Scurity Hardening #36

.bandit

@@ -0,0 +1,8 @@
+[bandit]
+# B101: assert is standard in pytest/unittest — all assert findings are in tests/.
+# B110: try/except/pass used intentionally in token_parsing.py multi-fallback chain;
+#       each pass falls through to the next extraction method.
+# B404: subprocess import is informational only; usage is for playwright CLI install.
+# B603: subprocess.run with fixed args ([sys.executable, "-m", "playwright", ...]) — no user input.
+# B105/B106: test fixture token values (gr-auth-xyz, tok-b, wrong-not-used) are not real credentials.
+skips = B101,B110,B404,B603,B105,B106

.flake8

@@ -0,0 +1,13 @@
+[flake8]
+# Only check hand-written source; generated models/api are excluded.
+exclude =
+    graphiant_sdk/models,
+    graphiant_sdk/api/default_api.py,
+    graphiant_sdk/__init__.py,
+    build,
+    dist,
+    .tox,
+    .venv,
+    venv
+max-line-length = 127
+max-complexity = 10

.gitattributes

@@ -0,0 +1,5 @@
+# Generated OpenAPI client files — collapsed in GitHub diffs/PRs
+graphiant_sdk/models/*.py          linguist-generated=true
+graphiant_sdk/api/default_api.py   linguist-generated=true
+graphiant_sdk/__init__.py          linguist-generated=true
+docs/*.md                          linguist-generated=true

.github/workflows/build.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.12'
+          python-version: '3.13'
           cache: 'pip'
 
       - name: Install build dependencies

.github/workflows/lint.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.12'
+          python-version: '3.13'
           cache: 'pip'
 
       - name: Install dependencies
@@ -52,8 +52,18 @@ jobs:
 
       - name: Run flake8
         run: |
-          flake8 graphiant_sdk/ --count --select=E9,F63,F7,F82 --show-source --statistics
-          flake8 graphiant_sdk/ --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
+          # Fatal errors on hand-written code only (config in .flake8 excludes generated files)
+          flake8 --count --select=E9,F63,F7,F82 --show-source --statistics \
+            graphiant_cli/ \
+            graphiant_sdk/api_client.py graphiant_sdk/configuration.py \
+            graphiant_sdk/exceptions.py graphiant_sdk/rest.py graphiant_sdk/api_response.py \
+            tests/
+          # Style warnings across same set (non-fatal)
+          flake8 --count --exit-zero --statistics \
+            graphiant_cli/ \
+            graphiant_sdk/api_client.py graphiant_sdk/configuration.py \
+            graphiant_sdk/exceptions.py graphiant_sdk/rest.py graphiant_sdk/api_response.py \
+            tests/
 
   mypy:
     name: MyPy Type Checking
@@ -65,7 +75,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.12'
+          python-version: '3.13'
           cache: 'pip'
 
       - name: Install dependencies

.github/workflows/release.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.12'
+          python-version: '3.13'
           cache: 'pip'
 
       - name: Install build dependencies

.github/workflows/test.yml

@@ -11,6 +11,7 @@ on:
       - 'requirements.txt'
       - 'test-requirements.txt'
       - 'setup.py'
+      - 'pyproject.toml'
   push:
     branches:
       - main
@@ -24,6 +25,7 @@ on:
       - 'requirements.txt'
       - 'test-requirements.txt'
       - 'setup.py'
+      - 'pyproject.toml'
   schedule:
     # Run nightly at 2 AM UTC
     - cron: '0 2 * * *'
@@ -80,7 +82,7 @@ jobs:
 
       - name: Upload coverage reports
         uses: codecov/codecov-action@v4
-        if: matrix.python-version == '3.12'
+        if: matrix.python-version == '3.13'
         with:
           file: ./coverage.xml
           flags: unittests

