base-cli 0.4.3__tar.gz → 0.5.0__tar.gz

base_cli-0.5.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,50 @@
+name: Bug report
+description: Report a reproducible base-cli defect
+title: "bug: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not include secrets, personal data, or vulnerability details. Use SECURITY.md for private reports.
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      description: Include the installed release, package revision, or commit.
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Include Python, Click/Typer, OS, architecture, and relevant extras.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Give the smallest command, fixture, or test that reproduces the problem.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: Redact credentials, tokens, personal data, and private paths.
+      render: text

base_cli-0.5.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Support and adoption questions
+    url: https://github.com/orgs/basefoundry/discussions
+    about: Ask ecosystem-wide usage and onboarding questions in the canonical public forum.
+  - name: Private security report
+    url: https://github.com/basefoundry/base-cli/security/advisories/new
+    about: Never disclose vulnerabilities or sensitive data in a public issue.

base_cli-0.5.0/.github/ISSUE_TEMPLATE/documentation.yml

@@ -0,0 +1,25 @@
+name: Documentation improvement
+description: Report missing, incorrect, or confusing base-cli documentation
+title: "docs: "
+labels:
+  - documentation
+body:
+  - type: input
+    id: location
+    attributes:
+      label: Documentation location
+      description: Give the URL or repository path.
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Explain what a reader cannot understand or do.
+    validations:
+      required: true
+  - type: textarea
+    id: suggestion
+    attributes:
+      label: Suggested improvement
+      description: Describe the corrected or clearer outcome.

base_cli-0.5.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,25 @@
+name: Feature proposal
+description: Propose a user-facing base-cli capability or improvement
+title: "feature: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: User problem
+      description: Who is affected, and what are they unable to do today?
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Describe what success looks like without requiring a particular implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives and context
+      description: Include workarounds, constraints, or compatibility concerns.

base_cli-0.5.0/.github/ISSUE_TEMPLATE/support.md

@@ -0,0 +1,12 @@
+---
+name: Adoption support
+about: Request migration or downstream compatibility help
+title: "[Support] "
+labels: ""
+assignees: ""
+---
+
+Use the Support and adoption question form when it is available. Include the
+base-cli version, Python and operating-system versions, a minimal
+reproduction, and redacted evidence. Never include secrets; use SECURITY.md
+for private vulnerability reports.

base_cli-0.5.0/.github/ISSUE_TEMPLATE/support.yml

@@ -0,0 +1,30 @@
+name: Support and adoption question
+description: Ask for help using or evaluating base-cli
+title: "support: "
+labels:
+  - adoption support
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For general ecosystem questions, prefer Base Discussions. Do not include secrets or security-sensitive details here.
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Include Python, Click/Typer, OS, architecture, and relevant extras.
+    validations:
+      required: true
+  - type: textarea
+    id: goal
+    attributes:
+      label: Goal and evidence
+      description: What are you trying to do, what did you try, and what happened?
+    validations:
+      required: true

{base_cli-0.4.3 → base_cli-0.5.0}/.github/workflows/compatibility.yml

@@ -37,6 +37,33 @@ jobs:
       - name: Run adapter and Beacon compatibility tests
         run: python -m pytest tests/test_typer_adapter.py compatibility/consumers/beacon_typer/tests
 
+  typer-click-boundaries:
+    name: Typer ${{ matrix.typer-version }} / Click ${{ matrix.click-version }} / Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.14"]
+        typer-version: ["0.25.1", "0.27.2"]
+        click-version: ["8.2.1", "8.5.0"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install framework and supported Typer adapter
+        run: |
+          python -m pip install "setuptools<77" "wheel"
+          python -m pip install ".[dev,typer]"
+      - name: Pin the tested Click/Typer boundary pair
+        run: python -m pip install --upgrade "click==${{ matrix.click-version }}" "typer==${{ matrix.typer-version }}"
+      - name: Install Beacon fixture without dependency resolution
+        run: python -m pip install --no-deps compatibility/consumers/beacon_typer
+      - name: Run adapter and Beacon compatibility tests
+        run: python -m pytest tests/test_typer_adapter.py compatibility/consumers/beacon_typer/tests
+
   downstream:
     name: Install and test independent consumers
     runs-on: ubuntu-latest
@@ -56,11 +83,17 @@ jobs:
           python -m pip install dist/*.whl
       - name: Validate consumer manifest
         run: python scripts/validate_consumers.py
-      - name: Install consumers independently
+      - name: Install consumers without dependency resolution
+        run: |
+          python -m pip install --no-deps compatibility/consumers/atlas_click
+          python -m pip install --no-deps compatibility/consumers/beacon_typer
+          python -m pip install --no-deps "compatibility/consumers/cinder_automation[observability]"
+      - name: Verify the installed framework matches the source release
         run: |
-          python -m pip install compatibility/consumers/atlas_click
-          python -m pip install compatibility/consumers/beacon_typer
-          python -m pip install "compatibility/consumers/cinder_automation[observability]"
+          expected="$(tr -d '\r\n' < VERSION)"
+          actual="$(python -c 'from importlib.metadata import version; print(version("base-cli"))')"
+          test "$actual" = "$expected"
+          python -m pip check
       - name: Run downstream compatibility suites
         run: |
           for tests in compatibility/consumers/*/tests; do

