codegraph-brain 0.7.2__tar.gz → 0.7.3__tar.gz

{codegraph_brain-0.7.2 → codegraph_brain-0.7.3}/.github/workflows/ci.yml

@@ -19,6 +19,11 @@ jobs:
         with:
           enable-cache: true
 
+      - name: Lockfile in step with pyproject
+        # MUST run before `uv sync`: sync silently re-resolves and rewrites
+        # uv.lock, so a check placed after it would always pass.
+        run: uv lock --check
+
       - name: Install Dependencies
         run: uv sync --group dev
 

codegraph_brain-0.7.3/.github/workflows/release-please.yml

@@ -0,0 +1,147 @@
+name: Release Please
+
+on:
+  push:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  release-please:
+    name: Release Please
+    runs-on: ubuntu-latest
+    permissions:
+      # Scoped to this job only: the publish job below must never inherit
+      # write access to the repository.
+      contents: write
+      pull-requests: write
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+      release_pr: ${{ steps.release.outputs.pr }}
+    steps:
+      - name: Mint a GitHub App token
+        id: app-token
+        # A GITHUB_TOKEN-authored PR leaves its checks parked in
+        # `action_required` forever, so release-please needs an identity of its
+        # own. App tokens beat a PAT: one hour of life, auto-rotated, scoped to
+        # this repo, and not tied to anyone's personal account.
+        # continue-on-error: an unconfigured App must degrade, not break the release.
+        continue-on-error: true
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
+        with:
+          # Accepted from either store: the App ID is not sensitive, so a repo
+          # variable is conventional, but it is commonly filed as a secret.
+          app-id: ${{ vars.CGIS_APP_ID || secrets.CGIS_APP_ID }}
+          private-key: ${{ secrets.CGIS_APP_PRIVATE_KEY }}
+
+      - name: Run release-please
+        id: release
+        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071  # v4.4.1
+        with:
+          # Falls back to GITHUB_TOKEN when the App is not configured — the
+          # release still opens, its checks just need a manual nudge.
+          token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  relock:
+    name: Re-lock the release PR
+    needs: release-please
+    # Only when release-please actually has an open release PR to amend.
+    if: needs.release-please.outputs.release_pr != ''
+    runs-on: ubuntu-latest
+    permissions:
+      # Narrower than the release job: this one only pushes a lockfile.
+      contents: write
+    steps:
+      - name: Mint a GitHub App token
+        id: app-token
+        # A GITHUB_TOKEN-authored PR leaves its checks parked in
+        # `action_required` forever, so release-please needs an identity of its
+        # own. App tokens beat a PAT: one hour of life, auto-rotated, scoped to
+        # this repo, and not tied to anyone's personal account.
+        # continue-on-error: an unconfigured App must degrade, not break the release.
+        continue-on-error: true
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
+        with:
+          # Accepted from either store: the App ID is not sensitive, so a repo
+          # variable is conventional, but it is commonly filed as a secret.
+          app-id: ${{ vars.CGIS_APP_ID || secrets.CGIS_APP_ID }}
+          private-key: ${{ secrets.CGIS_APP_PRIVATE_KEY }}
+
+      - name: Checkout the release branch
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          ref: ${{ fromJSON(needs.release-please.outputs.release_pr).headBranchName }}
+          token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
+        with:
+          enable-cache: true
+
+      - name: Re-lock and push if the version moved
+        run: |
+          set -euo pipefail
+          # release-please bumps pyproject.toml but never re-resolves uv.lock, so
+          # the lockfile's own version entry falls a release behind and the CI
+          # `uv lock --check` gate fails on every release PR (#303).
+          uv lock
+          if git diff --quiet -- uv.lock; then
+            echo "uv.lock already in step with pyproject.toml"
+            exit 0
+          fi
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add uv.lock
+          git commit -m "chore: re-lock uv.lock for the release"
+          git push
+
+  publish:
+    name: Publish to PyPI
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/codegraph-brain
+    permissions:
+      # Mints the short-lived OIDC token PyPI exchanges for an upload token.
+      # This is the whole point of trusted publishing: no API token in secrets.
+      id-token: write
+      # Lets the publish action attach PEP 740 provenance attestations.
+      attestations: write
+      contents: read
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
+        with:
+          enable-cache: true
+
+      - name: Build sdist and wheel
+        run: uv build
+
+      - name: Verify metadata
+        # Pinned and wheel-only: this job holds publish rights, so the tooling
+        # it pulls in must not be a floating version that can run setup scripts.
+        run: uvx --no-build --from "twine==7.0.0" twine check dist/*
+
+      - name: Verify version matches the tag
+        env:
+          TAG_NAME: ${{ needs.release-please.outputs.tag_name }}
+        run: |
+          set -euo pipefail
+          built=$(ls dist/*.whl | sed -E 's/.*-([0-9][^-]*)-py3.*/\1/')
+          echo "tag=$TAG_NAME built=$built"
+          case "$TAG_NAME" in
+            *"$built") ;;
+            *) echo "::error::tag $TAG_NAME does not match built version $built"; exit 1 ;;
+          esac
+
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2

