codex-a2a 0.6.1__tar.gz → 0.6.2__tar.gz

{codex_a2a-0.6.1 → codex_a2a-0.6.2}/.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: CI
+name: Validation
 
 on:
   pull_request:
@@ -11,6 +11,7 @@ permissions:
 
 jobs:
   quality-gate:
+    name: Validation Baseline
     runs-on: ubuntu-latest
 
     steps:
@@ -34,6 +35,7 @@ jobs:
         run: bash ./scripts/validate_baseline.sh
 
   runtime-matrix:
+    name: Runtime Matrix (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false

codex_a2a-0.6.2/.github/workflows/dependency-health.yml

@@ -0,0 +1,32 @@
+name: Dependency Health
+
+on:
+  workflow_dispatch:
+  schedule:
+    # 03:00 UTC on day-of-month 1
+    - cron: "0 3 1 * *"
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-health:
+    name: Dependency Health Audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
+
+      - name: Run dependency health checks
+        run: bash ./scripts/dependency_health.sh

{codex_a2a-0.6.1 → codex_a2a-0.6.2}/.github/workflows/publish.yml

@@ -1,4 +1,4 @@
-name: Publish
+name: Release Publish
 
 on:
   push:
@@ -18,6 +18,7 @@ on:
 
 jobs:
   build_release_artifacts:
+    name: Build Release Artifacts
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -42,6 +43,17 @@ jobs:
         with:
           enable-cache: true
 
+      - name: Sync dependencies
+        run: uv sync --all-extras --frozen
+
+      - name: Export runtime requirements for vulnerability audit
+        run: >
+          uv export --format requirements.txt --no-dev --locked --no-emit-project
+          --output-file /tmp/runtime-requirements.txt >/dev/null
+
+      - name: Run runtime dependency vulnerability audit
+        run: uv run pip-audit --requirement /tmp/runtime-requirements.txt
+
       - name: Resolve release tag
         id: release_tag
         run: echo "tag=${RELEASE_TAG}" >> "$GITHUB_OUTPUT"
@@ -103,6 +115,7 @@ jobs:
           if-no-files-found: error
 
   publish_pypi:
+    name: Publish to PyPI
     runs-on: ubuntu-latest
     needs: build_release_artifacts
     if: github.event_name == 'push' || inputs.publish_to_pypi
@@ -120,6 +133,7 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
 
   publish_github_release:
+    name: Sync GitHub Release
     runs-on: ubuntu-latest
     needs:
       - build_release_artifacts

{codex_a2a-0.6.1 → codex_a2a-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-a2a
-Version: 0.6.1
+Version: 0.6.2
 Summary: Codex A2A runtime adapter
 Author: liujuanjuan1984@Intelligent-Internet
 License-Expression: Apache-2.0
@@ -24,15 +24,20 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: a2a-sdk==0.3.25
 Requires-Dist: aiosqlite<1.0,>=0.20
-Requires-Dist: fastapi<0.111,>=0.110
+Requires-Dist: fastapi<0.122,>=0.121
 Requires-Dist: httpx<0.29,>=0.28.1
+Requires-Dist: protobuf<7.0,>=6.33.5
+Requires-Dist: pyasn1<1.0,>=0.6.3
 Requires-Dist: pydantic<3.0,>=2.6
 Requires-Dist: pydantic-settings<3.0,>=2.2
+Requires-Dist: requests<3.0,>=2.33.0
 Requires-Dist: sqlalchemy<3.0,>=2.0
 Requires-Dist: sse-starlette<3.0,>=2.1
 Requires-Dist: uvicorn<0.30,>=0.29
 Provides-Extra: dev
+Requires-Dist: pip-audit<3.0,>=2.9; extra == "dev"
 Requires-Dist: pre-commit>=3.7; extra == "dev"
+Requires-Dist: pygments<3.0,>=2.20.0; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
 Requires-Dist: pytest-cov<8.0,>=5.0; extra == "dev"

