devex-cli 0.26.0__tar.gz → 0.26.1__tar.gz

{devex_cli-0.26.0 → devex_cli-0.26.1}/.github/workflows/test.yml

@@ -23,6 +23,47 @@ jobs:
       - run: uv pip install -e ".[dev]"
       - run: uv run pytest
 
+  # --------------------------------------------------------------------------
+  # SonarCloud CI-based analysis + coverage. SonarCloud is no longer in
+  # Automatic Analysis mode (the two modes are mutually exclusive), so this job
+  # is the sole analysis path: it generates coverage.xml (with repo-relative
+  # paths via pyproject [tool.coverage.run] so Sonar can match files) and runs
+  # the scanner, which
+  # reads sonar-project.properties (projectKey / organization / reportPaths)
+  # and the SONAR_TOKEN repo secret. Runs on PRs (new-code decoration) and on
+  # pushes to main (baseline). fetch-depth: 0 gives Sonar the full history it
+  # needs for accurate new-code / blame attribution.
+  # --------------------------------------------------------------------------
+  sonarcloud:
+    name: SonarCloud
+    runs-on: ubuntu-latest
+    # Promote a *presence flag* (not the secret) to job env so the scan step
+    # can gate on it — `secrets.*` isn't allowed in `if:`. Lets forks /
+    # token-less runs skip the scan rather than hard-fail. (Pattern from the
+    # sibling agentfront repo, whose CI-based SonarCloud scan is green.)
+    env:
+      SONAR_TOKEN_PRESENT: ${{ secrets.SONAR_TOKEN != '' }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: "3.12"
+      - run: uv venv
+      - run: uv pip install -e ".[dev]"
+      - run: uv run pytest --cov=src/devex --cov-report=xml --cov-report=term
+      # Pinned to v6 to match the sibling agentfront repo's working scan.
+      # The v7+/v8 scanner engine 404s on `api.sonarcloud.io/analysis/analyses`
+      # against SonarQube Cloud; v6 posts to sonarcloud.io directly.
+      - name: SonarCloud Scan
+        if: env.SONAR_TOKEN_PRESENT == 'true'
+        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602  # v6
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: https://sonarcloud.io
+
   # --------------------------------------------------------------------------
   # Enforces that every PR touching code (src/, tests/, pyproject.toml) also
   # bumps the version in pyproject.toml. Without this, a merge to main that

{devex_cli-0.26.0 → devex_cli-0.26.1}/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.26.1] - 2026-05-29
+
+### Added
+
+- SonarCloud CI-based analysis + coverage upload: a `sonarcloud` job in test.yml runs `pytest --cov` and the SHA-pinned `sonarqube-scan-action` (v6), reading `sonar-project.properties` + the `SONAR_TOKEN` secret. Coverage config lives in `pyproject.toml [tool.coverage.run]` (`relative_files` so coverage.xml paths map to `sonar.sources=src`).
+
+### Changed
+
+- SonarCloud moved from Automatic Analysis to CI-based analysis (the two are mutually exclusive); project now under the `agentculture` org. Updated CLAUDE.md / sonar-project.properties notes accordingly.
+
 ## [0.26.0] - 2026-05-29
 
 ### Added

{devex_cli-0.26.0 → devex_cli-0.26.1}/CLAUDE.md

@@ -78,15 +78,15 @@ uv run devex --version
 uv run devex explain devex
 uv run devex explain explain
 
