bompage 1.0.0__tar.gz

bompage-1.0.0/.gitignore

@@ -0,0 +1,30 @@
+# python generated files
+__pycache__/
+*.py[oc]
+.coverage
+build/
+dist/
+wheels/
+*.egg-info
+
+# build output & coverage reports (anchored so deploy/reports/ stays tracked)
+/public/
+/reports/
+/demo-reports/
+
+# JS toolchain: web-src/ is the source, src/bompage/web/ is the Vite build output
+/node_modules/
+/.pnpm-store/
+/src/bompage/web/
+
+# venv
+.venv
+
+.DS_Store
+/.*cache/
+/.claude/
+/docs/memory/
+/docs/superpowers/
+/styles/
+/Taskfile.d/
+CLAUDE.md

bompage-1.0.0/.gitlab-ci.yml

@@ -0,0 +1,335 @@
+---
+workflow:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "schedule"
+    - if: $CI_PIPELINE_SOURCE == "web"
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
+      when: never
+    - if: $CI_COMMIT_TAG
+    - if: $CI_COMMIT_BRANCH
+  # Superseded pipelines abandon their still-running interruptible jobs when a
+  # newer commit lands on the same ref.
+  auto_cancel:
+    on_new_commit: interruptible
+
+# Interruptible by default so redundant pipelines free their runners. Jobs that
+# mutate something external (tag, PyPI upload, Pages deploy) opt out below.
+# Retries are limited to causes that are never the code itself: infra hiccups.
+default:
+  interruptible: true
+  retry:
+    max: 2
+    when:
+      - runner_system_failure
+      - stuck_or_timeout_failure
+      - scheduler_failure
+
+variables:
+  # Single source of truth for the Python minor version (see the note on
+  # `include:` below for why the component inputs still hard-code it).
+  PYTHON_VERSION: "3.14"
+  # Pinned go-task release fetched by `.install-task` (floating "latest" would
+  # make release jobs non-reproducible). Bump deliberately.
+  TASK_VERSION: "v3.53.1"
+  IMAGE_UV: ghcr.io/astral-sh/uv:python${PYTHON_VERSION}-trixie-slim
+  IMAGE_NODE: node:24-trixie-slim
+  # Trivy generates bompage's own release SBOM in the `push-sbom` job. Pinned so
+  # re-running an old tag is reproducible; Renovate bumps it (custom manager in
+  # renovate.json).
+  TRIVY_VERSION: "0.74.0"
+
+# `include:` is evaluated before the global `variables:` block, so the component
+# `inputs:` below cannot reference ${PYTHON_VERSION}. The four
+# `*_python_version: "3.14"` values are therefore kept as literals and must be
+# bumped together with PYTHON_VERSION above (and deploy/.gitlab-ci.yml).
+include:
+  - component: gitlab.com/op_so/components/core/lint@v2.0.2
+    inputs:
+      lint_vale: true
+      lint_markdown_glob: '"**/*.md" "#docs"'
+  - component: gitlab.com/op_so/components/python-uv/prepare-uv@v1.4.0
+    inputs:
+      prepare_uv_python_version: "3.14"
+  - component: gitlab.com/op_so/components/python-uv/lint-uv@v1.4.0
+    inputs:
+      lint_uv_python_version: "3.14"
+      lint_uv_isort: true
+      lint_uv_mypy: true
+      lint_uv_mypy_args: "--strict src/ tests/"
+      lint_uv_pyrefly: true
+  # Coverage is on by default and reads `[tool.coverage.run] source` from
+  # pyproject.toml, since the component passes `--cov` without an argument.
+  - component: gitlab.com/op_so/components/python-uv/test-uv@v1.4.0
+    inputs:
+      test_uv_python_version: "3.14"
+  - component: gitlab.com/op_so/components/core/semantic-release@v2.0.2
+  # Only runs on a scheduled pipeline setting RENOVATE=true, and needs a
+  # RENOVATE_TOKEN CI/CD variable.
+  - component: gitlab.com/op_so/components/core/renovate@v2.0.2
+  - component: gitlab.com/op_so/components/python-uv/publish-pypi-uv@v1.4.0
+    inputs:
+      publish_pypi_uv_python_version: "3.14"
+      publish_pypi_uv_stage: pypi-release
+
+stages:
+  - prepare-uv
+  - lint
+  - build-web
+  - tests
+  - release
+  - pypi-release
+  - pages-release
+  - sbom-release
+  - renovate
+
+# Shared pnpm setup for the dashboard sources (web-src/). corepack reads the
+# pnpm version from package.json `packageManager`, so it stays pinned in one
+# place instead of being repeated here.
+.pnpm:
+  image: $IMAGE_NODE
+  needs: []
+  interruptible: true
+  variables:
+    PNPM_HOME: "$CI_PROJECT_DIR/.pnpm-store"
+    # `corepack prepare` would otherwise block on an interactive confirmation
+    # before downloading the pnpm release pinned in package.json.
+    COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
+  cache:
+    key:
+      files:
+        - pnpm-lock.yaml
+      prefix: pnpm-${CI_DEFAULT_BRANCH}
