aemo-mdff-reader 2.0.2__tar.gz → 2.1.0__tar.gz

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.1.0}/CHANGELOG.md

@@ -4,6 +4,67 @@ All notable changes are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the
 project follows [Semantic Versioning](https://semver.org/).
 
+## [2.1.0](https://github.com/Utilified/aemo-mdff-reader/compare/v2.0.4...v2.1.0) (2026-05-10)
+
+
+### Features
+
+* drop Python 3.9, hash-pin CI installs, scope release-please permissions ([447ec98](https://github.com/Utilified/aemo-mdff-reader/commit/447ec98408edabfab45d28841a2e714d54f8dd11))
+
+
+### Documentation
+
+* remove broken OpenSSF Best Practices badge ([#21](https://github.com/Utilified/aemo-mdff-reader/issues/21)) ([91a68d5](https://github.com/Utilified/aemo-mdff-reader/commit/91a68d5a4b4fd4c027488b4fe770c4cd142a7454))
+
+## [2.0.4](https://github.com/Utilified/aemo-mdff-reader/compare/v2.0.3...v2.0.4) (2026-05-10)
+
+First release published to PyPI after the supply-chain hardening landed
+in v2.0.3 — which itself failed to publish due to two release-pipeline
+bugs (see notice on the v2.0.3 GitHub Release). PyPI users upgrading
+from 2.0.2 receive **both** the v2.0.3 hardening (SLSA build provenance,
+CycloneDX SBOM, release-please automation, dependabot grouping) and the
+fixes below in one upgrade. No source or behavioural changes versus 2.0.2.
+
+### Bug Fixes
+
+* release-please dispatch + SBOM directory creation ([#17](https://github.com/Utilified/aemo-mdff-reader/issues/17)) ([8e3cd13](https://github.com/Utilified/aemo-mdff-reader/commit/8e3cd13ca11bad3399efd2e5fd2fe5ae6bcb2a90))
+
+## [2.0.3](https://github.com/Utilified/aemo-mdff-reader/compare/v2.0.2...v2.0.3) (2026-05-10)
+
+Supply-chain hardening and release-process automation. No source or
+behavioural changes versus 2.0.2 — same wheel/sdist content, plus
+provenance, SBOM, and an automated release pipeline.
+
+### Added
+
+- SLSA build provenance attestations on the wheel and sdist (via
+  `actions/attest-build-provenance`). Verifiable with
+  `gh attestation verify`.
+- CycloneDX SBOM generated by `anchore/sbom-action` and attested
+  against both artifacts (via `actions/attest-sbom`). SBOM is also
+  attached to each GitHub Release alongside the sigstore signatures.
+- `release-please` automation: releases are now proposed and cut
+  from Conventional Commits. Merging the auto-generated release PR
+  creates the tag, which dispatches the existing `release.yml`
+  pipeline. See [CONTRIBUTING.md](CONTRIBUTING.md) for the flow.
+- Dependabot grouping: minor/patch GitHub Actions bumps land as a
+  single weekly PR; minor/patch runtime-extras bumps (pandas /
+  pyarrow / PyMySQL) land as a separate weekly PR. Majors stay
+  individual.
+- README badges for CodeQL, OpenSSF Scorecard, and OpenSSF Best
+  Practices.
+
+### Changed
+
+- Branch protection on `main` now requires PR conversation resolution
+  before merge.
+- GitHub Discussions enabled on the repository as a Q&A surface
+  separate from the issue tracker.
+
+### Bug Fixes
+
+* rename release-please config to default path ([#15](https://github.com/Utilified/aemo-mdff-reader/issues/15)) ([843d25f](https://github.com/Utilified/aemo-mdff-reader/commit/843d25ff8c35944e08eb70ebfdb076acdf1c9855))
+
 ## [Unreleased]
 
