dependency-support-policy 0.1.0__tar.gz

dependency_support_policy-0.1.0/.coderabbit.yaml

@@ -0,0 +1,3 @@
+reviews:
+    auto_review:
+        enabled: false

dependency_support_policy-0.1.0/.editorconfig

@@ -0,0 +1,22 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.py]
+indent_size = 4
+max_line_length = 120
+
+[*.{yml,yaml,json,md}]
+indent_size = 4
+
+[*.toml]
+indent_size = 2
+
+[Makefile]
+indent_style = tab

dependency_support_policy-0.1.0/.github/ISSUE_TEMPLATE/bug-report.md

@@ -0,0 +1,60 @@
+---
+name: 🐛 Bug Report
+about: Create a report to help us improve
+title: '[BUG]: '
+labels: bug
+assignees: ''
+---
+
+## 📝 Description
+
+A clear and concise description of what the bug is.
+
+## 🚀 Reproduction Steps
+
+Steps to reproduce the behavior:
+
+1. '...'
+2. '...'
+3. '...'
+
+## 💻 Minimal Reproducible Example
+
+Please provide the smallest `pyproject.toml` (and configuration) that
+demonstrates the issue, plus the exact CLI command or workflow snippet:
+
+```toml
+# pyproject.toml
+```
+
+```bash
+dependency-support-policy check --reference-date 2026-01-01
+```
+
+## 📋 Expected Behavior
+
+A clear and concise description of what you expected to happen (e.g. the
+floor you expected the policy to compute).
+
+## 💥 Actual Behavior / Output
+
+Add the CLI output, change-plan JSON, or workflow log here **after redacting
+secrets** (API keys, tokens, credentials, private URLs/paths, personal data).
+If this is a potential security vulnerability, do **not** post it publicly;
+use the Security reporting channel instead.
+
+```text
+
+```
+
+## 🛠 Environment Information
+
+- **Python Version:** (e.g., 3.13)
+- **Package / Action Version:** (e.g., 0.1.0 or the `uses:` ref)
+- **uv Version:** (e.g., 0.9.0, if lockfile handling is involved)
+- **Operating System:** (e.g., Windows 11, Ubuntu 22.04, macOS)
+- **Where it runs:** (CLI locally, GitHub Actions, other CI)
+
+## 📎 Additional Context
+
+Add any other context about the problem here (e.g., screenshots, logs).

dependency_support_policy-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+    - name: 🛡️ Security Vulnerability
+      url: https://github.com/isaac-cf-wong/dependency-support-policy-action/security/advisories/new
+      about: Please report security vulnerabilities privately here, not as public issues.
+    - name: 💬 Questions & Discussions
+      url: https://github.com/isaac-cf-wong/dependency-support-policy-action/discussions
+      about: Please ask and answer questions here.

dependency_support_policy-0.1.0/.github/ISSUE_TEMPLATE/feature-request.md

@@ -0,0 +1,45 @@
+---
+name: ✨ Feature Request
+about: Suggest an idea or improvement for this project
+title: '[FEATURE]: '
+labels: enhancement
+assignees: ''
+---
+
+## 🎯 Problem Statement
+
+Is your feature request related to a problem? Please describe.
+
+> _Ex: "I need a support policy with a fixed number of minor series instead
+> of a time window..."_
+
+## 💡 Proposed Solution
+
+A clear and concise description of what you want to happen. Describe the new
+functionality or the change to existing behavior.
+
+## 💻 Proposed Configuration / Usage Example
+
+If applicable, show how you would imagine using the feature — CLI flags,
+`[tool.dependency-support-policy]` keys, or action inputs:
+
+```yaml
+- uses: isaac-cf-wong/dependency-support-policy-action@v1
+  with:
+      # how you'd like to use the new feature
+```
+
+## 🌈 Use Case & Benefits
+
+Why is this feature important to you and other users? How does it improve the
+project?
+
+## 🔄 Alternatives Considered
+
+A clear and concise description of any alternative solutions or workarounds
+you've considered.
+
+## ⚠️ Additional Context
+
+Add any other context, screenshots, or links to similar implementations in
+other tools here.