+    paths:
+      - .pnpm-store
+  before_script:
+    - corepack enable
+    - corepack prepare --activate
+    - pnpm config set store-dir "$PNPM_HOME"
+    - pnpm install --frozen-lockfile
+
+# Dashboard sources (web-src/) validation: one job per step, like the Python
+# side, so a failure points at the right thing. All reuse .pnpm, start
+# immediately (needs: []) and only read the pnpm cache (build-web populates it).
+# Biome covers TS *and* CSS.
+format-web: # biome format check (TS + CSS)
+  extends: .pnpm
+  stage: lint
+  cache:
+    policy: pull
+  script:
+    - pnpm run format:web
+
+lint-web: # biome check, no formatter: lint rules + import sort (TS + CSS)
+  extends: .pnpm
+  stage: lint
+  cache:
+    policy: pull
+  script:
+    - pnpm run lint:web
+
+typecheck-web: # tsc --noEmit
+  extends: .pnpm
+  stage: lint
+  cache:
+    policy: pull
+  script:
+    - pnpm run typecheck:web
+
+test-web: # vitest run: web-src/*.test.ts (happy-dom)
+  extends: .pnpm
+  stage: tests
+  cache:
+    policy: pull
+  script:
+    - pnpm run test:web
+
+# Builds the constant Material Web (M3) dashboard into src/bompage/web/ (Vite +
+# icon subset). That directory is git-ignored, so any job that packages the
+# wheel or runs the dashboard tests must consume this artifact.
+build-web:
+  extends: .pnpm
+  stage: build-web
+  script:
+    - pnpm run build:web
+  artifacts:
+    paths:
+      - src/bompage/web/
+    expire_in: 1 week
+
+# Optional browser smoke of the built dashboard. Manual until a runner with the
+# Playwright dependencies is confirmed. Keep the image tag aligned with the
+# `playwright` version pinned in uv.lock (currently 1.62.0).
+test-e2e:
+  stage: tests
+  image: mcr.microsoft.com/playwright/python:v1.62.0
+  needs: ["build-web"]
+  dependencies: ["build-web"]
+  when: manual
+  allow_failure: true
+  interruptible: true
+  script:
+    - curl -LsSf https://astral.sh/uv/install.sh | sh
+    - export PATH="$HOME/.local/bin:$PATH"
+    - uv run --group dev playwright install chromium
+    - uv run --group dev pytest -m e2e
+
+.install-task: &install-task
+  - apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends curl ca-certificates
+  - sh -c "$(curl --fail --silent --show-error --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin "${TASK_VERSION}"
+
+# The cache block must stay identical to the one used by the python-uv
+# components: they share a single key and any divergence silently splits it.
+.abstract-uv:
+  image: $IMAGE_UV
+  needs: ["prepare-uv:sync"]
+  variables:
+    UV_CACHE_DIR: .uv-cache
+  cache:
+    key:
+      files:
+        - uv.lock
+      prefix: prepare-uv-${CI_DEFAULT_BRANCH}
+    paths:
+      - .uv-cache
+      - .venv
+    policy: pull
+  interruptible: true
+
+# The python-uv/test-uv@v1.3.0 component defines its job as `test-uv:pytest`
+# with `needs: ["prepare-uv:sync"]`. On its own it only sees the checkout, where
+# src/bompage/web/ is git-ignored, so every test guarded by the `built_web`
+# fixture (tests/conftest.py -> tests/test_build.py, tests/test_bompage.py,
+# tests/render/test_web.py) does `pytest.skip`. Re-declaring `needs` with
+# `build-web` (keeping prepare-uv:sync) pulls the artifact so CI exercises the
+# same set as a local `task 00:220-run-tests`. `artifacts: true` downloads it,
+# so no separate `dependencies:` is needed.
+test-uv:pytest:
+  needs:
+    - job: "prepare-uv:sync"
+      artifacts: true
+    - job: build-web
+      artifacts: true
+
+semantic-release:
+  # Creates the release tag: not interruptible.
+  interruptible: false
+  before_script:
+    - npx semantic-release --dry-run --no-ci
+    - if [ -s .VERSION ]; then task 00:800-project-set-version VERSION=$(cat .VERSION); fi
+
+# The component runs `uv sync --frozen && uv build && uv publish` without
+# substituting the version: without this before_script it would publish 0.0.0.
+# It also needs the `build-web` artifact so the wheel embeds src/bompage/web/
+# (see `[tool.hatch.build.targets.wheel] artifacts` in pyproject.toml). The
+# component ships `needs: ["prepare-uv:sync"]`; we re-declare it with build-web
+# added (a bare `dependencies: [build-web]` would be rejected as not part of
+# `needs`).
+publish-pypi-uv:
+  # Uploads to PyPI: not interruptible.
+  interruptible: false
+  needs:
+    - job: "prepare-uv:sync"
+      artifacts: true
+    - job: build-web