 ## [2.0.2] — 2026-05-10

aemo_mdff_reader-2.1.0/CONTRIBUTING.md

@@ -0,0 +1,222 @@
+# Contributing
+
+Thanks for your interest in improving aemo-mdff-reader. The repository
+is small and the bar for contributions is straightforward: a pull
+request that passes CI and doesn't regress the public benchmark is
+welcome.
+
+Naming: everything (GitHub repo `Utilified/aemo-mdff-reader`, PyPI
+distribution `aemo-mdff-reader`, Python import `aemo_mdff_reader`,
+CLI `aemo-mdff-reader`) is consistently named after the AEMO spec —
+MDFF, the Meter Data File Format that covers both NEM12 (interval) and
+NEM13 (accumulation) formats. GitHub serves redirects from the
+previous `Utilified/nem12-reader` repo URL so existing git pins
+continue to work; v1 callers importing `from nem12_reader …` need to
+update to `from aemo_mdff_reader …`.
+
+## Setup
+
+```bash
+git clone https://github.com/Utilified/aemo-mdff-reader.git
+cd aemo-mdff-reader
+python -m venv .venv && source .venv/bin/activate
+pip install -e .[dev]
+pytest
+```
+
+## CI requirements files
+
+`requirements/{dev,lint,build,audit}.txt` are hash-pinned lock files
+consumed by CI (`pip install --require-hashes`). They satisfy
+Scorecard's `PinnedDependenciesID` and protect CI against a compromised
+PyPI mirror. Dependabot refreshes them weekly.
+
+Source `.in` files are committed alongside the locks in `requirements/`.
+To regenerate manually after editing them or `pyproject.toml`:
+
+```bash
+pip install uv
+uv pip compile --generate-hashes --strip-extras --python-version 3.10 --output-file requirements/dev.txt   requirements/dev.in
+uv pip compile --generate-hashes --strip-extras --python-version 3.10 --output-file requirements/lint.txt  requirements/lint.in
+uv pip compile --generate-hashes --strip-extras --python-version 3.10 --output-file requirements/build.txt requirements/build.in
+uv pip compile --generate-hashes --strip-extras --python-version 3.10 --output-file requirements/audit.txt requirements/audit.in
+```
+
+`uv` is used over `pip-tools` because its resolver handles the
+3.10–3.12 matrix without back-tracking failures, and it emits hashes
+for every wheel of each pinned version (so a single lock file works
+across the whole CI matrix). The `--python-version 3.10` flag pins
+resolution to the lowest supported interpreter so packages whose
+latest releases dropped 3.10 are correctly stepped back to a
+compatible version.
+
+## Running the test suite
+
+```bash
+pytest -v
+pytest --cov=aemo_mdff_reader --cov-report=term-missing
+```
+
+A small, sanitized NEM12 sample lives at
+`tests/fixtures/sample_nem12.csv`. To generate larger synthetic files
+for ad-hoc testing or benchmarking:
+
+```bash
+python tests/fixtures/generate.py /tmp/big.csv --nmis 4 --days 365 --interval-minutes 5
+```
+
+## Performance
+
+`benchmarks/bench_parser.py` is the canonical performance test. Please
+run it before and after changes that touch the hot path
+(`parser.py::_emit_intervals`, `parse_to_columns`, `to_columns`):
+
+```bash
+python benchmarks/bench_parser.py --nmis 4 --days 365 --interval-minutes 5
+```
+
+The streaming and columnar fast paths must remain at or above the
+current published throughput.
+
+## Code style
+
+- Pure stdlib in the core. **No** new required runtime dependencies.
+  Optional features go behind `[project.optional-dependencies]`.
+- Type hints on all public symbols.
+- Keep `aemo_mdff_reader.types` slots-based — per-row allocation is on
+  the hot path.
+
+## Commit messages
+
+Releases are generated automatically from commits using
+[release-please](https://github.com/googleapis/release-please), so the
+commit subject prefix is load-bearing — it determines whether a release
+is cut and what kind of version bump it gets.
+
+Use [Conventional Commits](https://www.conventionalcommits.org/):
+
+| Prefix                             | Effect on next release                 |
+| ---------------------------------- | -------------------------------------- |
+| `feat: …`                          | minor bump (e.g. 2.0.x → 2.1.0)        |
+| `fix: …`                           | patch bump (e.g. 2.0.0 → 2.0.1)        |
+| `feat!: …` or `BREAKING CHANGE:` footer | major bump (e.g. 2.x → 3.0.0)     |
+| `chore: …` / `docs: …` / `refactor: …` / `style: …` / `test: …` / `ci: …` / `build: …` | no release on its own |
+| any commit with `Release-As: x.y.z` footer | forces that exact version    |
+
+Subject line: imperative mood, under 72 chars, lowercase after the
+prefix. Examples that work well:
+
+```
+feat: stream NEM13 250 records via parse_accumulations
