bigfix-remote-client-relevance 0.0.1__tar.gz

bigfix_remote_client_relevance-0.0.1/.editorconfig

@@ -0,0 +1,21 @@
+# Check http://editorconfig.org for more information
+# This is the main config file for this project:
+root = true
+
+[*]
+charset = utf-8
+trim_trailing_whitespace = true
+indent_style = space
+insert_final_newline = true
+
+[*.py]
+indent_size = 4
+
+[*.{bes,bes.mustache}]
+# bes files are XML, but the `actionscript` tag text must use crlf
+end_of_line = crlf
+indent_style = tab
+indent_size = 3
+
+[*.{bat,cmd}]
+end_of_line = crlf

bigfix_remote_client_relevance-0.0.1/.github/dependabot.yml

@@ -0,0 +1,46 @@
+# Dependency-update alerts, closing the "no automated vulnerability alerting
+# path" gap in docs/security-review.md.
+#
+# Requires Dependabot to be enabled on the GHES instance - this file is inert,
+# not an error, if it is not. Check Security > Dependabot settings.
+#
+# The 7-day cooldown is the point, not a courtesy: a release published minutes
+# ago is the likeliest to be a compromised one. It matches `exclude-newer` in
+# pyproject.toml and is zizmor's minimum.
+version: 2
+updates:
+  # "uv", not "pip": uv.lock is what the release wheel is built from
+  # (uv sync --locked), and "pip" would read pyproject.toml without updating
+  # the lock. Fall back to "pip" if this instance rejects the newer ecosystem.
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+
+  # Scans .pre-commit-config.yaml and updates each hook's `rev:` (SHA-pinned
+  # revs get their version comment updated too, same as the github-actions
+  # entries above). No `cooldown` here: as of 2026-03, GitHub does not support
+  # the cooldown option for this ecosystem, so these PRs land without the
+  # 7-day delay the other two ecosystems get - review before merging.
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"

