[Snyk] Security upgrade urllib3 from 2.0.7 to 2.6.0

.devcontainer/devcontainer.json

@@ -0,0 +1,33 @@
+{
+  "name": "Python 3",
+  // Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+  "image": "mcr.microsoft.com/devcontainers/python:1-3.11-bookworm",
+  "customizations": {
+    "codespaces": {
+      "openFiles": [
+        "README.md",
+        "ui/streamlit_app.py"
+      ]
+    },
+    "vscode": {
+      "settings": {},
+      "extensions": [
+        "ms-python.python",
+        "ms-python.vscode-pylance"
+      ]
+    }
+  },
+  "updateContentCommand": "[ -f packages.txt ] && sudo apt update && sudo apt upgrade -y && sudo xargs apt install -y <packages.txt; [ -f requirements.txt ] && pip3 install --user -r requirements.txt; pip3 install --user streamlit; echo '✅ Packages installed and Requirements met'",
+  "postAttachCommand": {
+    "server": "streamlit run ui/streamlit_app.py --server.enableCORS false --server.enableXsrfProtection false"
+  },
+  "portsAttributes": {
+    "8501": {
+      "label": "Application",
+      "onAutoForward": "openPreview"
+    }
+  },
+  "forwardPorts": [
+    8501
+  ]
+}

.env.example

@@ -0,0 +1,35 @@
+# DeepCode Environment Variables
+# Copy this file to .env and fill in your actual API keys
+# DO NOT commit .env to version control!
+
+# OpenAI-compatible API (Required)
+# Get from OpenAI or use compatible providers (OpenRouter, Together AI, etc.)
+OPENAI_API_KEY=sk-your-openai-api-key-here
+OPENAI_BASE_URL=https://api.openai.com/v1
+
+# Anthropic API (Required)
+# Get from https://console.anthropic.com/
+ANTHROPIC_API_KEY=sk-ant-your-anthropic-key-here
+
+# Optional: Web Search APIs
+# Choose one or both depending on your preference
+
+# Brave Search API (Optional)
+# Get from https://brave.com/search/api/
+BRAVE_API_KEY=your-brave-api-key-here
+
+# Bocha Search API (Optional)
+# Contact provider for access
+BOCHA_API_KEY=your-bocha-api-key-here
+
+# Optional: Additional Configuration
+# Uncomment and modify as needed
+
+# Set log level (debug, info, warning, error)
+# LOG_LEVEL=info
+
+# Set working directory for generated code
+# WORK_DIR=./workspace
+
+# Set output directory for artifacts
+# OUTPUT_DIR=./output

.github/workflows/pypi-publish.yml

@@ -0,0 +1,52 @@
+name: Upload DeepCode Package
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  release-build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+
+      - name: Build release distributions
+        run: |
+          python -m pip install build
+          python -m build
+
+      - name: Upload distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-dists
+          path: dist/
+
+  pypi-publish:
+    runs-on: ubuntu-latest
+    needs:
+      - release-build
+    permissions:
+      id-token: write
+
+    environment:
+      name: pypi
+
+    steps:
+      - name: Retrieve release distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: release-dists
+          path: dist/
+
+      - name: Publish release distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

.github/workflows/snyk-security.yml

@@ -0,0 +1,104 @@
+name: Snyk Code Security Scan
+
+on:
+  push:
+    branches: [ main, develop ]
+  pull_request:
+    branches: [ main, develop ]
+  workflow_dispatch:  # Allow manual trigger
+
+jobs:
+  snyk-security-scan:
+    name: Snyk Code Analysis
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write  # For SARIF upload to GitHub Security tab
+      id-token: write # Required for Snyk to authenticate securely
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: Run Snyk Code Test
+        continue-on-error: true  # Don't fail the build on vulnerabilities
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          # Install Snyk CLI
+          npm install -g snyk
+
+          # Authenticate
+          snyk auth "${{ secrets.SNYK_TOKEN }}"
+
+          # Run Snyk Code test
+          snyk code test --sarif-file-output=snyk-code.sarif || true
+
+          # Run Snyk Open Source test for dependencies
+          snyk test --sarif-file-output=snyk-oss.sarif || true
+
+      - name: Upload Snyk Code results to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: snyk-code.sarif
+          category: snyk-code
+
+      - name: Upload Snyk OSS results to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: snyk-oss.sarif
+          category: snyk-oss
+
+      - name: Run Python Snyk Analyzer
+        if: always()
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+          SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }}
+        run: |
+          python tools/snyk_code_analyzer.py . snyk-report.txt || true
+
+      - name: Upload Analysis Report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: snyk-analysis-report
+          path: |
+            snyk-report.txt
+            snyk-code.sarif
+            snyk-oss.sarif
+          retention-days: 30
+
+      - name: Comment PR with results
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            let comment = '## 🛡️ Snyk Security Analysis\n\n';
+
+            try {
+              const report = fs.readFileSync('snyk-report.txt', 'utf8');
+              comment += '```\n' + report + '\n```';
+            } catch (e) {
+              comment += '⚠️ Report not available\n';
+            }
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: comment
+            });

.gitignore

@@ -11,8 +11,12 @@ __pycache__/
 .venv/
 env/
 venv/
-*.env*
-.env_example
+*.env
+.env.*
+
+# Allow .env.example to be tracked
+!.env.example
+
 
 # Build / Distribution
 dist/
@@ -25,6 +29,7 @@ site/
 *.logfire
 *.coverage/
 log/
+logs/
 
 # Caches
 .cache/
@@ -58,9 +63,10 @@ ignore_this.txt
 *.ignore.*
 
 # unit-test files
+# Note: Exclude test_setup.py as it's the official setup verification script
 test_*
+!test_setup.py
 run_indexer_with_filtering.py
 
 # Cline files
 memory-bank/
-