+      artifacts: true
+  before_script:
+    - *install-task
+    - test -f src/bompage/web/index.html  # fail loudly if the artifact is missing
+    - task 00:800-project-set-version VERSION="${CI_COMMIT_TAG#v}"
+
+# Publishes the source-code documentation site (mkdocs). The BOMpage dashboard
+# itself is built by the central deployment repo (see deploy/), not here.
+pages:
+  extends: .abstract-uv
+  stage: pages-release
+  # Deploys GitLab Pages: not interruptible. `needs` is made explicit here (it is
+  # also inherited from .abstract-uv): the docs build only needs the uv venv, not
+  # the build-web artifact.
+  interruptible: false
+  needs:
+    - job: "prepare-uv:sync"
+      artifacts: true
+  before_script:
+    - *install-task
+    - uv sync --frozen
+    - task 00:800-project-set-version VERSION="${CI_COMMIT_TAG#v}"
+  script:
+    - uv run mkdocs build --site-dir public
+  artifacts:
+    paths:
+      - public
+  rules:
+    - if: $DISABLE_JOBS == "true"
+      when: never
+    - if: $CI_COMMIT_TAG
+
+# Dogfooding: on a release tag, generate bompage's own SBOM with Trivy and
+# publish it into the central SBOM repository via `bompage push` (spec sections 5
+# and 9). The released version is carried two ways: `uv lock` restamps it into
+# uv.lock so Trivy records it as the SBOM's root component version, and
+# `--sbom-version` puts it in the snapshot name
+# (reports/bompage/sbom-YYYYMMDD-<version>.json) and the commit message.
+# `push_report`'s anti-noise filter skips the commit when the dependency set is
+# byte-identical to the previous snapshot.
+#
+# Requires a masked CI/CD variable BOMPAGE_TOKEN: a project/group access token
+# scoped to write_repository on gitlab.com/op_so/pages/sbom-bompage only (spec
+# section 5.3). `bompage push` reads it from that variable.
+push-sbom:
+  extends: .abstract-uv
+  stage: sbom-release
+  # Pushes to an external repository: not interruptible.
+  interruptible: false
+  needs:
+    - job: "prepare-uv:sync"
+      artifacts: true
+    # Only publish the SBOM once the release itself has shipped to PyPI.
+    # `optional` keeps non-tag pipelines (where neither job runs) valid.
+    - job: publish-pypi-uv
+      artifacts: false
+      optional: true
+  variables:
+    # Central repository that hosts bompage's SBOM history.
+    BOMPAGE_REPO: "https://gitlab.com/op_so/pages/sbom-bompage.git"
+  before_script:
+    - *install-task  # curl + ca-certificates + task
+    - DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends git
+    # Pinned Trivy release tarball (no `curl | sh`): reproducible, fails loudly.
+    # Asset suffix is Linux-64bit (amd64) or Linux-ARM64 depending on the runner.
+    - |
+      set -e
+      case "$(uname -m)" in
+        x86_64) TARCH=64bit ;;
+        aarch64 | arm64) TARCH=ARM64 ;;
+        *) echo "unsupported runner arch: $(uname -m)" >&2; exit 1 ;;
+      esac
+      curl --fail --silent --show-error --location --output /tmp/trivy.tgz \
+        "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-${TARCH}.tar.gz"
+      tar -xzf /tmp/trivy.tgz -C /usr/local/bin trivy
+    - 'test -n "$BOMPAGE_TOKEN" || { echo "ERROR: CI/CD variable BOMPAGE_TOKEN is unset or empty" >&2; exit 1; }'
+    # `.venv` (bompage installed editable) matches the committed 0.0.0 lock here;
+    # stamp the real version afterwards and relock so uv.lock carries it before
+    # Trivy reads it as the SBOM's root component version.
+    - uv sync --frozen
+    - task 00:800-project-set-version VERSION="${CI_COMMIT_TAG#v}"
+    - uv lock
+  script:
+    # CycloneDX SBOM of the project. `--scanners license` limits Trivy to package
+    # + license data: no vulnerability DB download, and no volatile
+    # `vulnerabilities` section that would defeat push_report's anti-noise
+    # byte-compare. `--skip-files` drops the dashboard's build-time JS deps (only
+    # the built assets ship in the wheel).
+    - trivy fs --quiet --format cyclonedx --scanners license --offline-scan --skip-files "**/pnpm-lock.yaml" --output sbom.cdx.json .
+    - >
+      uv run --no-sync bompage push
+      --component bompage
+      --sbom sbom.cdx.json
+      --repo "$BOMPAGE_REPO"
+      --branch main
+      --sbom-version "${CI_COMMIT_TAG#v}"
+      --sbom-format cyclonedx
+  rules:
+    - if: $DISABLE_JOBS == "true"
+      when: never
+    - if: $CI_COMMIT_TAG