dependency_support_policy-0.1.0/.github/pull_request_template.md

@@ -0,0 +1,11 @@
+# Description
+
+<!-- What does this PR change, and why? -->
+
+## Checklist
+
+- [ ] PR title follows [Conventional Commits](https://www.conventionalcommits.org/)
+- [ ] `uv run pre-commit run --all-files` passes
+- [ ] `uv run pytest` passes (new behaviour is covered by tests)
+- [ ] `uv run mypy src` passes
+- [ ] Documentation updated where relevant

dependency_support_policy-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,289 @@
+name: CI
+on:
+    push:
+        branches: [main]
+    pull_request:
+        branches: [main]
+    workflow_dispatch:
+    workflow_call:
+
+permissions:
+    contents: read
+
+jobs:
+    zizmor:
+        # pre-commit.ci cannot run the zizmor hook (language: system), so the
+        # workflow security audit runs here instead.
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+              with:
+                  python-version: '3.13'
+                  enable-cache: 'true'
+
+            - name: Install dependencies
+              run: uv sync --group dev --frozen
+
+            - name: Run zizmor
+              run: uv run --frozen zizmor .github/workflows action.yml
+
+    test:
+        strategy:
+            matrix:
+                # Locked, minimum (lowest-direct), and latest (highest)
+                # resolutions run on ubuntu; macos runs highest only, on the
+                # assumption that resolution behaviour is OS-independent.
+                python-version: ['3.12', '3.13', '3.14']
+                os: [ubuntu-latest]
+                resolution: [locked, lowest-direct, highest]
+                include:
+                    - os: macos-latest
+                      python-version: '3.12'
+                      resolution: highest
+                    - os: macos-latest
+                      python-version: '3.13'
+                      resolution: highest
+                    - os: macos-latest
+                      python-version: '3.14'
+                      resolution: highest
+        runs-on: ${{ matrix.os }}
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+              with:
+                  python-version: ${{ matrix.python-version }}
+                  enable-cache: 'true'
+
+            - name: Install dependencies
+              env:
+                  RESOLUTION: ${{ matrix.resolution }}
+              run: |
+                  case "$RESOLUTION" in
+                      locked) uv sync --group dev --frozen ;;
+                      lowest-direct) uv sync --group dev --upgrade --resolution lowest-direct ;;
+                      highest) uv sync --group dev --upgrade ;;
+                  esac
+
+            - name: Run tests with pytest
+              run: uv run --no-sync pytest
+
+    typecheck:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+              with:
+                  python-version: '3.13'
+                  enable-cache: 'true'
+
+            - name: Install dependencies
+              run: uv sync --group dev --frozen
+
+            - name: Run mypy
+              run: uv run --frozen mypy src
+
+    build:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+              with:
+                  python-version: '3.13'
+                  enable-cache: 'true'
+
+            - name: Build distributions
+              run: uv build
+
+    action-compliant:
+        name: action test / compliant project
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false
+
+            - name: Run action (check mode)
+              id: policy
+              uses: ./
+              with:
+                  mode: check
+                  working-directory: tests/data/action/compliant
+                  reference-date: '2025-01-01'
+
+            - name: Assert no drift reported
+              env:
+                  CHANGED: ${{ steps.policy.outputs.changed }}
+                  PY_CHANGED: ${{ steps.policy.outputs.python-floor-changed }}
+              run: |
+                  test "$CHANGED" = "false"
+                  test "$PY_CHANGED" = "false"
+
+    action-dep-update:
+        name: action test / dependency floor update
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false
+
+            - name: Run action (update mode)
+              id: policy
+              uses: ./
+              with:
+                  mode: update
+                  working-directory: tests/data/action/dep-update
+                  reference-date: '2025-01-01'
+
+            - name: Assert dependency floor updated
+              env:
+                  CHANGED: ${{ steps.policy.outputs.changed }}
+                  PY_CHANGED: ${{ steps.policy.outputs.python-floor-changed }}
+                  FLOORS: ${{ steps.policy.outputs.dependency-floors-changed }}
