codex-core 0.2.1__tar.gz → 0.3.0__tar.gz

{codex_core-0.2.1 → codex_core-0.3.0}/.github/workflows/ci.yml

@@ -27,13 +27,13 @@ jobs:
         run: uv sync --locked --extra dev
 
       - name: Run pre-commit
-        run: uv run pre-commit run --all-files
+        run: uv run python tools/dev/check.py --lint
 
       - name: Run pip-audit
-        run: uv run pip-audit
+        run: uv run python tools/dev/check.py --security
 
       - name: Run mypy
-        run: uv run mypy src/codex_core/
+        run: uv run python tools/dev/check.py --types
 
   unit-tests:
     name: Unit Tests (Python ${{ matrix.python-version }})

{codex_core-0.2.1 → codex_core-0.3.0}/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0] - 2026-04-04
+
+### Added
+
+- **Quality Gate**: Declarative configuration support via `pyproject.toml` (`[tool.codex-check]`).
+- **Static Compiler**: Dependency-graph strategy for JS bundles (@provides/@depends parsing and resolution).
+- **Static Compiler**: New `compile_bundle` entry point for unified asset compilation.
+
+### Changed
+
+- **Quality Gate**: Refactored `BaseCheckRunner` to prioritize `pyproject.toml` over class attributes.
+- **Developer Tools**: Simplified `tools/dev/check.py` to a thin launcher.
+- **Documentation**: Updated architecture guides to promote declarative configuration.
+
+### Fixed
+
+- **Quality Gate**: Resolved line length issues and suppressed security warnings (Bandit B603) for internal subprocess calls.
+
+## [0.2.2] - 2026-03-29
+
+### Fixed
+- **CI Security Check Routing**: Updated `.github/workflows/ci.yml` to run lint, security, and type checks through `tools/dev/check.py` so GitHub Actions uses the same project-level check-runner policy as local development.
+- **pip-audit Policy Drift**: Restored `AUDIT_FLAGS` handling in CI, including `--skip-editable` and the project-specific ignore for `CVE-2026-4539`.
+
 ## [0.2.1] - 2026-03-29
 
 ### Added

{codex_core-0.2.1 → codex_core-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-core
-Version: 0.2.1
+Version: 0.3.0
 Summary: Core utilities, schemas and settings for Codex WaaS toolkit
 Project-URL: Homepage, https://github.com/codexdlc/codex-core
 Project-URL: Documentation, https://codexdlc.github.io/codex-core/

{codex_core-0.2.1 → codex_core-0.3.0}/docs/en/architecture/platform/dev.md

@@ -40,22 +40,29 @@ python tools/dev/check.py --ci          # everything non-interactively (GitHub A
 
 ### Project switches
 
-Projects can keep the shared orchestration and declare their local policy with
-simple boolean attributes on `CheckRunner`:
+The preferred way to declare project-level quality gate policy is via `pyproject.toml` using the `[tool.codex-check]` section:
+
+```toml
+[tool.codex-check]
+project-name = "my-project"
+audit-flags = "--skip-editable"
+run-lint = true
+run-types = true
+run-security = true
+run-unit-tests = true
+run-integration-tests = false
+test-stages = ["unit", "integration"]
+prompt-test-stages = ["integration"]
+```
+
+Legacy support for class attributes in `CheckRunner` is still available for backwards compatibility:
 
 ```python
 class CheckRunner(BaseCheckRunner):
-    RUN_LINT = True
-    RUN_TYPES = True
-    RUN_SECURITY = True
-    RUN_EXTRA_CHECKS = True
     RUN_UNIT_TESTS = True
     RUN_INTEGRATION_TESTS = False
 ```
 
-This is the preferred extension point when a library does not need every stage.
-Use method overrides only when behavior itself must change.
-
 ### Usage in a project
 
 ```python
@@ -171,6 +178,29 @@ JS source files into bundles. No Node.js, no external packages required.
 }
 ```
 
+JS also supports a dependency-aware mode:
+
+```json
+{
+    "js": {
+        "app.js": {
+            "strategy": "dependency_graph",
+            "entry": ["app/entry.js"],
+            "roots": ["core", "widgets", "builders", "app"]
+        }
+    }
+}
+```
+
+In this mode the compiler reads metadata from JS files:
+
+```js
+/* @provides cabinet.widgets.client_lookup
+   @depends cabinet.core.dom, cabinet.core.events */
+```
+
+and builds the bundle order automatically. The old ordered-mode with an explicit source list remains fully supported.
+
 Old CSS-only format is supported for backwards compatibility:
 ```json
 { "base.css": "app.css" }

{codex_core-0.2.1 → codex_core-0.3.0}/docs/ru/architecture/platform/dev.md

@@ -40,22 +40,29 @@ python tools/dev/check.py --ci          # всё без промптов (GitHub
 
 ### Проектные переключатели
 
-Проект может оставить общую оркестрацию и задать свою локальную политику через
-булевы атрибуты в `CheckRunner`:
+Рекомендуемый способ задания проектной политики проверки качества — через секцию `[tool.codex-check]` в файле `pyproject.toml`:
+
+```toml
+[tool.codex-check]
+project-name = "my-project"
+audit-flags = "--skip-editable"
+run-lint = true
+run-types = true
+run-security = true
+run-unit-tests = true
+run-integration-tests = false
+test-stages = ["unit", "integration"]
+prompt-test-stages = ["integration"]
+```
+
+Поддержка атрибутов класса в `CheckRunner` сохранена для обратной совместимости:
 
 ```python
 class CheckRunner(BaseCheckRunner):
-    RUN_LINT = True
-    RUN_TYPES = True
-    RUN_SECURITY = True
-    RUN_EXTRA_CHECKS = True
     RUN_UNIT_TESTS = True
     RUN_INTEGRATION_TESTS = False
 ```
 
-Это основной способ настройки, когда библиотеке не нужны все этапы проверки.
-Переопределяйте методы только тогда, когда нужно менять само поведение.
-
 ### Использование в проекте
 
 ```python
@@ -171,6 +178,29 @@ gen = ProjectTreeGenerator(
 }
 ```
 
+Для JS также поддерживается dependency-aware режим:
+
+```json
+{
+    "js": {
+        "app.js": {
+            "strategy": "dependency_graph",
+            "entry": ["app/entry.js"],
+            "roots": ["core", "widgets", "builders", "app"]
+        }
+    }
+}
+```
+
+В этом режиме компилятор читает metadata из JS-файлов:
+
+```js
+/* @provides cabinet.widgets.client_lookup
+   @depends cabinet.core.dom, cabinet.core.events */
+```
+
+И строит итоговый порядок автоматически. Старый ordered-mode через явный список файлов остаётся полностью поддержанным.
+
 Старый формат только для CSS поддерживается для обратной совместимости:
 ```json
 { "base.css": "app.css" }

{codex_core-0.2.1 → codex_core-0.3.0}/pyproject.toml

@@ -110,3 +110,12 @@ exclude_lines = [
 [tool.bandit]
 exclude_dirs = ["tests"]
 skips = ["B602", "B605", "B607", "B404"]
+
+[tool.codex-check]
+project-name = "codex-core"
+audit-flags = "--skip-editable --ignore-vuln CVE-2026-4539"
+integration-requires = "Redis"
+test-stages = ["unit", "integration"]
+prompt-test-stages = ["integration"]
+test-paths = ["tests"]
+types-paths = ["src"]