pyproject.toml

[build-system]
requires = ["setuptools>=68", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "mergese"
version = "2.0.0"
description = "Post-hoc model merging for software engineering - CLI + web tool."
readme = "README.md"
requires-python = ">=3.10"
license = { file = "LICENSE" }
authors = [
    { name = "Palash R. Roy" },
    { name = "Banani Roy" },
    { name = "Chanchal K. Roy" },
    { name = "Kevin A. Schneider" },
]
keywords = [
    "model-merging", "software-engineering", "code-models",
    "ties", "dare", "huggingface", "transformers", "task-vectors",
]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Science/Research",
    "License :: OSI Approved :: Apache Software License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Topic :: Scientific/Engineering :: Artificial Intelligence",
]
dependencies = [
    "click>=8.1",
    "torch>=2.0",
    "transformers>=4.40",
    "safetensors>=0.4",
    "rich>=13.0",
    "tqdm>=4.65",
    "numpy>=1.23",
]

[project.optional-dependencies]
server = [
    "flask>=3.0",
    "flask-cors>=4.0",
    "gunicorn>=21.2",
]
datasets = [
    "datasets>=2.18",
]
# Needed by `mergese export --format onnx`. torch.onnx uses `onnx` at
# save-time; torch >= 2.1 also pulls `onnxscript` from its exporter path.
# Both are pre-flighted by the CLI so a missing dep is a readable error.
export = [
    "onnx>=1.14",
    "onnxscript>=0.1",
]
dev = [
    "pytest>=8.0",
    # The server security/auth tests import the Flask app, so the dev extra
    # must be able to run the full suite on its own (CI installs ".[dev]").
    "flask>=3.0",
    "flask-cors>=4.0",
]

[project.scripts]
mergese = "mergese:main"

[project.urls]
Homepage = "https://github.com/srlabUsask/MergeSE"
Repository = "https://github.com/srlabUsask/MergeSE"
Issues = "https://github.com/srlabUsask/MergeSE/issues"

# ---- packaging ---------------------------------------------------------------
# The web tool and the bundled benchmark CSVs live outside any Python package,
# so a bare `pip install mergese` would ship only the Python modules and the
# server would 404 for / and expose no bundled datasets (B13). Install them as
# `data-files` under `share/mergese/...`; the server's _first_existing_dir
# helper searches that location when the repo-tree copies are absent.
[tool.setuptools]
py-modules = ["mergese", "mergese_tasks"]
include-package-data = true

[tool.setuptools.packages.find]
where = ["."]
include = ["server*"]
exclude = ["artifacts*", "uploads*", "tests*", "deploy*", "frontend*", "data*"]

[tool.setuptools.package-data]
"server" = ["*.json"]

[tool.setuptools.data-files]
"share/mergese/frontend" = [
    "frontend/index.html",
    "frontend/app.js",
    "frontend/styles.css",
    "frontend/favicon.svg",
]
"share/mergese/data/benchmarks" = [
    "data/benchmarks/index.json",
    "data/benchmarks/bigclonebench_demo.csv",
    "data/benchmarks/clcdsa_demo.csv",
    "data/benchmarks/gptclonebench_demo.csv",
]

# ---- ruff ---------------------------------------------------------------
# Focus on actual bug classes, not style nits. The CI job runs
# `ruff check mergese.py mergese_tasks.py server/ tests/` with these rules.
# Expand later if the team wants stricter formatting.
[tool.ruff]
line-length = 110
target-version = "py310"
extend-exclude = [
    "artifacts",
    "uploads",
    ".venv",
    "build",
    "dist",
]

[tool.ruff.lint]
# Narrow to rules that catch real bugs without noise:
# E9  -> syntax errors (parse failures, invalid tokens)
# F4  -> import issues (F401 unused, F403 star-import, F405 undefined-from-star)
# F6  -> literal + redefinition bugs (F601, F602, F621, ...)
# F7  -> syntax issues python flagged (F701, F702, ...)
# F8  -> F811 redefinition, F821 undefined-name, F841 unused variable
# F9  -> boolean/if/assignment smells
# W6  -> deprecated syntax (invalid escape sequences etc)
# S102, S106, S108 -> exec / hard-coded password / /tmp paths (not S110 bare-pass:
#        the project uses OSError-swallow pattern deliberately)
#
# F821 was previously disabled because mergese.py uses `torch = _lazy_torch()`
# and ruff couldn't resolve `"torch.Tensor"` string annotations - which hid a
# real `_REGISTRY` undefined-name bug that only surfaced via a 3rd-party
# audit. The TYPE_CHECKING import block in mergese.py now exposes `torch` to
# ruff without eager-loading at runtime, so F821 is safe to enable.
# B (bugbear) is OFF for now to keep the first-day CI green; graduate later.
select = ["E9", "F4", "F6", "F7", "F8", "F9", "W6", "S102", "S106", "S108"]
ignore = []

[tool.ruff.lint.per-file-ignores]
# Tests legitimately redefine fixtures, import for side effects, and set
# disposable "test-secret" strings - no S106 (hardcoded password) complaints.
"tests/*" = ["F401", "F811", "S106", "S108"]