PyNerva 0.0.7__tar.gz → 0.0.9__tar.gz

{pynerva-0.0.7 → pynerva-0.0.9}/.gitea/workflows/code-quality.yml

@@ -2,9 +2,9 @@ name: Code Quality
 
 on:
   push:
-    branches: [ main, master, develop ]
+    branches: [main, master, develop]
   pull_request:
-    branches: [ main, master, develop ]
+    branches: [main, master, develop]
 
 jobs:
   security-scan:
@@ -13,29 +13,45 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: "3.11"
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install bandit safety
+          # Pinned: bandit's [tool.bandit]/pyproject.toml support (used below)
+          # is version-dependent; verified working on 1.7.8 through 1.9.4 with
+          # Python 3.11, so pinning removes any ambiguity about what an
+          # unpinned future install would resolve to.
+          pip install bandit==1.9.4 pip-audit==2.10.1
           pip install -r requirements.txt
-      
+          pip install -r tests/requirements.txt
+
       - name: Run security checks with bandit
-        run: bandit -r nervapy/ -f json -o bandit-report.json || true
+        # -c pyproject.toml picks up [tool.bandit] (B101 suppression); bandit
+        # does not read pyproject.toml automatically unless told to.
+        run: bandit -r nervapy/ -c pyproject.toml -f json -o bandit-report.json
 
-      - name: Run safety checks
-        run: safety check --json --output safety-report.json || true
+      - name: Run dependency vulnerability checks with pip-audit
+        # pip-audit (PyPA's own tool, backed by OSV.dev) replaces safety here:
+        # no account/API key needed, unlike safety's "scan" command, and no
+        # deprecation warnings like safety's "check" command. tests/requirements.txt
+        # is installed above so this audits what CI actually resolved, not just
+        # what the unpinned ranges in the requirements files could resolve to.
+        run: pip-audit -r requirements.txt -r tests/requirements.txt -f json -o pip-audit-report.json
 
       - name: Upload security reports
+        if: success() || failure()
+        # v3, not v4+: this self-hosted Gitea runner reports as GHES-compatible,
+        # and GHES does not support the @actions/artifact v2 protocol that
+        # upload-artifact@v4+ requires (confirmed via a real CI failure here).
         uses: actions/upload-artifact@v3
         with:
           name: security-reports
           path: |
             bandit-report.json
-            safety-report.json
+            pip-audit-report.json
 
   type-checking:
     runs-on: ubuntu-latest-small
@@ -45,7 +61,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.11'
+          python-version: "3.11"
 
       - name: Install dependencies
         run: |
@@ -53,7 +69,7 @@ jobs:
           pip install mypy types-six
           pip install -r requirements.txt
           pip install -e .
-      
+
       - name: Run type checking
         run: mypy nervapy/ --ignore-missing-imports --no-strict-optional
 
@@ -65,13 +81,13 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.11'
+          python-version: "3.11"
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install isort
-      
+
       - name: Check import sorting with isort
         run: isort --check-only --diff nervapy/
 
@@ -83,13 +99,13 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.11'
+          python-version: "3.11"
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install radon xenon
-      
+
       - name: Analyze code complexity
         run: |
           echo "=== Cyclomatic Complexity ==="

{pynerva-0.0.7 → pynerva-0.0.9}/.github/workflows/code-quality.yml

@@ -13,31 +13,42 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: '3.11'
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install bandit safety
+          # Pinned: bandit's [tool.bandit]/pyproject.toml support (used below)
+          # is version-dependent; verified working on 1.7.8 through 1.9.4 with
+          # Python 3.11, so pinning removes any ambiguity about what an
+          # unpinned future install would resolve to.
+          pip install bandit==1.9.4 pip-audit==2.10.1
           pip install -r requirements.txt
-      
-      - name: Run security checks with bandit
-        run: bandit -r nervapy/ -f json -o bandit-report.json || true
-        continue-on-error: true
+          pip install -r tests/requirements.txt
 
-      - name: Run safety checks
-        run: safety check --json --output safety-report.json || true
-        continue-on-error: true
+      - name: Run security checks with bandit
+        # -c pyproject.toml picks up [tool.bandit] (B101 suppression); bandit
+        # does not read pyproject.toml automatically unless told to.
+        run: bandit -r nervapy/ -c pyproject.toml -f json -o bandit-report.json
+
+      - name: Run dependency vulnerability checks with pip-audit
+        # pip-audit (PyPA's own tool, backed by OSV.dev) replaces safety here:
+        # no account/API key needed, unlike safety's "scan" command, and no
+        # deprecation warnings like safety's "check" command. tests/requirements.txt
+        # is installed above so this audits what CI actually resolved, not just
+        # what the unpinned ranges in the requirements files could resolve to.
+        run: pip-audit -r requirements.txt -r tests/requirements.txt -f json -o pip-audit-report.json
 