.openapi-generator-ignore

@@ -3,8 +3,30 @@ LICENSE
 .travis.yml
 pyproject.toml
 requirements.txt
+test-requirements.txt
 setup.py
 README.md
+CHANGELOG.md
+CONTRIBUTING.md
+SECURITY.md
 .gitignore
+.gitattributes
+.flake8
+.bandit
 .gitlab-ci.yml
 .github/workflows/*
+Makefile
+scripts/generate.sh
+# Hand-written SDK core files — never overwrite
+graphiant_sdk/api_client.py
+graphiant_sdk/api_response.py
+graphiant_sdk/configuration.py
+graphiant_sdk/exceptions.py
+graphiant_sdk/rest.py
+graphiant_sdk/py.typed
+# Entire CLI package is hand-written
+graphiant_cli/*
+graphiant_cli/**/*
+# Hand-written tests
+tests/*
+tests/**/*

CONTRIBUTING.md

@@ -12,13 +12,8 @@ Thank you for your interest in contributing!
    ```
 3. **Set up development environment:**
    ```bash
-   # Create virtual environment
-   python3 -m venv venv
-   source venv/bin/activate  # On Windows: venv\Scripts\activate
-
-   # Install dependencies
-   pip install --upgrade pip setuptools wheel
-   pip install -r requirements.txt
+   python3 -m venv venv && source venv/bin/activate
+   make install        # pip install -e ".[dev]"
    ```
 
 ## Development Workflow
@@ -30,32 +25,18 @@ Thank you for your interest in contributing!
 
 2. **Make your changes** and ensure they pass local checks:
    ```bash
-   # Format code (using black or autopep8)
-   black graphiant_sdk/  # if using black
-   # or
-   autopep8 --in-place --recursive graphiant_sdk/
-
-   # Run linting
-   flake8 graphiant_sdk/
-   mypy graphiant_sdk/
-
-   # Run static analysis
-   pylint graphiant_sdk/  # optional
-
-   # Run tests
-   pytest --cov=graphiant_sdk --cov-report=html
+   make test           # pytest --cov=graphiant_sdk ...
+   make lint           # flake8 on hand-written files (generated excluded via .flake8)
+   make type-check     # mypy (generated models excluded via pyproject.toml)
+   make build          # python -m build (wheel + sdist)
+
+   # Or individually:
+   pytest -v tests/
+   flake8 graphiant_cli/ graphiant_sdk/api_client.py graphiant_sdk/configuration.py ...
+   mypy graphiant_sdk/ graphiant_cli/
    ```
 
-3. **Verify package builds:**
-   ```bash
-   # Build distribution
-   python setup.py sdist bdist_wheel
-
-   # Verify package
-   twine check dist/*
-   ```
-
-4. **Commit with clear messages:**
+3. **Commit with clear messages:**
    ```bash
    git commit -m "Add: description of changes"
    ```
@@ -70,9 +51,10 @@ The project uses multiple linting tools to ensure code quality:
 
 | Tool | Purpose | Target | CI/CD |
 |------|---------|--------|-------|
-| `flake8` | Python style guide (PEP 8) | All `.py` files | Yes (lint stage) |
-| `mypy` | Static type checking | All `.py` files | Yes (lint stage) |
-| `pylint` | Python code analysis | All `.py` files | Optional (local only) |
+| `flake8` | Python style guide (PEP 8) | Hand-written files only (`.flake8` excludes generated models) | Yes (lint stage) |
+| `mypy` | Static type checking | Hand-written files (generated models excluded via `pyproject.toml`) | Yes (lint stage) |
+
+Generated files (`graphiant_sdk/models/`, `default_api.py`, `__init__.py`) are excluded from linting and type-checking. Run `make lint` and `make type-check` locally to verify.
 
