coderio 0.4.0__tar.gz

coderio-0.4.0/.github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+updates:
+  # Python dependencies — checks pyproject.toml for updates
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "deps"
+    # Group minor/patch updates to reduce PR noise
+    groups:
+      minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # GitHub Actions — keeps workflow action versions current
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "ci"
+    commit-message:
+      prefix: "ci"

coderio-0.4.0/.github/workflows/ci.yml

@@ -0,0 +1,100 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install ruff
+        run: pip install "ruff>=0.16"
+      - name: Ruff check (lint)
+        run: ruff check src tests
+      - name: Ruff format check
+        # --check only verifies, doesn't modify files. Fails if any file
+        # isn't formatted — catches "forgot to format" in PRs.
+        run: ruff format --check src tests
+
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python-version: ["3.11", "3.12"]
+
+    env:
+      # Windows runners default to cp1252; Rich/Textual output contains CJK
+      # text (Chinese UI strings) that charmap can't encode. Force UTF-8 so
+      # `coderio --help` and subprocess-based tests don't crash with
+      # UnicodeEncodeError on windows-latest.
+      PYTHONIOENCODING: utf-8
+      PYTHONUTF8: "1"
+
+    steps:
+      - uses: actions/checkout@v7
+
+      # uv replaces pip for dependency installation (2026-08-14 migration).
+      # uv.lock is a first-class lockfile for both uv and Dependabot: CI gets
+      # fully reproducible installs (P1-4), while Dependabot updates pyproject
+      # constraints AND regenerates uv.lock in its PRs — the two mechanisms
+      # cooperate instead of fighting (the bare requirements-dev.txt approach
+      # had Dependabot produce internally-inconsistent updates; see PR #6).
+      - uses: astral-sh/setup-uv@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+
+      - name: Install dependencies (locked)
+        # --frozen: install EXACTLY what uv.lock pins; error if the lock is
+        # out of sync with pyproject.toml (forces committing both together).
+        # --extra dev: the dev dependency group (pytest/ruff/mypy/build).
+        run: uv sync --frozen --extra dev
+
+      - name: Check dependency consistency
+        # uv-managed venvs ship WITHOUT the pip module (uv manages installs
+        # itself), so `python -m pip check` fails there. `uv pip check` reads
+        # the same installed-package metadata via uv's own interface.
+        run: uv pip check
+
+      - name: Audit dependencies for known vulnerabilities
+        # Scans installed packages against the PyPI advisory database.
+        # Non-blocking (continue-on-error) — reports issues without failing CI.
+        shell: bash
+        continue-on-error: true
+        run: |
+          uv pip install pip-audit
+          uv run pip-audit
+
+      - name: Run tests with coverage
+        # Enforces a coverage floor so coverage can't silently regress.
+        # The 70% floor is conservative (current baseline is ~75%) — it catches
+        # gross regressions (a module losing its tests) without failing on
+        # minor fluctuations. pyproject.toml's [tool.coverage.report]
+        # fail_under=60 is the local-dev default; CI enforces the stricter 70%.
+        shell: bash
+        run: |
+          uv run python -m pytest -q --cov=coderio --cov-report=term-missing --cov-fail-under=70
+
+      - name: Type check (mypy)
+        # HARD GATE for clean modules. pyproject.toml's [[tool.mypy.overrides]]
+        # lists modules with known type issues (ignore_errors=true) — each is a
+        # tracked cleanup TODO. Modules NOT in that list must stay type-clean,
+        # so new type errors in clean code fail CI.
+        shell: bash
+        run: |
+          uv run python -m mypy src/coderio
+
+      - name: Build wheel (smoke)
+        shell: bash
+        run: |
+          uv build --wheel -o /tmp/wheel-test
+          echo "Wheel built successfully"

