data-refinery-cli 0.5.1__tar.gz → 0.5.2__tar.gz

data_refinery_cli-0.5.2/.github/workflows/publish-stack.yml

@@ -0,0 +1,175 @@
+name: Release — auto-tag + conditional stack publish
+
+# On every push to main (a merged PR) this tags the commit `vX.Y.Z` from the
+# pyproject version, so git tags track the PyPI release 1:1 (PyPI itself is
+# published by publish.yml on the same push). The storage-stack OCI artifact
+# (docker-compose.yml -> ghcr.io/<owner>/data-refinery-stack) is republished
+# ONLY when docker-compose.yml actually changed since the previous tag — most
+# PRs touch CLI code, not the substrate, so the image would otherwise be
+# byte-identical churn.
+#
+# Manual (re)publish of a specific version: run via workflow_dispatch with the
+# tag input; that always publishes the stack for that tag.
+#
+# When the stack IS published, two consumption paths ship for the version:
+#   1. OCI via `docker compose publish` —
+#      ghcr.io/<owner>/data-refinery-stack:<version> (+ :latest). A single
+#      manifest REFERENCING upstream mongo:8.0 + neo4j:5-community (not a custom
+#      image). Consume with:
+#        docker compose -f oci://ghcr.io/<owner>/data-refinery-stack:<version> up -d
+#   2. The raw docker-compose.yml attached to the GitHub Release.
+#
+# Tags/releases are immutable per version: a given <version> is published once.
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to (re)publish the stack for, e.g. v0.5.0"
+        required: true
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # push the version tag
+    outputs:
+      tag: ${{ steps.plan.outputs.tag }}
+      version: ${{ steps.plan.outputs.version }}
+      publish: ${{ steps.plan.outputs.publish }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Plan tag + compose-change gate
+        id: plan
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_TAG: ${{ github.event.inputs.tag }}
+        run: |
+          set -euo pipefail
+
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            # Manual: (re)publish exactly the requested tag, always.
+            TAG="$INPUT_TAG"
+            VERSION="${TAG#v}"
+            PUBLISH="true"
+            echo "Manual dispatch: will publish stack for ${TAG}"
+          else
+            # Push to main: derive the version from pyproject and tag it.
+            VERSION="$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml | head -n1)"
+            if [ -z "$VERSION" ]; then
+              echo "::error::could not read version from pyproject.toml"
+              exit 1
+            fi
+            TAG="v${VERSION}"
+            # Previous tag = highest v* EXCLUDING the current one. Excluding TAG
+            # matters on a re-run: if an earlier run pushed the tag but then
+            # failed before publishing, we must still compare against the real
+            # previous release and be able to re-publish to recover — never treat
+            # "tag exists" as "already published" and skip. Tag CREATION below is
+            # still idempotent (skipped when the tag exists); only publishing is
+            # decided by the compose-change gate.
+            PREV="$(git tag --list 'v*' --sort=-v:refname | grep -vxF "${TAG}" | head -n1 || true)"
+            if [ -z "$PREV" ] || ! git diff --quiet "${PREV}" HEAD -- docker-compose.yml; then
+              PUBLISH="true"
+              echo "Substrate changed (or bootstrap) since ${PREV:-none} — will publish stack."
+            else
+              PUBLISH="false"
+              echo "docker-compose.yml unchanged since ${PREV} — tag only, no stack publish."