bigfix_remote_client_relevance-0.0.1/.github/workflows/pre-commit.yaml

@@ -0,0 +1,122 @@
+---
+name: pre-commit
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+# read-only by default; the cross-repo checkout uses secrets.CROSSREPO_PAT
+permissions:
+  contents: read
+
+concurrency:
+  group: pre-commit-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    # no-commit-to-branch guards a developer's local `git commit`; it has nothing
+    # to check on a runner. On a push to main, actions/checkout leaves HEAD on
+    # the main branch, so the hook fails the whole run on a merged PR. (On a
+    # pull_request event HEAD is detached at the merge ref, where it passes -
+    # which is why this only shows up after the merge.) SKIP is read by
+    # pre-commit itself, so it applies to both steps below.
+    #
+    # GH_TOKEN puts zizmor in online mode (offline is the default without it):
+    # it can then fetch the referenced actions themselves for the audits that
+    # need that - see the comment above the zizmor hook in
+    # .pre-commit-config.yaml. The runner's own GITHUB_TOKEN is enough for a
+    # public repo; this is read-only per the `permissions:` block above and
+    # never touches git credentials (actions/checkout above already sets
+    # persist-credentials: false).
+    env:
+      SKIP: no-commit-to-branch
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # requited to grab the history of the PR for pre-commit
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      # single source of truth for the uv version: the `rev` of the
+      # astral-sh/uv-pre-commit repo in .pre-commit-config.yaml, which
+      # `pre-commit autoupdate` already keeps current. Read with awk rather
+      # than a yaml parser so it needs nothing installed first. `rev` is
+      # SHA-pinned (Dependabot's pre-commit ecosystem keeps the trailing
+      # `# X.Y.Z` comment in sync when it bumps the SHA - same convention as
+      # the actions/* pins above), so the version comes from that comment;
+      # fall back to the bare `rev` value for a tag-pinned rev with no
+      # comment.
+      - name: read uv version from .pre-commit-config.yaml
+        run: |
+          UV_VERSION="$(awk '
+            /^[[:space:]]*-[[:space:]]*repo:.*astral-sh\/uv-pre-commit[[:space:]]*$/ { found = 1; next }
+            found && $1 == "rev:" {
+              if (match($0, /#[ \t]*(frozen:[ \t]*)?[vV]?[0-9]+(\.[0-9]+)*/)) {
+                ver = substr($0, RSTART, RLENGTH)
+                sub(/^#[ \t]*(frozen:[ \t]*)?[vV]?/, "", ver)
+              } else {
+                ver = $2
+                gsub(/["'\'']/, "", ver)
+                sub(/^[vV]/, "", ver)
+              }
+              print ver
+              exit
+            }
+          ' .pre-commit-config.yaml)"
+          if [ -z "$UV_VERSION" ]; then
+            echo "::error::could not read the astral-sh/uv-pre-commit version from .pre-commit-config.yaml"
+            exit 1
+          fi
+          echo "UV_VERSION=$UV_VERSION" >> "$GITHUB_ENV"
+          echo "uv version: $UV_VERSION"
+
+      # the local `uv-lock-check` / `uv-build-wheel` hooks are language: system
+      # and run at the manual stage, which this workflow always requests. They
+      # look for `uv` on PATH first and only fall back to this repo's .venv,
+      # which does not exist on a runner - so uv has to be installed here or
+      # both hooks fail.
+      - name: install uv (needed by the local pre-commit hooks)
+        run: python -m pip install "uv==${UV_VERSION}"
+
+      - name: pre-commit local action test
+        if: github.event_name != 'workflow_dispatch'
+        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        with:
+          extra_args: >-
+            --color=always
+            --from-ref ${{ github.event.pull_request.base.sha || github.event.before }}
+            --to-ref ${{ github.event.pull_request.head.sha || github.sha }}
+            --hook-stage manual
+
+      # manual dispatch: run every hook (including the manual-stage ones -
+      # validate-pyproject, the pytest wrapper, the check-useless-excludes/
+      # check-hooks-apply meta hooks) against the full tree, not just the
+      # diff range a PR/push would use
+      - name: pre-commit local action test (manual dispatch)
+        if: github.event_name == 'workflow_dispatch'
+        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        with:
+          extra_args: --color=always --all-files --hook-stage manual
+
+      # `restore-keys` above means a config change restores the previous cache
+      # and then saves it back under the new key - so every hook rev bump would
+      # otherwise leave its old environment in the cache forever (the pytest
+      # hook's fastmcp install is the fat one). gc deletes exactly the
+      # environments no live config references. Last step in the job on purpose:
+      # actions/cache saves in its post step, which runs after this, so what
+      # gets uploaded is the pruned store. No `if:` - the default success()
+      # matches the cache action's own `post-if: success()`, so this runs in
+      # precisely the cases where a save follows. `pre-commit` is on PATH from
+      # the shared action's `python -m pip install pre-commit`.
+      - name: prune unused hook environments before the cache is saved
+        run: pre-commit gc