{codex_a2a-0.6.1 → codex_a2a-0.6.2}/pyproject.toml

@@ -26,10 +26,13 @@ classifiers = [
 dependencies = [
     "a2a-sdk==0.3.25",
     "aiosqlite>=0.20,<1.0",
-    "fastapi>=0.110,<0.111",
+    "fastapi>=0.121,<0.122",
     "httpx>=0.28.1,<0.29",
+    "protobuf>=6.33.5,<7.0",
+    "pyasn1>=0.6.3,<1.0",
     "pydantic>=2.6,<3.0",
     "pydantic-settings>=2.2,<3.0",
+    "requests>=2.33.0,<3.0",
     "sqlalchemy>=2.0,<3.0",
     "sse-starlette>=2.1,<3.0",
     "uvicorn>=0.29,<0.30",
@@ -37,7 +40,9 @@ dependencies = [
 
 [project.optional-dependencies]
 dev = [
+    "pip-audit>=2.9,<3.0",
     "pre-commit>=3.7",
+    "pygments>=2.20.0,<3.0",
     "pytest>=8.0",
     "pytest-asyncio>=0.23",
     "pytest-cov>=5.0,<8.0",

{codex_a2a-0.6.1 → codex_a2a-0.6.2}/scripts/README.md

@@ -14,6 +14,7 @@ This document only explains the remaining repository-local maintainer scripts. U
 
 - [`scripts/validate_baseline.sh`](./validate_baseline.sh): run the default local validation baseline used by contributors and CI.
 - [`scripts/validate_runtime_matrix.sh`](./validate_runtime_matrix.sh): run the reduced runtime-only validation used by the multi-version CI matrix.
+- [`scripts/dependency_health.sh`](./dependency_health.sh): run the standalone dependency review flow (`sync`/`pip check`, outdated package listing, and dev vulnerability audit).
 - [`scripts/smoke_test_built_cli.sh`](./smoke_test_built_cli.sh): validate that a built wheel can be installed through `uv tool` and becomes healthy.
 - [`scripts/sync_codex_docs.sh`](./sync_codex_docs.sh): refresh local upstream Codex reference snapshots when maintainers need them.
 
@@ -27,5 +28,7 @@ The `Publish` workflow now separates build, PyPI publish, and GitHub Release syn
 
 ## Notes
 
+- `validate_baseline.sh` and `dependency_health.sh` intentionally remain separate entrypoints and share common prerequisites through [`health_common.sh`](./health_common.sh).
+- `validate_baseline.sh` now blocks on runtime dependency vulnerability audit, while `dependency_health.sh` remains focused on broader dependency review (`outdated` + dev audit).
 - End-user runtime startup does not use repository scripts. Prefer the published CLI command documented in [README.md](../README.md) and [docs/guide.md](../docs/guide.md).
 - Keep long-form documentation changes in `docs/` to avoid divergence.

codex_a2a-0.6.2/scripts/dependency_health.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Run the standalone dependency health checks used by the dedicated workflow.
+set -euo pipefail
+
+# shellcheck source=./health_common.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/health_common.sh"
+
+run_shared_repo_health_prerequisites "dependency-health"
+
+echo "[dependency-health] list outdated packages"
+uv pip list --outdated
+
+dev_requirements="$(mktemp)"
+trap 'rm -f "${dev_requirements}"' EXIT
+
+echo "[dependency-health] export dev extra requirements"
+uv export \
+  --format requirements.txt \
+  --extra dev \
+  --no-dev \
+  --locked \
+  --no-emit-project \
+  --output-file "${dev_requirements}" >/dev/null
+
+echo "[dependency-health] run dev dependency vulnerability audit"
+uv run pip-audit --requirement "${dev_requirements}"

codex_a2a-0.6.2/scripts/health_common.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Shared prerequisites for repository health-check scripts.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+run_shared_repo_health_prerequisites() {
+  local label="${1:-health}"
+
+  cd "$ROOT_DIR"
+
+  if ! command -v uv >/dev/null 2>&1; then
+    echo "uv not found in PATH" >&2
+    exit 1
+  fi
+
+  echo "[${label}] sync locked environment"
+  uv sync --all-extras --frozen
+
+  echo "[${label}] verify dependency compatibility"
+  uv pip check
+}

{codex_a2a-0.6.1 → codex_a2a-0.6.2}/scripts/validate_baseline.sh

@@ -11,6 +11,18 @@ uv run pre-commit run --all-files
 uv run mypy --config-file mypy.ini
 uv run pytest
 