+            fi
+          fi
+
+          # Create the tag if it does not exist yet (push: always new here;
+          # dispatch: only when targeting a not-yet-created tag).
+          if ! git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null; then
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git tag -a "${TAG}" -m "data-refinery-cli ${TAG}"
+            git push origin "${TAG}"
+            echo "Created and pushed ${TAG}"
+          fi
+
+          {
+            echo "tag=${TAG}"
+            echo "version=${VERSION}"
+            echo "publish=${PUBLISH}"
+          } >> "$GITHUB_OUTPUT"
+
+  publish-stack:
+    needs: tag
+    if: needs.tag.outputs.publish == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # create/attach the release asset
+      packages: write # push the OCI artifact to GHCR
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          ref: ${{ needs.tag.outputs.tag }}
+
+      - name: Resolve image ref
+        id: ref
+        run: |
+          IMAGE="ghcr.io/${GITHUB_REPOSITORY_OWNER}/data-refinery-stack"
+          IMAGE="$(echo "$IMAGE" | tr '[:upper:]' '[:lower:]')"
+          echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
+          echo "Publishing ${IMAGE}:${{ needs.tag.outputs.version }}"
+
+      - name: Verify compose + OCI publish support
+        run: |
+          docker compose version
+          docker compose -f docker-compose.yml config --quiet
+          # `docker compose publish` landed in Compose v2.24 — fail early with a
+          # clear message on an older runner instead of a cryptic publish error.
+          docker compose publish --help >/dev/null 2>&1 || {
+            echo "::error::this docker compose has no 'publish' subcommand (needs v2.24+)"
+            exit 1
+          }
+          echo "compose validates; publish supported"
+
+      - name: Log in to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Publish compose as an OCI artifact
+        env:
+          IMAGE: ${{ steps.ref.outputs.image }}
+          VERSION: ${{ needs.tag.outputs.version }}
+        run: |
+          docker compose -f docker-compose.yml publish "${IMAGE}:${VERSION}" -y
+          docker compose -f docker-compose.yml publish "${IMAGE}:latest" -y
+
+      - name: Attach docker-compose.yml to the release (portable fallback)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RAW_TAG: ${{ needs.tag.outputs.tag }}
+          IMAGE: ${{ steps.ref.outputs.image }}
+          VERSION: ${{ needs.tag.outputs.version }}
+        run: |
+          if gh release view "${RAW_TAG}" >/dev/null 2>&1; then
+            gh release upload "${RAW_TAG}" docker-compose.yml --clobber
+          else
+            # --target pins the release (and the tag) at this commit, so a manual
+            # dispatch for a not-yet-existing tag still works.
+            gh release create "${RAW_TAG}" docker-compose.yml \
+              --target "${GITHUB_SHA}" \
+              --title "${RAW_TAG}" \
+              --notes "Storage stack (mongo 27018 + neo4j 7687). OCI: docker compose -f oci://${IMAGE}:${VERSION} up -d"
+          fi
+
+      - name: Summary
+        env:
+          IMAGE: ${{ steps.ref.outputs.image }}
+          VERSION: ${{ needs.tag.outputs.version }}
+          RAW_TAG: ${{ needs.tag.outputs.tag }}
+        run: |
+          {
+            echo "### Storage stack published"
+            echo ""
+            echo "- OCI: \`docker compose -f oci://${IMAGE}:${VERSION} up -d\`"
+            echo "- Release asset: \`docker-compose.yml\` on release ${RAW_TAG}"
+          } >> "$GITHUB_STEP_SUMMARY"