bigfix_remote_client_relevance-0.0.1/.github/workflows/tag_and_release.yaml

@@ -0,0 +1,222 @@
+---
+# Tags and releases on a version bump. Nothing here bumps the version: the flow
+# is to change `[project] version` in pyproject.toml in a PR, merge it to main,
+# and this workflow does the rest (tag, build, checksums, GitHub Release, and -
+# once deliberately enabled, see the publish step - PyPI).
+name: Tag and Release
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "pyproject.toml"
+      - "uv.lock"
+      - "src/**"
+      - ".github/workflows/tag_and_release.yaml"
+      - ".github/workflows/test.yaml"
+  # a re-run path for when a release run failed after the version was already
+  # merged; the tag check below still makes it a no-op if the tag exists
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  # deliberately no cancel-in-progress: never kill a release mid-flight
+  group: release-${{ github.ref }}
+
+jobs:
+  # Decides whether there is anything to do, so the expensive jobs below can be
+  # skipped outright. A push that touches src/** without bumping the version
+  # gets a green, near-instant run and no release.
+  version:
+    name: Check for an untagged version
+    runs-on: ubuntu-latest
+    # fork guard: a fork that pushes to its own main should not try to release
+    if: github.repository == 'jgstew/bigfix-remote-client-relevance'
+    outputs:
+      version: ${{ steps.getversion.outputs.version }}
+      release_needed: ${{ steps.tagged.outputs.release_needed }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # full history + tags: the tag check below needs every existing tag
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+
+      # `[project] version` in pyproject.toml is the single source of truth.
+      # tomllib is stdlib on the 3.11+ this package requires, and the runner's
+      # preinstalled python is new enough, so no setup-python step is needed.
+      - name: Read version from pyproject.toml
+        id: getversion
+        run: |
+          version="$(python3 -c 'import pathlib, tomllib; print(tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"])')"
+          if ! printf '%s' "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([.-]?[0-9A-Za-z.]+)?$'; then
+            echo "::error::unexpected version string in pyproject.toml: '$version'"
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "version: $version"
+
+      # Release only if this version has no tag yet. This is what makes the
+      # workflow idempotent and safe to re-run.
+      - name: Check whether v<version> is already tagged
+        id: tagged
+        env:
+          VERSION: ${{ steps.getversion.outputs.version }}
+        run: |
+          if git show-ref --tags --verify --quiet -- "refs/tags/v${VERSION}"; then
+            echo "release_needed=false" >> "$GITHUB_OUTPUT"
+            echo "v${VERSION} is already tagged - nothing to release"
+          else
+            echo "release_needed=true" >> "$GITHUB_OUTPUT"
+            echo "v${VERSION} has no tag yet - will release"
+          fi
+
+  # The gate. Reusing the test workflow means the release is blocked by the
+  # exact same job that guards PRs, with no third-party wait-for-checks action
+  # and no polling. Lint/type-check are owned by pre-commit.yaml and are not
+  # waited on here - branch protection on main is what keeps those green.
+  test:
+    name: Test
+    needs: version
+    if: needs.version.outputs.release_needed == 'true'
+    uses: ./.github/workflows/test.yaml
+
+  release:
+    name: Tag and Release
+    needs: [version, test]
+    runs-on: ubuntu-latest
+    # Deliberately gates the whole release - tag, GitHub release, and PyPI
+    # upload - not just the publish step, so an environment protection rule
+    # (required reviewer, wait timer, branch restriction) stops a release
+    # before the tag is cut rather than after. The name must match the
+    # `Environment name` field of the PyPI trusted publisher exactly: PyPI
+    # checks the `environment` claim in the OIDC token, and a mismatch fails
+    # the publish. Create it under Settings > Environments; an environment
+    # with no protection rules is valid and simply records the deployment.
+    environment: pypi
+    permissions:
+      # contents: write - create the tag and the release, and upload assets.
+      # id-token: write - OIDC for the PyPI trusted-publishing step at the end
+      # of this job. Both live here rather than in a separate publish job so
+      # the built dist/ does not have to be handed between jobs through
+      # upload-artifact/download-artifact.
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+
+      # same awk-from-.pre-commit-config.yaml source of truth as
+      # .github/workflows/test.yaml and pre-commit.yaml
+      - name: read uv version from .pre-commit-config.yaml
+        run: |
+          UV_VERSION="$(awk '
+            /^[[:space:]]*-[[:space:]]*repo:.*astral-sh\/uv-pre-commit[[:space:]]*$/ { found = 1; next }
+            found && $1 == "rev:" {
+              if (match($0, /#[ \t]*(frozen:[ \t]*)?[vV]?[0-9]+(\.[0-9]+)*/)) {
+                ver = substr($0, RSTART, RLENGTH)
+                sub(/^#[ \t]*(frozen:[ \t]*)?[vV]?/, "", ver)
+              } else {
+                ver = $2
+                gsub(/["'\'']/, "", ver)
+                sub(/^[vV]/, "", ver)
+              }
+              print ver
+              exit
+            }
+          ' .pre-commit-config.yaml)"
+          if [ -z "$UV_VERSION" ]; then