+fix: handle CRLF line endings in 300-record payloads
+chore: bump CI matrix to include Python 3.13
+```
+
+Squash-merge is preferred — the squash commit message becomes the
+release-please input, so make it count.
+
+## Reporting issues
+
+Please open an issue with:
+
+1. The Python version and OS.
+2. A minimal reproducer (a few NEM12 rows is usually enough).
+3. The expected vs actual behaviour.
+
+If you can share a sanitized sample file (no real NMIs / meter
+serials), please attach it to the issue.
+
+## Releasing
+
+Releases are automated via [release-please](https://github.com/googleapis/release-please).
+Maintainers do not run `git tag` by hand for normal releases.
+
+### Normal flow (Conventional Commits drive it)
+
+1. Land a `feat:` or `fix:` commit on `main` (via squash-merged PR).
+2. The `release-please` workflow runs and either opens a new release PR
+   titled `chore(main): release X.Y.Z` or updates the existing one.
+   The PR auto-bumps `pyproject.toml` and `aemo_mdff_reader/__init__.py`
+   (the `# x-release-please-version` annotation in `__init__.py` marks
+   the line release-please rewrites) and drafts the `CHANGELOG.md`
+   entry from the commit log.
+3. Review the release PR. Edit the changelog entry directly on the PR
+   if you want to massage wording — release-please will keep your
+   edits across reruns. When happy, **squash-merge** it.
+4. release-please creates the `vX.Y.Z` git tag on merge.
+5. Because tags created by `GITHUB_TOKEN` do not trigger downstream
+   tag-push workflows (GitHub anti-recursion guard), `release-please.yml`
+   explicitly dispatches `release.yml` for the new tag.
+6. `release.yml` runs the publish pipeline:
+   build → SLSA build provenance attestation → CycloneDX SBOM +
+   attestation → upload artefacts → wait on the `pypi` Environment
+   reviewer → sigstore sign → PyPI Trusted Publishing → GitHub Release
+   with wheel + sdist + signatures + SBOM attached.
+7. Approve the deployment in the `pypi` Environment when GitHub
+   notifies you. The publish completes; verify at
+   https://pypi.org/project/aemo-mdff-reader/ and
+   https://github.com/Utilified/aemo-mdff-reader/releases.
+
+### Forcing a release without a feat/fix commit
+
+Two options:
+
+- Add `Release-As: x.y.z` as a commit-message footer on a commit
+  landing on `main` (works for `chore:` / `docs:` etc. that wouldn't
+  trigger a release on their own).
+- Manually trigger the `release-please` workflow via GitHub Actions →
+  *release-please* → "Run workflow" (workflow_dispatch).
+
+### Emergency manual release (rare)
+
+`release.yml` still listens on tag-push, so a maintainer can bypass
+release-please entirely:
+
+```bash
+# Bump version in pyproject.toml AND aemo_mdff_reader/__init__.py
+# (preserve the `# x-release-please-version` comment on __init__.py),
+# update CHANGELOG.md, then:
+git commit -am "release: vX.Y.Z"
+git tag vX.Y.Z
+git push origin main vX.Y.Z
+```
+
+Use only if release-please is broken — otherwise you'll fight it on
+the next push.
+
+### One-time infrastructure setup (per project)
+
+Already done for `aemo-mdff-reader`; documented here for posterity.
+
+1. **PyPI Trusted Publishing**: register the project at
+   https://pypi.org/manage/account/publishing/ with:
+   - PyPI project name: `aemo-mdff-reader`
+   - Owner: `Utilified`
+   - Repository: `aemo-mdff-reader`
+   - Workflow filename: `release.yml`
+   - Environment name: `pypi`
+2. **GitHub Environment**: in *Settings → Environments*, create an
+   environment named `pypi`. Add required reviewers (recommended) and
+   restrict the deployment branch policy to `v*` tags.
+3. **Repository variable**: set `PYPI_PUBLISH_ENABLED=true` under
+   *Settings → Secrets and variables → Actions → Variables*. The
+   publish job is gated on this so the workflow runs cleanly while
+   Trusted Publishing is being configured (build + sign succeed;
+   publish skips).
+4. **Workflow permissions**: under *Settings → Actions → General →
+   Workflow permissions*, set "Read and write permissions" and tick
+   "Allow GitHub Actions to create and approve pull requests" — the
+   `release-please` action needs both to open release PRs.
+
+### Local dry run of the build
+
+```bash
+python -m build
+twine check --strict dist/*
+python -m venv /tmp/smoke && /tmp/smoke/bin/pip install dist/*.whl
+/tmp/smoke/bin/aemo-mdff-reader --version
+```
+
+There is no way to dry-run the publish step — Trusted Publishing only
+authenticates a real `release.yml` run on a real tag. The first
+release after touching `release.yml` is the de-facto integration test.

