bigfix-remote-session-relevance 0.2.0__tar.gz

bigfix_remote_session_relevance-0.2.0/.editorconfig

@@ -0,0 +1,21 @@
+# Check http://editorconfig.org for more information
+# This is the main config file for this project:
+root = true
+
+[*]
+charset = utf-8
+trim_trailing_whitespace = true
+indent_style = space
+insert_final_newline = true
+
+[*.py]
+indent_size = 4
+
+[*.{bes,bes.mustache}]
+# bes files are XML, but the `actionscript` tag text must use crlf
+end_of_line = crlf
+indent_style = tab
+indent_size = 3
+
+[*.{bat,cmd}]
+end_of_line = crlf

bigfix_remote_session_relevance-0.2.0/.editorconfig-checker.json

@@ -0,0 +1,20 @@
+{
+  "$comment": [
+    "Config for the editorconfig-checker hook in .pre-commit-config.yaml.",
+    "Run locally: `uvx --from editorconfig-checker ec`.",
+    "Scoping belongs in .editorconfig itself wherever it can be expressed",
+    "there, so rules and their exceptions stay in one place. Only what",
+    "EditorConfig cannot express belongs here."
+  ],
+  "Disable": {
+    "IndentSize": true
+  },
+  "$comment_Disable": [
+    "IndentSize checks that left-padding is a multiple of indent_size, which",
+    "flags ruff-format's own docstring and comment prose continuations (the",
+    "hanging-indent continuation lines in __init__.py, ssh.py and others).",
+    "ruff-format already fully governs Python indentation, so this check has",
+    "nothing to add and 19 false positives to contribute. indent_style,",
+    "end_of_line, trailing whitespace and final newline all stay on."
+  ]
+}

bigfix_remote_session_relevance-0.2.0/.github/dependabot.yml

@@ -0,0 +1,46 @@
+# Dependency-update alerts, closing the "no automated vulnerability alerting
+# path" gap in docs/security-review.md.
+#
+# Requires Dependabot to be enabled on the GHES instance - this file is inert,
+# not an error, if it is not. Check Security > Dependabot settings.
+#
+# The 7-day cooldown is the point, not a courtesy: a release published minutes
+# ago is the likeliest to be a compromised one. It matches `exclude-newer` in
+# pyproject.toml and is zizmor's minimum.
+version: 2
+updates:
+  # "uv", not "pip": uv.lock is what the release wheel is built from
+  # (uv sync --locked), and "pip" would read pyproject.toml without updating
+  # the lock. Fall back to "pip" if this instance rejects the newer ecosystem.
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+
+  # Scans .pre-commit-config.yaml and updates each hook's `rev:` (SHA-pinned
+  # revs get their version comment updated too, same as the github-actions
+  # entries above). No `cooldown` here: as of 2026-03, GitHub does not support
+  # the cooldown option for this ecosystem, so these PRs land without the
+  # 7-day delay the other two ecosystems get - review before merging.
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"

