batchvault 0.1.0__tar.gz

batchvault-0.1.0/.dockerignore

@@ -0,0 +1,20 @@
+.git
+.github
+.venv
+.temp
+.pytest_cache
+.ruff_cache
+**/__pycache__
+dist
+tests
+docs
+.env
+.env.*
+*.key
+*.pem
+*.pfx
+*.p12
+*.sig
+manifest.json
+archives
+restored

batchvault-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,38 @@
+name: Bug report
+description: Something does not work as expected
+labels: [bug]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened?
+      description: What did you run, what did you expect, and what happened instead?
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command or code
+      render: shell
+  - type: input
+    id: version
+    attributes:
+      label: BatchVault version
+      description: Output of `batchvault --version`
+    validations:
+      required: true
+  - type: dropdown
+    id: engine
+    attributes:
+      label: Engine
+      options: [auto, native, 7zip]
+  - type: input
+    id: platform
+    attributes:
+      label: OS and Python version
+  - type: textarea
+    id: log
+    attributes:
+      label: Log or error output
+      description: Run `batchvault doctor` and attach the relevant lines of the log file. Remove anything private.
+      render: text

batchvault-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/coldsofttech/BatchVault/security/advisories/new
+    about: Please report security problems privately.

batchvault-0.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,14 @@
+name: Feature request
+description: Suggest an improvement
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do?
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: What would you like BatchVault to do?

batchvault-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,10 @@
+## What changed
+
+<!-- What does this do, and why? -->
+
+## Checklist
+
+- [ ] Tests added or updated
+- [ ] `uv run ruff check .` and `uv run pytest -m "not integration and not e2e"` pass
+- [ ] `CHANGELOG.md` has a short `[Unreleased]` entry
+- [ ] README or `docs/` updated if behaviour changed

batchvault-0.1.0/.github/dependabot.yml

@@ -0,0 +1,33 @@
+version: 2
+
+updates:
+  # Python dependencies and the uv.lock file
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      python-dependencies:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+
+  # Actions used in .github/workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(ci)"
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  # Hook versions in .pre-commit-config.yaml
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps)"

batchvault-0.1.0/.github/workflows/docker.yml

@@ -0,0 +1,77 @@
+name: Docker
+
+# Builds the image on every pull request and publishes both variants to GHCR
+# when a version tag such as v0.2.0 is pushed.
+on:
+  push:
+    tags: ["v*.*.*"]
+  pull_request:
+    paths:
+      - Dockerfile
+      - .dockerignore
+      - pyproject.toml
+      - src/**
+      - .github/workflows/docker.yml
+
+concurrency:
+  group: docker-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  image:
+    name: Image (${{ matrix.variant }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { variant: native, with_7zip: "false", suffix: "" }
+          - { variant: 7zip, with_7zip: "true", suffix: "-7zip" }
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: docker/setup-qemu-action@v3
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Tags
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/batchvault
+          flavor: |
+            latest=false
+            suffix=${{ matrix.suffix }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
+
+      - name: Build${{ startsWith(github.ref, 'refs/tags/') && ' and push' || '' }}
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          build-args: WITH_7ZIP=${{ matrix.with_7zip }}
+          push: ${{ startsWith(github.ref, 'refs/tags/') }}
+          provenance: mode=max
+          sbom: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=${{ matrix.variant }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.variant }}

