adr-check 0.1.0__tar.gz

adr_check-0.1.0/.betterleaks.toml

@@ -0,0 +1,24 @@
+[extend]
+useDefault = true
+
+# Build output, if a language template's .gitignore later covers it: never
+# committed, and derived from sources that are scanned anyway.
+[[allowlists]]
+description = "Generated output, per .gitignore — never committed, and derived from sources that are scanned"
+paths = [
+  '''(?:^|/)coverage/''',
+  '''(?:^|/)coverage\.xml$''',
+  '''(?:^|/)\.coverage$''',
+  '''(?:^|/)dist/''',
+  '''(?:^|/)build/''',
+  '''(?:^|/)out/''',
+]
+
+# Parallel checkouts, read as a second copy of the tree: the same findings
+# twice, against whichever branch that worktree is on. Its own commits are
+# still covered, by the staged-diff hook and by pre-commit.yml on its PR.
+[[allowlists]]
+description = "Git worktrees — other checkouts of this repository, scanned on their own branch"
+paths = [
+  '''(?:^|/)\.worktrees/''',
+]

adr_check-0.1.0/.editorconfig

@@ -0,0 +1,19 @@
+# Mirrors what the pre-commit hooks enforce, so an editor writes a conforming
+# file instead of a hook rewriting it after the fact. See https://editorconfig.org.
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+
+[*.md]
+# trailing-whitespace runs with --markdown-linebreak-ext=md, keeping two-space
+# hard line breaks; trimming here would destroy what that hook protects.
+trim_trailing_whitespace = false
+max_line_length = 100
+
+[*.{yml,yaml}]
+indent_size = 2

adr_check-0.1.0/.gitattributes

@@ -0,0 +1,5 @@
+# eol=lf so a Windows checkout gets LF too, not just the index.
+* text=auto eol=lf
+
+# CRLF breaks a shebang, so keep this one explicit.
+*.sh text eol=lf

adr_check-0.1.0/.github/CODEOWNERS

@@ -0,0 +1,6 @@
+# Replace this handle in every repo created from this template: a team that
+# does not exist matches nobody, and GitHub reports no error when it happens.
+# This only requests a review. It withholds merge until one arrives where the
+# branch ruleset also turns on "Require review from Code Owners".
+
+* @agentic-delivery-au/engineering

adr_check-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,17 @@
+name: Bug report
+description: Something does not work the way it should
+labels: ["bug"]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened, and what did you expect instead?
+      description: Enough detail that someone can see the problem without asking a follow-up.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: How to reproduce it
+      description: The command, file, or steps. Leave this blank if it is not reproducible on demand.

adr_check-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,3 @@
+# Every PR has to reference an issue, so a one-line issue must stay possible;
+# the forms are a starting point, not a toll gate.
+blank_issues_enabled: true

adr_check-0.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,17 @@
+name: Feature request
+description: Something this repo should do that it does not do yet
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: The problem rather than the solution — why the current behaviour is not enough.
+    validations:
+      required: true
+
+  - type: textarea
+    id: approach
+    attributes:
+      label: Approach
+      description: If you already have one in mind. A sentence is enough; the rest is the discussion.

adr_check-0.1.0/.github/actionlint.yaml

@@ -0,0 +1,11 @@
+# actionlint checks action inputs against a generated snapshot of popular
+# actions, and its entry for create-github-app-token@v3 still requires the
+# deprecated app-id and does not know the client-id that replaced it. Upstream's
+# action.yml at v3.2.0 marks app-id "Use 'client-id' instead". Scoped to the two
+# messages so everything else about this workflow is still checked; remove it
+# once the snapshot catches up.
+paths:
+  .github/workflows/release-please.yml:
+    ignore:
+      - 'missing input "app-id" which is required by action "actions/create-github-app-token@v3"'
+      - 'input "client-id" is not defined in action "actions/create-github-app-token@v3"'

adr_check-0.1.0/.github/dependabot.yml

@@ -0,0 +1,26 @@
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"
+
+  # The dev dependency group pins exact versions, per the Python coding
+  # standard, so this is the only thing that moves them.
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      python:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"