+runtime_requirements="$(mktemp)"
+trap 'rm -f "${runtime_requirements}"' EXIT
+
+uv export \
+  --format requirements.txt \
+  --no-dev \
+  --locked \
+  --no-emit-project \
+  --output-file "${runtime_requirements}" >/dev/null
+
+uv run pip-audit --requirement "${runtime_requirements}"
+
 rm -f dist/codex_a2a-*.whl dist/codex_a2a-*.tar.gz
 build_warning_filters="ignore::UserWarning:vcs_versioning._backends._git,ignore::UserWarning:vcs_versioning.overrides"
 PYTHONWARNINGS="${build_warning_filters}${PYTHONWARNINGS:+,${PYTHONWARNINGS}}" uv build --no-sources

{codex_a2a-0.6.1 → codex_a2a-0.6.2}/src/codex_a2a.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-a2a
-Version: 0.6.1
+Version: 0.6.2
 Summary: Codex A2A runtime adapter
 Author: liujuanjuan1984@Intelligent-Internet
 License-Expression: Apache-2.0
@@ -24,15 +24,20 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: a2a-sdk==0.3.25
 Requires-Dist: aiosqlite<1.0,>=0.20
-Requires-Dist: fastapi<0.111,>=0.110
+Requires-Dist: fastapi<0.122,>=0.121
 Requires-Dist: httpx<0.29,>=0.28.1
+Requires-Dist: protobuf<7.0,>=6.33.5
+Requires-Dist: pyasn1<1.0,>=0.6.3
 Requires-Dist: pydantic<3.0,>=2.6
 Requires-Dist: pydantic-settings<3.0,>=2.2
+Requires-Dist: requests<3.0,>=2.33.0
 Requires-Dist: sqlalchemy<3.0,>=2.0
 Requires-Dist: sse-starlette<3.0,>=2.1
 Requires-Dist: uvicorn<0.30,>=0.29
 Provides-Extra: dev
+Requires-Dist: pip-audit<3.0,>=2.9; extra == "dev"
 Requires-Dist: pre-commit>=3.7; extra == "dev"
+Requires-Dist: pygments<3.0,>=2.20.0; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
 Requires-Dist: pytest-cov<8.0,>=5.0; extra == "dev"

{codex_a2a-0.6.1 → codex_a2a-0.6.2}/src/codex_a2a.egg-info/SOURCES.txt

@@ -10,6 +10,7 @@ mypy.ini
 pyproject.toml
 uv.lock
 .github/workflows/ci.yml
+.github/workflows/dependency-health.yml
 .github/workflows/publish.yml
 docs/architecture.md
 docs/compatibility.md
@@ -17,6 +18,8 @@ docs/extension-specifications.md
 docs/guide.md
 docs/maintainer-architecture.md
 scripts/README.md
+scripts/dependency_health.sh
+scripts/health_common.sh
 scripts/publish_github_release.sh
 scripts/smoke_test_built_cli.sh
 scripts/sync_codex_docs.sh
@@ -177,6 +180,8 @@ tests/parts/__init__.py
 tests/parts/test_text.py
 tests/profile/__init__.py
 tests/profile/test_profile.py
+tests/scripts/__init__.py
+tests/scripts/test_script_health_contract.py
 tests/server/__init__.py
 tests/server/test_agent_card.py
 tests/server/test_auth.py

{codex_a2a-0.6.1 → codex_a2a-0.6.2}/src/codex_a2a.egg-info/requires.txt

@@ -1,15 +1,20 @@
 a2a-sdk==0.3.25
 aiosqlite<1.0,>=0.20
-fastapi<0.111,>=0.110
+fastapi<0.122,>=0.121
 httpx<0.29,>=0.28.1
+protobuf<7.0,>=6.33.5
+pyasn1<1.0,>=0.6.3
 pydantic<3.0,>=2.6
 pydantic-settings<3.0,>=2.2
+requests<3.0,>=2.33.0
 sqlalchemy<3.0,>=2.0
 sse-starlette<3.0,>=2.1
 uvicorn<0.30,>=0.29
 
 [dev]
+pip-audit<3.0,>=2.9
 pre-commit>=3.7
+pygments<3.0,>=2.20.0
 pytest>=8.0
 pytest-asyncio>=0.23
 pytest-cov<8.0,>=5.0

{codex_a2a-0.6.1 → codex_a2a-0.6.2}/tests/package/test_release_distribution_contract.py