bigfix_remote_session_relevance-0.2.0/.github/workflows/pre-commit.yaml

@@ -0,0 +1,122 @@
+---
+name: pre-commit
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+# read-only by default; the cross-repo checkout uses secrets.CROSSREPO_PAT
+permissions:
+  contents: read
+
+concurrency:
+  group: pre-commit-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    # no-commit-to-branch guards a developer's local `git commit`; it has nothing
+    # to check on a runner. On a push to main, actions/checkout leaves HEAD on
+    # the main branch, so the hook fails the whole run on a merged PR. (On a
+    # pull_request event HEAD is detached at the merge ref, where it passes -
+    # which is why this only shows up after the merge.) SKIP is read by
+    # pre-commit itself, so it applies to both steps below.
+    #
+    # GH_TOKEN puts zizmor in online mode (offline is the default without it):
+    # it can then fetch the referenced actions themselves for the audits that
+    # need that - see the comment above the zizmor hook in
+    # .pre-commit-config.yaml. The runner's own GITHUB_TOKEN is enough for a
+    # public repo; this is read-only per the `permissions:` block above and
+    # never touches git credentials (actions/checkout above already sets
+    # persist-credentials: false).
+    env:
+      SKIP: no-commit-to-branch
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # requited to grab the history of the PR for pre-commit
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      # single source of truth for the uv version: the `rev` of the
+      # astral-sh/uv-pre-commit repo in .pre-commit-config.yaml, which
+      # `pre-commit autoupdate` already keeps current. Read with awk rather
+      # than a yaml parser so it needs nothing installed first. `rev` is
+      # SHA-pinned (Dependabot's pre-commit ecosystem keeps the trailing
+      # `# X.Y.Z` comment in sync when it bumps the SHA - same convention as
+      # the actions/* pins above), so the version comes from that comment;
+      # fall back to the bare `rev` value for a tag-pinned rev with no
+      # comment.
+      - name: read uv version from .pre-commit-config.yaml
+        run: |
+          UV_VERSION="$(awk '
+            /^[[:space:]]*-[[:space:]]*repo:.*astral-sh\/uv-pre-commit[[:space:]]*$/ { found = 1; next }
+            found && $1 == "rev:" {
+              if (match($0, /#[ \t]*(frozen:[ \t]*)?[vV]?[0-9]+(\.[0-9]+)*/)) {
+                ver = substr($0, RSTART, RLENGTH)
+                sub(/^#[ \t]*(frozen:[ \t]*)?[vV]?/, "", ver)
+              } else {
+                ver = $2
+                gsub(/["'\'']/, "", ver)
+                sub(/^[vV]/, "", ver)
+              }
+              print ver
+              exit
+            }
+          ' .pre-commit-config.yaml)"
+          if [ -z "$UV_VERSION" ]; then
+            echo "::error::could not read the astral-sh/uv-pre-commit version from .pre-commit-config.yaml"
+            exit 1
+          fi
+          echo "UV_VERSION=$UV_VERSION" >> "$GITHUB_ENV"
+          echo "uv version: $UV_VERSION"
+
+      # the local `uv-lock-check` / `uv-build-wheel` hooks are language: system
+      # and run at the manual stage, which this workflow always requests. They
+      # look for `uv` on PATH first and only fall back to this repo's .venv,
+      # which does not exist on a runner - so uv has to be installed here or
+      # both hooks fail.
+      - name: install uv (needed by the local pre-commit hooks)
+        run: python -m pip install "uv==${UV_VERSION}"
+
+      - name: pre-commit local action test
+        if: github.event_name != 'workflow_dispatch'
+        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        with:
+          extra_args: >-
+            --color=always
+            --from-ref ${{ github.event.pull_request.base.sha || github.event.before }}
+            --to-ref ${{ github.event.pull_request.head.sha || github.sha }}
+            --hook-stage manual
+
+      # manual dispatch: run every hook (including the manual-stage ones -
+      # validate-pyproject, the pytest wrapper, the check-useless-excludes/
+      # check-hooks-apply meta hooks) against the full tree, not just the
+      # diff range a PR/push would use
+      - name: pre-commit local action test (manual dispatch)
+        if: github.event_name == 'workflow_dispatch'
+        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        with:
+          extra_args: --color=always --all-files --hook-stage manual
+
+      # `restore-keys` above means a config change restores the previous cache
+      # and then saves it back under the new key - so every hook rev bump would
+      # otherwise leave its old environment in the cache forever (the pytest
+      # hook's fastmcp install is the fat one). gc deletes exactly the
+      # environments no live config references. Last step in the job on purpose:
+      # actions/cache saves in its post step, which runs after this, so what
+      # gets uploaded is the pruned store. No `if:` - the default success()
+      # matches the cache action's own `post-if: success()`, so this runs in
+      # precisely the cases where a save follows. `pre-commit` is on PATH from
+      # the shared action's `python -m pip install pre-commit`.
+      - name: prune unused hook environments before the cache is saved
+        run: pre-commit gc

