GitHub: https://github.com/SVSPraveen/DeployProof
PyPI: https://pypi.org/project/deployproof/
Hey everyone,
We’ve all encountered test suites boasting 90%+ or even 100% line coverage where the tests execute every line of code but assert almost nothing. With the rise of AI-assisted coding where copilots generate boilerplate tests that execute functions without asserting true invariants, line coverage has become a dangerously hollow metric.
The gold standard for proving that tests actually assert correctness is **mutation testing** (modifying AST operators like `==` to `!=`, `<` to `>`, or returning `None` to see if tests fail). But traditional mutation testing is painfully slow.
---
###What My Project Does
DeployProof is a deterministic, 100% local pre-push verification gate that solves the mutation latency problem by dropping feedback loops down to 2 to 5 seconds.
Instead of mutating whole files or the entire repository, DeployProof parses your active `git diff` against your base branch (or uncommitted working tree), maps changed line spans to their specific AST subtrees, and generates isolated mutations **strictly on newly written or touched logic**.
In addition to diff-scoped mutation testing, DeployProof provides **5 automated hygiene gates** that standard linters routinely miss:
- Diff-Scoped AST Mutation Engine (2–5s): Generates arithmetic, comparison, boolean, and boundary mutations strictly on changed AST nodes. If tests don't fail when logic is inverted, the gate blocks push with the exact surviving mutant line.
- Dependency Hallucination & Slopsquatting Defense: When new packages are introduced in `requirements.txt` or inline imports, DeployProof queries the public PyPI JSON API before push to verify the package actually exists on the public registry (guarding against hallucinated packages, typosquatting, and brand-new suspicious releases).
- Entropy Secret & Credential Scanning: Uses Shannon entropy analysis and regex pattern matching to detect hardcoded API keys (OpenAI, AWS, Anthropic, tokens) and tracked `.env` files in session diffs.
- Control Flow & Error Handling Hygiene: Detects and flags blanket `except Exception: pass` anti-patterns, swallowed exceptions, and unverified mock/monkeypatch fixtures introduced into tests.
- GhostApproval Symlink Defense: Traps repository sandbox-escaping symlinks before commits.
###Deep Multi-Worker Audits (`--full-repo --workers 8`)
For full-codebase audits, DeployProof includes a built-in parallel execution engine (`ProcessPoolExecutor`). It initializes isolated, PID-keyed filesystem sandboxes (`worker_<PID>`) with dedicated `--override-ini=cache_dir=...` and separate `--basetemp=...` pytest roots to scale across CPU cores without state leaks, cache collisions, or lock contention.
#### Zero Telemetry & 100% Local
DeployProof runs completely offline on your machine. The only outbound network call is checking package existence against the public PyPI registry. Zero code, findings, or telemetry ever leave your machine.
---
### Target Audience
DeployProof is built for:
Python Developers & Engineering Teams: Who want an automated, deterministic local gate before opening pull requests to ensure new code actually has assertion backing.
AI-Assisted Workflows: Developers using Cursor, Claude, Copilot, or ChatGPT who need a fast sanity gate to catch hallucinated package imports, unverified test mocks, and hollow line-coverage tests before pushing.
CI/CD Pipeline Maintainers: Teams looking for structured machine-readable JSON output (`deployproof check --json`) to enforce mutation thresholds in GitHub Actions without waiting 45 minutes.
---
### Comparison to Existing Tools
vs. pytest-cov / Line Coverage: Line coverage measures execution paths, not assertion quality. A test that calls a function without an `assert` gives 100% line coverage. DeployProof inverts logic operators (`==` to `!=`, `<` to `>`) to prove your tests actually fail when a bug is introduced.
vs. mutmut: Mutmut is the standard for full-repo mutation testing, but running it across an entire codebase takes 20 to 60+ minutes sequentially. DeployProof is designed specifically as a pre-push hook: it scopes mutations to the git diff in 2–5 seconds, and provides isolated parallel multi-worker sandboxes when running full audits.
vs. bandit / trufflehog: Linters like Bandit analyze static security patterns, and Trufflehog searches for git history secrets. DeployProof combines diff-scoped credential entropy with live PyPI package existence verification and AST mutation testing into a single sub-5-second pre-push command.
---
### Quick Start
```bash
# Install via pip or pipx
pip install deployproof
# or
pipx install deployproof
# Run check on your active changes / git diff:
deployproof check
# Run a parallel full-repository audit:
deployproof check --full-repo --workers 8
# Output machine-readable JSON for CI/CD:
deployproof check --json
```
