boost-skill-cli 1.0.255__tar.gz → 1.0.257__tar.gz

boost_skill_cli-1.0.257/CODE_OF_CONDUCT.md

@@ -0,0 +1,129 @@
+# Contributor Covenant Code of Conduct
+
+## Our pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the maintainers privately through
+[GitHub's private reporting form](https://github.com/jonnyeclectic/boost/security/advisories/new).
+That form is labeled for security reports, but it is the only private channel
+this repository has, and conduct reports sent through it reach the same people.
+Public issues are **not** the place for a conduct report.
+
+All complaints will be reviewed and investigated promptly and fairly. All
+community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary ban
+
+**Community impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent ban
+
+**Community impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org),
+version 2.1, available at
+<https://www.contributor-covenant.org/version/2/1/code_of_conduct.html>.
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/inclusion).
+
+For answers to common questions about this code of conduct, see the FAQ at
+<https://www.contributor-covenant.org/faq>. Translations are available at
+<https://www.contributor-covenant.org/translations>.

{boost_skill_cli-1.0.255 → boost_skill_cli-1.0.257}/CONTRIBUTING.md

@@ -97,6 +97,12 @@ list, and neither should be added to it.
 | `refurb boost_cli` | modernization smells the ruff families miss, zero findings |
 | `scripts/lock_toolchain.py --check` | the hash-pinned toolchain matches its `.in` declarations |
 
+## Code of conduct
+
+Participation is governed by the [Code of Conduct](CODE_OF_CONDUCT.md)
+(Contributor Covenant 2.1). Conduct reports go through the private reporting
+form linked there, never a public issue.
+
 ## Ground rules
 
 - **Stdlib only** at runtime. No third-party imports in `boost_cli/`.
@@ -147,6 +153,10 @@ also keeps line-adjacent conflicts rare.
 Branch from `main`, keep PRs focused, and write the PR description in the
 commit message (it becomes the release notes via release-drafter).
 
+[`.github/PULL_REQUEST_TEMPLATE.md`](.github/PULL_REQUEST_TEMPLATE.md)
+pre-fills the checklist — chiefly `make check` and the generated-file
+regeneration, which are the two things that most often send a PR back.
+
 ## Release safety — require branches be up to date
 
 Every merge to `main` cuts a PyPI release, and two PRs that are each green in

{boost_skill_cli-1.0.255 → boost_skill_cli-1.0.257}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.255
+Version: 1.0.257
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.255 → boost_skill_cli-1.0.257}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.255'
-__version_tuple__ = version_tuple = (1, 0, 255)
+__version__ = version = '1.0.257'
+__version_tuple__ = version_tuple = (1, 0, 257)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.255 → boost_skill_cli-1.0.257}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.255
+Version: 1.0.257
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.255 → boost_skill_cli-1.0.257}/boost_skill_cli.egg-info/SOURCES.txt

@@ -9,6 +9,7 @@
 .stylelintrc.json
 .vale.ini
 CLAUDE.md
+CODE_OF_CONDUCT.md
 CONTRIBUTING.md
 LICENSE
 MANIFEST.in
@@ -428,9 +429,11 @@ tests/unit/test_check_anchors.py
 tests/unit/test_claude_settings.py
 tests/unit/test_cliparse.py
 tests/unit/test_command_reference_fresh.py
+tests/unit/test_community_health_files.py
 tests/unit/test_config.py
 tests/unit/test_dense.py
 tests/unit/test_dense_fallback.py
+tests/unit/test_dependabot_config.py
 tests/unit/test_docs_pages_linked.py
 tests/unit/test_docsite_chrome.py
 tests/unit/test_ed25519.py

{boost_skill_cli-1.0.255 → boost_skill_cli-1.0.257}/setup.cfg

@@ -10,6 +10,8 @@ also_copy =
 	index.html
 	README.md
 	.github/
+	CONTRIBUTING.md
+	CODE_OF_CONDUCT.md
 
