The Deterministic Pre-Push Gate for Modern Python

What is DeployProof?

DeployProof is a local pre-push gate that checks whether your code changes are verified by tests, free from security vulnerabilities, and safe to deploy — before a single commit reaches your remote repository or CI pipeline.

Why 100% Line Coverage is a Dangerous Lie

Line coverage measures what code was executed by your interpreter, not what code was verified by assertions. An automated test can execute 100% of your codebase without asserting a single value, masking critical vulnerabilities.

def test_calculate_discount():
    # Only tests the happy path!
    # Line coverage tool reports 100% green,
    # but misses boundary and operator regressions.
    assert calculate_discount(100.0, 0.2) == 80.0

# DeployProof mutates operators in warm RAM:
# [1] calculator.py:2  if rate > 0.5:  --> if rate > 1.5:
# [2] calculator.py:3  return price * 0.5 --> return price / 0.5
# 
# Result: 3 Surviving Mutants (FAILED - 57.1% Score)
# Auto-Heal: deployproof check --heal-tests

🔬 Interactive Gate Explorer

Click any verification gate below to inspect how DeployProof analyzes AST syntax trees, catches security flaws, and synthesizes self-healing tests in real time.

The 7 Verification Gates (Deep Dive)

def is_admin(user: dict) -> bool:
    if os.environ.get('__DEPLOYPROOF_MUTANT__') == '42':
        return user.get('role') != 'superadmin' # Mutated in warm memory!
    return user.get('role') == 'superadmin'

# Auto-generated by DeployProof to kill surviving mutants
def test_kill_calculate_discount_boundary_rate():
    """Kills mutant: Replace 0.5 with 1.5 on line 2"""
    assert calculate_discount(100.0, 0.5) == 50.0

def test_kill_calculate_discount_capped_rate():
    """Kills mutant: Replace binary operator '*' with '/' on line 3"""
    assert calculate_discount(100.0, 0.8) == 50.0

# 1. SQL Injection via string formatting
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")  # BLOCKED: Formatted SQL execution

# 2. Command Injection via shell=True
subprocess.Popen(f"ping {host}", shell=True)                 # BLOCKED: shell=True execution

# 3. Insecure Deserialization (Remote Code Execution)
data = pickle.loads(untrusted_payload)                       # BLOCKED: Unsafe pickle deserialization

# Verified Pattern Signatures Caught in Diff & Git History:
OPENAI_KEY    = "sk-proj-abc1234567890..."      # BLOCKED: OpenAI API Key pattern
GITHUB_TOKEN  = "ghp_1234567890abcdef..."       # BLOCKED: GitHub Personal Access Token
AWS_KEY       = "AKIAIOSFODNN7EXAMPLE"          # BLOCKED: AWS Access Key ID
HIGH_ENTROPY  = "a8f9c2d1e0b345f879102938a1..." # BLOCKED: Shannon Entropy >= 3.8

dependencies = [
    "langchain-super-tools",  # BLOCKED: Does not exist on PyPI (Hallucinated by LLM)
    "fastapi-auth-quick",     # WARNING: Registered on PyPI < 30 days ago (Slopsquatting risk)
    "urllib3==1.26.4",        # BLOCKED: CVE-2021-33503 High severity vulnerability detected
]

try:
    process_payment(order)
except:
    pass  # BLOCKED: Bare swallowed exception completely silences critical runtime errors!

2-Minute Quickstart

Zero configuration required. Install and verify your changes in seconds.

1. Install DeployProof

# Recommended: Isolated global CLI
pipx install deployproof

# Or in active virtual environment
pip install deployproof

2. Run Verification on Staged Changes

# Verifies modified files in git diff (significantly faster than full-sweep tools)
deployproof check

3. Install Pre-Push Git Hook

# Installs .git/hooks/pre-push to automatically guard git push
deployproof init

🔧 Interactive Quick-Fix Mode (-i / --interactive)

DeployProof allows you to inspect surviving mutants and apply self-healing tests directly inside your terminal with a single keystroke:

$ deployproof check -i

[?] Fix 1/2: src/auth.py:14 (Missing Key Fallback Assertion)
    Apply to 'tests/test_auth.py'? [Y/n/q/all] (default: Y): y
    [+] Appended 'test_kill_verify_roles_line_14' to tests/test_auth.py!

🎉 All self-healing tests applied! Mutation Score: 100.0%

GitHub Actions & CI/CD Recipes

Add .github/workflows/deployproof.yml to automatically annotate pull requests and write rich Markdown step summaries to $GITHUB_STEP_SUMMARY:

name: DeployProof Verification Gate
on: [push, pull_request]

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 50
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: pip install -e . && pip install deployproof pytest
      - run: deployproof check --github-actions --workers 4

Pre-Commit Framework Integration

Add DeployProof to your .pre-commit-config.yaml:

repos:
  - repo: https://github.com/SVSPraveen/deployproof
    rev: v1.1.19
    hooks:
      - id: deployproof-check

Configuration (pyproject.toml)

DeployProof natively supports standard PEP 518 pyproject.toml configuration under [tool.deployproof]:

[tool.deployproof]
threshold = 85.0
workers = 8
timeout = 15.0
strict_mocks = true
strict_error_handling = true
sast_scanning = true
history_secrets_scanning = true
cve_scanning = true
generate_tests = "tests/test_deployproof_healed.py"

CLI Reference & Commands

DeployProof provides an extensive command-line interface with fine-grained control over all 7 verification gates:

Core Commands

Mutation Testing & Self-Healing Options

Security & Quality Gates

Reporting, CI/CD & Configuration

Windows Subsystem for Linux (WSL) Delegation

On Windows host machines, full-scale mutation testing tools (like mutmut) rely heavily on POSIX process forking. DeployProof provides a high-performance WSL bridge via the --wsl flag:

One-Time WSL Setup

To configure your Linux WSL environment with mutmut and pytest, run the following command once from Windows PowerShell:

wsl bash -c "python3 -m venv ~/.deployproof-wsl-venv && ~/.deployproof-wsl-venv/bin/pip install mutmut pytest"

Running DeployProof with WSL

# Run DeployProof on Windows delegating mutation execution to WSL
deployproof check --wsl

# Target specific files with WSL delegation
deployproof check --files src/app.py --wsl

Note: If WSL or the Linux venv is not configured, DeployProof automatically detects this and gracefully falls back to the native in-memory AST engine without failing.

Architecture & Benchmarks

Traditional mutation testing tools (like mutmut or Cosmic Ray) rewrite source files to disk for every mutant and run the full test suite each time — a process that gets slower as the codebase grows. DeployProof's in-memory schemata engine compiles all mutants into a single conditional AST in warm RAM, avoiding disk I/O entirely and scaling with the size of your diff rather than your entire repo.

Frequently Asked Questions

Does DeployProof make any outbound network requests?

DeployProof is 100% local-first and zero-telemetry. No source code or verification results ever leave your machine. The only outbound network requests are read-only HTTP queries to (1) the official PyPI registry to verify package existence and prevent LLM dependency hallucinations, and (2) the open OSV database to detect CVE advisories (which can be disabled via --no-check-cve or offline execution).

How is DeployProof so fast on large projects?

DeployProof defaults to diff-scoped verification, mutating only the lines modified in your active session. For full repository audits, it utilizes in-memory AST schemata compilation and multi-worker parallelism across your CPU cores.

Can DeployProof run in CI/CD pipelines?

Yes! With --github-actions or --ci, DeployProof automatically outputs GitHub PR inline annotations and publishes visual summary dashboard tables to $GITHUB_STEP_SUMMARY.