{base_cli-0.4.3 → base_cli-0.5.0}/.github/workflows/dependency-matrix.yml

@@ -20,7 +20,7 @@ jobs:
       fail-fast: false
       matrix:
         python-version: ["3.10", "3.14"]
-        click-version: ["8.1.*", "8.2.*", "8.3.*", "8.4.*"]
+        click-version: ["8.1.*", "8.2.*", "8.3.*", "8.4.*", "8.5.*"]
         pyyaml-version: ["6.0.*"]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

{base_cli-0.4.3 → base_cli-0.5.0}/.github/workflows/docs.yml

@@ -22,6 +22,8 @@ on:
       - ".github/workflows/dependency-matrix.yml"
       - ".github/workflows/compatibility.yml"
       - "tests/validate.sh"
+      - "tests/full_validate.sh"
+      - "docs/testing.md"
       - ".github/workflows/docs.yml"
   pull_request:
     paths:
@@ -33,6 +35,8 @@ on:
       - "scripts/validate_docs.py"
       - "scripts/generate_api_reference.py"
       - "tests/validate.sh"
+      - "tests/full_validate.sh"
+      - "docs/testing.md"
       - ".github/workflows/docs.yml"
   workflow_dispatch:
 
@@ -51,6 +55,8 @@ jobs:
     steps:
       - name: Check out source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0

{base_cli-0.4.3 → base_cli-0.5.0}/.github/workflows/package.yml

@@ -14,12 +14,19 @@ on:
       - "scripts/validate_examples.py"
       - "scripts/generate_release_metadata.py"
       - "scripts/validate_release_metadata.py"
+      - "scripts/verify_release_assets.py"
       - "scripts/validate_changelog.py"
       - "scripts/validate_release_ref.py"
+      - "scripts/validate_release_provenance.py"
       - "CHANGELOG.md"
       - "examples/**"
       - "compatibility/**"
       - "docs/releasing.md"
+      - "tests/test_package_workflow.py"
+      - "tests/test_verify_release_assets.py"
+      - "tests/test_validate_release_provenance.py"
+      - "requirements/release.in"
+      - "requirements/release.txt"
       - ".github/workflows/package.yml"
   push:
     branches:
@@ -57,6 +64,8 @@ jobs:
     steps:
       - name: Check out source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -80,9 +89,6 @@ jobs:
             exit 1
           fi
 
-      - name: Validate repository baseline
-        run: ./tests/validate.sh
-
       - name: Validate changelog
         run: python scripts/validate_changelog.py
 
@@ -98,10 +104,48 @@ jobs:
           mkdir -p dist
 
       - name: Install build and validation tools
-        run: python -m pip install --upgrade build twine
+        run: python -m pip install --require-hashes --no-deps -r requirements/release.txt
 
