boost-skill-cli 1.0.155__tar.gz → 1.0.157__tar.gz

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.157}/.gitignore

@@ -195,9 +195,9 @@ cython_debug/
 .abstra/
 
 # Visual Studio Code
-#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore
 #   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
-#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   and can be added to the global gitignore or merged into this file. However, if you prefer,
 #   you could uncomment the following to ignore the entire vscode folder
 # .vscode/
 # Temporary file for partial code execution

boost_skill_cli-1.0.157/.gitleaks.toml

@@ -0,0 +1,17 @@
+# gitleaks configuration — secret-scanning gate (see .github/workflows/ci.yml).
+#
+# Extends gitleaks' upstream default ruleset (which covers cloud keys, tokens,
+# private keys, high-entropy strings, …) and allowlists the one place boost
+# ships *synthetic* secrets on purpose: its own secret-scanner test fixtures.
+# Everything else — source, docs, real history — is scanned unmodified.
+
+title = "boost gitleaks config"
+
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "boost's own secret-scanner tests ship synthetic private keys / tokens by design (they exist to prove core/secretscan.py flags them)"
+paths = [
+    '''tests/unit/test_secretscan\.py''',
+]

boost_skill_cli-1.0.157/.pre-commit-config.yaml

@@ -0,0 +1,67 @@
+# Shift-left the `make lint` gate to *before* the commit, so ruff / mypy /
+# codespell / whitespace fixes land locally instead of failing in CI.
+#
+#   pip install pre-commit && pre-commit install   # once — hooks then run on `git commit`
+#   pre-commit run --all-files                      # run everything right now
+#
+# pre-commit.ci (free for open source) runs these on every PR and pushes the
+# auto-fixes back onto the branch — see the `ci:` block. Versions below are
+# pinned to match the tools `make lint` runs; bump them together.
+ci:
+  autofix_prs: true
+  autoupdate_schedule: monthly
+  # mypy is a `repo: local` hook that needs the project's venv — pre-commit.ci
+  # builds isolated hook envs and can't provide it, so `make lint` / CI own it.
+  skip: [mypy]
+
+minimum_pre_commit_version: "3.5.0"
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      # Whitespace fixers skip the generated boards (build_roadmap.py owns their
+      # bytes — a drift check would fight this hook), the loop-edited roadmap
+      # item data (many parallel branches touch these; a whitespace churn there
+      # means needless merge conflicts) and IDE files under .idea/.
+      - id: trailing-whitespace
+        exclude: &data_and_generated '^(docs/(roadmap|design-roadmap)\.html$|docs/roadmap/items/|\.idea/)'
+      - id: end-of-file-fixer
+        exclude: *data_and_generated
+      - id: mixed-line-ending
+        args: [--fix=lf]
+        exclude: *data_and_generated
+      - id: check-merge-conflict
+      - id: check-yaml
+      - id: check-toml
+      - id: check-added-large-files
+
+  # Ruff — pinned to the version in `make lint`; reads the same [tool.ruff]
+  # config from pyproject.toml and is scoped to the gate's paths.
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.22
+    hooks:
+      - id: ruff
+        args: [--fix]
+        files: ^(boost_cli|tests)/.*\.py$
+
+  # codespell — same version and [tool.codespell] config (skip / ignore lists)
+  # as `make lint`, scoped to the same targets: boost_cli, docs, README.
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.4.3
+    hooks:
+      - id: codespell
+        additional_dependencies: [tomli]
+        files: ^(boost_cli/|docs/|README\.md)
+
+  # mypy — run from the project venv so it matches `make lint` exactly
+  # (config drives it: files = ["boost_cli"]). Local so stdlib/editable
+  # resolution is identical; skipped on pre-commit.ci (see `ci.skip`).
+  - repo: local
+    hooks:
+      - id: mypy
+        name: mypy (boost_cli)
+        entry: mypy
+        language: system
+        pass_filenames: false
+        types: [python]

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.157}/CONTRIBUTING.md

@@ -13,6 +13,21 @@ make venv          # pytest, coverage, mutmut, ruff, mypy — runtime stays stdl
 Every test runs against a throwaway `$HOME`, so nothing touches your real
 agent configs.
 
+### Pre-commit hooks (recommended)
+
+Catch the `make lint` findings *before* they reach CI:
+
+```bash
+pip install pre-commit && pre-commit install   # once
+pre-commit run --all-files                      # or run everything now
+```
+
+`git commit` then runs ruff, mypy, codespell and the whitespace fixers on your
+staged files. The hooks in [`.pre-commit-config.yaml`](.pre-commit-config.yaml)
+are pinned to the same tool versions the lint gate uses, and
+[pre-commit.ci](https://pre-commit.ci) runs them on every PR and pushes any
+auto-fixes straight back onto the branch.
+
 ## The gates (CI runs all of these)
 
 | Command | Gate |

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.157}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.155
+Version: 1.0.157
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.157}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.155'
-__version_tuple__ = version_tuple = (1, 0, 155)
+__version__ = version = '1.0.157'
+__version_tuple__ = version_tuple = (1, 0, 157)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.157}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.155
+Version: 1.0.157
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.157}/boost_skill_cli.egg-info/SOURCES.txt

