agirails 2.3.2__tar.gz → 3.0.1__tar.gz

agirails-3.0.1/.github/workflows/release-pypi.yml

@@ -0,0 +1,178 @@
+name: Publish to PyPI
+
+# OIDC trusted-publisher workflow (PEP 740 + PyPI Trusted Publishers).
+# No long-lived API tokens stored in repo secrets — GitHub mints a
+# short-lived OIDC token at runtime, the pypa/gh-action-pypi-publish
+# action exchanges it with PyPI's Trusted Publisher endpoint for a
+# one-time upload privilege scoped to this exact workflow run.
+#
+# ──────────────────────────────────────────────────────────────────────────────
+# PyPI side — ONE-TIME SETUP per publisher
+#
+# TestPyPI (https://test.pypi.org/manage/account/publishing/):
+#   - "Add a new pending publisher"
+#   - PyPI project name:     agirails
+#   - Owner:                  agirails
+#   - Repository name:        sdk-python
+#   - Workflow filename:      release-pypi.yml
+#   - Environment name:       testpypi
+#
+# PyPI (https://pypi.org/manage/project/agirails/settings/publishing/):
+#   - "Add a new trusted publisher" (project already exists from 2.0.0+)
+#   - Owner:                  agirails
+#   - Repository name:        sdk-python
+#   - Workflow filename:      release-pypi.yml
+#   - Environment name:       pypi
+#
+# GitHub side — ONE-TIME SETUP
+#   Settings → Environments:
+#     - Create "testpypi"  (no protections needed)
+#     - Create "pypi"      (recommend: required reviewers = repo admin)
+#
+# ──────────────────────────────────────────────────────────────────────────────
+# How to release
+#
+#   Beta (b1, b2, …, rcN):
+#     git tag v3.0.0b1
+#     git push origin v3.0.0b1
+#     → Workflow auto-publishes to TestPyPI only.
+#
+#   Stable:
+#     git tag v3.0.0
+#     git push origin v3.0.0
+#     → Workflow publishes to TestPyPI automatically.
+#     → For PyPI: open Actions tab → "Publish to PyPI" → "Run workflow"
+#       → target=pypi → click Run. Environment gate requires reviewer
+#       approval before the upload step actually runs.
+#
+#   Emergency (manual trigger for either target):
+#     Actions tab → workflow_dispatch with target=testpypi or pypi
+#
+# Pre-release detection: a version is considered pre-release if it
+# contains "a", "b", or "rc" per PEP 440 (e.g. 3.0.0b1, 3.0.0rc2).
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      target:
+        description: 'Publish target'
+        required: true
+        type: choice
+        default: testpypi
+        options:
+          - testpypi
+          - pypi
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build wheel + sdist
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      is_prerelease: ${{ steps.version.outputs.is_prerelease }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install build
+        run: python -m pip install --upgrade build
+
+      - name: Build distribution
+        run: python -m build
+
+      - name: Extract version
+        id: version
+        run: |
+          VERSION=$(python -c "import tomllib; print(tomllib.loads(open('pyproject.toml','rb').read().decode())['project']['version'])")
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          # PEP 440 pre-release markers.
+          if [[ "$VERSION" =~ (a|b|rc)[0-9]+ ]]; then
+            echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
+          fi
+          echo "Built version: $VERSION"
+
+      - name: Verify tag matches version
+        if: github.event_name == 'push'
+        run: |
+          TAG="${GITHUB_REF#refs/tags/v}"
+          VERSION="${{ steps.version.outputs.version }}"
+          if [[ "$TAG" != "$VERSION" ]]; then
+            echo "::error::Tag v$TAG does not match pyproject.toml version $VERSION"
+            exit 1
+          fi
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  testpypi:
+    name: Publish to TestPyPI
+    needs: build
+    runs-on: ubuntu-latest
+    # Runs on every tag push AND on every workflow_dispatch (both
+    # testpypi and pypi targets). A pypi run gets a TestPyPI smoke
+    # publish first — the pypi job depends on this succeeding.
+    if: |
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch'
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/agirails/${{ needs.build.outputs.version }}/
+    permissions:
+      id-token: write  # OIDC token issuance
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to TestPyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          # Skip if a duplicate upload would error — useful when re-running
+          # a failed workflow that already uploaded.
+          skip-existing: true
+
+  pypi:
+    name: Publish to PyPI
+    # Gate on a green TestPyPI publish — stable upload cannot bypass
+    # the TestPyPI smoke step (defence-in-depth).
+    needs: [build, testpypi]
+    runs-on: ubuntu-latest
+    # Live PyPI: workflow_dispatch with target=pypi (forces manual gate even
+    # for stable tags). Beta versions can NOT be auto-promoted by accident.
+    if: |
+      github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'pypi'
+    environment:
+      name: pypi
+      url: https://pypi.org/project/agirails/${{ needs.build.outputs.version }}/
+    permissions:
+      id-token: write
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true

{agirails-2.3.2 → agirails-3.0.1}/.github/workflows/test.yml

@@ -16,6 +16,11 @@ on:
       - 'pyproject.toml'
       - '.github/workflows/test.yml'
   workflow_dispatch:  # Allow manual trigger
+  schedule:
+    # Weekly mutation testing — Mondays at 03:00 UTC. The mutmut job is
+    # the only consumer of this trigger; other jobs ignore it via the
+    # `if: github.event_name == ...` guards on each job.
+    - cron: '0 3 * * 1'
 
 env:
   PYTHON_VERSION: '3.11'
@@ -50,8 +55,12 @@ jobs:
 
       - name: Run unit tests
         run: |
+          # integration_sepolia is also marker-gated in pyproject.toml,
+          # but ignore the dir explicitly so the runner doesn't even
+          # collect them (saves seconds + clearer "X deselected" output).
           pytest tests/ \
             --ignore=tests/integration/ \
+            --ignore=tests/integration_sepolia/ \
             --ignore=tests/benchmarks/ \
             -v \
             --tb=short \
@@ -217,13 +226,26 @@ jobs:
           python -m pip install --upgrade pip
           pip install -e ".[dev]"
 
-      - name: Run parity tests
+      - name: Run parity tests (Python-only fixtures)
         run: |
           pytest tests/test_parity.py -v --tb=short
 
-      - name: Run fixture-based parity tests
+      - name: Run cross-SDK parity tests (TS-signed → Python verify)
+        # tests/test_cross_sdk/ uses pre-generated JSON fixtures in
+        # tests/fixtures/cross_sdk/ that are produced by the TypeScript
+        # SDK's CounterOfferBuilder/CounterAcceptBuilder. Fixtures are
+        # committed to the repo; no Node setup needed at CI time.
+        # To regenerate (after any wire-format change), run locally:
+        #   NODE_PATH=../sdk-js/node_modules node scripts/generate_parity_vectors.js
         run: |
-          pytest tests/fixtures/ -v --tb=short || true
+          pytest tests/test_cross_sdk/ -v --tb=short
+
+      - name: Run golden hash snapshots
+        # Pinned bytes32 outputs for canonical-JSON + builder.compute_hash.
+        # If anyone silently changes serialization, this fails before
+        # integrators see broken transactions.
+        run: |
+          pytest tests/test_golden/ -v --tb=short
 
   # =============================================================================
   # Integration Tests (Requires Anvil - Push only)
@@ -386,3 +408,105 @@ jobs:
           needs.test-security.result == 'failure' ||
           needs.lint.result == 'failure'
         run: exit 1
+
+  # =============================================================================
+  # Live Base sepolia — manual gate only.
+  #
+  # Runs the gated `integration_sepolia` test suite against the real
+  # Base sepolia kernel (0x9d25…0021b). Costs 1-5 sepolia txes per
+  # full run, signed by the wallet whose keystore + password are
+  # supplied as repo secrets.
+  #
+  # Required secrets:
+  #   ACTP_KEY_PASSWORD       — keystore decryption password
+  #   ACTP_KEYSTORE_BASE64    — base64-encoded keystore JSON (committed
+  #                             keystore-file path doesn't exist in CI)
+  # =============================================================================
+  live-sepolia:
+    name: Live Base sepolia integration
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    if: github.event_name == 'workflow_dispatch'
+    needs: test-fast
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: 'pip'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Materialize keystore from secret
+        env:
+          ACTP_KEYSTORE_BASE64: ${{ secrets.ACTP_KEYSTORE_BASE64 }}
+        run: |
+          if [ -z "$ACTP_KEYSTORE_BASE64" ]; then
+            echo "::error::ACTP_KEYSTORE_BASE64 secret not configured; skipping live tests"
+            exit 78  # neutral skip
+          fi
+          mkdir -p ~/.actp/mainnet-deployer
+          echo "$ACTP_KEYSTORE_BASE64" | base64 -d > ~/.actp/mainnet-deployer/deployer
+          chmod 600 ~/.actp/mainnet-deployer/deployer
+
+      - name: Run live sepolia integration
+        env:
+          ACTP_KEY_PASSWORD: ${{ secrets.ACTP_KEY_PASSWORD }}
+        run: |
+          pytest tests/integration_sepolia/ \
+            -m integration_sepolia \
+            -v --tb=short
+
+  # =============================================================================
+  # Mutation testing — weekly schedule + manual.
+  #
+  # mutmut introduces small code mutations (negate condition, swap
+  # operator, etc.) and re-runs the test suite. Each "survived"
+  # mutation means our tests didn't catch a behaviour change — points
+  # at gaps in test coverage that line coverage alone can't see.
+  # Configured in pyproject.toml [tool.mutmut].
+  # =============================================================================
+  mutation-test:
+    name: Mutation testing
+    runs-on: ubuntu-latest
+    timeout-minutes: 360  # 6h cap
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: 'pip'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev,mutation]"
+
+      - name: Run mutmut
+        run: |
+          mutmut run --paths-to-mutate src/agirails/utils/security.py,src/agirails/runtime/mock_runtime.py,src/agirails/protocol/proofs.py || true
+          mutmut results > mutmut_results.txt
+          mutmut junitxml > mutmut_results.xml || true
+          echo "## Mutation Results" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          tail -40 mutmut_results.txt >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+
+      - name: Upload mutation report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: mutmut-results
+          path: |
+            mutmut_results.txt
+            mutmut_results.xml

{agirails-2.3.2 → agirails-3.0.1}/.gitignore

@@ -16,6 +16,10 @@ eggs/
 .eggs/
 lib/
 lib64/
+# Keep the SDK's own cli/lib helper module (run_request etc.) — the
+# generic `lib/` rule above is meant for build/venv directories.
+!src/agirails/cli/lib/
+!src/agirails/cli/lib/**
 parts/
 sdist/
 var/
@@ -41,6 +45,7 @@ htmlcov/
 .cache
 nosetests.xml
 coverage.xml
+coverage.json
 *.cover
 *.py,cover
 .hypothesis/