batchvault-0.1.0/.github/workflows/e2e.yml

@@ -0,0 +1,338 @@
+name: End-to-end
+
+# Runs the real program the way users do: the command line and the built package
+# (tests/e2e), the GitHub Action (this repository's action.yml, used as "./"),
+# and the Docker images. Also run before every release (see release.yml).
+on:
+  workflow_call:
+  workflow_dispatch:
+  push:
+    branches: [main]
+  pull_request:
+    paths:
+      - src/**
+      - tests/e2e/**
+      - action.yml
+      - Dockerfile
+      - .dockerignore
+      - pyproject.toml
+      - uv.lock
+      - .github/workflows/e2e.yml
+  schedule:
+    - cron: "0 4 * * 1" # Mondays; catches changes in runners, pip and Docker
+
+concurrency:
+  group: e2e-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  cli-and-package:
+    name: CLI and package / ${{ matrix.os }} / Python ${{ matrix.python }}
+    runs-on: ${{ matrix.os }}
+    # Same matrix as tests.yml. Python 3.15 may still be a pre-release; don't
+    # let it block the build.
+    continue-on-error: ${{ matrix.python == '3.15' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { os: ubuntu-latest, python: "3.11" }
+          - { os: ubuntu-latest, python: "3.12" }
+          - { os: ubuntu-latest, python: "3.13" }
+          - { os: ubuntu-latest, python: "3.14" }
+          - { os: ubuntu-latest, python: "3.15" }
+          - { os: windows-latest, python: "3.11" }
+          - { os: macos-latest, python: "3.11" }
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: astral-sh/setup-uv@v7
+
+      - name: Install
+        run: uv sync --python ${{ matrix.python }}
+
+      # No -n: the package tests build a wheel and virtual environments once.
+      - name: CLI and package tests
+        run: uv run pytest -m "e2e and not docker" -v
+
+  docker:
+    name: Docker images
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: astral-sh/setup-uv@v7
+
+      - name: Install
+        run: uv sync --python 3.11
+
+      - name: Docker tests (builds both images)
+        run: uv run pytest -m docker -v
+
+  action:
+    name: GitHub Action / ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    defaults:
+      run:
+        shell: bash
+    env:
+      PYTHONUTF8: "1"
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # Only used by the steps below that create keys or edit files; the action
+      # installs its own copy.
+      - name: Install BatchVault for helper steps
+        run: python -m pip install --quiet ".[crypto]"
+
+      - name: Create test data
+        run: python tests/e2e/scripts/make_data.py data
+
+      # --- pack, verify, unpack -------------------------------------------
+      - name: Pack
+        id: pack
+        uses: ./
+        with:
+          files: |
+            data/report.bin
+            data/notes.txt
+            data/ünï cödé.txt
+            data/empty.dat
+            data/sub dir/nested file.csv
+          output: archives
+          engine: native
+          volume-size: 256k
+          verify: "true"
+
+      - name: Pack reported success and wrote a manifest
+        env:
+          STATUS: ${{ steps.pack.outputs.status }}
+          OUTPUT: ${{ steps.pack.outputs.output }}
+          RESULT: ${{ steps.pack.outputs.result-json }}
+        run: |
+          test "$STATUS" = success
+          test "$OUTPUT" = archives
+          test -f archives/manifest.json
+          test -s "$RESULT"
+          python -c "import json,sys; d=json.load(open(sys.argv[1], encoding='utf-8')); assert len(d['entries'])==5" "$RESULT"
+
+      - name: Verify against the originals
+        id: verify
+        uses: ./
+        with:
+          command: verify
+          source: archives
+          against: data
+
+      - name: Unpack
+        id: unpack
+        uses: ./
+        with:
+          command: unpack
+          source: archives
+          output: restored
+
+      - name: Restored files are identical
+        env:
+          VERIFY: ${{ steps.verify.outputs.status }}
+          UNPACK: ${{ steps.unpack.outputs.status }}
+        run: |
+          test "$VERIFY" = success
+          test "$UNPACK" = success
+          python tests/e2e/scripts/compare.py data restored
+
+      # --- incremental mode -----------------------------------------------
+      - name: Pack again with update (nothing changed)
+        id: update
+        uses: ./
+        with:
+          files: |
+            data/report.bin
+            data/notes.txt
+          output: archives
+          engine: native
+          volume-size: 256k
+          update: "true"
+          fail-on-error: "false"
+
+      - name: Nothing was re-archived
+        env:
+          STATUS: ${{ steps.update.outputs.status }}
+        run: test "$STATUS" = skipped
+
+      # --- artifact upload ------------------------------------------------
+      - name: Pack and upload as an artifact
+        uses: ./
+        with:
+          files: data/notes.txt
+          output: uploaded
+          engine: native
+          upload-artifact: "true"
+          artifact-name: e2e-archives-${{ matrix.os }}
+
+      - name: Download the artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: e2e-archives-${{ matrix.os }}
+          path: downloaded
+
+      - name: Artifact holds the archive
+        run: |
+          test -f downloaded/manifest.json
+          ls downloaded/notes.txt
+
+      # --- encryption -----------------------------------------------------
+      - name: Pack encrypted
+        uses: ./
+        with:
+          files: data/notes.txt
+          output: vault
+          engine: native
+          encrypt: "true"
+          password: e2e-throwaway-password
+
+      - name: Unpack with the wrong password
+        id: wrong
+        uses: ./
+        with:
+          command: unpack
+          source: vault
+          output: wrong-restore
+          password: not-the-password
+          fail-on-error: "false"
+
+      - name: Unpack with the right password
+        id: right
+        uses: ./
+        with:
+          command: unpack
+          source: vault
+          output: right-restore
+          password: e2e-throwaway-password
+
+      - name: Only the right password restores
+        env:
+          WRONG: ${{ steps.wrong.outputs.status }}
+          RIGHT: ${{ steps.right.outputs.status }}
+        run: |
+          test "$WRONG" = failed
+          test "$RIGHT" = success
+          test ! -e wrong-restore/notes.txt
+          python tests/e2e/scripts/compare.py data right-restore notes.txt
+
+      # --- signing --------------------------------------------------------
+      - name: Create keys
+        run: batchvault keygen --private signing.key --public signing.pub -q
+
+      - name: Pack with a signed manifest
+        uses: ./
+        with:
+          files: data/notes.txt
+          output: signed
+          engine: native
+          sign-key: signing.key
+
+      - name: Verify the signature
+        id: signed
+        uses: ./
+        with:
+          command: verify
+          source: signed
+          public-key: signing.pub
+
+      - name: Tamper with the manifest
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          path = Path("signed/manifest.json")
+          path.write_text(path.read_text(encoding="utf-8").replace("notes.txt", "other.txt", 1), encoding="utf-8")
+          PY
+
+      - name: Verify the tampered manifest
+        id: tampered
+        uses: ./
+        with:
+          command: verify
+          source: signed
+          public-key: signing.pub
+          fail-on-error: "false"
+
+      - name: The signature check caught the change
+        env:
+          GOOD: ${{ steps.signed.outputs.status }}
+          BAD: ${{ steps.tampered.outputs.status }}
+        run: |
+          test "$GOOD" = success
+          test "$BAD" = failed
+
+      # --- failures -------------------------------------------------------
+      - name: Pack a file that does not exist
+        id: missing
+        continue-on-error: true
+        uses: ./
+        with:
+          files: data/does-not-exist.txt
+          output: nope
+
+      - name: Pack a missing file without failing the step
+        id: missing-quiet
+        uses: ./
+        with:
+          files: data/does-not-exist.txt
+          output: nope
+          fail-on-error: "false"
+
+      - name: Failures are reported
+        env:
+          OUTCOME: ${{ steps.missing.outcome }}
+          STATUS: ${{ steps.missing-quiet.outputs.status }}
+        run: |
+          test "$OUTCOME" = failure
+          test "$STATUS" = failed
+          test ! -e nope
+
+      # --- 7-Zip (only where the runner has it) ---------------------------
+      - name: Detect 7-Zip
+        id: sevenzip
+        run: |
+          if command -v 7zz >/dev/null || command -v 7z >/dev/null || [ -f "/c/Program Files/7-Zip/7z.exe" ]; then
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Pack with 7-Zip
+        if: steps.sevenzip.outputs.found == 'true'
+        id: sz-pack
+        uses: ./
+        with:
+          files: |
+            data/report.bin
+            data/notes.txt
+          output: sz-archives
+          engine: 7zip
+          volume-size: 256k
+          verify: "true"
+
+      - name: Unpack the 7-Zip archives
+        if: steps.sevenzip.outputs.found == 'true'
+        uses: ./
+        with:
+          command: unpack
+          source: sz-archives
+          output: sz-restored
+
+      - name: 7-Zip round trip is identical
+        if: steps.sevenzip.outputs.found == 'true'
+        run: python tests/e2e/scripts/compare.py data sz-restored report.bin notes.txt