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aemo-mdff-reader
-Version: 2.0.2
+Version: 2.1.0
 Summary: Fast streaming reader for AEMO MDFF NEM12 / NEM13 metering files. Zero required dependencies.
 Author: Utilified Holdings Pty Ltd
 License-Expression: MIT
@@ -15,7 +15,6 @@ Classifier: Intended Audience :: Information Technology
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -23,7 +22,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Office/Business :: Financial
 Classifier: Topic :: Scientific/Engineering
 Classifier: Topic :: Utilities
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Provides-Extra: pandas
@@ -49,8 +48,10 @@ Dynamic: license-file
 
 [![CI](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/ci.yml/badge.svg)](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/aemo-mdff-reader.svg)](https://pypi.org/project/aemo-mdff-reader/)
-[![Python versions](https://img.shields.io/pypi/pyversions/aemo-mdff-reader.svg)](https://pypi.org/project/aemo-mdff-reader/)
+[![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-blue)](https://pypi.org/project/aemo-mdff-reader/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![CodeQL](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/codeql.yml/badge.svg)](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Utilified/aemo-mdff-reader/badge)](https://scorecard.dev/viewer/?uri=github.com/Utilified/aemo-mdff-reader)
 
 Fast, zero-dependency streaming reader for AEMO **NEM12** and **NEM13**
 metering files. Implements AEMO MDFF (Meter Data File Format) v2.6.
@@ -237,10 +238,16 @@ pip install -e .[dev]
 pytest
 ```
 
-CI runs ruff, mypy --strict, the test matrix on Python 3.9 → 3.12 /
-Linux / macOS / Windows, `pip-audit`, `bandit`, and a wheel-install
-smoke test. Releases are signed with sigstore and published to PyPI
-via Trusted Publishing on tag.
+CI runs ruff, mypy --strict, the test matrix on Python 3.10 → 3.12 /
+Linux / macOS / Windows, `pip-audit`, `bandit`, CodeQL, OpenSSF
+Scorecard, and a wheel-install smoke test.
+
+Releases are automated by [release-please](https://github.com/googleapis/release-please)
+from [Conventional Commits](https://www.conventionalcommits.org/) on
+`main`, then signed with sigstore, attested with SLSA build provenance
+and a CycloneDX SBOM, and published to PyPI via Trusted Publishing.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the contributor commit
+conventions and the full release flow.
 
 ## License
 

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.1.0}/README.md

@@ -2,8 +2,10 @@
 
 [![CI](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/ci.yml/badge.svg)](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/aemo-mdff-reader.svg)](https://pypi.org/project/aemo-mdff-reader/)
-[![Python versions](https://img.shields.io/pypi/pyversions/aemo-mdff-reader.svg)](https://pypi.org/project/aemo-mdff-reader/)
+[![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-blue)](https://pypi.org/project/aemo-mdff-reader/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![CodeQL](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/codeql.yml/badge.svg)](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Utilified/aemo-mdff-reader/badge)](https://scorecard.dev/viewer/?uri=github.com/Utilified/aemo-mdff-reader)
 
 Fast, zero-dependency streaming reader for AEMO **NEM12** and **NEM13**
 metering files. Implements AEMO MDFF (Meter Data File Format) v2.6.
@@ -190,10 +192,16 @@ pip install -e .[dev]
 pytest
 ```
 