-# Coverage (matches what build.yml runs; SonarCloud reads this file)
+# Coverage (matches the `sonarcloud` job in test.yml; SonarCloud reads coverage.xml)
 uv run pytest --cov=src/devex --cov-report=xml --cov-report=term
 ```
 
 ## CI surface
 
-- `.github/workflows/test.yml` — matrix: 3 OS × 4 Python (3.10–3.13) running `uv run pytest`. Also runs a `version-check` job on PRs that fails (with a sticky `<!-- version-check -->` comment) when `pyproject.toml`'s version on the PR matches the one on `main` and any code file under `src/` / `tests/` / `pyproject.toml` changed. Docs-only PRs skip the check.
+- `.github/workflows/test.yml` — matrix: 3 OS × 4 Python (3.10–3.13) running `uv run pytest`. Also runs (1) a `sonarcloud` job that generates `coverage.xml` (`pytest --cov`, repo-relative paths via `pyproject [tool.coverage.run]`) and runs the SHA-pinned `sonarqube-scan-action` (needs the `SONAR_TOKEN` repo secret); and (2) a `version-check` job on PRs that fails (with a sticky `<!-- version-check -->` comment) when `pyproject.toml`'s version on the PR matches the one on `main` and any code file under `src/` / `tests/` / `pyproject.toml` changed. Docs-only PRs skip the version check.
 - `.github/workflows/publish.yml` — builds sdist + wheel. PRs publish a per-PR dev version to TestPyPI (sticky install-command comment); pushes to `main` publish the stable version to TestPyPI (canary), then an `autotag` job pushes `v<version>` if missing, which gates the inline `publish-pypi` + `github-release` jobs. No manual tagging — bumping `pyproject.toml` is the release signal.
-- SonarCloud is configured as **Automatic Analysis** on the repo (no CI workflow). Coverage and quality are read by SonarCloud directly.
+- SonarCloud runs in **CI-based analysis** mode (Automatic Analysis is off — the two are mutually exclusive). The `sonarcloud` job in `test.yml` uploads coverage + triggers the scan via `sonarqube-scan-action`, reading `sonar-project.properties` and the `SONAR_TOKEN` secret. The quality gate decorates PRs and gates merges.
 - All third-party actions are **pinned to full commit SHAs** with trailing `# vN` comments (rule `githubactions:S7637`). Keep new actions pinned the same way.
 
 ## SonarCloud notes

{devex_cli-0.26.0 → devex_cli-0.26.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devex-cli
-Version: 0.26.0
+Version: 0.26.1
 Summary: Agent-operated developer-experience CLI — deterministic per-backend markdown briefings for autonomous agents.
 Project-URL: Homepage, https://culture.dev/devex/
 Project-URL: Repository, https://github.com/agentculture/devex

{devex_cli-0.26.0 → devex_cli-0.26.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devex-cli"
-version = "0.26.0"
+version = "0.26.1"
 description = "Agent-operated developer-experience CLI — deterministic per-backend markdown briefings for autonomous agents."
 authors = [{name = "Ori Nachum"}]
 license = {text = "MIT"}
@@ -45,6 +45,21 @@ packages = ["src/devex"]
 testpaths = ["tests"]
 addopts = "-n auto -v"
 
+[tool.coverage.run]
+source = ["src/devex"]
+# Emit repo-relative paths in coverage.xml so SonarCloud maps them to
+# sonar.sources=src (absolute / .venv paths fail to map → empty coverage).
+relative_files = true
+
+[tool.coverage.report]
+show_missing = true
+fail_under = 60
+exclude_lines = [
+    "pragma: no cover",
+    "if __name__ == .__main__.",
+    "if TYPE_CHECKING:",
+]
+
 [tool.black]
 line-length = 100
 

{devex_cli-0.26.0 → devex_cli-0.26.1}/sonar-project.properties

@@ -1,5 +1,5 @@
 sonar.projectKey=agentculture_devex
-sonar.organization=orinachum
+sonar.organization=agentculture
 
 # Displayed in SonarCloud UI
 sonar.projectName=devex
@@ -12,12 +12,11 @@ sonar.sourceEncoding=UTF-8
 # Python: target versions (matches CI matrix)
 sonar.python.version=3.10, 3.11, 3.12, 3.13
 
-# Coverage report path. SonarCloud runs in Automatic Analysis mode (no
-# CI-based scan — see PR #20). Automatic Analysis doesn't upload
-# pytest-cov output; this key remains so that if/when we ever revisit
-# coverage delivery, the file path is already declared. The bugs /
-# vulnerabilities / code-smells portion of the analysis works without
-# coverage and is what gates the PR quality gate today.
+# Coverage report path. SonarCloud now runs in CI-based analysis mode
+# (Automatic Analysis is OFF — the two are mutually exclusive). The `sonarcloud`
+# job in .github/workflows/test.yml runs `pytest --cov` (repo-relative paths
+# via pyproject [tool.coverage.run], so Sonar can match files) and the
+# sonarqube-scan-action uploads this report. Requires the SONAR_TOKEN repo secret.
 sonar.python.coverage.reportPaths=coverage.xml
 
 # S5496 triggers on render_string() because it renders a Jinja template with a

{devex_cli-0.26.0 → devex_cli-0.26.1}/uv.lock

@@ -202,7 +202,7 @@ toml = [
 
 [[package]]
 name = "devex-cli"
-version = "0.26.0"
+version = "0.26.1"
 source = { editable = "." }
 dependencies = [
     { name = "jinja2" },