
     ) == (
         _out(line=3, column=5, err=PdbError()),
     )
+
+
+def test_nested_print_is_detected():
+    assert _plugin_results('foo(print(0))') == (
+        _out(line=1, column=5, err=PrintError()),
+    )
+
+
+def test_nested_breakpoint_is_detected():
+    assert _plugin_results('foo(breakpoint())') == (
+        _out(line=1, column=5, err=BreakpointError()),
+    )
+
+
+def test_no_false_positive_on_arbitrary_object_print():
+    assert not _plugin_results('logger.print("msg")')
+
+
+def test_no_false_positive_on_arbitrary_object_breakpoint():
+    assert not _plugin_results('self.breakpoint()')
+
+
+def test_no_false_positive_on_arbitrary_object_set_trace():
+    assert not _plugin_results('cursor.set_trace()')