bigfix_remote_session_relevance-0.2.0/.github/workflows/tag_and_release.yaml

@@ -0,0 +1,228 @@
+---
+# Tags and releases on a version bump. Nothing here bumps the version: the flow
+# is to change `[project] version` in pyproject.toml in a PR, merge it to main,
+# and this workflow does the rest (tag, build, checksums, GitHub Release, and -
+# once deliberately enabled, see the publish step - PyPI).
+name: Tag and Release
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "pyproject.toml"
+      - "uv.lock"
+      - "src/**"
+      - ".github/workflows/tag_and_release.yaml"
+      - ".github/workflows/test.yaml"
+  # a re-run path for when a release run failed after the version was already
+  # merged; the tag check below still makes it a no-op if the tag exists
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  # deliberately no cancel-in-progress: never kill a release mid-flight
+  group: release-${{ github.ref }}
+
+jobs:
+  # Decides whether there is anything to do, so the expensive jobs below can be
+  # skipped outright. A push that touches src/** without bumping the version
+  # gets a green, near-instant run and no release.
+  version:
+    name: Check for an untagged version
+    runs-on: ubuntu-latest
+    # fork guard: a fork that pushes to its own main should not try to release
+    if: github.repository == 'jgstew/bigfix-remote-session-relevance'
+    outputs:
+      version: ${{ steps.getversion.outputs.version }}
+      release_needed: ${{ steps.tagged.outputs.release_needed }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # full history + tags: the tag check below needs every existing tag
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+
+      # `[project] version` in pyproject.toml is the single source of truth.
+      # tomllib is stdlib on the 3.11+ this package requires, and the runner's
+      # preinstalled python is new enough, so no setup-python step is needed.
+      - name: Read version from pyproject.toml
+        id: getversion
+        run: |
+          version="$(python3 -c 'import pathlib, tomllib; print(tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"])')"
+          if ! printf '%s' "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([.-]?[0-9A-Za-z.]+)?$'; then
+            echo "::error::unexpected version string in pyproject.toml: '$version'"
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "version: $version"
+
+      # Release only if this version has no tag yet. This is what makes the
+      # workflow idempotent and safe to re-run.
+      - name: Check whether v<version> is already tagged
+        id: tagged
+        env:
+          VERSION: ${{ steps.getversion.outputs.version }}
+        run: |
+          if git show-ref --tags --verify --quiet -- "refs/tags/v${VERSION}"; then
+            echo "release_needed=false" >> "$GITHUB_OUTPUT"
+            echo "v${VERSION} is already tagged - nothing to release"
+          else
+            echo "release_needed=true" >> "$GITHUB_OUTPUT"
+            echo "v${VERSION} has no tag yet - will release"
+          fi
+
+  # The gate. Reusing the test workflow means the release is blocked by the
+  # exact same job that guards PRs, with no third-party wait-for-checks action
+  # and no polling. Lint/type-check are owned by pre-commit.yaml and are not
+  # waited on here - branch protection on main is what keeps those green.
+  test:
+    name: Test
+    needs: version
+    if: needs.version.outputs.release_needed == 'true'
+    uses: ./.github/workflows/test.yaml # zizmor: ignore[self-repository] -- ./ is the documented local reusable-workflow form
+
+  release:
+    name: Tag and Release
+    needs: [version, test]
+    runs-on: ubuntu-latest
+    # Deliberately gates the whole release - tag, GitHub release, and PyPI
+    # upload - not just the publish step, so an environment protection rule
+    # (required reviewer, wait timer, branch restriction) stops a release
+    # before the tag is cut rather than after. The name must match the
+    # `Environment name` field of the PyPI trusted publisher exactly: PyPI
+    # checks the `environment` claim in the OIDC token, and a mismatch fails
+    # the publish. Create it under Settings > Environments; an environment
+    # with no protection rules is valid and simply records the deployment.
+    environment: pypi
+    permissions:
+      # contents: write - create the tag and the release, and upload assets.
+      # id-token: write - OIDC for the PyPI trusted-publishing step at the end
+      # of this job. Both live here rather than in a separate publish job so
+      # the built dist/ does not have to be handed between jobs through
+      # upload-artifact/download-artifact.
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+
+      # same awk-from-.pre-commit-config.yaml source of truth as
+      # .github/workflows/test.yaml and pre-commit.yaml
+      - name: read uv version from .pre-commit-config.yaml
+        run: |
+          UV_VERSION="$(awk '
+            /^[[:space:]]*-[[:space:]]*repo:.*astral-sh\/uv-pre-commit[[:space:]]*$/ { found = 1; next }
+            found && $1 == "rev:" {
+              if (match($0, /#[ \t]*(frozen:[ \t]*)?[vV]?[0-9]+(\.[0-9]+)*/)) {
+                ver = substr($0, RSTART, RLENGTH)
+                sub(/^#[ \t]*(frozen:[ \t]*)?[vV]?/, "", ver)
+              } else {
+                ver = $2
+                gsub(/["'\'']/, "", ver)
+                sub(/^[vV]/, "", ver)
+              }
+              print ver
+              exit
+            }
+          ' .pre-commit-config.yaml)"
+          if [ -z "$UV_VERSION" ]; then
+            echo "::error::could not read the astral-sh/uv-pre-commit version from .pre-commit-config.yaml"