{data_refinery_cli-0.5.1 → data_refinery_cli-0.5.2}/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/). This project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.2] - 2026-06-21
+
+### Changed
+
+- `publish-stack.yml` now runs on every push to `main`: a `tag` job derives the version from `pyproject.toml` and creates the `v<version>` git tag (tags now track the PyPI release 1:1), and the stack OCI image is **republished only when `docker-compose.yml` changed** since the previous tag — most releases bump the CLI, not the substrate, so the image no longer churns on every merge. A `workflow_dispatch` with a `tag` input still force-(re)publishes a specific version. (`docs/stack-image.md` + `CLAUDE.md` updated.)
+
 ## [0.5.1] - 2026-06-21
 
 ### Changed

{data_refinery_cli-0.5.1 → data_refinery_cli-0.5.2}/CLAUDE.md

@@ -14,7 +14,9 @@ and freshness of data as it is stored and fetched. It is being split out of
 *Wave 1* (issue #1): the storage substrate (`docker-compose.yml` — mongo 27018 +
 neo4j 7687/apoc) and the `data-refinery stack up/down/status` verb wrapping
 `docker compose`, plus the GHCR publish workflow
-(`.github/workflows/publish-stack.yml`) and the pinnable docs
+(`.github/workflows/publish-stack.yml` — on every push to `main` it auto-tags
+`v<version>` from `pyproject.toml`, then republishes the stack OCI image **only
+when `docker-compose.yml` changed** since the previous tag) and the pinnable docs
 (`docs/stack-image.md`, `docs/contract.md`). *Wave 2* (issue #3): the
 storage-neutral **store** — the generic envelope (`data_refinery/store/`), the
 importable `data_refinery.store.put/get/list` library mirrored by `data-refinery

{data_refinery_cli-0.5.1 → data_refinery_cli-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: data-refinery-cli
-Version: 0.5.1
+Version: 0.5.2
 Summary: Agent and CLI for data quality in storage and retrieval — validating, deduplicating, and checking the integrity and freshness of data as it is stored and fetched. Split out of eidetic-cli so eidetic keeps agent-memory; sibling to daria, the Data Refinery Intelligent Agent.
 Project-URL: Homepage, https://github.com/agentculture/data-refinery-cli
 Project-URL: Issues, https://github.com/agentculture/data-refinery-cli/issues

{data_refinery_cli-0.5.1 → data_refinery_cli-0.5.2}/docs/stack-image.md

@@ -33,8 +33,13 @@ project.
 - **Name:** `ghcr.io/agentculture/data-refinery-stack`
 - **Tags:** the release version without the leading `v` (e.g. `0.4.0`), plus
   `latest`.
-- **Immutability:** a given version tag is published exactly once, on the
-  `v<version>` git tag. Treat `0.4.0` as immutable; `latest` floats.
+- **Immutability:** a given version tag is published exactly once. Treat
+  `0.4.0` as immutable; `latest` floats.
+- **Cadence:** the image is **only (re)published when `docker-compose.yml`
+  actually changes** between releases — most releases bump the CLI, not the
+  substrate, so the stack image stays put while the PyPI version moves. The
+  image version therefore tracks the latest release in which the compose
+  changed, not every release.
 
 > **Not a multi-arch image.** The published artifact is a single OCI manifest
 > produced by `docker compose publish` — it *references* the upstream `mongo:8.0`
@@ -81,6 +86,11 @@ consumer that needs byte-for-byte reproducibility should pin the upstream image
 ## Publishing
 
 [`.github/workflows/publish-stack.yml`](../.github/workflows/publish-stack.yml)
-runs on a `v*` tag (or `workflow_dispatch`): it validates the compose, logs in to
-GHCR with the workflow token, `docker compose publish`es the OCI artifact at the
-version tag and `latest`, and attaches `docker-compose.yml` to the release.
+runs on every **push to `main`** (a merged PR). Its `tag` job derives the version
+from `pyproject.toml` and creates the `v<version>` git tag (so tags track the
+PyPI release 1:1), then gates: it only proceeds to publish when `docker-compose.yml`
+differs from the previous tag. When it does, the `publish-stack` job validates the
+compose, logs in to GHCR with the workflow token, `docker compose publish`es the
+OCI artifact at the version tag and `latest`, and attaches `docker-compose.yml` to
+the release. A `workflow_dispatch` with a `tag` input force-(re)publishes a
+specific version's stack regardless of the gate.

{data_refinery_cli-0.5.1 → data_refinery_cli-0.5.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "data-refinery-cli"
-version = "0.5.1"
+version = "0.5.2"
 description = "Agent and CLI for data quality in storage and retrieval — validating, deduplicating, and checking the integrity and freshness of data as it is stored and fetched. Split out of eidetic-cli so eidetic keeps agent-memory; sibling to daria, the Data Refinery Intelligent Agent."
 readme = "README.md"
 license = "Apache-2.0"

{data_refinery_cli-0.5.1 → data_refinery_cli-0.5.2}/uv.lock

@@ -156,7 +156,7 @@ wheels = [
 
 [[package]]
 name = "data-refinery-cli"
-version = "0.5.1"
+version = "0.5.2"
 source = { editable = "." }
 