adr_check-0.1.0/.github/pull_request_template.md

@@ -0,0 +1,34 @@
+<!--
+A reviewer, human or LLM, reads this before your diff.
+
+The PR title becomes the commit subject on the trunk: Conventional Commits,
+lowercase, 72 characters or fewer. The description becomes the commit body, so
+everything below is permanent. AGENTS.md has the full conventions.
+-->
+
+## What
+
+<!--
+One paragraph, readable without opening the diff. Add why the change was needed,
+and anything about the approach that would surprise a reviewer, where those are
+not already obvious from the diff or the linked issue. A typo fix needs a
+sentence; a change of approach needs the reasoning.
+-->
+
+## Testing
+
+<!--
+How you verified this. "Tested manually" is not enough. Say what you tested and
+how. Write "None" if you did not verify it, because an empty field reads as an
+oversight rather than a decision.
+
+For a skill change, the useful evidence is that you loaded the skill and ran it
+against something real, not that the markdown renders.
+-->
+
+Fixes: #
+
+<!--
+Fixes closes the issue on merge. Use Refs: instead where this is one of several
+PRs against the same issue, so only the last one closes it.
+-->

adr_check-0.1.0/.github/workflows/lint-pr.yml

@@ -0,0 +1,44 @@
+name: 'Lint PR'
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - edited
+      - synchronize
+
+# Keyed on the workflow too: concurrency groups are repo-wide, so without it this
+# would cancel the pre-commit run for the same PR.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  main:
+    name: Validate PR title
+    runs-on: ubuntu-slim
+    permissions:
+      pull-requests: read
+    steps:
+      # Dependabot titles its own PRs and we don't control the casing it picks
+      # (e.g. "Bump actions/cache from 4 to 6"), so it fails the lowercase check
+      # below by design rather than by mistake.
+      #
+      # This condition has to stay on the step, not the job. `Validate PR title`
+      # is a required status check, and a skipped job never reports a conclusion,
+      # so hoisting it to the job would leave every Dependabot PR permanently
+      # blocked. A job whose only step is skipped still succeeds.
+      - uses: amannn/action-semantic-pull-request@v6
+        if: github.event.pull_request.user.login != 'dependabot[bot]'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          # PR title must not start with a capital letter
+          subjectPattern: ^(?![A-Z]).+$
+          # If the PR only contains a single commit, the action will validate that
+          # it matches the configured pattern.
+          validateSingleCommit: true
+          # Related to `validateSingleCommit` you can opt-in to validate that the PR
+          # title matches a single commit to avoid confusion.
+          validateSingleCommitMatchesPrTitle: true

adr_check-0.1.0/.github/workflows/pre-commit.yml

@@ -0,0 +1,53 @@
+name: pre-commit
+
+# Runs the same hooks contributors run locally. Without this, the hooks are
+# optional in practice: anyone who has not run `pre-commit install`, or who
+# commits with --no-verify, bypasses every check in the harness.
+
+on:
+  pull_request:
+    # No `types:` defaults to [opened, synchronize, reopened], which excludes
+    # `edited` — fired when a PR's base branch is changed (e.g. retargeting a
+    # stacked branch onto main after its base merges), leaving this check
+    # stale against the old base until something else pushes a new commit.
+    types: [opened, reopened, edited, synchronize]
+  push:
+    branches: [main]
+
+# `main` pushes group by ref rather than PR number, and are never cancelled: a
+# superseded push would leave trunk with no green run against its head commit.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.14"
+      # The pyrefly hook shells out to uv so the checker sees the project's
+      # resolved dependencies, so uv has to be on PATH here too. setup-uv
+      # stopped publishing floating major tags after v7, so a bare v10 404s.
+      - uses: astral-sh/setup-uv@v10.3.0
+        with:
+          enable-cache: true
+      # --locked rather than --frozen: --frozen installs from the lock without
+      # checking it against pyproject.toml, so a dependency change that was never
+      # re-locked passes CI green.
+      - run: uv sync --locked
+      # Pinned so a new pre-commit release cannot change a CI result on its own;
+      # bump in step with what contributors install locally.
+      - run: python -m pip install pre-commit==4.6.2
+      # Reuse the built hook environments across runs; keyed on the hook config
+      # so it invalidates when a hook or its version changes.
+      - uses: actions/cache@v6
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ runner.os }}-py3.14-${{ hashFiles('.pre-commit-config.yaml') }}
+      - run: pre-commit run --all-files --show-diff-on-failure