       - name: Build sdist and wheel
-        run: python -m build --sdist --wheel --outdir dist
+        env:
+          # Keep the reproducibility input numeric; push-event timestamps are
+          # ISO-8601 strings and are not accepted by wheel/build backends.
+          SOURCE_DATE_EPOCH: '0'
+        run: |
+          rm -rf dist-a dist-b "$RUNNER_TEMP/base-cli-build-a" "$RUNNER_TEMP/base-cli-build-b"
+          mkdir -p dist-a dist-b
+          mkdir -p "$RUNNER_TEMP/base-cli-build-a" "$RUNNER_TEMP/base-cli-build-b"
+          git archive "$GITHUB_SHA" | tar -x -C "$RUNNER_TEMP/base-cli-build-a"
+          git archive "$GITHUB_SHA" | tar -x -C "$RUNNER_TEMP/base-cli-build-b"
+          (cd "$RUNNER_TEMP/base-cli-build-a" && python -m build --sdist --wheel --outdir "$GITHUB_WORKSPACE/dist-a")
+          (cd "$RUNNER_TEMP/base-cli-build-b" && python -m build --sdist --wheel --outdir "$GITHUB_WORKSPACE/dist-b")
+          python - <<'PY'
+          import gzip
+          import os
+          import tarfile
+          from pathlib import Path
+
+          epoch = int(os.environ["SOURCE_DATE_EPOCH"])
+          for directory in (Path("dist-a"), Path("dist-b")):
+              for path in directory.glob("*.tar.gz"):
+                  with tarfile.open(path, "r:gz") as source:
+                      members = [(member, source.extractfile(member).read() if member.isfile() else None) for member in source.getmembers()]
+                  temporary = path.with_suffix(path.suffix + ".tmp")
+                  with temporary.open("wb") as raw:
+                      with gzip.GzipFile(filename=path.name, mode="wb", fileobj=raw, mtime=epoch) as compressed:
+                          with tarfile.open(fileobj=compressed, mode="w|") as target:
+                              for member, payload in sorted(members, key=lambda item: item[0].name):
+                                  member.mtime = epoch
+                                  member.uid = member.gid = 0
+                                  member.uname = member.gname = ""
+                                  member.pax_headers = {}
+                                  target.addfile(member, None if payload is None else __import__("io").BytesIO(payload))
+                  temporary.replace(path)
+          PY
+          (cd dist-a && sha256sum * | sort) > dist-a.SHA256SUMS
+          (cd dist-b && sha256sum * | sort) > dist-b.SHA256SUMS
+          diff -u dist-a.SHA256SUMS dist-b.SHA256SUMS
+          cp dist-a/* dist/
 
       - name: Validate artifact contents and metadata
         run: python scripts/validate_package_artifact.py dist
@@ -112,7 +156,7 @@ jobs:
       - name: Generate release checksums and SPDX SBOM
         env:
           SOURCE_REVISION: ${{ github.sha }}
-          SOURCE_DATE_EPOCH: ${{ github.event.head_commit.timestamp || '0' }}
+          SOURCE_DATE_EPOCH: '0'
         run: python scripts/generate_release_metadata.py dist
 
       - name: Validate release checksums and SPDX SBOM
@@ -137,6 +181,7 @@ jobs:
           path: |
             dist/SBOM.spdx.json
             dist/SHA256SUMS
+            dist/RELEASE-BOM-ROW.json
           if-no-files-found: error
           retention-days: 90
 
@@ -152,6 +197,8 @@ jobs:
     steps:
       - name: Check out source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -190,9 +237,31 @@ jobs:
       - name: Check installed dependency consistency
         run: python -m pip check
 
+  provenance:
+    name: Verify reviewed release provenance
+    needs: [build, smoke]
+    if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') || github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Fetch trusted main history
+        run: git fetch --no-tags --prune origin "refs/heads/main:refs/remotes/origin/main"
+
+      - name: Verify release provenance
+        env:
+          PUBLISH_TARGET: ${{ inputs.publish_target || '' }}
+        run: python scripts/validate_release_provenance.py
+
   publish:
     name: Publish reviewed distribution
-    needs: [build, smoke]
+    needs: [build, smoke, provenance]
     if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') || github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -224,7 +293,7 @@ jobs:
 
   attest:
     name: Attest reviewed release
-    needs: [build, smoke]
+    needs: [build, smoke, provenance]
     if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') || github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -258,13 +327,22 @@ jobs:
 
   release:
     name: Create GitHub Release
-    needs: [build, smoke, publish, attest]
+    needs: [build, smoke, provenance, publish, attest]
     if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: write
+      attestations: read
     steps:
+      - name: Check out the tag source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+
       - name: Download reviewed distributions
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -277,18 +355,110 @@ jobs:
           name: base-cli-release-metadata-${{ github.run_id }}
           path: dist
 
