devpi-process 1.3.1__tar.gz → 1.3.3__tar.gz

devpi_process-1.3.3/.github/SECURITY.md

@@ -0,0 +1,49 @@
+# Security policy
+
+devpi-process is a Python library that starts a throwaway devpi server, creates indexes on it, and uploads packages, for
+use in tests. This policy says how to report a security problem and how we decide whether a report is one.
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security problem.** Use
+[GitHub's private vulnerability reporting](https://github.com/tox-dev/devpi-process/security/advisories/new). If you do
+not have a GitHub account, or you are a Tidelift subscriber, report through the
+[Tidelift security contact](https://tidelift.com/security) instead; Tidelift coordinates the fix and the disclosure with
+us. If neither works for you, email [gaborjbernat@gmail.com](mailto:gaborjbernat@gmail.com).
+
+Include what the attacker controls and what they gain, the steps or a proof of concept, and the versions and platform
+you tested. Write the report yourself; unreviewed tool or model output takes longer to triage.
+
+## What to expect
+
+Volunteers maintain devpi-process, with no on-call rotation. We aim to acknowledge a report within **5 working days**
+and assess it within **15 working days**. Fixes are developed in a private fork attached to the draft advisory, ship in
+a new release, and the advisory, with a CVE requested through GitHub, goes out with that release. The default embargo is
+**90 days** from the report; we agree any change with the reporter. We credit reporters in the advisory under the name
+they choose, or not at all. There is no bug bounty.
+
+## Supported versions
+
+Only the latest release receives fixes. Confirm the problem reproduces on it before reporting.
+
+## Vulnerability or bug
+
+A report is a vulnerability when an attacker who controls only an input that the [threat model](THREAT_MODEL.md) lists
+as untrusted breaks a guarantee devpi-process makes. A report that first needs control of something the threat model
+trusts, such as the test code that drives it or the devpi tools it runs, is a bug: we fix it in the open and publish no
+advisory. Classify by who supplies the dangerous input, not by how bad the outcome sounds.
+
+**In scope**
+
+- devpi-process starting the server on an interface other than localhost when the caller passes no `start_args`.
+- devpi-process running a program other than the `devpi-init`, `devpi-server` and `devpi` in the interpreter's scripts
+  directory, or passing caller data to them as anything but separate arguments.
+- Server data written outside the directory the caller passed.
+
+**Out of scope**
+
+- Using devpi-process as a production package index: it is a test helper.
+- Other local users reaching the server's port or reading its command line on a shared machine (see accepted risks).
+- Vulnerabilities in devpi itself; report them to [devpi](https://github.com/devpi/devpi).
+
+If you cannot tell which side a finding falls on, report it privately and we will decide.