adr_check-0.1.0/.github/workflows/release-please.yml

@@ -0,0 +1,59 @@
+name: release-please
+
+# Maintains an open release PR off main: it accumulates the Conventional Commits
+# since the last release, and merging it tags the version and cuts the GitHub
+# release. The publish job then uploads the tagged build to PyPI.
+
+on:
+  push:
+    branches: [main]
+
+# The App token below does all the work, so GITHUB_TOKEN is left with nothing.
+permissions: {}
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    steps:
+      # A release PR opened with GITHUB_TOKEN triggers no workflows, so the
+      # checks the ruleset requires would never report on it and it could never
+      # merge. No owner or repositories input, so the token covers this
+      # repository only; the permission-* set is release-please's documented
+      # minimum, and without it the token inherits every permission the
+      # installation holds. README "Repository settings" covers the App setup.
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          client-id: ${{ vars.RELEASE_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+
+      - uses: googleapis/release-please-action@v5
+        id: release
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  # PyPI trusted publishing is registered against this file name and the `pypi` environment.
+  publish:
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v10.3.0
+      - run: uv build
+      - uses: pypa/gh-action-pypi-publish@v1.14.2

adr_check-0.1.0/.github/workflows/tests.yml

@@ -0,0 +1,41 @@
+name: tests
+
+on:
+  pull_request:
+    # Default types exclude `edited`, so a retargeted PR keeps a stale result.
+    types: [opened, reopened, edited, synchronize]
+  push:
+    branches: [main]
+
+# `main` pushes are never cancelled: a superseded one would leave trunk with no
+# green run against its head commit.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  # The job id is the status check context ruleset_payload() requires in
+  # scripts/bootstrap_repo.py; renaming it blocks every pull request.
+  pytest:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      # setup-uv stopped publishing floating major tags after v7, so v10 404s.
+      - uses: astral-sh/setup-uv@v10.3.0
+        with:
+          enable-cache: true
+      # --frozen would install from a lockfile that no longer matches pyproject.
+      - run: uv sync --locked
+      - run: uv run --no-sync pytest
+      # The default swallows an upload failure, leaving Codecov reporting a
+      # stale commit.
+      - uses: codecov/codecov-action@v7
+        with:
+          # `files` adds to what the search finds rather than replacing it.
+          files: coverage.xml
+          disable_search: true
+          fail_ci_if_error: true
+          token: ${{ secrets.CODECOV_TOKEN }}

adr_check-0.1.0/.gitignore

@@ -0,0 +1,29 @@
+# OS / editor cruft
+.DS_Store
+*.swp
+
+# Local secrets
+.env
+
+# Local git worktrees
+.worktrees/
+
+# Claude Code agent worktrees and local state
+.claude/worktrees/
+
+# Python bytecode
+__pycache__/
+*.py[cod]
+
+# Python build output
+dist/
+*.egg-info/
+
+# Python environment and tool caches
+.venv/
+.pytest_cache/
+.ruff_cache/
+
+# Coverage output, written by every `uv run pytest`
+.coverage
+coverage.xml

adr_check-0.1.0/.markdownlint.jsonc

@@ -0,0 +1,7 @@
+{
+  // 100 to match .mdformat.toml's wrap. Tables and code blocks can't be
+  // rewrapped, so they're exempt.
+  "MD013": { "line_length": 100, "tables": false, "code_blocks": false },
+  "MD033": false, // inline HTML is fine
+  "MD041": false // first line need not be a top-level heading
+}

adr_check-0.1.0/.markdownlintignore

@@ -0,0 +1,4 @@
+node_modules/
+.git/
+.claude/
+CHANGELOG.md

adr_check-0.1.0/.mdformat.toml

@@ -0,0 +1,5 @@
+# mdformat configuration — https://mdformat.readthedocs.io
+# Read by the pre-commit hook, editor integrations, and manual `mdformat .` runs.
+
+wrap = 100          # wrap prose at 100 columns
+end_of_line = "lf"

