@zackees/soldr 0.7.5 → 0.7.7

package/README.md

@@ -56,12 +56,11 @@ the published `SHA256SUMS` file, and exposes the `soldr` command.
 
 ## GitHub Actions setup
 
-The current GitHub Actions entry point is the repository root action in this repository:
+The current GitHub Actions entry point is the public `setup-soldr` action:
 
 ```yaml
-- uses: zackees/soldr@<ref>
+- uses: zackees/setup-soldr@v0
   with:
-    version: 0.7.4
     cache: true
 
 - run: soldr cargo build --locked --release
@@ -74,17 +73,16 @@ That action:
 - bootstraps `rustup` into the cached runner-local root when the runner does not already have it
 - preinstalls the exact Rust toolchain from `rust-toolchain.toml` by default via `rustup`
 - restores a cacheable runner-local root for Soldr, Cargo, and rustup state
-- restores and saves the zccache compilation artifact cache at `~/.zccache` by default; set `build-cache: false` to disable it
-- restores and saves the Cargo target directory by default for no-op CI fast paths; set `target-cache: false` to disable it or `target-dir:` to choose another target directory
+- restores and saves the Soldr-owned zccache compilation artifact cache under `SOLDR_CACHE_DIR` by default; set `build-cache: false` to disable it
+- restores and saves a bounded hot Cargo target cache by default for no-op CI fast paths; set `target-cache: false` to disable it, `target-cache-mode: full` to opt into whole-target caching, or `target-dir:` to choose another target directory
 - puts `soldr` on `PATH` for later steps
-- is the extraction source for the planned public `zackees/setup-soldr` action product
 
 If your project pins Rust in `rust-toolchain.toml`, let the action read that file or pass the exact value with `toolchain:`. Do not preinstall a different generic toolchain such as `stable` and assume `soldr` will reconcile it later. The action exports `RUSTUP_TOOLCHAIN` after installation so later `cargo`, `rustc`, and `soldr cargo ...` steps stay on the toolchain it just installed instead of asking `rustup` to resolve a pinned file lazily.
 
 On GitHub-hosted runners, this means you usually do not need a separate toolchain setup action for the normal path. The action still uses `rustup` under the hood today, but it bootstraps `rustup` itself when the runner does not already have it.
 On runners without `rustup`, the action downloads and installs it into the cached runner-local root before provisioning the requested toolchain.
 
-For same-repository validation, use `uses: ./`. This repository smoke-tests that path in [setup-soldr-action.yml](./.github/workflows/setup-soldr-action.yml). GitHub Marketplace publication still requires extracting this action into a separate public action repository because GitHub requires a single root `action.yml` and no workflow files in the published repository. The repo-contained extraction plan and intended `zackees/setup-soldr@v1` contract live in [docs/SETUP_SOLDR_PUBLIC_ACTION.md](./docs/SETUP_SOLDR_PUBLIC_ACTION.md). Until that public repo exists, treat `zackees/soldr@<ref>` as the current contract and pin a full commit SHA or explicit release tag instead of assuming `@v1`. For fuller examples and fallback patterns, see [INTEGRATION.md](./INTEGRATION.md).
+The public action lives in [`zackees/setup-soldr`](https://github.com/zackees/setup-soldr) and is generated from this repository's root action source. This repository dogfoods `zackees/setup-soldr@v0` in [setup-soldr-action.yml](./.github/workflows/setup-soldr-action.yml). For fuller examples and fallback patterns, see [INTEGRATION.md](./INTEGRATION.md).
 
 ### CI cache lineage
 
@@ -124,13 +122,14 @@ If soldr solves that one problem well, it becomes a super tool: the command you
 
 - **Tool acquisition** (the crgx half): Need `maturin`, `cargo-dylint`, or any crate binary? soldr fetches a pre-built binary from GitHub Releases in seconds. No `cargo install` from source. Cached locally for instant reuse. On `0.5.x`, this is still an upstream trust decision rather than a repo-side trust guarantee; see [docs/TRUST_BOUNDARIES.md](./docs/TRUST_BOUNDARIES.md).
 
-- **Compilation caching** (the zccache half): `soldr cargo ...` now fetches and manages a pinned `zccache` release for Rust builds. soldr owns the zccache daemon/session wiring; zccache's artifact store still uses its current default cache root.
+- **Compilation caching** (the zccache half): `soldr cargo ...` now fetches and manages a pinned `zccache` release for Rust builds. soldr owns the zccache daemon/session wiring and keeps managed zccache artifacts under Soldr's cache root.
 