devpi_process-1.3.3/.github/THREAT_MODEL.md

@@ -0,0 +1,93 @@
+# Threat model
+
+This model says what devpi-process trusts, where untrusted input enters, and which guarantees hold at each boundary, so
+a report can be classified as a vulnerability or a bug. [SECURITY.md](SECURITY.md) covers reporting; if the two
+disagree, SECURITY.md wins and we fix this file.
+
+## How devpi-process works
+
+`IndexServer(path)` runs `devpi-init` to initialize a server directory with a random root password, starts
+`devpi-server` on a free port at its default host, `localhost`, and drives the `devpi` client to log in as root, create
+indexes and upload distributions. The three programs come from the interpreter's scripts directory and run with argument
+lists, never a shell. Upstream PyPI is off unless `with_root_pypi` is set. When the context manager exits, the server
+process stops.
+
+```mermaid
+flowchart LR
+    test["Test code<br/>(trusted)"] --> dp["devpi-process"]
+    dp -->|"devpi-init, devpi-server,<br/>devpi (argument lists)"| srv["devpi server on localhost"]
+    srv <--> dir[("Server directory")]
+    local["Other local users"] -.->|"can reach the port"| srv
+    classDef trusted fill:#cfe4ff,stroke:#1f6feb,color:#0b1f3a;
+    classDef boundary fill:#ffe3a3,stroke:#d29200,color:#3a2c00;
+    class test,dp trusted;
+    class srv,dir,local boundary;
+```
+
+## Compared with similar tools
+
+We drew the boundary where comparable projects in other ecosystems draw theirs. The shared rule, stated by the
+[Node.js threat model](https://github.com/nodejs/node/blob/main/SECURITY.md#the-nodejs-threat-model), is that a report
+which first needs a trusted element compromised is out of scope; the first triage question, as
+[DOMPurify](https://github.com/cure53/DOMPurify/blob/main/SECURITY.md#what-we-consider-a-vulnerability) puts it, is what
+the attacker controls.
+
+| Project                                                                                 | Language   | Where it draws the line                                                                                                             |
+| --------------------------------------------------------------------------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------- |
+| [Verdaccio](https://github.com/verdaccio/verdaccio/security/policy)                     | JavaScript | Private registry; reports go through Snyk.                                                                                          |
+| [distribution (registry)](https://github.com/distribution/distribution/security/policy) | Go         | The OCI registry used as a test fixture; private reports to its CNCF list.                                                          |
+| [Vitest](https://github.com/vitest-dev/vitest/security/policy)                          | JavaScript | Trusts the developer, the config file, plugins and every project file; only reports that need no trusted element compromised count. |
+
+## Trusted
+
+An attacker who controls any of these already has what devpi-process could give them:
+
+- The test code and every path, index name, argument and file it passes, `start_args` included.
+- The devpi tools in the interpreter's scripts directory, and the packages uploaded.
+
+## Untrusted inputs
+
+| Input           | Comes from                            | What devpi-process guarantees                                                                         |
+| --------------- | ------------------------------------- | ----------------------------------------------------------------------------------------------------- |
+| Network clients | Anything that can connect to the port | The server listens on `localhost` unless `start_args` change it; uploads need the generated password. |
+
+## Threats and controls
+
+| STRIDE                 | Threat                                                 | Control                                                                            |
+| ---------------------- | ------------------------------------------------------ | ---------------------------------------------------------------------------------- |
+| Spoofing               | Another process logs in as root.                       | A random root password is generated for each server.                               |
+| Information disclosure | Another local user reads the root password.            | Accepted risk: it is passed to `devpi-init` and `devpi login` on the command line. |
+| Tampering              | Caller data injects shell syntax into a devpi command. | Programs run with argument lists, never a shell.                                   |
+
+## Release chain
+
+Releases run on the shared [tox-dev/github-workflows](https://github.com/tox-dev/github-workflows) pipeline. A release
+App, not a person, pushes the release commit and tag; the build installs its tools from a hash-checked `pylock.toml`
+resolved with a seven-day upload cooldown by default; PyPI receives the files through
+[trusted publishing](https://docs.pypi.org/trusted-publishers/) with attestations, and the GitHub Release is immutable.
+Every workflow pins third-party actions to a commit SHA.
+
+## Vulnerability or bug
+
+| Report                                                          | Verdict       | Why                                         |
+| --------------------------------------------------------------- | ------------- | ------------------------------------------- |
+| The server listens on `0.0.0.0` by default                      | Vulnerability | Exposes a test index to the network.        |
+| An index name with `;` runs a shell command                     | Vulnerability | Arguments must stay data.                   |
+| Another user on a shared CI host sees the root password in `ps` | Accepted risk | Documented below; use a single-user runner. |
+
+## Severity
+
+- **High:** a caller value runs as a shell command, or the server listens beyond localhost without `start_args` asking
+  for it.
+- **Medium:** server data written outside the caller's directory, or a program other than the devpi tools runs.
+- **Low:** the server fails to stop, or leaves files behind, after the context manager exits.
+
+## Accepted risks
+
+- The root password is 8 letters from Python's `random`, and it is visible in the process list while `devpi-init` and
+  `devpi login` run. devpi-process is for tests on single-user machines and CI runners.
+
+## Keeping this current
+
+Revisit this model when devpi-process gains a new input source, network access, a new way to run code, or a new place it
+writes to, and whenever an advisory is published.