 [egg_info]
 tag_build = 

boost_skill_cli-1.0.257/tests/unit/test_community_health_files.py

@@ -0,0 +1,90 @@
+"""Unit test: the GitHub community-health files exist and are wired up.
+
+A malformed issue form does not error anywhere a human will see — GitHub just
+silently falls back to a blank issue, and the template quietly stops existing.
+Same for a PR template GitHub cannot find because it was moved. These are the
+cheap structural checks that catch that class of breakage.
+
+Read by hand rather than with PyYAML, which is not a dependency of this repo;
+``scripts/check_required_checks.py`` sets the same precedent for workflow YAML.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[2]
+TEMPLATES = ROOT / ".github" / "ISSUE_TEMPLATE"
+
+pytestmark = pytest.mark.skipif(
+    not (ROOT / ".github").is_dir(),
+    reason="repo-root .github not reachable (e.g. mutation sandbox)")
+
+# The set GitHub actually renders. A typo here ("textbox", "check") is accepted
+# by no parser and reported by nothing — the field just vanishes from the form.
+FIELD_TYPES = {"markdown", "input", "textarea", "dropdown", "checkboxes"}
+
+FORMS = ["bug_report.yml", "feature_request.yml"]
+
+
+def form_text(name: str) -> str:
+    return (TEMPLATES / name).read_text(encoding="utf-8")
+
+
+@pytest.mark.parametrize("name", FORMS)
+def test_each_issue_form_exists_and_is_named(name):
+    text = form_text(name)
+    # GitHub requires both at the top level; without them the file is ignored.
+    assert re.search(r"^name:\s*\S", text, re.M), "%s has no name:" % name
+    assert re.search(r"^description:\s*\S", text, re.M), "%s has no description:" % name
+    assert re.search(r"^body:\s*$", text, re.M), "%s has no body:" % name
+
+
+@pytest.mark.parametrize("name", FORMS)
+def test_every_field_declares_a_type_github_renders(name):
+    types = re.findall(r"^  - type:\s*(\S+)\s*$", form_text(name), re.M)
+    assert types, "%s declares no fields" % name
+    assert set(types) <= FIELD_TYPES, "unknown field type in %s: %s" % (
+        name, sorted(set(types) - FIELD_TYPES))
+
+
+@pytest.mark.parametrize("name", FORMS)
+def test_field_ids_are_unique(name):
+    # Duplicate ids make GitHub drop one of the fields, silently.
+    ids = re.findall(r"^    id:\s*(\S+)\s*$", form_text(name), re.M)
+    assert len(ids) == len(set(ids)), "duplicate field id in %s" % name
+
+
+def test_the_bug_form_asks_for_the_diagnostics_that_make_a_bug_reproducible():
+    # The whole point of the form over a blank issue: `boost doctor` and the
+    # exact command are required, so triage does not start with two questions.
+    text = form_text("bug_report.yml")
+    assert "boost doctor" in text
+    assert "boost log --crashes" in text
+    assert text.count("required: true") >= 4
+
+
+def test_security_reports_are_routed_away_from_public_issues():
+    advisory = "security/advisories/new"
+    assert advisory in form_text("bug_report.yml"), \
+        "the bug form must say where a vulnerability goes instead"
+    assert advisory in (TEMPLATES / "config.yml").read_text(encoding="utf-8")
+
+
+def test_the_pr_template_is_where_github_looks_for_it():
+    template = ROOT / ".github" / "PULL_REQUEST_TEMPLATE.md"
+    assert template.is_file(), "GitHub only auto-fills from this exact path"
+    text = template.read_text(encoding="utf-8")
+    assert "make check" in text
+    # The generated-file checklist is the item that most often sends a PR back.
+    for generated in ("build_roadmap.py", "build_command_reference.py",
+                      "build_registries.py"):
+        assert generated in text
+
+
+def test_the_code_of_conduct_is_linked_from_contributing():
+    assert (ROOT / "CODE_OF_CONDUCT.md").is_file()
+    assert "CODE_OF_CONDUCT.md" in (ROOT / "CONTRIBUTING.md").read_text(
+        encoding="utf-8"), "an unlinked code of conduct is one nobody reads"

