What Zero Dependencies Actually Meant for RepoX-Ray

Description and use

RepoX-Ray is a CLI tool that scans repositories for security and quality issues without any third‑party packages, relying solely on Python’s standard library.

Problem

Build a CLI tool to scan repositories for security, dependency, Git, configuration, and code‑quality issues without installing any third‑party packages.

Outcome

RepoX-Ray delivers comprehensive repository scanning without any third‑party runtime packages, demonstrating that zero dependency can be achieved through careful use of the standard library.

Workflow

• 1. Replace Git operations with subprocess calls to the git CLI.
• 2. Implement CLI using argparse instead of Click or Typer.
• 3. Use dataclasses for data models in place of Pydantic.
• 4. Write tests with unittest rather than pytest.
• 5. Handle file and pattern matching with pathlib and fnmatch.
• 6. Leverage the ast module for import analysis and syntax‑based inspections.
• 7. Perform Git history analysis by running git commands via subprocess and parsing output to detect deleted sensitive files and recover secrets.
• 8. Integrate all components into a single CLI tool.
• 9. Run automated tests to ensure functionality.
• 10. Publish the tool with no runtime dependencies.

Evidence

RepoX-Ray ended up with an empty requirements.txt, 47 passing automated tests, Git-history analysis, cross-file checks, and a repository health score — all without third-party runtime packages.

Source