batchvault-0.1.0/.github/workflows/lint.yml

@@ -0,0 +1,27 @@
+name: Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: lint-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  ruff:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: astral-sh/setup-uv@v7
+
+      - name: Install
+        run: uv sync --python 3.11
+
+      - name: Ruff
+        run: uv run ruff check .

batchvault-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,79 @@
+name: Release
+
+# Publishes to PyPI when a version tag such as v0.2.0 is pushed.
+# Uses PyPI trusted publishing: register this repository and the "pypi"
+# environment as a trusted publisher in the PyPI project settings.
+on:
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Check version and tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: astral-sh/setup-uv@v7
+
+      - name: Tag must match the package version
+        shell: bash
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          project=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")
+          module=$(python3 -c "import re; print(re.search(r'__version__ = \"(.+?)\"', open('src/batchvault/__init__.py').read()).group(1))")
+          echo "tag=$tag pyproject=$project __init__=$module"
+          if [ "$tag" != "$project" ] || [ "$tag" != "$module" ]; then
+            echo "::error::Tag v$tag must match the version in pyproject.toml ($project) and src/batchvault/__init__.py ($module)."
+            exit 1
+          fi
+
+      - name: Install
+        run: uv sync --python 3.11
+
+      - name: Lint
+        run: uv run ruff check .
+
+      - name: Unit tests
+        run: uv run pytest -m "not integration and not e2e"
+
+      - name: Integration tests
+        run: uv run pytest -m integration
+
+  e2e:
+    name: End-to-end tests
+    uses: ./.github/workflows/e2e.yml
+
+  publish:
+    name: Build and publish
+    needs: [check, e2e]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: astral-sh/setup-uv@v7
+
+      - name: Build
+        run: uv build
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: dist/*
+
+      - name: Publish to PyPI
+        run: uv publish --trusted-publishing always
+
+      - name: GitHub release
+        uses: softprops/action-gh-release@v3
+        with:
+          generate_release_notes: true
+          files: dist/*

batchvault-0.1.0/.github/workflows/tests.yml

@@ -0,0 +1,45 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: ${{ matrix.os }} / Python ${{ matrix.python }}
+    runs-on: ${{ matrix.os }}
+    # Python 3.15 may still be a pre-release; don't let it block the build.
+    continue-on-error: ${{ matrix.python == '3.15' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { os: ubuntu-latest, python: "3.11" }
+          - { os: ubuntu-latest, python: "3.12" }
+          - { os: ubuntu-latest, python: "3.13" }
+          - { os: ubuntu-latest, python: "3.14" }
+          - { os: ubuntu-latest, python: "3.15" }
+          - { os: windows-latest, python: "3.11" }
+          - { os: macos-latest, python: "3.11" }
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: astral-sh/setup-uv@v7
+
+      - name: Install
+        run: uv sync --python ${{ matrix.python }}
+
+      - name: Unit tests
+        run: uv run pytest -m "not integration and not e2e" -n auto
+
+      - name: Integration tests
+        run: uv run pytest -m integration -n auto