boost_skill_cli-1.0.257/tests/unit/test_dependabot_config.py

@@ -0,0 +1,106 @@
+"""Unit test: .github/dependabot.yml — what actually gets bump PRs.
+
+Dependabot only scans manifests under an entry's declared ``directory``, so
+"we have a pip entry" says nothing about which manifests are covered. This
+pins the two that matter (``/requirements`` for the hash-pinned toolchain, ``/``
+for ``pyproject.toml``'s extras) and ties the root entry's ignore list to the
+version ceilings pyproject actually sets — so lifting a ceiling and leaving a
+stale ignore behind fails here rather than silently costing us the bump PRs.
+
+Read by hand rather than with a YAML parser: PyYAML is not a dependency of this
+repo, and ``scripts/check_required_checks.py`` sets the same precedent for
+workflow YAML.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[2]
+CONFIG = ROOT / ".github" / "dependabot.yml"
+PYPROJECT = ROOT / "pyproject.toml"
+
+pytestmark = pytest.mark.skipif(
+    not CONFIG.exists(),
+    reason="repo-root .github/dependabot.yml not reachable (e.g. mutation sandbox)")
+
+_ENTRY = re.compile(r"^  - package-ecosystem:\s*(\S+)\s*$")
+_FIELD = re.compile(r"^    (\w[\w-]*):\s*(\S*)\s*$")
+_IGNORE = re.compile(r"^      - dependency-name:\s*(\S+)\s*$")
+
+
+def entries():
+    """[(ecosystem, directory, [ignored dependency names])] in file order."""
+    out = []
+    for line in CONFIG.read_text(encoding="utf-8").splitlines():
+        m = _ENTRY.match(line)
+        if m:
+            out.append((m.group(1), None, []))
+            continue
+        if not out:
+            continue
+        eco, _directory, ignored = out[-1]
+        m = _FIELD.match(line)
+        if m and m.group(1) == "directory":
+            out[-1] = (eco, m.group(2), ignored)
+            continue
+        m = _IGNORE.match(line)
+        if m:
+            ignored.append(m.group(1))
+    return out
+
+
+def pip_entry(directory: str):
+    matches = [e for e in entries() if e[0] == "pip" and e[1] == directory]
+    assert len(matches) == 1, "expected exactly one pip entry for %r" % directory
+    return matches[0]
+
+
+def test_every_entry_declares_a_directory():
+    # An entry with no directory silently defaults to /, which would make one
+    # of these a duplicate of another rather than the coverage it looks like.
+    assert entries(), "no update entries parsed — has the file's shape changed?"
+    for eco, directory, _ignored in entries():
+        assert directory, "%s entry has no directory" % eco
+
+
+def test_the_pinned_toolchain_is_covered():
+    # requirements/*.txt are hash-pinned; a pin with no update path is only
+    # half the job, so this entry is what stops the lock silently rotting.
+    assert pip_entry("/requirements")[1] == "/requirements"
+
+
+def test_pyprojects_extras_are_covered():
+    # The bug this file was added for: only /requirements was declared, so
+    # pyproject.toml at the repo root was never scanned and [rag]/[bdd]/[perf]
+    # got no proactive bumps at all — only reactive pip-audit CVE flags.
+    assert pip_entry("/")[1] == "/"
+
+
+def test_the_actions_workflows_are_covered():
+    assert [e for e in entries() if e[0] == "github-actions"], \
+        "workflow action versions are a supply-chain surface too"
+
+
+@pytest.mark.skipif(sys.version_info < (3, 11),
+                    reason="tomllib is stdlib only on Python 3.11+")
+def test_the_root_ignore_list_matches_the_ceilings_pyproject_sets():
+    """Ignore exactly the packages pyproject deliberately holds back.
+
+    ragas 0.2.x hard-imports a ChatVertexAI path that langchain>=1.0 removed,
+    so the [eval] stack carries upper bounds and a bump PR there cannot be
+    merged. Ignoring them is why declaring ``directory: /`` is safe at all.
+    Anything held back but *not* ignored raises unmergeable PRs; anything
+    ignored but no longer held back silently costs us a bump we could take.
+    """
+    import tomllib
+
+    with open(PYPROJECT, "rb") as f:
+        extras = tomllib.load(f)["project"]["optional-dependencies"]
+    held_back = {re.split(r"[<>=!~\[]", req, maxsplit=1)[0].strip()
+                 for reqs in extras.values() for req in reqs if "<" in req}
+    assert held_back, "no upper bounds left in pyproject — drop the ignores"
+    assert set(pip_entry("/")[2]) == held_back