From a91b9d0245ad0b325c11b3ddb973257dfaeee402 Mon Sep 17 00:00:00 2001
From: Hyemin Lee <hyemin.lee@bok.or.kr>
Date: Wed, 17 Jun 2026 10:54:48 +0900
Subject: [PATCH] chore: python tooling and Claude Code project settings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- pinned runtime/dev deps (폐쇄망 반입용 버전 고정)
- .env.example, .gitignore
- .claude/settings.json: 시크릿/env 읽기 차단, FastAPI dev 명령 허용

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .claude/settings.json | 39 +++++++++++++++++++++++++++++++++++++++
 .env.example          |  9 +++++++++
 .gitignore            |  8 ++++++++
 requirements-dev.txt  |  5 +++++
 requirements.txt      |  7 +++++++
 5 files changed, 68 insertions(+)
 create mode 100644 .claude/settings.json
 create mode 100644 .env.example
 create mode 100644 .gitignore
 create mode 100644 requirements-dev.txt
 create mode 100644 requirements.txt

diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 0000000..f573eac
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,39 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "permissions": {
+    "deny": [
+      "Read(./.env)",
+      "Read(./.env.*)",
+      "Read(**/.env)",
+      "Read(**/.env.*)",
+      "Read(**/*.pem)",
+      "Read(**/*secret*)",
+      "Read(**/secrets/**)",
+      "Read(**/.secrets/**)",
+      "Bash(env)",
+      "Bash(env *)",
+      "Bash(printenv*)",
+      "Bash(set)",
+      "Bash(export -p*)"
+    ],
+    "ask": [
+      "Bash(echo $*)",
+      "Bash(cat ./.env*)"
+    ],
+    "allow": [
+      "Bash(python -m venv *)",
+      "Bash(python -m pip *)",
+      "Bash(pip install *)",
+      "Bash(pip freeze*)",
+      "Bash(uvicorn *)",
+      "Bash(python -m uvicorn *)",
+      "Bash(pytest*)",
+      "Bash(python -m pytest*)",
+      "Bash(ruff*)",
+      "Bash(python -m ruff *)",
+      "Read",
+      "Edit",
+      "Write"
+    ]
+  }
+}
diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..ae510fd
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,9 @@
+# 복사해서 .env 로 쓰고 실제 값 채우기 (.env 는 커밋 금지)
+PULP_BASE_URL=http://localhost:8080
+PULP_USERNAME=admin
+PULP_PASSWORD=
+# TLS 검증: 사내 HTTPS Pulp + 사내 CA 면 PULP_CA_FILE 경로 지정.
+# 개발 중 self-signed 라 검증 끄려면 false (운영 금지).
+PULP_VERIFY_TLS=true
+# 사내 CA 인증서(.pem) 경로. 비워두면 시스템 기본 신뢰저장소 사용.
+PULP_CA_FILE=
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e5625b3
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,8 @@
+.env
+__pycache__/
+*.pyc
+.venv/
+venv/
+.pytest_cache/
+.ruff_cache/
+audit-log.jsonl
diff --git a/requirements-dev.txt b/requirements-dev.txt
new file mode 100644
index 0000000..0482e49
--- /dev/null
+++ b/requirements-dev.txt
@@ -0,0 +1,5 @@
+-r requirements.txt
+# 개발/테스트 전용
+pytest==8.3.4
+respx==0.22.0
+ruff==0.9.2
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..2e54687
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,7 @@
+# 런타임 의존성 (폐쇄망 반입 위해 버전 고정)
+fastapi==0.115.6
+uvicorn[standard]==0.34.0
+httpx==0.28.1
+jinja2==3.1.4
+python-multipart==0.0.20
+pydantic-settings==2.7.1