aemo-mdff-reader 2.0.2__tar.gz → 2.0.4__tar.gz

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.0.4}/CHANGELOG.md

@@ -4,6 +4,55 @@ All notable changes are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the
 project follows [Semantic Versioning](https://semver.org/).
 
+## [2.0.4](https://github.com/Utilified/aemo-mdff-reader/compare/v2.0.3...v2.0.4) (2026-05-10)
+
+First release published to PyPI after the supply-chain hardening landed
+in v2.0.3 — which itself failed to publish due to two release-pipeline
+bugs (see notice on the v2.0.3 GitHub Release). PyPI users upgrading
+from 2.0.2 receive **both** the v2.0.3 hardening (SLSA build provenance,
+CycloneDX SBOM, release-please automation, dependabot grouping) and the
+fixes below in one upgrade. No source or behavioural changes versus 2.0.2.
+
+### Bug Fixes
+
+* release-please dispatch + SBOM directory creation ([#17](https://github.com/Utilified/aemo-mdff-reader/issues/17)) ([8e3cd13](https://github.com/Utilified/aemo-mdff-reader/commit/8e3cd13ca11bad3399efd2e5fd2fe5ae6bcb2a90))
+
+## [2.0.3](https://github.com/Utilified/aemo-mdff-reader/compare/v2.0.2...v2.0.3) (2026-05-10)
+
+Supply-chain hardening and release-process automation. No source or
+behavioural changes versus 2.0.2 — same wheel/sdist content, plus
+provenance, SBOM, and an automated release pipeline.
+
+### Added
+
+- SLSA build provenance attestations on the wheel and sdist (via
+  `actions/attest-build-provenance`). Verifiable with
+  `gh attestation verify`.
+- CycloneDX SBOM generated by `anchore/sbom-action` and attested
+  against both artifacts (via `actions/attest-sbom`). SBOM is also
+  attached to each GitHub Release alongside the sigstore signatures.
+- `release-please` automation: releases are now proposed and cut
+  from Conventional Commits. Merging the auto-generated release PR
+  creates the tag, which dispatches the existing `release.yml`
+  pipeline. See [CONTRIBUTING.md](CONTRIBUTING.md) for the flow.
+- Dependabot grouping: minor/patch GitHub Actions bumps land as a
+  single weekly PR; minor/patch runtime-extras bumps (pandas /
+  pyarrow / PyMySQL) land as a separate weekly PR. Majors stay
+  individual.
+- README badges for CodeQL, OpenSSF Scorecard, and OpenSSF Best
+  Practices.
+
+### Changed
+
+- Branch protection on `main` now requires PR conversation resolution
+  before merge.
+- GitHub Discussions enabled on the repository as a Q&A surface
+  separate from the issue tracker.
+
+### Bug Fixes
+
+* rename release-please config to default path ([#15](https://github.com/Utilified/aemo-mdff-reader/issues/15)) ([843d25f](https://github.com/Utilified/aemo-mdff-reader/commit/843d25ff8c35944e08eb70ebfdb076acdf1c9855))
+
 ## [Unreleased]
 