codegraph_brain-0.7.3/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.7.3"
+}

{codegraph_brain-0.7.2 → codegraph_brain-0.7.3}/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.7.3](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.7.2...codegraph-brain-v0.7.3) (2026-07-31)
+
+
+### Bug Fixes
+
+* **assets:** drop the argv-driven output path from the avatar generator ([#308](https://github.com/zaebee/codegraph-brain/issues/308)) ([d118074](https://github.com/zaebee/codegraph-brain/commit/d118074a6b2137f789b4978f870f5496ee1135b5))
+* **ci:** read the App ID from a secret as well as a variable ([#306](https://github.com/zaebee/codegraph-brain/issues/306)) ([90513bc](https://github.com/zaebee/codegraph-brain/commit/90513bc3f588241848fd7404f9be5b6479a72293))
+
 ## [0.7.2](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.7.1...codegraph-brain-v0.7.2) (2026-07-31)
 
 

{codegraph_brain-0.7.2 → codegraph_brain-0.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codegraph-brain
-Version: 0.7.2
+Version: 0.7.3
 Summary: Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP.
 Project-URL: Homepage, https://github.com/zaebee/codegraph-brain
 Project-URL: Repository, https://github.com/zaebee/codegraph-brain

codegraph_brain-0.7.3/docs/assets/.gitignore

@@ -0,0 +1 @@
+_variants/

codegraph_brain-0.7.3/docs/assets/cgis-app-avatar.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" width="200" height="200"><rect width="200" height="200" rx="44" fill="#0d1526"/><line x1="113.2" y1="55.7" x2="142.8" y2="86.3" stroke="#64748b" stroke-width="8" stroke-linecap="round"/><line x1="142.8" y1="113.7" x2="113.2" y2="144.3" stroke="#64748b" stroke-width="8" stroke-linecap="round"/><line x1="86.8" y1="55.7" x2="57.2" y2="86.3" stroke="#fbbf24" stroke-width="9" stroke-linecap="round"/><line x1="57.2" y1="113.7" x2="86.8" y2="144.3" stroke="#fbbf24" stroke-width="9" stroke-linecap="round"/><circle cx="100" cy="42" r="18" fill="#22d3ee"/><circle cx="44" cy="100" r="18" fill="#fbbf24"/><circle cx="156" cy="100" r="18" fill="#a78bfa"/><circle cx="100" cy="158" r="18" fill="#22d3ee"/></svg>