-CI runs ruff, mypy --strict, the test matrix on Python 3.9 → 3.12 /
-Linux / macOS / Windows, `pip-audit`, `bandit`, and a wheel-install
-smoke test. Releases are signed with sigstore and published to PyPI
-via Trusted Publishing on tag.
+CI runs ruff, mypy --strict, the test matrix on Python 3.10 → 3.12 /
+Linux / macOS / Windows, `pip-audit`, `bandit`, CodeQL, OpenSSF
+Scorecard, and a wheel-install smoke test.
+
+Releases are automated by [release-please](https://github.com/googleapis/release-please)
+from [Conventional Commits](https://www.conventionalcommits.org/) on
+`main`, then signed with sigstore, attested with SLSA build provenance
+and a CycloneDX SBOM, and published to PyPI via Trusted Publishing.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the contributor commit
+conventions and the full release flow.
 
 ## License
 

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.1.0}/aemo_mdff_reader/__init__.py

@@ -48,7 +48,7 @@ from .types import (
     NMIDetails,
 )
 
-__version__ = "2.0.2"
+__version__ = "2.1.0"  # x-release-please-version
 
 __all__ = [
     "INTERVAL_DATA_OUTPUT_HEADERS",

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.1.0}/aemo_mdff_reader/cli.py

@@ -223,6 +223,7 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
         try:
             sys.stdout.flush()
         except BrokenPipeError:
+            # Pipe is already gone; nothing to flush.
             pass
     return 0
 

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.1.0}/aemo_mdff_reader/sql/__init__.py

@@ -7,8 +7,14 @@ The dependency is only required when you actually instantiate
 
 from __future__ import annotations
 
+from typing import TYPE_CHECKING
+
 from .query import COLUMNS, QueryBuilder
 
+if TYPE_CHECKING:
+    # Visible to static analysers / IDEs without forcing pymysql to load.
+    from .store import DBCredentials, Storer
+
 __all__ = ["COLUMNS", "DBCredentials", "QueryBuilder", "Storer"]
 
 

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.1.0}/aemo_mdff_reader/sql/store.py

@@ -4,7 +4,15 @@
 
 import pymysql.cursors
 
-from .query import *
+from .query import (
+    CHANNEL_TABLE,
+    IMPORT_TABLE,
+    INTERVAL_DATA_TABLE,
+    INTERVAL_TABLE,
+    INTERVAL_TYPE_TABLE,
+    NMI_TABLE,
+    QueryBuilder,
+)
 
 # Load queries once session is imported
 QUERY_FOLDER = "queries"
@@ -128,11 +136,11 @@ class Storer:
 
                     data_intervals.append(data_interval)
             query = QueryBuilder.insert_query(NMI_TABLE, data_nmi)
-            resultset = cursor.execute(query)
+            cursor.execute(query)
 
             for row in range(len(data_channel)):
                 query = QueryBuilder.insert_query(CHANNEL_TABLE, [data_channel[row]])
-                resultset = cursor.execute(query)
+                cursor.execute(query)
                 query = "SELECT channelID FROM `nem`.`channel` WHERE `NMI` = %s AND `NMISuffix` = %s AND `MeterSerialNumber` = %s"
                 cursor.execute(
                     query, (data_channel[row][0], data_channel[row][2], data_channel[row][4])