devpi_process-1.3.3/.github/dependabot.yaml

@@ -0,0 +1,30 @@
+version: 2
+multi-ecosystem-groups:
+  dependencies:
+    schedule:
+      interval: weekly
+      day: tuesday
+    labels:
+      - dependencies
+      - skip news
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    patterns:
+      - '*'
+    multi-ecosystem-group: dependencies
+    labels:
+      - dependencies
+      - skip news
+    cooldown:
+      default-days: 7
+  - package-ecosystem: pre-commit
+    directory: /
+    patterns:
+      - '*'
+    multi-ecosystem-group: dependencies
+    labels:
+      - dependencies
+      - skip news
+    cooldown:
+      default-days: 7

devpi_process-1.3.3/.github/workflows/check.yaml

@@ -0,0 +1,46 @@
+name: 🧪 check
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+    tags-ignore: ["**"]
+  pull_request:
+    types: [opened, synchronize, reopened]
+  schedule:
+    - cron: "0 8 * * *"
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  test:
+    name: 🧪 Test
+    uses: tox-dev/github-workflows/.github/workflows/check.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+    with:
+      pytest-addopts: "-vv --durations=5"
+      include: |
+        [
+          {"env": "3.15"},
+          {"env": "3.15t", "python": "3.15t"},
+          {"env": "3.14", "python": "3.14"},
+          {"env": "3.13", "python": "3.13"},
+          {"env": "3.12", "python": "3.12"},
+          {"env": "3.11", "python": "3.11"},
+          {"env": "type"},
+          {"env": "dev"},
+          {"env": "pkg_meta"}
+        ]
+  gate:
+    name: 🚦 Required checks pass
+    if: ${{ !cancelled() }} # codespell:ignore cancelled
+    needs: [test]
+    runs-on: ubuntu-26.04
+    permissions: {}
+    steps:
+      - name: 🚦 Require all needed jobs to pass
+        uses: tox-dev/github-workflows/required-checks@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+        with:
+          needs: ${{ toJSON(needs) }}

devpi_process-1.3.3/.github/workflows/codeql.yaml

@@ -0,0 +1,22 @@
+name: 🛡️ CodeQL
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+  pull_request:
+  schedule:
+    - cron: "0 9 * * 2"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+jobs:
+  analyze:
+    name: 🛡️ Analyze
+    uses: tox-dev/github-workflows/.github/workflows/codeql.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      languages: '["actions","python"]'
+      paths-ignore: '["tests"]'

devpi_process-1.3.3/.github/workflows/news.yaml

@@ -0,0 +1,30 @@
+name: 📝 Changelog
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+permissions:
+  contents: read
+  pull-requests: read
+jobs:
+  changelog:
+    name: 📝 News fragment
+    runs-on: ubuntu-26.04
+    steps:
+      - name: 📥 Check out code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: 🐍 Install uv
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          version: latest-known
+          python-version: "3.15"
+          enable-cache: false
+      - name: 📦 Install locked release tools
+        uses: tox-dev/github-workflows/install-locked-tools@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+        with:
+          groups: release-news
+          venv: ${{ runner.temp }}/release-tools
+      - name: 🔍 Validate news fragments
+        uses: tox-dev/github-workflows/validate-news@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0

devpi_process-1.3.3/.github/workflows/prepare-release.yaml

@@ -0,0 +1,25 @@
+name: 🏷️ Prepare release
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: Version bump type
+        required: true
+        type: choice
+        options:
+          - auto
+          - major
+          - minor
+          - patch
+        default: auto
+permissions:
+  contents: read
+  pull-requests: read
+jobs:
+  prepare:
+    name: 🏷️ Prepare Towncrier release
+    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    with:
+      bump: ${{ inputs.bump }}
+    secrets:
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