+                  FILES: ${{ steps.policy.outputs.files-changed }}
+              run: |
+                  test "$CHANGED" = "true"
+                  test "$PY_CHANGED" = "false"
+                  echo "$FLOORS" | jq -e '.[] | select(.name == "numpy" and .new == "1.25.0")'
+                  echo "$FILES" | jq -e '. == ["pyproject.toml"]'
+                  grep -F '"numpy>=1.25.0", # comment must survive' tests/data/action/dep-update/pyproject.toml
+
+    action-python-update:
+        name: action test / python floor update
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false
+
+            - name: Run action (update mode)
+              id: policy
+              uses: ./
+              with:
+                  mode: update
+                  working-directory: tests/data/action/python-update
+                  reference-date: '2025-01-01'
+
+            - name: Assert python floor updated
+              env:
+                  CHANGED: ${{ steps.policy.outputs.changed }}
+                  PY_CHANGED: ${{ steps.policy.outputs.python-floor-changed }}
+                  PLAN: ${{ steps.policy.outputs.plan }}
+              run: |
+                  test "$CHANGED" = "true"
+                  test "$PY_CHANGED" = "true"
+                  echo "$PLAN" | jq -e '.python_change.new_requires_python == ">=3.11"'
+                  grep -F 'requires-python = ">=3.11"' tests/data/action/python-update/pyproject.toml
+
+    action-with-lock:
+        name: action test / uv.lock regeneration
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false
+
+            - name: Run action (update mode with lock)
+              id: policy
+              uses: ./
+              with:
+                  mode: update
+                  working-directory: tests/data/action/with-lock
+                  reference-date: '2025-01-01'
+                  lock: minimal
+
+            - name: Assert lockfile regenerated and consistent
+              env:
+                  FILES: ${{ steps.policy.outputs.files-changed }}
+              run: |
+                  echo "$FILES" | jq -e '. == ["pyproject.toml", "uv.lock"]'
+                  grep -F '"numpy>=1.25.0"' tests/data/action/with-lock/pyproject.toml
+                  ! grep -F 'version = "1.24.4"' tests/data/action/with-lock/uv.lock
+                  uv lock --check --project tests/data/action/with-lock
+
+    action-check-outdated:
+        name: action test / check-only mode
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false
+
+            - name: Run action (check mode, expected to fail)
+              id: check
+              continue-on-error: true
+              uses: ./
+              with:
+                  mode: check
+                  working-directory: tests/data/action/dep-update
+                  reference-date: '2025-01-01'
+
+            - name: Run action (check mode, fail-on-outdated disabled)
+              id: check-soft
+              uses: ./
+              with:
+                  mode: check
+                  working-directory: tests/data/action/dep-update
+                  reference-date: '2025-01-01'
+                  fail-on-outdated: 'false'
+
+            - name: Assert check semantics
+              env:
+                  CHECK_OUTCOME: ${{ steps.check.outcome }}
+                  CHECK_CHANGED: ${{ steps.check.outputs.changed }}
+                  SOFT_CHANGED: ${{ steps.check-soft.outputs.changed }}
+              run: |
+                  test "$CHECK_OUTCOME" = "failure"
+                  test "$CHECK_CHANGED" = "true"
+                  test "$SOFT_CHANGED" = "true"
+                  # check mode must not modify the repository
+                  git diff --exit-code tests/data/action/dep-update
+
+    action-invalid-config:
+        name: action test / invalid configuration
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false
+
+            - name: Run action (invalid config, expected to fail)
+              id: invalid
+              continue-on-error: true
+              uses: ./
+              with:
+                  mode: check
+                  working-directory: tests/data/action/invalid-config
+                  reference-date: '2025-01-01'
+
+            - name: Run action (invalid mode, expected to fail)
+              id: bad-mode
+              continue-on-error: true
+              uses: ./
+              with:
+                  mode: destroy
+                  working-directory: tests/data/action/compliant
+
+            - name: Assert failures
+              env:
+                  INVALID_OUTCOME: ${{ steps.invalid.outcome }}
+                  BAD_MODE_OUTCOME: ${{ steps.bad-mode.outcome }}
+              run: |
+                  test "$INVALID_OUTCOME" = "failure"
+                  test "$BAD_MODE_OUTCOME" = "failure"

