agentrust-trace-tests 0.4.0__tar.gz → 0.4.1__tar.gz

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.4.1}/.github/workflows/codeql.yml

@@ -28,16 +28,16 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.37.4
         with:
           languages: python
           queries: +security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@v4.37.4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.37.4
         continue-on-error: true
         with:
           category: /language:python

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.4.1}/.github/workflows/contributor-check.yml

@@ -30,7 +30,10 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: agentrust-io/.github
-          ref: main
+          # Pinned deliberately: this workflow runs on pull_request_target
+          # with a write-capable token, so the code it checks out must not
+          # track a mutable ref. Bump this SHA after reviewing the diff.
+          ref: 0fe4520ee71a743fcd33f409fe366ee3e1da6f86 # main as of 2026-08-01
           persist-credentials: false
           sparse-checkout: |
             scripts

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.4.1}/.github/workflows/release.yml

@@ -41,4 +41,4 @@ jobs:
           name: dist
           path: dist/
 
-      - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.4.1}/.github/workflows/scorecard.yml

@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: scorecard-results.sarif
           results_format: sarif
@@ -35,6 +35,6 @@ jobs:
           publish_results: false
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.4
         with:
           sarif_file: scorecard-results.sarif

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.4.1}/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## v0.4.1 — 2026-08-03
+
+### Fixed
+
+- **`--version` reported the wrong version.** `__version__` was a second hardcoded literal alongside `pyproject.toml` and never moved, so it sat at `0.2.0` through both the 0.3.0 and 0.4.0 releases: `trace-tests --version` printed `0.2.0` from a 0.4.0 install while `importlib.metadata` correctly returned `0.4.0`. It is now read from installed distribution metadata, so there is one source of truth and the value cannot fall behind a release again.
+
+  This mattered more than a wrong string usually would. The v0.2 profile cutover shipped in 0.4.0, and a 0.2.x suite rejects every v0.2 record, so `--version` is exactly the command someone runs to work out whether their suite matches their producer. It was the one command that could not answer.
+
 ## v0.4.0 — 2026-07-28
 
 ### Changed

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentrust-trace-tests
-Version: 0.4.0
+Version: 0.4.1
 Summary: TRACE conformance test suite
 Project-URL: Homepage, https://github.com/agentrust-io/trace-tests
 Project-URL: Repository, https://github.com/agentrust-io/trace-tests
@@ -64,7 +64,7 @@ Description-Content-Type: text/markdown
 
 > **Test suite v0.2.** Tracks [TRACE Spec v0.2](https://github.com/agentrust-io/trace-spec).
 
-Conformance tests for TRACE — Trust Runtime Attestation and Compliance Evidence. Run this suite against your implementation to verify it meets the spec before claiming TRACE compliance.
+Conformance tests for TRACE (Trust Runtime Attestation and Compliance Evidence). Run this suite against your implementation to verify it meets the spec before claiming TRACE compliance.
 
 Seven test modules covering the full specification: envelope structure, signature algorithms, TEE runtime claims, policy binding, tool-call transcripts, SCITT transparency anchoring, and supply chain provenance.
 

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.4.1}/README.md

@@ -27,7 +27,7 @@
 
 > **Test suite v0.2.** Tracks [TRACE Spec v0.2](https://github.com/agentrust-io/trace-spec).
 
-Conformance tests for TRACE — Trust Runtime Attestation and Compliance Evidence. Run this suite against your implementation to verify it meets the spec before claiming TRACE compliance.
+Conformance tests for TRACE (Trust Runtime Attestation and Compliance Evidence). Run this suite against your implementation to verify it meets the spec before claiming TRACE compliance.
 
 Seven test modules covering the full specification: envelope structure, signature algorithms, TEE runtime claims, policy binding, tool-call transcripts, SCITT transparency anchoring, and supply chain provenance.
 

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentrust-trace-tests"
-version = "0.4.0"
+version = "0.4.1"
 description = "TRACE conformance test suite"
 readme = "README.md"
 license = { text = "Apache-2.0" }

agentrust_trace_tests-0.4.1/src/trace_tests/__init__.py

@@ -0,0 +1,20 @@
+"""TRACE conformance test suite."""
+
+from importlib.metadata import PackageNotFoundError, version
+
+# Read the version from installed distribution metadata rather than restating it
+# here. `pyproject.toml` is what the build and PyPI publish, so a second literal
+# in this file is a copy that can fall behind silently: it sat at "0.2.0" through
+# both the 0.3.0 and 0.4.0 releases, so `trace-tests --version` reported 0.2.0
+# from a 0.4.0 install. That is worse than cosmetic, because the v0.2 profile
+# cutover landed in 0.4.0 and `--version` is the command someone runs to find out
+# whether they have a suite that accepts v0.2 records.
+try:
+    __version__ = version("agentrust-trace-tests")
+except PackageNotFoundError:  # pragma: no cover - source tree with no install
+    # Importable without being installed (e.g. PYTHONPATH against a checkout).
+    # There is no metadata to read here, and guessing a number would reintroduce
+    # the drift this exists to prevent.
+    __version__ = "0.0.0+unknown"
+
+__all__ = ["__version__"]

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.4.1}/tests/unit/test_cli.py

@@ -57,3 +57,29 @@ def test_partial_cmcp_envelope_is_rejected(tmp_path):
     result = CliRunner().invoke(main, ["verify", "--record", str(p), "--level", "0"])
     assert result.exit_code == 2, result.output
     assert "partial cmcp-runtime envelope" in result.output
+
+
+def test_version_matches_distribution_metadata():
+    """`--version` must report the installed distribution version.
+
+    `__version__` was a second hardcoded literal alongside `pyproject.toml` and
+    fell behind through two releases, so a 0.4.0 install reported 0.2.0. Since
+    the v0.2 profile cutover shipped in 0.4.0, `--version` was the one command
+    that could not tell you whether your suite accepts v0.2 records.
+    """
+    from importlib.metadata import version
+
+    expected = version("agentrust-trace-tests")
+    result = CliRunner().invoke(main, ["--version"])
+
+    assert result.exit_code == 0, result.output
+    assert expected in result.output, f"expected {expected!r} in {result.output!r}"
+
+
+def test_dunder_version_is_not_a_stale_literal():
+    """Guard against reverting to a hardcoded `__version__`."""
+    from importlib.metadata import version
+
+    import trace_tests
+
+    assert trace_tests.__version__ == version("agentrust-trace-tests")

agentrust_trace_tests-0.4.0/src/trace_tests/__init__.py

@@ -1,3 +0,0 @@
-"""TRACE conformance test suite."""
-
-__version__ = "0.2.0"