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.1.0}/aemo_mdff_reader.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aemo-mdff-reader
-Version: 2.0.2
+Version: 2.1.0
 Summary: Fast streaming reader for AEMO MDFF NEM12 / NEM13 metering files. Zero required dependencies.
 Author: Utilified Holdings Pty Ltd
 License-Expression: MIT
@@ -15,7 +15,6 @@ Classifier: Intended Audience :: Information Technology
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -23,7 +22,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Office/Business :: Financial
 Classifier: Topic :: Scientific/Engineering
 Classifier: Topic :: Utilities
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Provides-Extra: pandas
@@ -49,8 +48,10 @@ Dynamic: license-file
 
 [![CI](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/ci.yml/badge.svg)](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/aemo-mdff-reader.svg)](https://pypi.org/project/aemo-mdff-reader/)
-[![Python versions](https://img.shields.io/pypi/pyversions/aemo-mdff-reader.svg)](https://pypi.org/project/aemo-mdff-reader/)
+[![Python versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-blue)](https://pypi.org/project/aemo-mdff-reader/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![CodeQL](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/codeql.yml/badge.svg)](https://github.com/Utilified/aemo-mdff-reader/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Utilified/aemo-mdff-reader/badge)](https://scorecard.dev/viewer/?uri=github.com/Utilified/aemo-mdff-reader)
 