@@ -8,7 +8,9 @@ CONTRIBUTING_TEXT = Path("CONTRIBUTING.md").read_text()
 SECURITY_TEXT = Path("SECURITY.md").read_text()
 SCRIPTS_README_TEXT = Path("scripts/README.md").read_text()
 CI_WORKFLOW_TEXT = Path(".github/workflows/ci.yml").read_text()
+DEPENDENCY_HEALTH_WORKFLOW_TEXT = Path(".github/workflows/dependency-health.yml").read_text()
 PUBLISH_WORKFLOW_TEXT = Path(".github/workflows/publish.yml").read_text()
+DEPENDENCY_HEALTH_SCRIPT_TEXT = Path("scripts/dependency_health.sh").read_text()
 SMOKE_TEST_SCRIPT_TEXT = Path("scripts/smoke_test_built_cli.sh").read_text()
 RUNTIME_MATRIX_SCRIPT_TEXT = Path("scripts/validate_runtime_matrix.sh").read_text()
 SYNC_CODEX_DOCS_TEXT = Path("scripts/sync_codex_docs.sh").read_text()
@@ -52,24 +54,48 @@ def test_readme_documents_released_cli_installation_via_uv_tool() -> None:
 
 
 def test_publish_workflow_builds_and_smoke_tests_release_artifacts() -> None:
+    assert "name: Release Publish" in PUBLISH_WORKFLOW_TEXT
     assert 'tags:\n      - "v*"' in PUBLISH_WORKFLOW_TEXT
     assert "workflow_dispatch" in PUBLISH_WORKFLOW_TEXT
+    assert "name: Build Release Artifacts" in PUBLISH_WORKFLOW_TEXT
+    assert "name: Publish to PyPI" in PUBLISH_WORKFLOW_TEXT
+    assert "name: Sync GitHub Release" in PUBLISH_WORKFLOW_TEXT
+    assert "Export runtime requirements for vulnerability audit" in PUBLISH_WORKFLOW_TEXT
+    assert "Run runtime dependency vulnerability audit" in PUBLISH_WORKFLOW_TEXT
+    assert "uv run pip-audit --requirement /tmp/runtime-requirements.txt" in PUBLISH_WORKFLOW_TEXT
     assert "uv build --no-sources" in PUBLISH_WORKFLOW_TEXT
     assert "bash ./scripts/smoke_test_built_cli.sh" in PUBLISH_WORKFLOW_TEXT
     assert "gh-action-pypi-publish" in PUBLISH_WORKFLOW_TEXT
 
 
 def test_ci_workflow_deduplicates_full_gate_and_runtime_matrix() -> None:
+    assert "name: Validation" in CI_WORKFLOW_TEXT
     assert "quality-gate:" in CI_WORKFLOW_TEXT
+    assert "name: Validation Baseline" in CI_WORKFLOW_TEXT
     assert 'python-version: "3.13"' in CI_WORKFLOW_TEXT
     assert "bash ./scripts/validate_baseline.sh" in CI_WORKFLOW_TEXT
     assert "runtime-matrix:" in CI_WORKFLOW_TEXT
+    assert "name: Runtime Matrix (Python ${{ matrix.python-version }})" in CI_WORKFLOW_TEXT
     assert 'python-version: ["3.11", "3.12"]' in CI_WORKFLOW_TEXT
     assert "bash ./scripts/validate_runtime_matrix.sh" in CI_WORKFLOW_TEXT
 