coderio-0.4.0/.github/workflows/release.yml

@@ -0,0 +1,122 @@
+name: Release
+
+# Triggered by pushing a tag like v0.4.0. Builds wheel + sdist, runs the test
+# suite, verifies both artifacts in a clean venv, publishes to PyPI (Trusted
+# Publishing, no token) and attaches both to a GitHub Release.
+#
+# To cut a release:
+#   git tag v0.4.0
+#   git push origin v0.4.0
+#
+# PyPI publishing uses Trusted Publishing (OIDC). One-time setup (repo owner):
+#   pypi.org → Account settings → Publishing → Add a new pending publisher:
+#     PyPI project name: coderio
+#     Owner: Lion-1209 / Repository: coderio
+#     Workflow name: release.yml / Environment: pypi
+#   Then create the "pypi" environment in the repo (Settings → Environments).
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write  # needed to create the release + upload assets
+
+jobs:
+  # Test gate: a tag is a release — it must not ship broken code. The CI
+  # workflow covers pushes/PRs, but a tag could be cut from a commit that
+  # predates a fix; this gate makes the release itself fail loudly instead.
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - name: Run test suite
+        run: |
+          uv sync --frozen --extra dev
+          uv run python -m pytest -q
+
+  release:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Build wheel + sdist
+        run: |
+          pip install build
+          python -m build
+
+      - name: Verify wheel in clean venv (full deps)
+        # Install the wheel WITH all dependencies (not --no-deps) to verify
+        # the full user install path. Then run --help + import the deepagents
+        # engine + verify bundled skills. This catches missing deps that the
+        # old --no-deps + manual 5-package approach missed.
+        run: |
+          python -m venv /tmp/wheel-test-venv
+          /tmp/wheel-test-venv/bin/pip install dist/*.whl
+          /tmp/wheel-test-venv/bin/coderio --help
+          /tmp/wheel-test-venv/bin/coderio run --help
+          # Verify the deepagents engine imports (the production path).
+          /tmp/wheel-test-venv/bin/python -c "
+          from coderio.agent.deep_loop import run_deep_agent
+          from coderio.agent.harness_middleware import HarnessMiddleware
+          from coderio.agent.permission_middleware import PermissionMiddleware
+          from coderio.cli.tui import CoderioTUI
+          print('deepagents engine imports OK')
+          "
+          # Verify bundled skills are importable from the installed package.
+          /tmp/wheel-test-venv/bin/python -c "
+          from coderio.skills.store import load_skill_store
+          from pathlib import Path
+          import coderio
+          pkg = Path(coderio.__file__).parent / 'skills'
+          store = load_skill_store(pkg, 0, None)
+          assert len(store.names()) > 0, 'no bundled skills found'
+          print(f'{len(store.names())} bundled skills OK')
+          "
+
+      - name: Verify sdist installs
+        # sdist is the source-of-truth artifact; verify it installs and runs
+        # too (a broken sdist — missing files, bad metadata — only shows up
+        # at install time).
+        run: |
+          python -m venv /tmp/sdist-test-venv
+          /tmp/sdist-test-venv/bin/pip install dist/*.tar.gz
+          /tmp/sdist-test-venv/bin/coderio --help
+
+      - name: Create GitHub Release + attach artifacts
+        uses: softprops/action-gh-release@v3
+        with:
+          generate_release_notes: true
+          files: dist/*.whl dist/*.tar.gz
+
+  publish-pypi:
+    # PyPI via Trusted Publishing (OIDC) — no API token to manage or leak.
+    # Requires the one-time pending-publisher setup described at the top.
+    needs: release
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write  # OIDC token for Trusted Publishing
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Build (same commit as the verified artifacts)
+        run: |
+          pip install build
+          python -m build
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true

coderio-0.4.0/.gitignore

@@ -0,0 +1,41 @@
+# OS
+.DS_Store
+Thumbs.db
+desktop.ini
+
+# IDE / Editor
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# Node
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Python
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+*.egg-info/
+build/
+dist/
+
+# Testing / linting
+.pytest_cache/
+.mypy_cache/
+.coverage
+coverage.xml
+htmlcov/
+
+# coderio user data (project-local layer)
+.coderio/
+
+# Misc
+*.log
+.tmp/
+tmp/
+.zcode/