fix: address SonarQube code quality issues

Author: nikolay-e

.github/workflows/cd.yml

@@ -1,8 +1,7 @@
 # .github/workflows/cd.yml
 name: treemapper CD
 
-permissions:
-  contents: write
+permissions: {}
 
 'on':
   workflow_dispatch:
@@ -316,6 +315,8 @@ jobs:
       (needs.publish-to-pypi.result == 'success' ||
        needs.publish-to-pypi.result == 'skipped')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Download git bundle
         uses: actions/download-artifact@v7

.github/workflows/ci.yml

@@ -3,7 +3,6 @@ name: treemapper CI
 
 permissions:
   contents: read
-  security-events: write  # For CodeQL
 
 'on':
   pull_request:

pyproject.toml

@@ -159,7 +159,8 @@ dev = [
     "twine>=4.0,<7.0",
     "pyinstaller>=5.0,<7.0",
     # Security fixes
-    "urllib3>=2.6.0",
+    "urllib3>=2.6.3",
+    "filelock>=3.20.3",
 ]
 
 [tool.setuptools.dynamic]

src/treemapper/cli.py

@@ -57,18 +57,19 @@ def _resolve_root_dir(directory: str) -> Path:
 
 
 def _resolve_output_file(output_file_arg: str | None, output_format: str) -> tuple[Path | None, bool]:
-    force_stdout = output_file_arg == "-"
-    if output_file_arg is None or output_file_arg == "-":
-        return None, force_stdout
+    if output_file_arg is None:
+        return None, False
+    if output_file_arg == "-":
+        return None, True
 
     if output_file_arg == "":
         ext = "yaml" if output_format == "yaml" else output_format
-        return Path(f"tree.{ext}").resolve(), force_stdout
+        return Path(f"tree.{ext}").resolve(), False
 
     output_file = Path(output_file_arg).resolve()
     if output_file.is_dir():
         _exit_error(f"'{output_file_arg}' is a directory, not a file.")
-    return output_file, force_stdout
+    return output_file, False
 
 
 def _resolve_ignore_file(ignore_file_arg: str | None) -> Path | None:

src/treemapper/diffctx/edges/config/build.py

@@ -25,7 +25,7 @@
 _CMAKE_SET_RE = re.compile(r"set\s*\(\s*([A-Z_][A-Z0-9_]*)", re.IGNORECASE)
 
 _SCRIPT_CALL_RE = re.compile(r"(?:bash|sh|python|python3|\.\/scripts\/|\.\/bin\/)([a-zA-Z0-9_.-]+)")
-_SOURCE_FILE_RE = re.compile(r"\b([a-zA-Z_][a-zA-Z0-9_]*\.(?:c|cpp|cc|cxx|h|hpp|hxx|py|sh|go|rs|java))\b")
+_SOURCE_FILE_RE = re.compile(r"\b([a-zA-Z_]\w*\.(?:c|cpp|cc|cxx|h|hpp|hxx|py|sh|go|rs|java))\b")
 
 
 def _is_makefile(path: Path) -> bool:

src/treemapper/diffctx/edges/config/cicd.py

@@ -7,15 +7,11 @@
 from ..base import EdgeBuilder, EdgeDict, FragmentIndex, discover_files_by_refs
 
 _GHA_RUN_RE = re.compile(r"^\s*-?\s*run:\s*[|>]?\s*(.+?)(?:\n\s{4,}|\n[^\s]|$)", re.MULTILINE | re.DOTALL)
-_GHA_USES_RE = re.compile(r"^\s*uses:\s*([^\s@]+)", re.MULTILINE)
-_GHA_WITH_RE = re.compile(r"^\s*with:\s*\n((?:\s+\w+:.+\n)+)", re.MULTILINE)
 
 _GITLAB_SCRIPT_RE = re.compile(r"^\s*(?:script|before_script|after_script):\s*\n((?:\s+-\s*.+\n)+)", re.MULTILINE)
 _GITLAB_INCLUDE_RE = re.compile(r"^\s*-?\s*(?:local|project|remote|template):\s*['\"]?([^'\"#\n]+)", re.MULTILINE)
-_GITLAB_EXTENDS_RE = re.compile(r"^\s*extends:\s*['\"]?([^'\"#\n]+)", re.MULTILINE)
 
-_JENKINS_STAGE_RE = re.compile(r"stage\s*\(\s*['\"]([^'\"]+)['\"]", re.MULTILINE)
-_JENKINS_SH_RE = re.compile(r"sh\s*(?:\(['\"]|['\"])(.+?)(?:['\"](?:\))?)", re.MULTILINE | re.DOTALL)
+_JENKINS_SH_RE = re.compile(r"sh\s*(?:\(['\"]|['\"])(.+?)(?:['\"])\)?", re.MULTILINE | re.DOTALL)
 _JENKINS_SCRIPT_RE = re.compile(r"script\s*\{([^}]+)\}", re.MULTILINE | re.DOTALL)
 
 _SCRIPT_CALL_RE = re.compile(r"(?:bash|sh|python|python3|node|npm|yarn|pnpm|make|go|cargo|dotnet|mvn|gradle)\s+([^\s;&|]+)")

src/treemapper/diffctx/edges/semantic/c_family.py

@@ -30,7 +30,7 @@
 _NAMESPACE_RE = re.compile(r"^\s*namespace\s+(\w+)", re.MULTILINE)
 