 ## [2.0.2] — 2026-05-10

aemo_mdff_reader-2.0.4/CONTRIBUTING.md

@@ -0,0 +1,196 @@
+# Contributing
+
+Thanks for your interest in improving aemo-mdff-reader. The repository
+is small and the bar for contributions is straightforward: a pull
+request that passes CI and doesn't regress the public benchmark is
+welcome.
+
+Naming: everything (GitHub repo `Utilified/aemo-mdff-reader`, PyPI
+distribution `aemo-mdff-reader`, Python import `aemo_mdff_reader`,
+CLI `aemo-mdff-reader`) is consistently named after the AEMO spec —
+MDFF, the Meter Data File Format that covers both NEM12 (interval) and
+NEM13 (accumulation) formats. GitHub serves redirects from the
+previous `Utilified/nem12-reader` repo URL so existing git pins
+continue to work; v1 callers importing `from nem12_reader …` need to
+update to `from aemo_mdff_reader …`.
+
+## Setup
+
+```bash
+git clone https://github.com/Utilified/aemo-mdff-reader.git
+cd aemo-mdff-reader
+python -m venv .venv && source .venv/bin/activate
+pip install -e .[dev]
+pytest
+```
+
+## Running the test suite
+
+```bash
+pytest -v
+pytest --cov=aemo_mdff_reader --cov-report=term-missing
+```
+
+A small, sanitized NEM12 sample lives at
+`tests/fixtures/sample_nem12.csv`. To generate larger synthetic files
+for ad-hoc testing or benchmarking:
+
+```bash
+python tests/fixtures/generate.py /tmp/big.csv --nmis 4 --days 365 --interval-minutes 5
+```
+
+## Performance
+
+`benchmarks/bench_parser.py` is the canonical performance test. Please
+run it before and after changes that touch the hot path
+(`parser.py::_emit_intervals`, `parse_to_columns`, `to_columns`):
+
+```bash
+python benchmarks/bench_parser.py --nmis 4 --days 365 --interval-minutes 5
+```
+
+The streaming and columnar fast paths must remain at or above the
+current published throughput.
+
+## Code style
+
+- Pure stdlib in the core. **No** new required runtime dependencies.
+  Optional features go behind `[project.optional-dependencies]`.
+- Type hints on all public symbols.
+- Keep `aemo_mdff_reader.types` slots-based — per-row allocation is on
+  the hot path.
+
+## Commit messages
+
+Releases are generated automatically from commits using
+[release-please](https://github.com/googleapis/release-please), so the
+commit subject prefix is load-bearing — it determines whether a release
+is cut and what kind of version bump it gets.
+
+Use [Conventional Commits](https://www.conventionalcommits.org/):
+
+| Prefix                             | Effect on next release                 |
+| ---------------------------------- | -------------------------------------- |
+| `feat: …`                          | minor bump (e.g. 2.0.x → 2.1.0)        |
+| `fix: …`                           | patch bump (e.g. 2.0.0 → 2.0.1)        |
+| `feat!: …` or `BREAKING CHANGE:` footer | major bump (e.g. 2.x → 3.0.0)     |
+| `chore: …` / `docs: …` / `refactor: …` / `style: …` / `test: …` / `ci: …` / `build: …` | no release on its own |
+| any commit with `Release-As: x.y.z` footer | forces that exact version    |
+
+Subject line: imperative mood, under 72 chars, lowercase after the
+prefix. Examples that work well:
+
+```
+feat: stream NEM13 250 records via parse_accumulations
+fix: handle CRLF line endings in 300-record payloads
+chore: bump CI matrix to include Python 3.13
+```
+
+Squash-merge is preferred — the squash commit message becomes the
+release-please input, so make it count.
+
+## Reporting issues
+
+Please open an issue with:
+
+1. The Python version and OS.
+2. A minimal reproducer (a few NEM12 rows is usually enough).
+3. The expected vs actual behaviour.
+
+If you can share a sanitized sample file (no real NMIs / meter
+serials), please attach it to the issue.
+
+## Releasing
+
+Releases are automated via [release-please](https://github.com/googleapis/release-please).
+Maintainers do not run `git tag` by hand for normal releases.
+
+### Normal flow (Conventional Commits drive it)
+
+1. Land a `feat:` or `fix:` commit on `main` (via squash-merged PR).
+2. The `release-please` workflow runs and either opens a new release PR
+   titled `chore(main): release X.Y.Z` or updates the existing one.
+   The PR auto-bumps `pyproject.toml` and `aemo_mdff_reader/__init__.py`
+   (the `# x-release-please-version` annotation in `__init__.py` marks
+   the line release-please rewrites) and drafts the `CHANGELOG.md`
+   entry from the commit log.
+3. Review the release PR. Edit the changelog entry directly on the PR
+   if you want to massage wording — release-please will keep your
+   edits across reruns. When happy, **squash-merge** it.
+4. release-please creates the `vX.Y.Z` git tag on merge.
+5. Because tags created by `GITHUB_TOKEN` do not trigger downstream
+   tag-push workflows (GitHub anti-recursion guard), `release-please.yml`
+   explicitly dispatches `release.yml` for the new tag.
+6. `release.yml` runs the publish pipeline:
+   build → SLSA build provenance attestation → CycloneDX SBOM +
+   attestation → upload artefacts → wait on the `pypi` Environment
+   reviewer → sigstore sign → PyPI Trusted Publishing → GitHub Release
+   with wheel + sdist + signatures + SBOM attached.
+7. Approve the deployment in the `pypi` Environment when GitHub
+   notifies you. The publish completes; verify at
+   https://pypi.org/project/aemo-mdff-reader/ and
+   https://github.com/Utilified/aemo-mdff-reader/releases.
+
+### Forcing a release without a feat/fix commit
+
+Two options:
+
+- Add `Release-As: x.y.z` as a commit-message footer on a commit
+  landing on `main` (works for `chore:` / `docs:` etc. that wouldn't
+  trigger a release on their own).
+- Manually trigger the `release-please` workflow via GitHub Actions →
+  *release-please* → "Run workflow" (workflow_dispatch).
+
+### Emergency manual release (rare)
+
+`release.yml` still listens on tag-push, so a maintainer can bypass
+release-please entirely:
+
+```bash
+# Bump version in pyproject.toml AND aemo_mdff_reader/__init__.py
+# (preserve the `# x-release-please-version` comment on __init__.py),
+# update CHANGELOG.md, then:
+git commit -am "release: vX.Y.Z"
+git tag vX.Y.Z
+git push origin main vX.Y.Z
+```
+
+Use only if release-please is broken — otherwise you'll fight it on
+the next push.
+
+### One-time infrastructure setup (per project)
+
+Already done for `aemo-mdff-reader`; documented here for posterity.
+
+1. **PyPI Trusted Publishing**: register the project at
+   https://pypi.org/manage/account/publishing/ with:
+   - PyPI project name: `aemo-mdff-reader`
+   - Owner: `Utilified`
+   - Repository: `aemo-mdff-reader`
+   - Workflow filename: `release.yml`
+   - Environment name: `pypi`
+2. **GitHub Environment**: in *Settings → Environments*, create an
+   environment named `pypi`. Add required reviewers (recommended) and
+   restrict the deployment branch policy to `v*` tags.
+3. **Repository variable**: set `PYPI_PUBLISH_ENABLED=true` under
+   *Settings → Secrets and variables → Actions → Variables*. The
+   publish job is gated on this so the workflow runs cleanly while
+   Trusted Publishing is being configured (build + sign succeed;
+   publish skips).
+4. **Workflow permissions**: under *Settings → Actions → General →
+   Workflow permissions*, set "Read and write permissions" and tick
+   "Allow GitHub Actions to create and approve pull requests" — the
+   `release-please` action needs both to open release PRs.
+
+### Local dry run of the build
+
+```bash
+python -m build
+twine check --strict dist/*
+python -m venv /tmp/smoke && /tmp/smoke/bin/pip install dist/*.whl
+/tmp/smoke/bin/aemo-mdff-reader --version
+```
+
+There is no way to dry-run the publish step — Trusted Publishing only
+authenticates a real `release.yml` run on a real tag. The first
+release after touching `release.yml` is the de-facto integration test.

