What Zero Dependencies Actually Meant for RepoX-Ray

说明与用途

RepoX-Ray 是一个完全不依赖第三方包的 CLI 工具，利用 Python 标准库扫描仓库中的安全和质量问题。

问题

Build a CLI tool to scan repositories for security, dependency, Git, configuration, and code‑quality issues without installing any third‑party packages.

结果

RepoX-Ray delivers comprehensive repository scanning without any third‑party runtime packages, demonstrating that zero dependency can be achieved through careful use of the standard library.

工作流

• 1. Replace Git operations with subprocess calls to the git CLI.
• 2. Implement CLI using argparse instead of Click or Typer.
• 3. Use dataclasses for data models in place of Pydantic.
• 4. Write tests with unittest rather than pytest.
• 5. Handle file and pattern matching with pathlib and fnmatch.
• 6. Leverage the ast module for import analysis and syntax‑based inspections.
• 7. Perform Git history analysis by running git commands via subprocess and parsing output to detect deleted sensitive files and recover secrets.
• 8. Integrate all components into a single CLI tool.
• 9. Run automated tests to ensure functionality.
• 10. Publish the tool with no runtime dependencies.

证据

RepoX-Ray ended up with an empty requirements.txt, 47 passing automated tests, Git-history analysis, cross-file checks, and a repository health score — all without third-party runtime packages.

来源