# shouryamishra27/codebase-dependency-auditor architecture

> Architecture diagram of the GitHub repository shouryamishra27/codebase-dependency-auditor, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/shouryamishra27/codebase-dependency-auditor
- Repository: https://github.com/shouryamishra27/codebase-dependency-auditor

## Overview

depaudit is a command-line security auditor for Python GitHub repositories. The principal workflow starts with a repository URL, clones and inventories the repository, analyzes Python imports and declared dependency files, queries OSV for vulnerabilities, classifies risk, and renders a terminal or JSON report. Import analysis also supports undeclared-import findings. The README documents additional CLI behavior such as severity-based failure thresholds. Some source excerpts are partial, so the graph shows documented orchestration without inferring unshown internal calls.

Main entry points: [`src/depaudit/auditor.py`](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/auditor.py) (Audit orchestrator), [`src/depaudit/cli.py`](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/cli.py) (CLI), [`src/depaudit/scanner/repository.py`](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/scanner/repository.py) (Clone and discovery), [`src/depaudit/vulnerability/osv_client.py`](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/vulnerability/osv_client.py) (OSV client)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interface["CLI and output"]
  node_cli["CLI<br/>[cli.py]"]
  node_terminal["Terminal rendering<br/>[terminal.py]"]
  node_json["JSON rendering<br/>[json_report.py]"]
end

subgraph group_orchestration["Audit orchestration"]
  node_auditor["Audit orchestrator<br/>[auditor.py]"]
end

subgraph group_scanning["Repository scanning"]
  node_repository["Clone and discovery<br/>[repository.py]"]
  node_ast["AST import analysis<br/>[ast_parser.py]"]
  node_dependency_parser["Manifest parsing"]
end

subgraph group_assessment["Vulnerability assessment"]
  node_osv_client["OSV client<br/>[osv_client.py]"]
  node_risk["Risk classification<br/>[risk.py]"]
end

subgraph group_reporting["Report models and rendering"]
  node_report_model["Report aggregation<br/>[report.py]"]
  node_finding_model["Finding and severity<br/>[vulnerability.py]"]
end

node_user(("User"))
node_github(("GitHub repository"))
node_osv(("OSV API"))

node_user -->|"submits URL"| node_cli
node_cli -->|"runs audit"| node_auditor
node_auditor -->|"clones and discovers"| node_repository
node_github -->|"provides repository"| node_repository
node_repository -->|"returns files and manifests"| node_auditor
node_auditor -->|"analyzes Python files"| node_ast
node_auditor -->|"parses manifests"| node_dependency_parser
node_auditor -->|"queries packages"| node_osv_client
node_osv_client -->|"requests vulnerability data"| node_osv
node_osv -->|"returns advisories"| node_osv_client
node_auditor -->|"classifies severity"| node_risk
node_auditor -->|"builds report"| node_report_model
node_auditor -->|"creates findings"| node_finding_model
node_cli -->|"renders terminal output"| node_terminal
node_cli -->|"renders JSON output"| node_json
node_terminal -->|"prints report"| node_user
node_json -->|"prints report"| node_user

click node_cli "https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/cli.py"
click node_auditor "https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/auditor.py"
click node_repository "https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/scanner/repository.py"
click node_ast "https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/scanner/ast_parser.py"
click node_dependency_parser "https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/scanner/dependency_parser.py"
click node_osv_client "https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/vulnerability/osv_client.py"
click node_risk "https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/risk.py"
click node_report_model "https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/models/report.py"
click node_finding_model "https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/models/vulnerability.py"
click node_terminal "https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/reporting/terminal.py"
click node_json "https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/reporting/json_report.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_terminal,node_json,node_user toneBlue
class node_auditor toneAmber
class node_repository,node_ast,node_dependency_parser,node_osv toneMint
class node_osv_client,node_risk toneRose
class node_report_model,node_finding_model,node_github toneIndigo
```

## Components

### CLI and output

- [CLI](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/cli.py): `src/depaudit/cli.py`
- [Terminal rendering](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/reporting/terminal.py): `src/depaudit/reporting/terminal.py`
- [JSON rendering](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/reporting/json_report.py): `src/depaudit/reporting/json_report.py`

### Audit orchestration

- [Audit orchestrator](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/auditor.py): `src/depaudit/auditor.py`

### Repository scanning

- [Clone and discovery](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/scanner/repository.py): `src/depaudit/scanner/repository.py`
- [AST import analysis](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/scanner/ast_parser.py): `src/depaudit/scanner/ast_parser.py`
- [Manifest parsing](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/scanner/dependency_parser.py): `src/depaudit/scanner/dependency_parser.py`

### Vulnerability assessment

- [OSV client](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/vulnerability/osv_client.py): `src/depaudit/vulnerability/osv_client.py`
- [Risk classification](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/risk.py): `src/depaudit/risk.py`

### Report models and rendering

- [Report aggregation](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/models/report.py): `src/depaudit/models/report.py`
- [Finding and severity](https://github.com/shouryamishra27/codebase-dependency-auditor/blob/main/src/depaudit/models/vulnerability.py): `src/depaudit/models/vulnerability.py`

### Other components

- **User**
- **GitHub repository**
- **OSV API**

## Connections

- User → CLI: submits URL
- CLI → Audit orchestrator: runs audit
- Audit orchestrator → Clone and discovery: clones and discovers
- GitHub repository → Clone and discovery: provides repository
- Clone and discovery → Audit orchestrator: returns files and manifests
- Audit orchestrator → AST import analysis: analyzes Python files
- Audit orchestrator → Manifest parsing: parses manifests
- Audit orchestrator → OSV client: queries packages
- OSV client → OSV API: requests vulnerability data
- OSV API → OSV client: returns advisories
- Audit orchestrator → Risk classification: classifies severity
- Audit orchestrator → Report aggregation: builds report
- Audit orchestrator → Finding and severity: creates findings
- CLI → Terminal rendering: renders terminal output
- CLI → JSON rendering: renders JSON output
- Terminal rendering → User: prints report
- JSON rendering → User: prints report