+            echo "::error::could not read the astral-sh/uv-pre-commit version from .pre-commit-config.yaml"
+            exit 1
+          fi
+          echo "UV_VERSION=$UV_VERSION" >> "$GITHUB_ENV"
+          echo "uv version: $UV_VERSION"
+
+      - name: install uv
+        run: python -m pip install "uv==${UV_VERSION}"
+
+      - name: uv build (wheel + sdist)
+        run: uv build
+
+      # `sha256sum -c SHA256SUMS.txt`-verifiable, and with no dist/ prefix in
+      # it, so it checks out wherever the assets are downloaded to. Globs are
+      # listed explicitly rather than `./*` so the output file can never end up
+      # listing itself.
+      - name: Compute SHA-256 checksums
+        working-directory: dist
+        run: |
+          sha256sum ./*.whl ./*.tar.gz > SHA256SUMS.txt
+          cat SHA256SUMS.txt
+
+      # Release notes: GitHub's own generated notes (same content the Releases
+      # UI would produce) with the checksums appended, so the hashes are
+      # readable in the release body as well as downloadable as an asset. The
+      # notes are built here instead of passing --generate-notes to `gh release
+      # create` so the appended block is not at the mercy of how that flag
+      # combines with --notes.
+      - name: Build release notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.version.outputs.version }}
+        run: |
+          notes_file="${RUNNER_TEMP}/release-notes.md"
+          if ! gh api "repos/${GITHUB_REPOSITORY}/releases/generate-notes" \
+                --method POST \
+                -f "tag_name=v${VERSION}" \
+                -f "target_commitish=${GITHUB_SHA}" \
+                --jq '.body' > "$notes_file"; then
+            echo "::warning::could not generate release notes; falling back to a plain body"
+            printf 'Release v%s\n' "${VERSION}" > "$notes_file"
+          fi
+          {
+            printf '\n## SHA-256\n\n'
+            printf 'Verify with `sha256sum -c SHA256SUMS.txt`:\n\n'
+            printf '```\n'
+            cat dist/SHA256SUMS.txt
+            printf '```\n'
+          } >> "$notes_file"
+          echo "NOTES_FILE=$notes_file" >> "$GITHUB_ENV"
+          cat "$notes_file"
+
+      # `gh release create --target` creates the tag itself, so this needs no
+      # git push and the checkout above can stay credential-less. Using the gh
+      # CLI (preinstalled on the runner) also means one less third-party action
+      # to pin and keep updated.
+      - name: Create the GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.version.outputs.version }}
+        run: |
+          gh release create "v${VERSION}" \
+            --target "${GITHUB_SHA}" \
+            --title "v${VERSION}" \
+            --notes-file "${NOTES_FILE}" \
+            dist/*.whl dist/*.tar.gz dist/SHA256SUMS.txt
+
+      # Inert until all of these are true, so nothing can publish by accident:
+      #   1. a PyPI trusted publisher exists for this repo with workflow name
+      #      `tag_and_release.yaml` and environment name `pypi`, matching the
+      #      `environment:` above (https://docs.pypi.org/trusted-publishers/)
+      #   2. the repository variable PYPI_PUBLISH is set to `true`
+      #      (Settings > Secrets and variables > Actions > Variables)
+      #   3. whatever protection rules the `pypi` environment carries have been
+      #      satisfied - those gate this entire job, tagging included
+      # `uv publish` speaks OIDC natively given the id-token: write permission
+      # above, so there is no long-lived API token to store and no
+      # pypa/gh-action-pypi-publish pin to maintain. The release is already
+      # created at this point: a failure here leaves the GitHub release intact
+      # and is re-run by hand, not by re-running the whole workflow.
+      - name: Publish to PyPI (trusted publishing)
+        if: vars.PYPI_PUBLISH == 'true'
+        # the explicit globs keep SHA256SUMS.txt (which lives in dist/ too) out
+        # of the upload; uv publish would otherwise take everything in dist/
+        run: uv publish --trusted-publishing always dist/*.whl dist/*.tar.gz

bigfix_remote_client_relevance-0.0.1/.github/workflows/test.yaml

@@ -0,0 +1,57 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+  # lets tag_and_release.yaml gate the release on this same job via `uses:`
+  workflow_call:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: py${{ matrix.python-version }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        python-version: ["3.11", "3.12", "3.13"]
+        include:
+          - os: macos-latest
+            python-version: "3.12"
+          - os: windows-latest
+            python-version: "3.12"
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
+        with:
+          enable-cache: true
+
+      # --frozen resolves from the committed lockfile. That matters because
+      # [tool.uv] exclude-newer is a rolling 7-day window: re-resolving here
+      # would drift from what was locked.
+      - name: Install
+        run: uv sync --frozen --python ${{ matrix.python-version }}
+
+      - name: Lint
+        run: uv run ruff check .
+
+      - name: Type-check
+        run: uv run mypy src
+
+      # Tests needing a real qna, Docker, sshd, or the network are marked and
+      # auto-skip here (see tests/conftest.py).
+      - name: Test
+        run: uv run pytest -q -rs

bigfix_remote_client_relevance-0.0.1/.gitignore

@@ -0,0 +1,219 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer,
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+hosts.toml