 ```bash
 # Build through soldr's front door:
 soldr cargo build --release
 soldr cargo test
 soldr --no-cache cargo test
+soldr purge
 SOLDR_RUSTC_WRAPPER=sccache soldr cargo build
 SOLDR_RUSTC_WRAPPER=none soldr cargo build
 
@@ -160,8 +159,8 @@ soldr maturin build --release
 - **One obvious command**: Fetch tools, pick the right Windows target, and run through managed zccache through the same entry point.
 - **Front-door builds**: `soldr cargo ...` is the primary build UX.
 - **Invisible caching**: `soldr cargo ...` uses a soldr-managed zccache by default, with `soldr --no-cache cargo ...` as the opt-out.
-- **Real cache controls**: `soldr status`, `soldr cache`, and `soldr clean` report and manage the soldr-managed zccache state instead of placeholder behavior.
-- **One cache boundary, eventually**: soldr keeps its own tools and zccache session state in `~/.soldr/`. Current zccache artifacts still live in zccache's default cache root until upstream exposes a supported cache-dir override.
+- **Real cache controls**: `soldr status`, `soldr cache`, and `soldr clean` report and manage the soldr-managed zccache state, while `soldr purge` removes all Soldr-managed cache artifacts for bug clearing and benchmarking.
+- **One cache boundary**: soldr keeps its own tools, zccache session state, and managed zccache artifacts under `~/.soldr/` by default. Use `SOLDR_CACHE_DIR` to move that root.
 - **Pre-built first**: Download a pre-built binary before compiling from source. Fall back gracefully.
 - **Cargo-compatible**: soldr preserves normal cargo arguments instead of forcing a separate workflow.
 - **Cross-platform**: Linux, macOS, Windows (x86_64 + aarch64).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackees/soldr",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Instant Rust tools and builds from one command.",
   "license": "BSD-3-Clause",
   "homepage": "https://github.com/zackees/soldr",

package/scripts/test-npm-package.js

@@ -9,11 +9,57 @@ const root = path.resolve(__dirname, "..");
 const pkg = require(path.join(root, "package.json"));
 const install = require(path.join(root, "scripts", "install.js"));
 
+function tomlSection(toml, sectionName) {
+  const header = `[${sectionName}]`;
+  const lines = toml.split(/\r?\n/);
+  const body = [];
+  let found = false;
+
+  for (const line of lines) {
+    if (/^\s*\[.*\]\s*$/.test(line)) {
+      if (found) {
+        break;
+      }
+      found = line.trim() === header;
+      continue;
+    }
+
+    if (found) {
+      body.push(line);
+    }
+  }
+
+  return found ? body.join("\n") : null;
+}
+
 const cargoToml = fs.readFileSync(path.join(root, "Cargo.toml"), "utf8");
 const cargoVersion = cargoToml.match(/\[workspace\.package\][\s\S]*?^version = "([^"]+)"/m);
 assert(cargoVersion, "workspace package version not found in Cargo.toml");
 assert.strictEqual(pkg.version, cargoVersion[1], "package.json version must match Cargo.toml");
 
+const pyprojectToml = fs.readFileSync(path.join(root, "pyproject.toml"), "utf8");
+const pyprojectProject = tomlSection(pyprojectToml, "project");
+assert(pyprojectProject, "[project] section not found in pyproject.toml");
+
+assert(
+  !/^\s*version\s*=/.test(pyprojectProject),
+  'pyproject.toml [project] must not hardcode version; PyPI must derive it from Cargo.toml',
+);
+
+const dynamicVersion = pyprojectProject.match(/^\s*dynamic\s*=\s*\[([^\]]*)\]\s*$/m);
+assert(
+  dynamicVersion,
+  'pyproject.toml [project] must declare dynamic = ["version"] so PyPI derives from Cargo.toml',
+);
+
+const dynamicItems = [...dynamicVersion[1].matchAll(/"([^"]+)"|'([^']+)'/g)].map(
+  (match) => match[1] || match[2],
+);
+assert(
+  dynamicItems.includes("version"),
+  'pyproject.toml [project] dynamic metadata must include "version"',
+);
+
 assert.strictEqual(pkg.name, "@zackees/soldr");
 assert.strictEqual(pkg.license, "BSD-3-Clause");
 assert.strictEqual(pkg.bin.soldr, "bin/soldr.js");
@@ -42,4 +88,4 @@ assert.strictEqual(
   "abc123",
 );
 
-console.log("npm package checks passed");
+console.log("npm package and PyPI version checks passed");