adr_check-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,115 @@
+# See https://pre-commit.com for usage and hook docs.
+# Update pinned revs with: pre-commit autoupdate
+
+default_install_hook_types: [pre-commit, commit-msg]
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+        args: [--markdown-linebreak-ext=md]  # keep 2-space hard line breaks in .md
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-merge-conflict
+      - id: check-added-large-files
+      - id: mixed-line-ending
+        args: [--fix=lf]
+
+  - repo: https://github.com/hukkin/mdformat
+    rev: 1.0.0
+    hooks:
+      - id: mdformat
+        # release-please owns CHANGELOG.md and rewrites it in its own format on
+        # every release, so formatting it here just starts a tug of war.
+        # (^|/) rather than ^ so a monorepo releasing per package keeps its
+        # apps/*/CHANGELOG.md and libs/*/CHANGELOG.md excluded too.
+        exclude: (^|/)CHANGELOG\.md$
+        additional_dependencies:
+          - mdformat-gfm
+          - mdformat-footnote
+          - mdformat-frontmatter  # leave YAML front matter (skill SKILL.md, etc.) untouched
+
+  - repo: https://github.com/igorshubovych/markdownlint-cli
+    rev: v0.49.1
+    hooks:
+      - id: markdownlint
+        exclude: (^|/)CHANGELOG\.md$
+        args: ["--config", ".markdownlint.jsonc"]
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      # The plain id builds from source rather than pulling a Docker image or
+      # expecting a preinstalled binary; the CI job installs only Python.
+      # Go pinned to the version betterleaks already downloads, so the two
+      # hooks share one cached toolchain.
+      - id: actionlint
+        language_version: "1.27.0"
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.16.7
+    hooks:
+      # --fix writes the fixes and still fails the commit, so stage them and
+      # commit again.
+      - id: ruff-check
+        args: [--fix]
+      # types_or narrowed: the upstream hook also claims markdown at this rev, and
+      # Ruff reformats Python blocks inside .md. mdformat owns Markdown here, and
+      # two formatters on one file is the tug of war CHANGELOG.md already shows.
+      - id: ruff-format
+        types_or: [python, pyi]
+
+  - repo: local
+    hooks:
+      # Pyrefly ships no .pre-commit-hooks.yaml, so this is a local hook. It runs
+      # through uv so the checker sees the project's resolved dependencies.
+      # --locked because a bare `uv run` rewrites uv.lock in place when it is
+      # stale, leaving a tracked file modified as a side effect of committing.
+      # src scopes the check past scripts/ and tests/ -- see pyproject.toml.
+      - id: pyrefly
+        name: pyrefly
+        entry: uv run --locked pyrefly check src
+        language: system
+        types: [python]
+        pass_filenames: false  # the checker needs the project, not the staged files
+
+  - repo: https://github.com/commitizen-tools/commitizen
+    rev: v4.18.0
+    hooks:
+      # -l measures the whole first line, type and scope included, and ignores
+      # the body, which is exactly the section 2.1 rule. Overriding args
+      # replaces the hook's shipped defaults, so --allow-abort is repeated here,
+      # and --commit-msg-file stays last because pre-commit appends the message
+      # filename after the configured args.
+      - id: commitizen
+        stages: [commit-msg]
+        args: [--allow-abort, --message-length-limit, "72", --commit-msg-file]
+
+  - repo: https://github.com/betterleaks/betterleaks
+    rev: v1.8.1
+    hooks:
+      # Reports without writing, so nothing is left modified and unstaged.
+      # .betterleaks.toml holds what the repository treats as benign.
+      # language_version so every machine builds the same scanner.
+      - id: betterleaks
+        language_version: "1.27.0"
+
+  - repo: local
+    hooks:
+      # The --apply path writes real repository settings, so a fake gh is the
+      # only place it gets exercised. Runs on any scripts/ change, not just the
+      # test file, since the script is what the assertions are about.
+      - id: bootstrap-repo-tests
+        name: bootstrap_repo tests
+        entry: python3 -m unittest discover -s scripts -t scripts
+        language: system
+        pass_filenames: false
+        files: ^scripts/.*\.py$
+
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.11.0.1-1
+    hooks:
+      # shellcheck-py ships the binary as a wheel, so this needs no system
+      # shellcheck -- the CI job installs only Python.
+      - id: shellcheck

adr_check-0.1.0/.pre-commit-hooks.yaml

@@ -0,0 +1,8 @@
+- id: adr-check
+  name: adr-check
+  description: Check the ADRs in docs/adr against the ADR rules, without comparing with main
+  entry: adr-check
+  language: python
+  language_version: python3.14  # the package needs it, and pre-commit's own Python may be older
+  files: ^docs/adr/
+  pass_filenames: false  # the check reads the whole directory, including the other ADRs

adr_check-0.1.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.1.0"
+}