 _FUNC_CALL_RE = re.compile(r"\b(\w+)\s*\(")
-_TYPE_REF_RE = re.compile(r"\b([A-Z][A-Za-z0-9_]*)\b")
+_TYPE_REF_RE = re.compile(r"\b([A-Z]\w*)\b")
 
 _METHOD_IMPL_RE = re.compile(r"^\s*(?:[\w:]+\s+)?(\w+)::(\w+)\s*\(", re.MULTILINE)
 

src/treemapper/diffctx/edges/semantic/dotnet.py

@@ -20,18 +20,18 @@
 _CS_INHERIT_RE = re.compile(r"(?:class|interface|struct|record)\s+\w+\s*(?:<[^>]+>)?\s*:\s*([A-Z]\w*(?:\s*,\s*[A-Z]\w*)*)")
 _CS_GENERIC_RE = re.compile(r"<([A-Z]\w*(?:\s*,\s*[A-Z]\w*)*)>")
 _CS_METHOD_RE = re.compile(
-    r"^\s*(?:public|private|protected|internal)?\s*(?:static|virtual|override|abstract|async)?\s*(?:[A-Z]\w*(?:<[^>]+>)?)\s+([A-Z][a-zA-Z0-9_]*)\s*\(",
+    r"^\s*(?:public|private|protected|internal)?\s*(?:static|virtual|override|abstract|async)?\s*(?:[A-Z]\w*(?:<[^>]+>)?)\s+([A-Z]\w*)\s*\(",
     re.MULTILINE,
 )
 
 _FS_OPEN_RE = re.compile(r"^\s*open\s+([A-Z][a-zA-Z0-9_.]*)", re.MULTILINE)
 _FS_MODULE_RE = re.compile(r"^\s*module\s+(?:rec\s+)?([A-Z][a-zA-Z0-9_.]*)", re.MULTILINE)
 _FS_NAMESPACE_RE = re.compile(r"^\s*namespace\s+(?:rec\s+)?([A-Z][a-zA-Z0-9_.]*)", re.MULTILINE)
 _FS_TYPE_RE = re.compile(r"^\s*type\s+(?:private\s+)?([A-Z]\w*)", re.MULTILINE)
-_FS_LET_RE = re.compile(r"^\s*let\s+(?:rec\s+)?(?:private\s+)?([a-z][a-zA-Z0-9_]*)", re.MULTILINE)
+_FS_LET_RE = re.compile(r"^\s*let\s+(?:rec\s+)?(?:private\s+)?([a-z]\w*)", re.MULTILINE)
 
-_TYPE_REF_RE = re.compile(r"(?<![a-z_])([A-Z][a-zA-Z0-9_]*)\b")
-_ATTRIBUTE_RE = re.compile(r"\[([A-Z][a-zA-Z0-9_]*)\]")
+_TYPE_REF_RE = re.compile(r"(?<![a-z_])([A-Z]\w*)\b")
+_ATTRIBUTE_RE = re.compile(r"\[([A-Z]\w*)\]")
 
 
 def _is_dotnet_file(path: Path) -> bool:

src/treemapper/diffctx/edges/semantic/go.py

@@ -16,7 +16,7 @@
 _GO_CONST_VAR_RE = re.compile(r"^(?:const|var)\s+(\w+)\s+", re.MULTILINE)
 
 _GO_FUNC_CALL_RE = re.compile(r"\b([A-Z]\w+)\s*\(")
-_GO_TYPE_REF_RE = re.compile(r"\*?([A-Z][a-zA-Z0-9]*)\b")
+_GO_TYPE_REF_RE = re.compile(r"\*?([A-Z]\w*)\b")
 _GO_PKG_CALL_RE = re.compile(r"\b(\w+)\.([A-Z]\w*)")
 
 

src/treemapper/diffctx/edges/semantic/jvm.py

@@ -26,15 +26,15 @@
     re.MULTILINE,
 )
 _KOTLIN_FUN_RE = re.compile(
-    r"^\s*(?:public|private|internal|protected)?\s*(?:suspend\s+)?fun\s+(?:<[^>]+>\s+)?([a-z][a-zA-Z0-9_]*)", re.MULTILINE
+    r"^\s*(?:public|private|internal|protected)?\s*(?:suspend\s+)?fun\s+(?:<[^>]+>\s+)?([a-z]\w*)", re.MULTILINE
 )
 
 _SCALA_IMPORT_RE = re.compile(r"^\s*import\s+([a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)*(?:\.[A-Z_]\w*)?)", re.MULTILINE)
 _SCALA_CLASS_RE = re.compile(r"^\s*(?:abstract\s+)?(?:sealed\s+)?(?:case\s+)?(?:class|trait|object)\s+([A-Z]\w*)", re.MULTILINE)
-_SCALA_DEF_RE = re.compile(r"^\s*(?:private|protected)?\s*def\s+([a-z][a-zA-Z0-9_]*)", re.MULTILINE)
+_SCALA_DEF_RE = re.compile(r"^\s*(?:private|protected)?\s*def\s+([a-z]\w*)", re.MULTILINE)
 
-_TYPE_REF_RE = re.compile(r"(?<![a-z_])([A-Z][a-zA-Z0-9_]*)\b")
-_ANNOTATION_RE = re.compile(r"@([A-Z][a-zA-Z0-9_]*)")
+_TYPE_REF_RE = re.compile(r"(?<![a-z_])([A-Z]\w*)\b")
+_ANNOTATION_RE = re.compile(r"@([A-Z]\w*)")
 
 
 def _is_jvm_file(path: Path) -> bool: