azimut 0.2.2__tar.gz → 0.2.3__tar.gz

{azimut-0.2.2 → azimut-0.2.3}/.github/workflows/release.yml

@@ -11,8 +11,37 @@ permissions:
   id-token: write   # PyPI Trusted Publishing (OIDC) — no token secret needed
 
 jobs:
+  guard:
+    name: Version + release gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      # Install the app (editable) + dev tools, like the CI backend job, so the
+      # gate can import azimut and run its tests. No frontend build: these tests
+      # don't touch the built UI, and the app tolerates a missing static dir.
+      - run: uv sync --frozen --extra dev
+      # The pushed tag must equal the version baked into the code. When it
+      # didn't (0.2.2 shipped a stale __version__), the binary's self-update
+      # check nagged every user about the very release they were running. This
+      # is the check the release used to lack — it runs before anything builds.
+      - name: Tag matches the code version
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          ver="$(uv run --no-sync python -c 'import azimut; print(azimut.__version__)')"
+          echo "tag=$tag  __version__=$ver"
+          [ "$tag" = "$ver" ] || { echo "::error::tag v$tag != __version__ $ver — bump src/azimut/__init__.py"; exit 1; }
+      # The version-parity gate the release workflow used to skip: pyproject's
+      # single-sourced version and the extension manifest must line up.
+      - name: Release gate + version parity
+        run: uv run --no-sync pytest tests/test_release_gate.py tests/test_updates.py -q
+
   dist:
     name: Build wheel + sdist
+    needs: guard
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -45,6 +74,7 @@ jobs:
 
   binaries:
     name: Binary (${{ matrix.os }})
+    needs: guard
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false

{azimut-0.2.2 → azimut-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: azimut
-Version: 0.2.2
+Version: 0.2.3
 Summary: A local OSINT workspace for media, geolocation proofs and case management.
 Project-URL: Homepage, https://github.com/OsintMeThat/azimut
 Author: OsintMeThat
@@ -49,6 +49,8 @@ to fix a point on the map.*
 
 ## v0.2.2: Login-walled downloads
 
+> v0.2.3 is a bug-fix release: it corrects the version the v0.2.2 binary reported, which made its startup update check falsely announce an update to everyone already on v0.2.2. No feature changes.
+
 | Tool | What it does |
 |------|--------------|
 | **Media** | Import local files or download by URL (X, Telegram, TikTok, YouTube, Instagram and more via yt-dlp, with a gallery-dl fallback for image-only posts). Public media is fetched cookie-less; a login-walled post prompts once for a browser session or an exported `cookies.txt`. Each item gets a clean local file, metadata and a SHA-256. Multi-photo posts open a picker. |
@@ -235,7 +237,7 @@ wheel + Windows/Linux/macOS binaries, attaches them to a GitHub release, and
 publishes to PyPI. **Don't publish by hand.**
 
 ```bash
-git tag v0.2.2 && git push origin v0.2.2
+git tag v0.2.3 && git push origin v0.2.3
 ```
 
 One-time setup: register the repo as a

{azimut-0.2.2 → azimut-0.2.3}/README.md

@@ -11,6 +11,8 @@ to fix a point on the map.*
 
 ## v0.2.2: Login-walled downloads
 
+> v0.2.3 is a bug-fix release: it corrects the version the v0.2.2 binary reported, which made its startup update check falsely announce an update to everyone already on v0.2.2. No feature changes.
+
 | Tool | What it does |
 |------|--------------|
 | **Media** | Import local files or download by URL (X, Telegram, TikTok, YouTube, Instagram and more via yt-dlp, with a gallery-dl fallback for image-only posts). Public media is fetched cookie-less; a login-walled post prompts once for a browser session or an exported `cookies.txt`. Each item gets a clean local file, metadata and a SHA-256. Multi-photo posts open a picker. |
@@ -197,7 +199,7 @@ wheel + Windows/Linux/macOS binaries, attaches them to a GitHub release, and
 publishes to PyPI. **Don't publish by hand.**
 
 ```bash
-git tag v0.2.2 && git push origin v0.2.2
+git tag v0.2.3 && git push origin v0.2.3
 ```
 
 One-time setup: register the repo as a

{azimut-0.2.2 → azimut-0.2.3}/docs/RELEASE_NOTES.md

@@ -1,4 +1,4 @@
-# Azimut v0.2.2
+# Azimut v0.2.3
 
 ## OSINT toolkit at a glance
 
@@ -9,6 +9,7 @@
 
 ## What changed
 
+- **Bug fix (from v0.2.2).** The v0.2.2 binary reported itself as an older version, so its startup update check wrongly announced that v0.2.2 was available to anyone already running it. Fixed here, with a release-time guard so the version can't drift again. Upgrade to stop the false prompt.
 - **Gated downloads.** Downloads now get past a login wall. Public media is still fetched without any session; only when a post turns out to need an account does Media offer to borrow a signed-in browser's cookies or an exported `cookies.txt`. The session is used for that download, kept private in your workspace, and never leaves the machine. Chromium on Windows can't be read, so Azimut points you to the file route instead.
 - **Responsive Geo Proof toolbar.** The proof toolbar reflows to fit narrow screens instead of overflowing, and remembers the colour and stroke width you last drew with.
 

{azimut-0.2.2 → azimut-0.2.3}/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Azimut Capture",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "File into Azimut: screenshot the map you are looking at (coordinates from the URL), or save any other page as a bookmark.",
   "permissions": ["activeTab", "scripting", "storage", "notifications"],
   "host_permissions": ["http://127.0.0.1/*", "http://localhost/*"],

{azimut-0.2.2 → azimut-0.2.3}/pyproject.toml

@@ -4,7 +4,9 @@ build-backend = "hatchling.build"
 
 [project]
 name = "azimut"
-version = "0.2.2"
+# Single-sourced from src/azimut/__init__.py so a release is bumped in one place
+# (see [tool.hatch.version] below). Never add a literal version here.
+dynamic = ["version"]
 description = "A local OSINT workspace for media, geolocation proofs and case management."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -86,6 +88,11 @@ Homepage = "https://github.com/OsintMeThat/azimut"
 # the sdist and the wheel — `python -m build` builds the wheel from the sdist,
 # so if the sdist omits static the shipped wheel has no UI. Run `npm run build`
 # before building the package.
+# The version hatchling stamps into the wheel/sdist is read from __version__,
+# so pyproject never carries a second copy that can drift out of sync.
+[tool.hatch.version]
+path = "src/azimut/__init__.py"
+
 [tool.hatch.build]
 artifacts = ["src/azimut/static/**"]
 

{azimut-0.2.2 → azimut-0.2.3}/src/azimut/__init__.py

@@ -2,7 +2,12 @@
 
 from PIL import Image as _Image
 
-__version__ = "0.2.1"
+# The single source of truth for the app version. pyproject.toml reads it back
+# through hatchling's dynamic version (``[tool.hatch.version]``) and the
+# extension manifest is kept in lock-step by a test, so a release is bumped in
+# exactly one place. Getting this wrong nags every user with a false update
+# (the binary's self-check compares this against the latest GitHub tag).
+__version__ = "0.2.3"
 
 # Cap the pixels Pillow will decode from a file, process-wide. A tiny,
 # highly-compressed image can otherwise expand to gigabytes in memory and take

{azimut-0.2.2 → azimut-0.2.3}/tests/test_release_gate.py

@@ -22,7 +22,7 @@ from pathlib import Path
 from bigcase import build_big_case
 from legacy_case import write_legacy_json_case
 
-from azimut import __version__, workspace
+from azimut import workspace
 from azimut.engine import links as link_engine
 from azimut.engine import media as media_engine
 from azimut.engine import thumbnails
@@ -192,7 +192,12 @@ def test_case_db_lives_under_the_workspace_root(tmp_workspace):
 
 def test_release_tooling_is_bounded_and_built_from_the_lock():
     cfg = _pyproject()
-    assert cfg["project"]["version"] == __version__
+    # Version is single-sourced from src/azimut/__init__.py through hatchling's
+    # dynamic version, so pyproject carries no literal copy to drift out of sync
+    # (the 0.2.2 release shipped a stale __version__ against a bumped pyproject).
+    assert "version" not in cfg["project"]
+    assert "version" in cfg["project"]["dynamic"]
+    assert cfg["tool"]["hatch"]["version"]["path"] == "src/azimut/__init__.py"
     assert cfg["build-system"]["requires"] == ["hatchling>=1.27,<2"]
     release = cfg["dependency-groups"]["release"]
     assert any(dep.startswith("build>=") and "<2" in dep for dep in release)
@@ -210,6 +215,12 @@ def test_release_tooling_is_bounded_and_built_from_the_lock():
     assert "--no-editable" in workflow
     assert "uv run python" not in workflow
     assert "body_path: docs/RELEASE_NOTES.md" in workflow
+    # A guard job runs before anything builds: it checks the pushed tag equals
+    # __version__ and runs the version-parity gate the release used to skip, so
+    # a stale version can never ship again (the 0.2.2 false-update-nag bug).
+    assert "tag=$tag  __version__=$ver" in workflow
+    assert "pytest tests/test_release_gate.py tests/test_updates.py" in workflow
+    assert "\n  dist:\n" in workflow and "needs: guard" in workflow
     release_job = workflow.split("  release:\n", maxsplit=1)[1]
     assert release_job.index("actions/checkout@v4") < release_job.index(
         "softprops/action-gh-release@v2"

{azimut-0.2.2 → azimut-0.2.3}/uv.lock

@@ -90,7 +90,7 @@ wheels = [
 
 [[package]]
 name = "azimut"
-version = "0.2.2"
+version = "0.2.3"
 source = { editable = "." }
 dependencies = [
     { name = "fastapi" },