 Fast, zero-dependency streaming reader for AEMO **NEM12** and **NEM13**
 metering files. Implements AEMO MDFF (Meter Data File Format) v2.6.
@@ -237,10 +238,16 @@ pip install -e .[dev]
 pytest
 ```
 
-CI runs ruff, mypy --strict, the test matrix on Python 3.9 → 3.12 /
-Linux / macOS / Windows, `pip-audit`, `bandit`, and a wheel-install
-smoke test. Releases are signed with sigstore and published to PyPI
-via Trusted Publishing on tag.
+CI runs ruff, mypy --strict, the test matrix on Python 3.10 → 3.12 /
+Linux / macOS / Windows, `pip-audit`, `bandit`, CodeQL, OpenSSF
+Scorecard, and a wheel-install smoke test.
+
+Releases are automated by [release-please](https://github.com/googleapis/release-please)
+from [Conventional Commits](https://www.conventionalcommits.org/) on
+`main`, then signed with sigstore, attested with SLSA build provenance
+and a CycloneDX SBOM, and published to PyPI via Trusted Publishing.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the contributor commit
+conventions and the full release flow.
 
 ## License
 

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.1.0}/pyproject.toml

@@ -11,14 +11,15 @@ build-backend = "setuptools.build_meta"
 # Pillow / PIL precedent (``pip install Pillow`` → ``import PIL``)
 # applies here.
 name = "aemo-mdff-reader"
-version = "2.0.2"
+version = "2.1.0"
 description = "Fast streaming reader for AEMO MDFF NEM12 / NEM13 metering files. Zero required dependencies."
 readme = "README.md"
 license = "MIT"
 license-files = ["LICENSE"]
-# Python 3.8 is EOL (Oct 2024) and setuptools 77+ — required for the
-# PEP 639 license metadata above — does not publish a 3.8 wheel.
-requires-python = ">=3.9"
+# Python 3.9 reached end-of-life in October 2025; CI hash-pinning of
+# pandas/pyarrow/numpy no longer resolves cleanly against 3.9 wheels.
+# 3.10 is the lowest supported runtime as of v3.0.
+requires-python = ">=3.10"
 authors = [
     { name = "Utilified Holdings Pty Ltd" },
 ]
@@ -30,7 +31,6 @@ classifiers = [
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3 :: Only",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
@@ -95,7 +95,7 @@ exclude_lines = [
 
 [tool.ruff]
 line-length = 100
-target-version = "py39"
+target-version = "py310"
 
 [tool.ruff.lint]
 select = [
@@ -128,10 +128,6 @@ ignore = [
 "aemo_mdff_reader/sql/*" = ["F401", "F403", "F405", "UP031"]
 
 [tool.mypy]
-# Lowest supported runtime is 3.9 (see ``requires-python``), but mypy
-# 1.16+ no longer accepts ``<3.10`` here. Type-checking against 3.10
-# still produces useful results — we don't use any 3.10-only typing
-# features (no ``match`` statements, no PEP 604 ``X | Y`` at runtime).
 python_version = "3.10"
 strict = true
 files = ["aemo_mdff_reader"]

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.1.0}/tests/test_parser.py

@@ -127,7 +127,8 @@ def test_parse_to_columns_matches_to_columns():
 
 
 def test_parse_to_columns_from_iterable():
-    rows = list(csv.reader(open(FIXTURE)))
+    with open(FIXTURE) as f:
+        rows = list(csv.reader(f))
     a = parse_to_columns(FIXTURE)
     b = parse_to_columns(rows)
     assert a == b
@@ -178,7 +179,8 @@ def test_header_repr():
 
 
 def test_nem_reader_read_from_array():
-    rows = list(csv.reader(open(FIXTURE)))
+    with open(FIXTURE) as f:
+        rows = list(csv.reader(f))
     rdr = NEMReader()
     rdr.read_from_array(rows)
     assert len(rdr.readings) == 3 * 48
@@ -188,7 +190,8 @@ def test_nem_reader_read_from_array():
 def test_nem_reader_to_columns_without_filename():
     # NEMReader.to_columns falls through the Reading-iterable branch
     # when no source filename is buffered.
-    rows = list(csv.reader(open(FIXTURE)))
+    with open(FIXTURE) as f:
+        rows = list(csv.reader(f))
     rdr = NEMReader()
     rdr.read_from_array(rows)
     cols = rdr.to_columns()

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.1.0}/tests/test_spec.py

@@ -2,8 +2,11 @@
 
 from __future__ import annotations
 
+from urllib.parse import urlparse
+
 import aemo_mdff_reader
-from aemo_mdff_reader import spec
+
+spec = aemo_mdff_reader.spec
 
 
 def test_spec_module_is_re_exported():
@@ -16,7 +19,9 @@ def test_spec_version_metadata():
     # ISO-8601 effective date keeps callers parseable.
     assert spec.SPEC_EFFECTIVE_DATE == "2024-09-29"
     assert "Meter Data File Format" in spec.SPEC_DOCUMENT_TITLE
-    assert spec.SPEC_URL.startswith("https://www.aemo.com.au")
+    parsed = urlparse(spec.SPEC_URL)
+    assert parsed.scheme == "https"