+            exit 1
+          fi
+          echo "UV_VERSION=$UV_VERSION" >> "$GITHUB_ENV"
+          echo "uv version: $UV_VERSION"
+
+      - name: install uv
+        run: python -m pip install "uv==${UV_VERSION}"
+
+      - name: uv build (wheel + sdist)
+        run: uv build
+
+      # `sha256sum -c SHA256SUMS.txt`-verifiable, and with no dist/ prefix in
+      # it, so it checks out wherever the assets are downloaded to. Globs are
+      # listed explicitly rather than `./*` so the output file can never end up
+      # listing itself.
+      - name: Compute SHA-256 checksums
+        working-directory: dist
+        run: |
+          sha256sum ./*.whl ./*.tar.gz > SHA256SUMS.txt
+          cat SHA256SUMS.txt
+
+      # Release notes: GitHub's own generated notes (same content the Releases
+      # UI would produce) with the checksums appended, so the hashes are
+      # readable in the release body as well as downloadable as an asset. The
+      # notes are built here instead of passing --generate-notes to `gh release
+      # create` so the appended block is not at the mercy of how that flag
+      # combines with --notes.
+      - name: Build release notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.version.outputs.version }}
+        run: |
+          notes_file="${RUNNER_TEMP}/release-notes.md"
+          if ! gh api "repos/${GITHUB_REPOSITORY}/releases/generate-notes" \
+                --method POST \
+                -f "tag_name=v${VERSION}" \
+                -f "target_commitish=${GITHUB_SHA}" \
+                --jq '.body' > "$notes_file"; then
+            echo "::warning::could not generate release notes; falling back to a plain body"
+            printf 'Release v%s\n' "${VERSION}" > "$notes_file"
+          fi
+          # SC2016 fires on the backticks below, but they are markdown code
+          # spans destined for the release body, not command substitutions --
+          # single quotes are what keeps them literal. The suggested fix
+          # (double quotes) would mean escaping every one of them for no gain.
+          # Scoped to this group so the rest of the script keeps the check.
+          # shellcheck disable=SC2016
+          {
+            printf '\n## SHA-256\n\n'
+            printf 'Verify with `sha256sum -c SHA256SUMS.txt`:\n\n'
+            printf '```\n'
+            cat dist/SHA256SUMS.txt
+            printf '```\n'
+          } >> "$notes_file"
+          echo "NOTES_FILE=$notes_file" >> "$GITHUB_ENV"
+          cat "$notes_file"
+
+      # `gh release create --target` creates the tag itself, so this needs no
+      # git push and the checkout above can stay credential-less. Using the gh
+      # CLI (preinstalled on the runner) also means one less third-party action
+      # to pin and keep updated.
+      - name: Create the GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.version.outputs.version }}
+        run: |
+          gh release create "v${VERSION}" \
+            --target "${GITHUB_SHA}" \
+            --title "v${VERSION}" \
+            --notes-file "${NOTES_FILE}" \
+            dist/*.whl dist/*.tar.gz dist/SHA256SUMS.txt
+
+      # Inert until all of these are true, so nothing can publish by accident:
+      #   1. a PyPI trusted publisher exists for this repo with workflow name
+      #      `tag_and_release.yaml` and environment name `pypi`, matching the
+      #      `environment:` above (https://docs.pypi.org/trusted-publishers/)
+      #   2. the repository variable PYPI_PUBLISH is set to `true`
+      #      (Settings > Secrets and variables > Actions > Variables)
+      #   3. whatever protection rules the `pypi` environment carries have been
+      #      satisfied - those gate this entire job, tagging included
+      # `uv publish` speaks OIDC natively given the id-token: write permission
+      # above, so there is no long-lived API token to store and no
+      # pypa/gh-action-pypi-publish pin to maintain. The release is already
+      # created at this point: a failure here leaves the GitHub release intact
+      # and is re-run by hand, not by re-running the whole workflow.
+      - name: Publish to PyPI (trusted publishing)
+        if: vars.PYPI_PUBLISH == 'true'
+        # the explicit globs keep SHA256SUMS.txt (which lives in dist/ too) out
+        # of the upload; uv publish would otherwise take everything in dist/
+        run: uv publish --trusted-publishing always dist/*.whl dist/*.tar.gz

bigfix_remote_session_relevance-0.2.0/.github/workflows/test.yaml

@@ -0,0 +1,57 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+  # lets tag_and_release.yaml gate the release on this same job via `uses:`
+  workflow_call:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: py${{ matrix.python-version }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        python-version: ["3.11", "3.12", "3.15"]
+        include:
+          - os: macos-latest
+            python-version: "3.12"
+          - os: windows-latest
+            python-version: "3.12"
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          enable-cache: true
+
+      # --frozen resolves from the committed lockfile. That matters because
+      # [tool.uv] exclude-newer is a rolling 7-day window: re-resolving here
+      # would drift from what was locked.
+      - name: Install
+        run: uv sync --frozen --python ${{ matrix.python-version }}
+
+      - name: Lint
+        run: uv run ruff check .
+
+      - name: Type-check
+        run: uv run mypy src
+
+      # Tests needing a real BigFix server or local openssl are marked and
+      # auto-skip here (see tests/conftest.py).
+      - name: Test
+        run: uv run pytest -q -rs