       - name: Upload security reports
+        if: success() || failure()
         uses: actions/upload-artifact@v4
         with:
           name: security-reports
           path: |
             bandit-report.json
-            safety-report.json
+            pip-audit-report.json
 
   type-checking:
     runs-on: ubuntu-latest

pynerva-0.0.9/.github/workflows/publish.yml

@@ -0,0 +1,36 @@
+name: Publish to PyPI
+
+on:
+    release:
+        types: [ published ]
+    workflow_dispatch: {}
+
+jobs:
+    publish:
+        runs-on: ubuntu-latest
+        # workflow_dispatch (manual "test release") goes to TestPyPI under its
+        # own environment, so it can never pick up the real PyPI trusted
+        # publisher that's bound to the "release" environment.
+        environment: ${{ github.event_name == 'workflow_dispatch' && 'testpypi' || 'release' }}
+        permissions:
+            id-token: write # required for trusted publishing
+
+        steps:
+            - uses: actions/checkout@v4
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@v5
+
+            - name: Build package
+              run: uv build
+
+            - name: Publish to TestPyPI (manual test run)
+              if: github.event_name == 'workflow_dispatch'
+              # --check-url lets the same version be re-tested repeatedly
+              # without bumping it, by skipping a re-upload of a file already
+              # on TestPyPI instead of failing.
+              run: uv publish --publish-url https://test.pypi.org/legacy/ --check-url https://test.pypi.org/simple/
+
+            - name: Publish to PyPI
+              if: github.event_name == 'release'
+              run: uv publish

pynerva-0.0.9/CHANGELOG.md

@@ -0,0 +1,41 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
+
+## [0.0.9] - 2026-11-08
+
+### Added
+
+- ARM: support packing multiple functions into one shared assembly file via `ArmAssemblyWriter`
+- ARM: add `Function.prelude_asm` for injecting raw assembly text
+
+### Fixed
+
+- ARM: fix pre-existing bug in constants array handling
+- ARM writer: feature-mismatch validation across packed functions, alignment aggregation, ARMCC epilogue handling, and a bug where packing functions with constants/literal pools could leave executable code placed in a data section
+
+### Changed
+
+- CI: harden security-scan workflow — bandit + pip-audit (replacing deprecated `safety`), pinned tool versions, upload reports on failure too
+- CI: remove duplicate PyPI publish path; add a safe `workflow_dispatch` TestPyPI dry-run path for testing the release pipeline without touching production PyPI
+- Bump `urllib3` 2.7.0 -> 2.8.0
+- Bump `certifi` 2026.4.22 -> 2026.10.18
+
+### Tests
+
+- ARM: add tests for UXTH
+
+## [0.0.8] - 2026-07-19
+
+### Added
+
+- [arm-m] Adds UXTH instruction
+
+## [0.0.7] - 2026-06-16
+
+### Added
+
+- Adds support for generating assembly kernels that can be included to Rust projects.
+

{pynerva-0.0.7 → pynerva-0.0.9}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: PyNerva
-Version: 0.0.7
+Version: 0.0.9
 Summary: Framework for exploring advanced program synthesis and transformation techniques
 Project-URL: Homepage, https://github.com/kriskwiatkowski/NervaPy.git
 Author-email: Kris Kwiatkowski <kris@amongbytes.com>

{pynerva-0.0.7 → pynerva-0.0.9}/nervapy/arm/__init__.py

@@ -93,7 +93,7 @@ from nervapy.arm.generic import (ADC, ADCCC, ADCCS, ADCEQ, ADCGE, ADCGT, ADCHI,
                                  TSTCS, TSTEQ, TSTGE, TSTGT, TSTHI, TSTHS,
                                  TSTLE, TSTLO, TSTLS, TSTLT, TSTMI, TSTNE,
                                  TSTPL, TSTVC, TSTVS, TT, TTA, TTAT, TTT,
-                                 UMAAL, UMAALGE, UMLAL, UMULL, B)
+                                 UMAAL, UMAALGE, UMLAL, UMULL, UXTH, B)
 from nervapy.arm.literal_pool import LDR_LITERAL, LDRL
 from nervapy.arm.microarchitecture import Microarchitecture
 from nervapy.arm.pseudo import (ALIGN, ASSUME, IMPORT, INIT, LABEL, LOAD,