codegraph_brain-0.7.3/docs/assets/generate_avatar.py

@@ -0,0 +1,123 @@
+"""Generate the cgis GitHub App avatar.
+
+Ships `v3-lit-path` as `cgis-app-avatar.png`; the other two are kept so the
+alternatives are on the record rather than lost in a chat log.
+
+The motif comes from the domain rather than decoration: cgis's drift alphabet is
+built on directed triads (`_TRICODES` / `TRIAD_ORDER`), so the glyphs are actual
+triad shapes — 021D (diverging) and the layered_dag ideal.
+
+No arrowheads. SVG markers scale by stroke-width by default (a 4.5-unit head at
+stroke 9 renders as a 40-unit blob), and even sized correctly an arrowhead is
+mush at the 40px a bot avatar occupies in a PR thread. Hierarchy is carried by
+node size and colour instead.
+
+Rendered at 400px for upload and 40px to check legibility at comment size.
+"""
+
+import pathlib
+
+import cairosvg
+
+BG = "#0d1526"
+EDGE = "#64748b"
+CYAN = "#22d3ee"
+VIOLET = "#a78bfa"
+AMBER = "#fbbf24"
+
+HEAD = (
+    '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" width="200" height="200">'
+    f'<rect width="200" height="200" rx="44" fill="{BG}"/>'
+)
+TAIL = "</svg>"
+
+
+def edge(
+    p1: tuple[float, float], p2: tuple[float, float], *, colour: str = EDGE, w: float = 8
+) -> str:
+    """A graph edge, trimmed at both ends so it meets the node rims cleanly."""
+    (x1, y1), (x2, y2) = p1, p2
+    dx, dy = x2 - x1, y2 - y1
+    length = (dx * dx + dy * dy) ** 0.5
+    ux, uy = dx / length, dy / length
+    pad = 19
+    return (
+        f'<line x1="{x1 + ux * pad:.1f}" y1="{y1 + uy * pad:.1f}" '
+        f'x2="{x2 - ux * pad:.1f}" y2="{y2 - uy * pad:.1f}" '
+        f'stroke="{colour}" stroke-width="{w}" stroke-linecap="round"/>'
+    )
+
+
+def node(p: tuple[float, float], colour: str, r: float = 18) -> str:
+    """A graph node."""
+    return f'<circle cx="{p[0]}" cy="{p[1]}" r="{r}" fill="{colour}"/>'
+
+
+TOP, LEFT, RIGHT, BOTTOM = (100, 42), (44, 100), (156, 100), (100, 158)
+
+# 1. layered_dag — diverge at the top, converge at the bottom.
+v1 = (
+    HEAD
+    + edge(TOP, LEFT)
+    + edge(TOP, RIGHT)
+    + edge(LEFT, BOTTOM)
+    + edge(RIGHT, BOTTOM)
+    + node(TOP, CYAN)
+    + node(LEFT, VIOLET)
+    + node(RIGHT, VIOLET)
+    + node(BOTTOM, CYAN)
+    + TAIL
+)
+
+# 2. 021D on its own — fewest strokes, best legibility at 40px.
+T2, BL2, BR2 = (100, 54), (48, 144), (152, 144)
+v2 = (
+    HEAD
+    + edge(T2, BL2, w=9)
+    + edge(T2, BR2, w=9)
+    + node(T2, CYAN, 21)
+    + node(BL2, VIOLET, 21)
+    + node(BR2, VIOLET, 21)
+    + TAIL
+)
+
+# 3. layered_dag with one path lit — structure, plus the analysis laid over it.
+v3 = (
+    HEAD
+    + edge(TOP, RIGHT)
+    + edge(RIGHT, BOTTOM)
+    + edge(TOP, LEFT, colour=AMBER, w=9)
+    + edge(LEFT, BOTTOM, colour=AMBER, w=9)
+    + node(TOP, CYAN)
+    + node(LEFT, AMBER)
+    + node(RIGHT, VIOLET)
+    + node(BOTTOM, CYAN)
+    + TAIL
+)
+
+HERE = pathlib.Path(__file__).parent
+# Variants land in a gitignored scratch dir; only the chosen one is versioned,
+# so re-running this never litters docs/assets.
+VARIANTS = HERE / "_variants"
+VARIANTS.mkdir(parents=True, exist_ok=True)
+
+CHOSEN = "v3-lit-path"
+
+for name, svg in (("v1-layered-dag", v1), ("v2-fanout", v2), ("v3-lit-path", v3)):
+    (VARIANTS / f"{name}.svg").write_text(svg)
+    for px in (400, 40):
+        cairosvg.svg2png(
+            bytestring=svg.encode(),
+            write_to=str(VARIANTS / f"{name}-{px}.png"),
+            output_width=px,
+            output_height=px,
+        )
+    if name == CHOSEN:
+        (HERE / "cgis-app-avatar.svg").write_text(svg)
+        cairosvg.svg2png(
+            bytestring=svg.encode(),
+            write_to=str(HERE / "cgis-app-avatar.png"),
+            output_width=400,
+            output_height=400,
+        )
+    print(f"rendered {name}" + ("  <- shipped as cgis-app-avatar.*" if name == CHOSEN else ""))