 **Note:** All linting tools run automatically in CI/CD on every pull request and push to main/develop branches.
 
@@ -99,7 +81,7 @@ pytest tests/test_default_api.py::test_function_name
 
 ### Test Structure
 
-- `tests/` directory contains all test files
+- `tests/` directory contains all test files (hand-written; listed in `.openapi-generator-ignore`)
 - Tests use the `pytest` framework
 - Tests are automatically run in CI/CD across Python 3.10, 3.11, 3.12, and 3.13
 
@@ -125,6 +107,28 @@ def test_error_handling():
         pass
 ```
 
+## Code Generation
+
+Most files in this repo (`graphiant_sdk/models/`, `graphiant_sdk/api/default_api.py`, `graphiant_sdk/__init__.py`, `docs/`) are auto-generated from the OpenAPI spec. **Do not edit them directly** — your changes will be overwritten on the next generation run.
+
+The hand-written files are protected by `.openapi-generator-ignore`:
+- `graphiant_cli/` — entire CLI package
+- `graphiant_sdk/api_client.py`, `configuration.py`, `exceptions.py`, `rest.py`, `api_response.py`, `py.typed`
+- `tests/` — all tests
+- `pyproject.toml`, `setup.py`, `requirements.txt`, `README.md`, `CHANGELOG.md`, tooling files
+
+To regenerate after a spec update:
+
+```bash
+# Place the new spec in api/ then:
+make generate
+# or: OPENAPI_SPEC=api/my-new-spec.json bash scripts/generate.sh
+```
+
+`scripts/generate.sh` auto-detects `openapi-generator` (Homebrew) or `openapi-generator-cli` (npm), reads `packageVersion` from `pyproject.toml`, and passes `--git-user-id`/`--git-repo-id` so generated docs never contain `GIT_USER_ID` placeholders.
+
+Review `git diff` carefully after generation — pay particular attention to files in `.openapi-generator-ignore` to confirm they were not overwritten.
+
 ## Code Standards
 
 ### Python Code
@@ -225,17 +229,16 @@ class DeviceManager:
 
 ## Pull Request Checklist
 
-- [ ] Code follows PEP 8 style guidelines
-- [ ] Code is formatted (black/autopep8)
-- [ ] All tests pass locally
-- [ ] Linting passes (`flake8`, `mypy`)
-- [ ] Type hints are included for all functions
-- [ ] Docstrings are included for all classes and functions
+- [ ] `make test` passes (all tests green)
+- [ ] `make lint` passes (no new flake8 errors in hand-written files)
+- [ ] `make type-check` passes (no new mypy errors)
+- [ ] `make build` succeeds (wheel and sdist build cleanly)
+- [ ] If adding/changing generated code: `make generate` was run and only expected files changed
+- [ ] Type hints included for all new functions
 - [ ] Commit messages are clear
 - [ ] Commits are signed with GPG (required)
 - [ ] Branch is rebased (no merge commits allowed)
 - [ ] All CI/CD checks pass (lint, test, build)
-- [ ] Package builds successfully
 
 ## Branch Protection Requirements
 

Makefile

@@ -0,0 +1,43 @@
+.PHONY: install test lint type-check build generate clean help
+
+## install: Install package in editable mode with dev dependencies
+install:
+	pip install -e ".[dev]"
+
+## test: Run pytest with coverage
+test:
+	pytest --cov=graphiant_sdk --cov-report=term --cov-report=xml
+
+## lint: Run flake8 on hand-written files only (generated files excluded via .flake8)
+lint:
+	flake8 graphiant_cli/ \
+	  graphiant_sdk/api_client.py \
+	  graphiant_sdk/configuration.py \
+	  graphiant_sdk/exceptions.py \
+	  graphiant_sdk/rest.py \
+	  graphiant_sdk/api_response.py \
+	  tests/
+
+## type-check: Run mypy (generated models excluded via pyproject.toml)
+type-check:
+	mypy graphiant_sdk/ graphiant_cli/
+
+## build: Build wheel and source distribution
+build:
+	python -m build
+
+## generate: Regenerate SDK from the OpenAPI spec
+generate:
+	@bash scripts/generate.sh
+
+## clean: Remove build artifacts
+clean:
+	rm -rf dist/ build/ *.egg-info/
+	find . -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true
+	find . -name "*.pyc" -delete 2>/dev/null || true
+
+## help: Show this help
+help:
+	@grep -E '^## ' Makefile | sed 's/## /  /'
+
+.DEFAULT_GOAL := test