Skip to main content

coop-review-core

Shared infrastructure for the coop-*-review family of offline, advisory standards linters (coop-sql-review, coop-dax-review, and future siblings).

It holds the tool-agnostic building blocks that were otherwise duplicated across each linter, so an infrastructure fix lands once instead of being copy-pasted (and silently drifting) between repos. Each linter keeps its own parsers, rules, Finding/Result model, and standards.md; it parameterizes the core with its own package name, tool name, and standards file.

What's in it

Module What it provides
coop_review_core.progress Stderr-only, TTY-gated scan progress (Progress, should_enable).
coop_review_core.diagnostics The Diagnostic model + processing-problem category constants.
coop_review_core.severity Severity ordering (SEVERITIES, severity_rank, at_or_above) + the stable, line-independent fingerprint.
coop_review_core.suppressions Inline <tool>:ignore directives + a fingerprint baseline (scan_directives, is_inline_suppressed, write_baseline, load_baseline).
coop_review_core.upgrade Self-update planning — the only networked part (build_plan, upgrade_command).
coop_review_core.config The rules.yml config layer with unified discovery (RuleConfig, apply_config, discover_config) + standards resolution (resolve_standards_path, standards_info).
coop_review_core.cliutils Shared CLI helpers (display_path, config_write_path, write_extra_report, run_upgrade + with_upgrade_options).
coop_review_core.report Shared report chrome — console badges/ANSI + the branded HTML style — plus the machine-JSON envelope, the SARIF 2.1.0 emitter (to_sarif), the JUnit XML emitter (to_junit, for Azure DevOps), and the single bundled Cooptimize logo (logo_data_uri).
coop_review_core.delta Run-to-run envelope comparison (diff_envelopes → EnvelopeDelta: new / fixed / persisting, keyed on each finding's fingerprint) with delta_text / delta_markdown renderers — "what changed since last review?".
coop_review_core.errors CoopReviewError, the common base of every user-facing error core raises.

Everything is deterministic and offline except upgrade (PyPI metadata / git fetch), and nothing here ever blocks a build.

How a linter uses it

from coop_review_core.config import RuleConfig, apply_config, resolve_standards_path
from coop_review_core.suppressions import scan_directives, is_inline_suppressed
from coop_review_core.upgrade import build_plan, upgrade_command

std = resolve_standards_path(user_path, BUNDLED_STANDARDS)          # tool passes its own bundled copy
rules = apply_config(all_rules(), RuleConfig.load(config_path))     # works on the tool's own Rule type
directives = scan_directives(file_text, tool="coop-sql-review")     # tool passes its own marker
plan = build_plan("coop-sql-review", __version__)                  # tool passes its name + version

apply_config is structural: it works on any rule dataclass with id / severity / default_enabled / params fields, so each linter keeps its own Rule.

Develop

make setup   # python3 -m venv .venv && pip install -e ".[dev]"
make test    # .venv/bin/pytest -q
make lint    # .venv/bin/ruff check . && .venv/bin/ruff format --check .

(No make? Each target is a one-liner — see the Makefile.) Use Python 3.10–3.13 for the venv — 3.14 doesn't process the editable install's .pth. If python3 is 3.14+, create the venv explicitly: python3.13 -m venv .venv.

Testing core changes against the linters

The consumer repos (coop-sql-review, coop-dax-review, assumed cloned side by side with this one under a single parent directory — substitute your parent for $HOME/Developer below) hold a non-editable installed copy of core in their .venvs, so an edit here is invisible to them until core is re-published and reinstalled. To run a consumer's tests (or CLI) against your local, unpublished core, shadow its installed copy — from the consumer repo:

PYTHONPATH="$HOME/Developer/coop-review-core/src:$PWD/src" .venv/bin/python -m pytest -q

PYTHONPATH beats site-packages, so the first entry shadows the installed core with this repo's src; $PWD/src keeps the consumer's own package importable next to it. Confirm the shadow took with ... -c "import coop_review_core; print(coop_review_core.__file__)" — it must print a path under this repo, not the consumer's site-packages.

Release = bump __version__ in src/coop_review_core/__init__.py (the single source — pyproject derives it), run make release-check, then tag vX.Y.Z; publish.yml refuses a tag that doesn't match __version__, builds, publishes to PyPI via trusted publishing, and cuts a GitHub Release. The tag push is the publish — releases happen only on an explicit request naming the version (agents: see AGENTS.md, "Version + release discipline").

Metadata

Release files for coop-review-core 0.10.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for coop-review-core 0.10.0
File Size Uploaded Provenance
coop_review_core-0.10.0.tar.gz 138.7 kB With provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for coop-review-core 0.10.0
File Interpreter ABI Platform
coop_review_core-0.10.0-py3-none-any.whl Python 3 none any Details

Total release size: 241.1 kB

Release files / coop_review_core-0.10.0.tar.gz

Download URL coop_review_core-0.10.0.tar.gz
Size 138.7 kB
Tags Source
SHA-256 checksum
How to use checksums
2c82c20887204dbf12f5a403b5badd734d886bc613b8eee3c60138ba58be39f1
BLAKE2b-256 checksum
How to use checksums
f744c80efd93cc8665003fb41859f59016296ae8edf557f8c3ffde9099b3f1ae
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.12

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jul 16, 2026.

Transparency log

Release files / coop_review_core-0.10.0-py3-none-any.whl

Download URL coop_review_core-0.10.0-py3-none-any.whl
Size 102.4 kB
Tags Python 3
SHA-256 checksum
How to use checksums
76f684ec368a0816c0a3a0d25007dd753611830d334ca8ffa08b8e22b5289408
BLAKE2b-256 checksum
How to use checksums
f79c00e22bbab83e7b4bdfa770aacf95e9220c7df8eb906f3028ead948991eac
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.12

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jul 16, 2026.

Transparency log

Security for coop-review-core 0.10.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for coop_review_core-0.10.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jul 16, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page