Source code for mafw.devtools.toolchain.tools.pip_audit

#  Copyright 2026 European Union
#  Author: Bulgheroni Antonio (antonio.bulgheroni@ec.europa.eu)
#  SPDX-License-Identifier: EUPL-1.2
"""
PipAuditTool — concrete ProjectTool for pip-audit.

This module implements the :class:`PipAuditTool` class that manages the
``pip-audit`` dependency in the ``dev`` optional-dependencies of
``pyproject.toml``. pip-audit is a vulnerability scanner for Python
packages and is referenced in a single location, so no cross-file
consistency verification is required.

Since pip-audit has no ``post_update`` hook or custom logic, its
implementation is purely declarative — only the package name and section
path differ from the :class:`~mafw.devtools.toolchain.ProjectTool`
defaults.
"""

from __future__ import annotations

from mafw.devtools.toolchain import ProjectTool




class PipAuditTool(ProjectTool):
    """Manage pip-audit's version lower bound in pyproject.toml.

    pip-audit is categorized as a *project* tool because its version is
    controlled through the ``dev`` optional-dependencies group in
    ``pyproject.toml``. There are no additional configuration files to
    keep in sync, so :meth:`verify` always returns an empty list (inherited
    from :class:`~mafw.devtools.toolchain.ProjectTool`).

    All behaviour — bootstrapping, version detection, updating, and
    verification — is provided by the :class:`~mafw.devtools.toolchain.ProjectTool` base class.

    :param project_root: Path to the project root directory containing
        ``pyproject.toml``. Defaults to the current working directory.
    :type project_root: Path
    """

    @property
    def package_name(self) -> str:
        """PyPI package name for pip-audit."""
        return 'pip-audit'

    @property
    def section_path(self) -> str:
        """Dot-separated TOML path to the dependency array containing pip-audit."""
        return 'project.optional-dependencies.dev'

    @property
    def env_name(self) -> str:
        """Hatch environment where pip-audit lives."""
        return 'dev'