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aemo-mdff-reader
-Version: 2.0.2
+Version: 2.0.4
 Summary: Fast streaming reader for AEMO MDFF NEM12 / NEM13 metering files. Zero required dependencies.
 Author: Utilified Holdings Pty Ltd
 License-Expression: MIT
@@ -51,6 +51,10 @@ Dynamic: license-file
 [![PyPI](https://img.shields.io/pypi/v/aemo-mdff-reader.svg)](https://pypi.org/project/aemo-mdff-reader/)
 [![Python versions](https://img.shields.io/pypi/pyversions/aemo-mdff-reader.svg)](https://pypi.org/project/aemo-mdff-reader/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![CodeQL](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/codeql.yml/badge.svg)](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Utilified/aemo-mdff-reader/badge)](https://scorecard.dev/viewer/?uri=github.com/Utilified/aemo-mdff-reader)
+<!-- TODO: replace PROJECTID after registering at https://www.bestpractices.dev/ -->
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/PROJECTID/badge)](https://www.bestpractices.dev/projects/PROJECTID)
 
 Fast, zero-dependency streaming reader for AEMO **NEM12** and **NEM13**
 metering files. Implements AEMO MDFF (Meter Data File Format) v2.6.
@@ -238,9 +242,15 @@ pytest
 ```
 
 CI runs ruff, mypy --strict, the test matrix on Python 3.9 → 3.12 /
-Linux / macOS / Windows, `pip-audit`, `bandit`, and a wheel-install
-smoke test. Releases are signed with sigstore and published to PyPI
-via Trusted Publishing on tag.
+Linux / macOS / Windows, `pip-audit`, `bandit`, CodeQL, OpenSSF
+Scorecard, and a wheel-install smoke test.
+
+Releases are automated by [release-please](https://github.com/googleapis/release-please)
+from [Conventional Commits](https://www.conventionalcommits.org/) on
+`main`, then signed with sigstore, attested with SLSA build provenance
+and a CycloneDX SBOM, and published to PyPI via Trusted Publishing.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the contributor commit
+conventions and the full release flow.
 
 ## License
 

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.0.4}/README.md

@@ -4,6 +4,10 @@
 [![PyPI](https://img.shields.io/pypi/v/aemo-mdff-reader.svg)](https://pypi.org/project/aemo-mdff-reader/)
 [![Python versions](https://img.shields.io/pypi/pyversions/aemo-mdff-reader.svg)](https://pypi.org/project/aemo-mdff-reader/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![CodeQL](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/codeql.yml/badge.svg)](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Utilified/aemo-mdff-reader/badge)](https://scorecard.dev/viewer/?uri=github.com/Utilified/aemo-mdff-reader)
+<!-- TODO: replace PROJECTID after registering at https://www.bestpractices.dev/ -->
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/PROJECTID/badge)](https://www.bestpractices.dev/projects/PROJECTID)
 
 Fast, zero-dependency streaming reader for AEMO **NEM12** and **NEM13**
 metering files. Implements AEMO MDFF (Meter Data File Format) v2.6.
@@ -191,9 +195,15 @@ pytest
 ```
 