{codegraph_brain-0.7.2 → codegraph_brain-0.7.3}/pyproject.toml

@@ -7,7 +7,7 @@ packages = ["src/cgis"]
 
 [project]
 name = "codegraph-brain"
-version = "0.7.2"
+version = "0.7.3"
 description = "Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP."
 readme = "README.md"
 requires-python = ">=3.12"

{codegraph_brain-0.7.2 → codegraph_brain-0.7.3}/uv.lock

@@ -261,7 +261,7 @@ wheels = [
 
 [[package]]
 name = "codegraph-brain"
-version = "0.7.1"
+version = "0.7.3"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },
@@ -1246,7 +1246,7 @@ name = "pexpect"
 version = "4.9.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "ptyprocess", marker = "python_full_version < '3.13' or python_full_version >= '3.15' or sys_platform != 'win32'" },
+    { name = "ptyprocess" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/42/92/cc564bf6381ff43ce1f4d06852fc19a2f11d180f23dc32d9588bee2f149d/pexpect-4.9.0.tar.gz", hash = "sha256:ee7d41123f3c9911050ea2c2dac107568dc43b2d3b0c7557a33212c398ead30f", size = 166450, upload-time = "2023-11-25T09:07:26.339Z" }
 wheels = [

codegraph_brain-0.7.2/.github/workflows/release-please.yml

@@ -1,76 +0,0 @@
-name: Release Please
-
-on:
-  push:
-    branches: [ main ]
-  workflow_dispatch:
-
-jobs:
-  release-please:
-    name: Release Please
-    runs-on: ubuntu-latest
-    permissions:
-      # Scoped to this job only: the publish job below must never inherit
-      # write access to the repository.
-      contents: write
-      pull-requests: write
-    outputs:
-      release_created: ${{ steps.release.outputs.release_created }}
-      tag_name: ${{ steps.release.outputs.tag_name }}
-    steps:
-      - name: Run release-please
-        id: release
-        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071  # v4.4.1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          config-file: release-please-config.json
-          manifest-file: .release-please-manifest.json
-
-  publish:
-    name: Publish to PyPI
-    needs: release-please
-    if: needs.release-please.outputs.release_created == 'true'
-    runs-on: ubuntu-latest
-    environment:
-      name: pypi
-      url: https://pypi.org/p/codegraph-brain
-    permissions:
-      # Mints the short-lived OIDC token PyPI exchanges for an upload token.
-      # This is the whole point of trusted publishing: no API token in secrets.
-      id-token: write
-      # Lets the publish action attach PEP 740 provenance attestations.
-      attestations: write
-      contents: read
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
-        with:
-          ref: ${{ needs.release-please.outputs.tag_name }}
-
-      - name: Setup uv
-        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
-        with:
-          enable-cache: true
-
-      - name: Build sdist and wheel
-        run: uv build
-
-      - name: Verify metadata
-        # Pinned and wheel-only: this job holds publish rights, so the tooling
-        # it pulls in must not be a floating version that can run setup scripts.
-        run: uvx --no-build --from "twine==7.0.0" twine check dist/*
-
-      - name: Verify version matches the tag
-        env:
-          TAG_NAME: ${{ needs.release-please.outputs.tag_name }}
-        run: |
-          set -euo pipefail
-          built=$(ls dist/*.whl | sed -E 's/.*-([0-9][^-]*)-py3.*/\1/')
-          echo "tag=$TAG_NAME built=$built"
-          case "$TAG_NAME" in
-            *"$built") ;;
-            *) echo "::error::tag $TAG_NAME does not match built version $built"; exit 1 ;;
-          esac
-
-      - name: Publish
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2

codegraph_brain-0.7.2/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.7.2"
-}