 [package.optional-dependencies]

data_refinery_cli-0.5.1/.github/workflows/publish-stack.yml

@@ -1,95 +0,0 @@
-name: Publish storage stack to GHCR
-
-# Publishes the storage substrate (docker-compose.yml) on a version tag.
-#
-# Two consumption paths are published for the same version (issue #1):
-#   1. An OCI artifact via `docker compose publish` —
-#      ghcr.io/agentculture/data-refinery-stack:<version> (+ :latest).
-#      The artifact is a SINGLE manifest that REFERENCES the upstream
-#      mongo:8.0 + neo4j:5-community images (which are themselves multi-arch);
-#      it is not a custom multi-arch image. Consume with:
-#        docker compose -f oci://ghcr.io/agentculture/data-refinery-stack:<version> up -d
-#   2. The raw docker-compose.yml attached to the GitHub Release, for consumers
-#      whose docker/compose predates OCI compose support — curl + `-f` it.
-#
-# Tags are immutable per release: a given <version> is published once.
-
-on:
-  push:
-    tags:
-      - "v*"
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Tag to publish (e.g. v0.4.0)"
-        required: true
-
-permissions:
-  contents: write   # create/attach the release asset
-  packages: write   # push the OCI artifact to GHCR
-
-jobs:
-  publish-stack:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-      - name: Resolve version + image ref
-        id: ref
-        run: |
-          RAW_TAG="${{ github.event.inputs.tag || github.ref_name }}"
-          VERSION="${RAW_TAG#v}"
-          IMAGE="ghcr.io/${GITHUB_REPOSITORY_OWNER}/data-refinery-stack"
-          IMAGE="$(echo "$IMAGE" | tr '[:upper:]' '[:lower:]')"
-          echo "raw_tag=${RAW_TAG}" >> "$GITHUB_OUTPUT"
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
-          echo "Publishing ${IMAGE}:${VERSION}"
-
-      - name: Verify compose + OCI publish support
-        run: |
-          docker compose version
-          docker compose -f docker-compose.yml config --quiet
-          # `docker compose publish` landed in Compose v2.24 — fail early with a
-          # clear message on an older runner instead of a cryptic publish error.
-          docker compose publish --help >/dev/null 2>&1 || {
-            echo "::error::this docker compose has no 'publish' subcommand (needs v2.24+)"
-            exit 1
-          }
-          echo "compose validates; publish supported"
-
-      - name: Log in to GHCR
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
-
-      - name: Publish compose as an OCI artifact
-        env:
-          IMAGE: ${{ steps.ref.outputs.image }}
-          VERSION: ${{ steps.ref.outputs.version }}
-        run: |
-          docker compose -f docker-compose.yml publish "${IMAGE}:${VERSION}" -y
-          docker compose -f docker-compose.yml publish "${IMAGE}:latest" -y
-
-      - name: Attach docker-compose.yml to the release (portable fallback)
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RAW_TAG: ${{ steps.ref.outputs.raw_tag }}
-        run: |
-          if gh release view "${RAW_TAG}" >/dev/null 2>&1; then
-            gh release upload "${RAW_TAG}" docker-compose.yml --clobber
-          else
-            # --target pins the release (and creates the tag) at this commit, so
-            # a manual workflow_dispatch with a not-yet-existing tag still works.
-            gh release create "${RAW_TAG}" docker-compose.yml \
-              --target "${GITHUB_SHA}" \
-              --title "${RAW_TAG}" \
-              --notes "Storage stack (mongo 27018 + neo4j 7687). OCI: docker compose -f oci://${{ steps.ref.outputs.image }}:${{ steps.ref.outputs.version }} up -d"
-          fi
-
-      - name: Summary
-        run: |
-          {
-            echo "### Storage stack published"
-            echo ""
-            echo "- OCI: \`docker compose -f oci://${{ steps.ref.outputs.image }}:${{ steps.ref.outputs.version }} up -d\`"
-            echo "- Release asset: \`docker-compose.yml\` on release ${{ steps.ref.outputs.raw_tag }}"
-          } >> "$GITHUB_STEP_SUMMARY"