 CI runs ruff, mypy --strict, the test matrix on Python 3.9 → 3.12 /
-Linux / macOS / Windows, `pip-audit`, `bandit`, and a wheel-install
-smoke test. Releases are signed with sigstore and published to PyPI
-via Trusted Publishing on tag.
+Linux / macOS / Windows, `pip-audit`, `bandit`, CodeQL, OpenSSF
+Scorecard, and a wheel-install smoke test.
+
+Releases are automated by [release-please](https://github.com/googleapis/release-please)
+from [Conventional Commits](https://www.conventionalcommits.org/) on
+`main`, then signed with sigstore, attested with SLSA build provenance
+and a CycloneDX SBOM, and published to PyPI via Trusted Publishing.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the contributor commit
+conventions and the full release flow.
 
 ## License
 

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.0.4}/aemo_mdff_reader/__init__.py

@@ -48,7 +48,7 @@ from .types import (
     NMIDetails,
 )
 
-__version__ = "2.0.2"
+__version__ = "2.0.4"  # x-release-please-version
 
 __all__ = [
     "INTERVAL_DATA_OUTPUT_HEADERS",

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.0.4}/aemo_mdff_reader.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aemo-mdff-reader
-Version: 2.0.2
+Version: 2.0.4
 Summary: Fast streaming reader for AEMO MDFF NEM12 / NEM13 metering files. Zero required dependencies.
 Author: Utilified Holdings Pty Ltd
 License-Expression: MIT
@@ -51,6 +51,10 @@ Dynamic: license-file
 [![PyPI](https://img.shields.io/pypi/v/aemo-mdff-reader.svg)](https://pypi.org/project/aemo-mdff-reader/)
 [![Python versions](https://img.shields.io/pypi/pyversions/aemo-mdff-reader.svg)](https://pypi.org/project/aemo-mdff-reader/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![CodeQL](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/codeql.yml/badge.svg)](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Utilified/aemo-mdff-reader/badge)](https://scorecard.dev/viewer/?uri=github.com/Utilified/aemo-mdff-reader)
+<!-- TODO: replace PROJECTID after registering at https://www.bestpractices.dev/ -->
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/PROJECTID/badge)](https://www.bestpractices.dev/projects/PROJECTID)
 