dependency_support_policy-0.1.0/.github/workflows/codeql.yml

@@ -0,0 +1,31 @@
+name: CodeQL
+on:
+    push:
+        branches: [main]
+    pull_request:
+        branches: [main]
+    workflow_dispatch:
+    workflow_call:
+
+permissions:
+    security-events: write
+
+jobs:
+    codeql:
+        name: codeql
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false
+
+            - name: Initialize CodeQL
+              uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+              with:
+                  languages: python
+
+            - name: Autobuild
+              uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+
+            - name: Perform CodeQL Analysis
+              uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4

dependency_support_policy-0.1.0/.github/workflows/documentation.yml

@@ -0,0 +1,50 @@
+name: Documentation
+
+on:
+    push:
+        branches: [main]
+    workflow_dispatch:
+
+permissions:
+    contents: read
+    pages: write
+    id-token: write
+
+concurrency:
+    group: pages
+    cancel-in-progress: false
+
+jobs:
+    deploy:
+        runs-on: ubuntu-latest
+        timeout-minutes: 15
+        environment:
+            name: github-pages
+            url: ${{ steps.deployment.outputs.page_url }}
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+              with:
+                  python-version: '3.13'
+                  enable-cache: 'true'
+
+            - name: Install dependencies
+              run: uv sync --group docs --frozen
+
+            - run: uv run --frozen zensical build
+
+            - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
+              with:
+                  path: site
+                  # Attempt-scoped so "Re-run failed jobs" does not leave two
+                  # same-named artifacts in the run, which deploy-pages rejects.
+                  name: github-pages-${{ github.run_attempt }}
+
+            - id: deployment
+              uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+              with:
+                  artifact_name: github-pages-${{ github.run_attempt }}

dependency_support_policy-0.1.0/.github/workflows/draft_release.yml

@@ -0,0 +1,51 @@
+name: Draft Release
+
+on:
+    push:
+        branches: [main]
+
+permissions:
+    contents: write
+    pull-requests: read
+
+concurrency:
+    group: draft-release
+    cancel-in-progress: true
+
+jobs:
+    draft-release:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  fetch-depth: 0
+                  persist-credentials: false
+
+            - name: Generate changelog
+              id: changelog
+              uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5 # v4.8.0
+              with:
+                  config: cliff.toml
+                  args: --unreleased --verbose
+              env:
+                  OUTPUT: CHANGELOG.md
+
+            - name: Delete existing draft release
+              continue-on-error: true
+              run: |
+                  gh release delete next-release --yes --repo "$GITHUB_REPOSITORY"
+              env:
+                  GH_TOKEN: ${{ github.token }}
+
+            - name: Create or Update Draft Release
+              uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+              with:
+                  tag_name: next-release
+                  name: 'Next Release (Draft)'
+                  body: |
+                      ${{ steps.changelog.outputs.content }}
+
+                      ---
+                      *This is an automatically generated draft release.*
+                  draft: true
+                  prerelease: false

dependency_support_policy-0.1.0/.github/workflows/publish_testpypi.yml

@@ -0,0 +1,85 @@
+name: Publish to TestPyPI
+
+on:
+    push:
+        branches:
+            - main
+    workflow_dispatch:
+        inputs:
+            tag_name:
+                description: 'Tag name for the publish (e.g., v1.2.3)'
+                required: false
+                type: string
+    workflow_call:
+        inputs:
+            tag_name:
+                description: 'Tag name for the publish (e.g., v1.2.3)'
+                required: false
+                type: string
+
+permissions:
+    contents: read
+
+jobs:
+    publish:
+        runs-on: ubuntu-latest
+        environment:
+            name: testpypi
+        permissions:
+            id-token: write
+            contents: read
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  ref: ${{ inputs.tag_name || github.sha }}
+                  fetch-depth: 0
+                  persist-credentials: false
+
+            - name: Output build information
+              env:
+                  REF_NAME: ${{ inputs.tag_name || github.sha }}
+              run: |
+                  {
+                    echo "### Publishing Build :package:"
+                    echo "- **Ref**: $REF_NAME"
+                  } >> "$GITHUB_STEP_SUMMARY"
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+              with:
+                  python-version: '3.13'
+                  enable-cache: 'true'
+
+            - name: Install dependencies
+              run: uv sync --group dev --frozen
+
+            - name: Set version for publishing
+              env:
+                  TAG_NAME: ${{ inputs.tag_name }}
+              run: |
+                  if [ -n "$TAG_NAME" ]; then
+                    # Use the tag, stripping the 'v' prefix if present
+                    VERSION="${TAG_NAME#v}"
+                  else
+                    # For untagged builds, take the dynamic version and strip
+                    # the +local part, which TestPyPI rejects
+                    VERSION=$(uv run --frozen python -c 'from importlib.metadata import version; print(version("dependency-support-policy"))' | sed 's/+.*//')
+                  fi
+                  echo "Publishing version $VERSION"
+
+                  # Pin the version statically for this build
+                  sed -i "s/dynamic = \[\"version\"\]/version = \"$VERSION\"\ndynamic = []/" pyproject.toml
+
+            - name: Build distribution
+              run: uv build
+
+            - name: Smoke test (wheel)
+              run: uv run --isolated --no-project --with dist/*.whl
+                  tests/smoke_test.py
+
+            - name: Smoke test (source distribution)
+              run: uv run --isolated --no-project --with dist/*.tar.gz
+                  tests/smoke_test.py
+
+            - name: Publish to TestPyPI
+              run: uv publish --index testpypi