+    assert parsed.hostname == "www.aemo.com.au"
 
 
 def test_allowed_interval_lengths_match_spec():

{aemo_mdff_reader-2.0.2 → aemo_mdff_reader-2.1.0}/tests/test_sql.py

@@ -43,7 +43,7 @@ def test_storer_attribute_lazy_loads():
     # If pymysql is not installed, accessing Storer should raise ImportError
     # only at access time, not at module import time.
     pytest.importorskip("aemo_mdff_reader.sql")
-    import aemo_mdff_reader.sql as sql_mod
+    from aemo_mdff_reader import sql as sql_mod
 
     if "pymysql" in sys.modules:
         # If pymysql is available in the test env, we can at least confirm

aemo_mdff_reader-2.0.2/CONTRIBUTING.md

@@ -1,118 +0,0 @@
-# Contributing
-
-Thanks for your interest in improving aemo-mdff-reader. The repository
-is small and the bar for contributions is straightforward: a pull
-request that passes CI and doesn't regress the public benchmark is
-welcome.
-
-Naming: everything (GitHub repo `Utilified/aemo-mdff-reader`, PyPI
-distribution `aemo-mdff-reader`, Python import `aemo_mdff_reader`,
-CLI `aemo-mdff-reader`) is consistently named after the AEMO spec —
-MDFF, the Meter Data File Format that covers both NEM12 (interval) and
-NEM13 (accumulation) formats. GitHub serves redirects from the
-previous `Utilified/nem12-reader` repo URL so existing git pins
-continue to work; v1 callers importing `from nem12_reader …` need to
-update to `from aemo_mdff_reader …`.
-
-## Setup
-
-```bash
-git clone https://github.com/Utilified/aemo-mdff-reader.git
-cd aemo-mdff-reader
-python -m venv .venv && source .venv/bin/activate
-pip install -e .[dev]
-pytest
-```
-
-## Running the test suite
-
-```bash
-pytest -v
-pytest --cov=aemo_mdff_reader --cov-report=term-missing
-```
-
-A small, sanitized NEM12 sample lives at
-`tests/fixtures/sample_nem12.csv`. To generate larger synthetic files
-for ad-hoc testing or benchmarking:
-
-```bash
-python tests/fixtures/generate.py /tmp/big.csv --nmis 4 --days 365 --interval-minutes 5
-```
-
-## Performance
-
-`benchmarks/bench_parser.py` is the canonical performance test. Please
-run it before and after changes that touch the hot path
-(`parser.py::_emit_intervals`, `parse_to_columns`, `to_columns`):
-
-```bash
-python benchmarks/bench_parser.py --nmis 4 --days 365 --interval-minutes 5
-```
-
-The streaming and columnar fast paths must remain at or above the
-current published throughput.
-
-## Code style
-
-- Pure stdlib in the core. **No** new required runtime dependencies.
-  Optional features go behind `[project.optional-dependencies]`.
-- Type hints on all public symbols.
-- Keep `aemo_mdff_reader.types` slots-based — per-row allocation is on
-  the hot path.
-
-## Reporting issues
-
-Please open an issue with:
-
-1. The Python version and OS.
-2. A minimal reproducer (a few NEM12 rows is usually enough).
-3. The expected vs actual behaviour.
-
-If you can share a sanitized sample file (no real NMIs / meter
-serials), please attach it to the issue.
-
-## Releasing
-
-Maintainers only. Releases are tagged and pushed to GitHub; the
-`Release` workflow then builds, signs (sigstore), publishes to PyPI
-(via Trusted Publishing), and attaches signatures to the GitHub Release.
-
-### One-time setup (per project)
-
-Before the first release, configure these on PyPI / GitHub:
-
-1. **PyPI Trusted Publishing**: register the project at
-   https://pypi.org/manage/account/publishing/ with:
-   - PyPI project name: `aemo-mdff-reader`
-   - Owner: `Utilified`
-   - Repository: `aemo-mdff-reader`
-   - Workflow filename: `release.yml`
-   - Environment name: `pypi`
-2. **GitHub Environment**: in *Settings → Environments*, create an
-   environment named `pypi`. Add required reviewers if you want
-   manual approval before publish (recommended for the first few
-   releases). Without this environment, the publish job will fail with
-   a confusing "environment not found" error.
-
-### Cutting a release
-
-```bash
-# Bump version in pyproject.toml AND aemo_mdff_reader/__init__.py.
-# Update CHANGELOG.md with the new section.
-git commit -am "release: vX.Y.Z"
-git tag vX.Y.Z
-git push origin main vX.Y.Z
-```
-
-The `Release` workflow takes over from here. Verify the published
-artefact at https://pypi.org/project/aemo-mdff-reader/ and the
-GitHub Release at https://github.com/Utilified/aemo-mdff-reader/releases.
-
-### Local dry run
-
-```bash
-python -m build
-twine check --strict dist/*
-python -m venv /tmp/smoke && /tmp/smoke/bin/pip install dist/*.whl
-/tmp/smoke/bin/aemo-mdff-reader --version
-```