 Fast, zero-dependency streaming reader for AEMO **NEM12** and **NEM13**
 metering files. Implements AEMO MDFF (Meter Data File Format) v2.6.
@@ -238,9 +242,15 @@ pytest
 ```
 
 CI runs ruff, mypy --strict, the test matrix on Python 3.9 → 3.12 /
-Linux / macOS / Windows, `pip-audit`, `bandit`, and a wheel-install
-smoke test. Releases are signed with sigstore and published to PyPI
-via Trusted Publishing on tag.
+Linux / macOS / Windows, `pip-audit`, `bandit`, CodeQL, OpenSSF
+Scorecard, and a wheel-install smoke test.
+
+Releases are automated by [release-please](https://github.com/googleapis/release-please)
+from [Conventional Commits](https://www.conventionalcommits.org/) on
+`main`, then signed with sigstore, attested with SLSA build provenance
+and a CycloneDX SBOM, and published to PyPI via Trusted Publishing.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the contributor commit
+conventions and the full release flow.
 
 ## License
 

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.0.4}/pyproject.toml

@@ -11,7 +11,7 @@ build-backend = "setuptools.build_meta"
 # Pillow / PIL precedent (``pip install Pillow`` → ``import PIL``)
 # applies here.
 name = "aemo-mdff-reader"
-version = "2.0.2"
+version = "2.0.4"
 description = "Fast streaming reader for AEMO MDFF NEM12 / NEM13 metering files. Zero required dependencies."
 readme = "README.md"
 license = "MIT"

aemo_mdff_reader-2.0.2/CONTRIBUTING.md

@@ -1,118 +0,0 @@
-# Contributing
-
-Thanks for your interest in improving aemo-mdff-reader. The repository
-is small and the bar for contributions is straightforward: a pull
-request that passes CI and doesn't regress the public benchmark is
-welcome.
-
-Naming: everything (GitHub repo `Utilified/aemo-mdff-reader`, PyPI
-distribution `aemo-mdff-reader`, Python import `aemo_mdff_reader`,
-CLI `aemo-mdff-reader`) is consistently named after the AEMO spec —
-MDFF, the Meter Data File Format that covers both NEM12 (interval) and
-NEM13 (accumulation) formats. GitHub serves redirects from the
-previous `Utilified/nem12-reader` repo URL so existing git pins
-continue to work; v1 callers importing `from nem12_reader …` need to
-update to `from aemo_mdff_reader …`.
-
-## Setup
-
-```bash
-git clone https://github.com/Utilified/aemo-mdff-reader.git
-cd aemo-mdff-reader
-python -m venv .venv && source .venv/bin/activate
-pip install -e .[dev]
-pytest
-```
-
-## Running the test suite
-
-```bash
-pytest -v
-pytest --cov=aemo_mdff_reader --cov-report=term-missing
-```
-
-A small, sanitized NEM12 sample lives at
-`tests/fixtures/sample_nem12.csv`. To generate larger synthetic files
-for ad-hoc testing or benchmarking:
-
-```bash
-python tests/fixtures/generate.py /tmp/big.csv --nmis 4 --days 365 --interval-minutes 5
-```
-
-## Performance
-
-`benchmarks/bench_parser.py` is the canonical performance test. Please
-run it before and after changes that touch the hot path
-(`parser.py::_emit_intervals`, `parse_to_columns`, `to_columns`):
-
-```bash
-python benchmarks/bench_parser.py --nmis 4 --days 365 --interval-minutes 5
-```
-
-The streaming and columnar fast paths must remain at or above the
-current published throughput.
-
-## Code style
-
-- Pure stdlib in the core. **No** new required runtime dependencies.
-  Optional features go behind `[project.optional-dependencies]`.
-- Type hints on all public symbols.
-- Keep `aemo_mdff_reader.types` slots-based — per-row allocation is on
-  the hot path.
-
-## Reporting issues
-
-Please open an issue with:
-
-1. The Python version and OS.
-2. A minimal reproducer (a few NEM12 rows is usually enough).
-3. The expected vs actual behaviour.
-
-If you can share a sanitized sample file (no real NMIs / meter
-serials), please attach it to the issue.
-
-## Releasing
-
-Maintainers only. Releases are tagged and pushed to GitHub; the
-`Release` workflow then builds, signs (sigstore), publishes to PyPI
-(via Trusted Publishing), and attaches signatures to the GitHub Release.
-
-### One-time setup (per project)
-
-Before the first release, configure these on PyPI / GitHub:
-
-1. **PyPI Trusted Publishing**: register the project at
-   https://pypi.org/manage/account/publishing/ with:
-   - PyPI project name: `aemo-mdff-reader`
-   - Owner: `Utilified`
-   - Repository: `aemo-mdff-reader`
-   - Workflow filename: `release.yml`
-   - Environment name: `pypi`
-2. **GitHub Environment**: in *Settings → Environments*, create an
-   environment named `pypi`. Add required reviewers if you want
-   manual approval before publish (recommended for the first few
-   releases). Without this environment, the publish job will fail with
-   a confusing "environment not found" error.
-
-### Cutting a release
-
-```bash
-# Bump version in pyproject.toml AND aemo_mdff_reader/__init__.py.
-# Update CHANGELOG.md with the new section.
-git commit -am "release: vX.Y.Z"
-git tag vX.Y.Z
-git push origin main vX.Y.Z
-```
-
-The `Release` workflow takes over from here. Verify the published
-artefact at https://pypi.org/project/aemo-mdff-reader/ and the
-GitHub Release at https://github.com/Utilified/aemo-mdff-reader/releases.
-
-### Local dry run
-
-```bash
-python -m build
-twine check --strict dist/*
-python -m venv /tmp/smoke && /tmp/smoke/bin/pip install dist/*.whl
-/tmp/smoke/bin/aemo-mdff-reader --version
-```