 
+def test_dependency_health_workflow_runs_as_a_standalone_check() -> None:
+    assert "name: Dependency Health" in DEPENDENCY_HEALTH_WORKFLOW_TEXT
+    assert "workflow_dispatch" in DEPENDENCY_HEALTH_WORKFLOW_TEXT
+    assert 'cron: "0 3 1 * *"' in DEPENDENCY_HEALTH_WORKFLOW_TEXT
+    assert "dependency-health:" in DEPENDENCY_HEALTH_WORKFLOW_TEXT
+    assert "name: Dependency Health Audit" in DEPENDENCY_HEALTH_WORKFLOW_TEXT
+    assert 'python-version: "3.13"' in DEPENDENCY_HEALTH_WORKFLOW_TEXT
+    assert "enable-cache: false" in DEPENDENCY_HEALTH_WORKFLOW_TEXT
+    assert "bash ./scripts/dependency_health.sh" in DEPENDENCY_HEALTH_WORKFLOW_TEXT
+    assert "uv pip list --outdated" in DEPENDENCY_HEALTH_SCRIPT_TEXT
+    assert "uv run pip-audit" in DEPENDENCY_HEALTH_SCRIPT_TEXT
+
+
 def test_scripts_index_exposes_built_cli_smoke_test() -> None:
     assert "validate_runtime_matrix.sh" in SCRIPTS_README_TEXT
+    assert "dependency_health.sh" in SCRIPTS_README_TEXT
     assert "smoke_test_built_cli.sh" in SCRIPTS_README_TEXT
     assert "`uv tool`" in SCRIPTS_README_TEXT
     assert "runtime entrypoints live in the released `codex-a2a` CLI" in SCRIPTS_README_TEXT
@@ -137,6 +163,7 @@ def test_validation_and_publish_paths_filter_known_build_warnings() -> None:
     validate_baseline_text = Path("scripts/validate_baseline.sh").read_text()
     assert "vcs_versioning._backends._git" in validate_baseline_text
     assert "vcs_versioning.overrides" in validate_baseline_text
+    assert "uv run pip-audit --requirement" in validate_baseline_text
     assert "vcs_versioning._backends._git" in PUBLISH_WORKFLOW_TEXT
     assert "vcs_versioning.overrides" in PUBLISH_WORKFLOW_TEXT
 

codex_a2a-0.6.2/tests/scripts/__init__.py

@@ -0,0 +1 @@
+"""Script contract tests."""

codex_a2a-0.6.2/tests/scripts/test_script_health_contract.py

@@ -0,0 +1,43 @@
+from pathlib import Path
+
+DEPENDENCY_HEALTH_TEXT = Path("scripts/dependency_health.sh").read_text()
+HEALTH_COMMON_TEXT = Path("scripts/health_common.sh").read_text()
+SCRIPTS_INDEX_TEXT = Path("scripts/README.md").read_text()
+VALIDATE_BASELINE_TEXT = Path("scripts/validate_baseline.sh").read_text()
+
+
+def test_shared_repo_health_prerequisites_live_in_common_helper() -> None:
+    assert "run_shared_repo_health_prerequisites()" in HEALTH_COMMON_TEXT
+    assert 'echo "[${label}] sync locked environment"' in HEALTH_COMMON_TEXT
+    assert 'echo "[${label}] verify dependency compatibility"' in HEALTH_COMMON_TEXT
+    assert "uv sync --all-extras --frozen" in HEALTH_COMMON_TEXT
+    assert "uv pip check" in HEALTH_COMMON_TEXT
+
+
+def test_validate_baseline_keeps_local_regression_scope() -> None:
+    assert "uv run pre-commit run --all-files" in VALIDATE_BASELINE_TEXT
+    assert "uv run mypy --config-file mypy.ini" in VALIDATE_BASELINE_TEXT
+    assert "uv run pytest" in VALIDATE_BASELINE_TEXT
+    assert "uv export" in VALIDATE_BASELINE_TEXT
+    assert "uv run pip-audit" in VALIDATE_BASELINE_TEXT
+    assert "uv pip list --outdated" not in VALIDATE_BASELINE_TEXT
+
+
+def test_dependency_health_keeps_dependency_review_scope() -> None:
+    assert (
+        'source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/health_common.sh"'
+        in DEPENDENCY_HEALTH_TEXT
+    )
+    assert 'run_shared_repo_health_prerequisites "dependency-health"' in DEPENDENCY_HEALTH_TEXT
+    assert "uv pip list --outdated" in DEPENDENCY_HEALTH_TEXT
+    assert "uv run pip-audit" in DEPENDENCY_HEALTH_TEXT
+    assert "uv run pytest" not in DEPENDENCY_HEALTH_TEXT
+    assert "uv run mypy" not in DEPENDENCY_HEALTH_TEXT
+    assert "uv run pre-commit run --all-files" not in DEPENDENCY_HEALTH_TEXT
+
+
+def test_scripts_index_documents_split_health_entrypoints() -> None:
+    assert "default local validation baseline used by contributors and CI" in SCRIPTS_INDEX_TEXT
+    assert "standalone dependency review flow" in SCRIPTS_INDEX_TEXT
+    assert "health_common.sh" in SCRIPTS_INDEX_TEXT
+    assert "intentionally remain separate entrypoints" in SCRIPTS_INDEX_TEXT