bompage-1.0.0/.gitleaks.toml

@@ -0,0 +1,4 @@
+title = "gitleaks config"
+
+[extend]
+useDefault = true

bompage-1.0.0/.markdownlint.yaml

@@ -0,0 +1,9 @@
+---
+# Default state for all rules
+default: true
+
+# Path to configuration file to extend
+extends: null
+
+# MD013/line-length - Line length
+MD013: false

bompage-1.0.0/.node-version

@@ -0,0 +1 @@
+24

bompage-1.0.0/.pre-commit-config.yaml

@@ -0,0 +1,27 @@
+---
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+        args: [--markdown-linebreak-ext=md]
+      - id: end-of-file-fixer
+      - id: check-yaml
+        args: [--unsafe]
+      - id: check-added-large-files
+      # Hooks added from sample-config
+      - id: check-executables-have-shebangs
+      - id: check-json
+      - id: check-merge-conflict
+      - id: check-shebang-scripts-are-executable
+      - id: check-symlinks
+      - id: check-toml
+      - id: check-xml
+      - id: detect-private-key
+      - id: fix-byte-order-marker
+      - id: mixed-line-ending
+
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks

bompage-1.0.0/.python-version

@@ -0,0 +1 @@
+3.14

bompage-1.0.0/.releaserc

@@ -0,0 +1,17 @@
+{
+  "branches": [
+    "main",
+    "master"
+  ],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    [
+      "@semantic-release/exec",
+      {
+        "verifyReleaseCmd": "echo ${nextRelease.version} > .VERSION"
+      }
+    ],
+    "@semantic-release/gitlab"
+  ]
+}

bompage-1.0.0/.yamllint

@@ -0,0 +1,17 @@
+---
+extends: default
+
+ignore: |
+  .cache/
+  .venv/
+  node_modules/
+  mkdocs.yml
+  pnpm-lock.yaml
+  Taskfile.d/
+  Taskfile.yml
+  styles/
+
+rules:
+  line-length: disable
+  comments:
+    min-spaces-from-content: 1

bompage-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright © 2026 FX Soubirou soubirou@yahoo.fr
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.