How shouryamishra27/codebase-dependency-auditor works
depaudit is a command-line security auditor for Python GitHub repositories. The principal workflow starts with a repository URL, clones and inventories the repository, analyzes Python imports and declared dependency files, queries OSV for vulnerabilities, classifies risk, and renders a terminal or JSON report. Import analysis also supports undeclared-import findings. The README documents additional CLI behavior such as severity-based failure thresholds. Some source excerpts are partial, so the graph shows documented orchestration without inferring unshown internal calls.
Main entry points: auditor.py Audit orchestrator · cli.py CLI · repository.py Clone and discovery · osv_client.py OSV client
Components 14
CLI and output
- CLI
src/depaudit/cli.py - Terminal rendering
src/depaudit/reporting/terminal.py - JSON rendering
src/depaudit/reporting/json_report.py
Audit orchestration
- Audit orchestrator
src/depaudit/auditor.py
Repository scanning
- Clone and discovery
src/depaudit/scanner/repository.py - AST import analysis
src/depaudit/scanner/ast_parser.py - Manifest parsing
src/depaudit/scanner/dependency_parser.py
Vulnerability assessment
- OSV client
src/depaudit/vulnerability/osv_client.py - Risk classification
src/depaudit/risk.py
Report models and rendering
- Report aggregation
src/depaudit/models/report.py - Finding and severity
src/depaudit/models/vulnerability.py
Other components
- User
- GitHub repository
- OSV API
Connections 17
- User → CLI: submits URL
- CLI → Audit orchestrator: runs audit
- Audit orchestrator → Clone and discovery: clones and discovers
- GitHub repository → Clone and discovery: provides repository
- Clone and discovery → Audit orchestrator: returns files and manifests
- Audit orchestrator → AST import analysis: analyzes Python files
- Audit orchestrator → Manifest parsing: parses manifests
- Audit orchestrator → OSV client: queries packages
- OSV client → OSV API: requests vulnerability data
- OSV API → OSV client: returns advisories
- Audit orchestrator → Risk classification: classifies severity
- Audit orchestrator → Report aggregation: builds report
- Audit orchestrator → Finding and severity: creates findings
- CLI → Terminal rendering: renders terminal output
- CLI → JSON rendering: renders JSON output
- Terminal rendering → User: prints report
- JSON rendering → User: prints report