@@ -1,5 +1,7 @@
 .gitattributes
 .gitignore
+.gitleaks.toml
+.pre-commit-config.yaml
 CLAUDE.md
 CONTRIBUTING.md
 LICENSE
@@ -281,6 +283,7 @@ tests/unit/test_docs_pages_linked.py
 tests/unit/test_embed.py
 tests/unit/test_errors_and_cli_table.py
 tests/unit/test_frontmatter.py
+tests/unit/test_gitleaks_config.py
 tests/unit/test_gitutil.py
 tests/unit/test_imperative.py
 tests/unit/test_import_budget.py

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.157}/docs/roadmap/items/secret-scanning-gitleaks-push-protection.md

@@ -2,15 +2,15 @@
 id: secret-scanning-gitleaks-push-protection
 board: code
 section: health
-status: planned
+status: shipped
 category: Security · Secrets
 complexity: S
 impact: Med
 wow: 3
 note: pre-commit-able
 order: 4
-owner:
-pr:
+owner: loop/gitleaks
+pr: 180
 title: Secret scanning — <code>gitleaks</code> + push protection
 ---
 Scan the full history and every PR diff for leaked tokens, keys and

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.157}/docs/roadmap/items/shift-left-gate-pre-commit-pre-commit-ci.md

@@ -2,15 +2,15 @@
 id: shift-left-gate-pre-commit-pre-commit-ci
 board: code
 section: dx
-status: planned
+status: shipped
 category: DX · Infra
 complexity: S
 impact: High
 wow: 4
 note: auto-fix PRs
 order: 2
-owner:
-pr:
+owner: loop/pre-commit
+pr: 181
 title: Shift-left gate — <code>pre-commit</code> + pre-commit.ci
 ---
 A <code>.pre-commit-config.yaml</code> runs ruff, mypy, codespell and the

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.157}/docs/roadmap.html

@@ -987,7 +987,7 @@ harness.</p>
       </article>
 
       <article class="cap rcard">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · Secrets</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Security · Secrets</span></div>
         <h3>Secret scanning — <code>gitleaks</code> + push protection</h3>
         <p>Scan the full history and every PR diff for leaked tokens, keys and
            PyPI credentials with the free <code>gitleaks</code> action, paired
@@ -1325,7 +1325,7 @@ improvement is real (or isn't)."</p>
       </article>
 
       <article class="cap rcard">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">DX · Infra</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">DX · Infra</span></div>
         <h3>Shift-left gate — <code>pre-commit</code> + pre-commit.ci</h3>
         <p>A <code>.pre-commit-config.yaml</code> runs ruff, mypy, codespell and the
            whitespace fixers <em>before</em> code ever reaches CI, and the free-for-OSS

boost_skill_cli-1.0.157/tests/unit/test_gitleaks_config.py

@@ -0,0 +1,59 @@
+"""Unit test: .gitleaks.toml — the secret-scanning gate's configuration.
+
+Validates the config is well-formed and does what the CI gate relies on:
+extend the upstream default ruleset and allowlist boost's own synthetic
+secret-scanner fixtures (so the gate stays green on deliberate test data while
+still catching a real leak anywhere else).
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_CONFIG = Path(__file__).resolve().parents[2] / ".gitleaks.toml"
+
+pytestmark = [
+    pytest.mark.skipif(not _CONFIG.exists(),
+                       reason="repo-root .gitleaks.toml not reachable (e.g. mutation sandbox)"),
+    pytest.mark.skipif(sys.version_info < (3, 11),
+                       reason="tomllib is stdlib only on Python 3.11+"),
+]
+
+
+def _load():
+    import tomllib
+    with open(_CONFIG, "rb") as f:
+        return tomllib.load(f)
+
+
+def test_is_valid_toml():
+    assert isinstance(_load(), dict)
+
+
+def test_extends_the_default_ruleset():
+    # Without useDefault the config would replace, not extend, gitleaks' rules —
+    # silently disabling every built-in detector.
+    cfg = _load()
+    assert cfg.get("extend", {}).get("useDefault") is True
+
+
+def test_allowlists_the_secretscan_fixtures():
+    cfg = _load()
+    allowlists = cfg.get("allowlists") or ([cfg["allowlist"]] if "allowlist" in cfg else [])
+    paths = [p for al in allowlists for p in al.get("paths", [])]
+    assert any("test_secretscan" in p for p in paths), (
+        "the synthetic-secret fixture file must be allowlisted or the gate "
+        "reports boost's own test data as a leak")
+
+
+def test_allowlist_does_not_blanket_ignore_tests():
+    # A too-broad `tests/` allowlist would blind the scanner to a real secret
+    # committed in any other test file. Keep it scoped to the fixture file.
+    cfg = _load()
+    allowlists = cfg.get("allowlists") or ([cfg["allowlist"]] if "allowlist" in cfg else [])
+    paths = [p for al in allowlists for p in al.get("paths", [])]
+    for p in paths:
+        assert p.rstrip("$").rstrip("/") not in ("tests", "tests/", r"tests/.*", "tests"), \
+            "allowlist path %r is too broad — scope it to the fixture file" % p