-      - name: Create or update GitHub Release
+      - name: Verify and create immutable GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          set -euo pipefail
           tag="$GITHUB_REF_NAME"
-          assets=(dist/*.whl dist/*.tar.gz dist/SHA256SUMS dist/SBOM.spdx.json)
-          if gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-            gh release upload "$tag" "${assets[@]}" --clobber --repo "$GITHUB_REPOSITORY"
-          else
-            gh release create "$tag" "${assets[@]}" \
+          assets=(dist/*.whl dist/*.tar.gz dist/SHA256SUMS dist/SBOM.spdx.json dist/RELEASE-BOM-ROW.json)
+          tag_commit="$(gh api "repos/$GITHUB_REPOSITORY/commits/$tag" --jq .sha)"
+          if [[ "$tag_commit" != "$GITHUB_SHA" ]]; then
+            echo "Release tag $tag resolves to $tag_commit, not reviewed commit $GITHUB_SHA." >&2
+            exit 1
+          fi
+
+          python scripts/validate_release_metadata.py dist
+          for asset in dist/*.whl dist/*.tar.gz; do
+            gh attestation verify "$asset" \
               --repo "$GITHUB_REPOSITORY" \
-              --title "$tag" \
-              --generate-notes \
-              --notes "Published distributions and release metadata for $tag. See CHANGELOG.md for the reviewed release notes."
+              --signer-workflow "github.com/$GITHUB_REPOSITORY/.github/workflows/package.yml" \
+              --source-digest "$GITHUB_SHA" \
+              --source-ref "$GITHUB_REF"
+            gh attestation verify "$asset" \
+              --repo "$GITHUB_REPOSITORY" \
+              --signer-workflow "github.com/$GITHUB_REPOSITORY/.github/workflows/package.yml" \
+              --source-digest "$GITHUB_SHA" \
+              --source-ref "$GITHUB_REF" \
+              --predicate-type "https://spdx.dev/Document"
+          done
+
+          release_tmp="$(mktemp -d "$RUNNER_TEMP/base-cli-release.XXXXXX")"
+          trap 'rm -rf "$release_tmp"' EXIT
+          release_json="$release_tmp/release.json"
+          release_error="$release_tmp/release-error.txt"
+          release_response="$release_tmp/release-response.txt"
+
+          read_release_metadata() {
+            local retry_404="${1:-false}"
+            local attempt=1
+            local status_line
+            while :; do
+              if gh api --include "repos/$GITHUB_REPOSITORY/releases/tags/$tag" \
+                >"$release_response" 2>"$release_error"; then
+                awk 'BEGIN { body = 0 } { sub(/\r$/, ""); if (body) print; else if ($0 == "") body = 1 }' \
+                  "$release_response" >"$release_json"
+                return 0
+              fi
+              status_line="$(sed -n '1s/\r$//p' "$release_response")"
+              if [[ "$status_line" =~ ^HTTP/[0-9.]+[[:space:]]404[[:space:]] ]]; then
+                if [[ "$retry_404" != true || "$attempt" -ge 5 ]]; then
+                  return 1
+                fi
+                sleep $((attempt * 2))
+                attempt=$((attempt + 1))
+                continue
+              fi
+              cat "$release_error" >&2
+              return 2
+            done
+          }
+
+          verify_existing_release() {
+            local existing_assets="$release_tmp/existing-assets"
+            mkdir -p "$existing_assets"
+            gh release download "$tag" --repo "$GITHUB_REPOSITORY" --dir "$existing_assets"
+            python scripts/verify_release_assets.py \
+              --expected-dir dist \
+              --existing-dir "$existing_assets" \
+              --release-json "$release_json" \
+              --version-file VERSION \
+              --tag "$tag" \
+              --source-commit "$GITHUB_SHA" \
+              --resolved-tag-commit "$tag_commit"
+          }
+
+          if read_release_metadata; then
+            verify_existing_release
+            echo "Existing release $tag is byte-for-byte identical; leaving the immutable release unchanged."
+            exit 0
+          else
+            release_status=$?
+            if [[ "$release_status" -ne 1 ]]; then
+              exit "$release_status"
+            fi
+          fi
+
+          create_status=0
+          gh release create "$tag" "${assets[@]}" \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "$tag" \
+            --generate-notes \
+            --notes "Published distributions and release metadata for $tag. See CHANGELOG.md for the reviewed release notes." \
+            || create_status=$?
+
+          if read_release_metadata true; then
+            verify_existing_release
+            if [[ "$create_status" -ne 0 ]]; then
+              echo "gh release create failed with status $create_status; refusing to hide the publication error." >&2
+              exit "$create_status"
+            fi
+            echo "Verified immutable release $tag after publication."
+          else
+            release_status=$?
+            if [[ "$create_status" -ne 0 ]]; then
+              exit "$create_status"
+            fi
+            echo "Release $tag was created but could not be read back (HTTP 404)." >&2
+            exit "$release_status"
           fi