devpi_process-1.3.3/.github/workflows/release.yaml

@@ -0,0 +1,57 @@
+name: 🚀 Release to PyPI
+on:
+  push:
+    tags: ["*"]
+permissions:
+  contents: read
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  build:
+    name: 🏗️ Build
+    uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+  notes:
+    name: 📝 Render GitHub Release notes
+    uses: tox-dev/github-workflows/.github/workflows/release-notes.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+    with:
+      tag: ${{ github.ref_name }}
+      changelog: CHANGELOG.md
+      artifact-url: https://pypi.org/project/devpi-process/${{ github.ref_name }}/
+  release:
+    name: 🚀 Publish to PyPI
+    needs:
+      - build
+      - notes
+    runs-on: ubuntu-26.04
+    environment:
+      name: release
+      url: https://pypi.org/project/devpi-process/${{ github.ref_name }}
+    permissions:
+      id-token: write # PyPI verifies this workflow through OIDC.
+    steps:
+      - name: 📩 Download distributions
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          artifact-ids: ${{ needs.build.outputs.distributions-artifact-id }}
+          path: dist/
+      - name: 🚀 Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        with:
+          packages-dir: dist
+  github-release:
+    name: 🚀 Publish GitHub Release
+    needs: [build, release, notes]
+    uses: tox-dev/github-workflows/.github/workflows/github-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: write # GitHub Release creation and edits require this permission.
+    with:
+      project: devpi-process
+      version: ${{ github.ref_name }}
+      tag: ${{ github.ref_name }}
+      artifact-pattern: python-package-distributions
+      notes-artifact-id: ${{ needs.notes.outputs.artifact-id }}

devpi_process-1.3.3/.github/workflows/scorecard.yaml

@@ -0,0 +1,26 @@
+name: 🛡️ scorecard
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "30 7 * * 2"
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+jobs:
+  analysis:
+    name: 🛡️ Scorecard analysis
+    if: github.repository == 'tox-dev/devpi-process'
+    permissions:
+      actions: read # read workflow runs for the Packaging check
+      checks: read # read check runs for the CI-Tests and SAST checks
+      contents: read # check out and scan the repository
+      id-token: write # authenticate the results published to the scorecard API
+      issues: read # read issue activity for the Maintained check
+      pull-requests: read # read reviews for the Code-Review check
+      security-events: write # upload the SARIF results to code scanning
+      statuses: read # read commit statuses for the CI-Tests check
+    uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0

devpi_process-1.3.3/.github/workflows/upgrade-release-tools.yaml

@@ -0,0 +1,22 @@
+name: 🔒 Upgrade release tools
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 8 * * 2"
+permissions: {}
+concurrency:
+  group: upgrade-release-tools
+  cancel-in-progress: false
+jobs:
+  upgrade:
+    name: 🔀 Upgrade release tools
+    uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+    secrets:
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+    with:
+      commit-message: "build(deps): refresh release lock"
+      pull-request-title: "build(deps): refresh project lock"
+      pull-request-body: |-
+        Relock `pylock.toml` with Nab after the seven-day cooldown.

{devpi_process-1.3.1 → devpi_process-1.3.3}/.gitignore

@@ -5,3 +5,4 @@ coverage.xml
 __pycache__
 **.pyc
 src/devpi_process/_version.py
+/uv.lock

{devpi_process-1.3.1 → devpi_process-1.3.3}/.pre-commit-config.yaml

@@ -1,50 +1,50 @@
+ci:
+  autoupdate_schedule: quarterly
 default_language_version:
   python: python3.15
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
     hooks:
       - id: end-of-file-fixer
       - id: trailing-whitespace
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.38.2
+    rev: a76b92851fc9eede9f9bc4073eb55202f34eb0df # frozen: 0.39.0
     hooks:
       - id: check-github-workflows
         args: ["--verbose"]
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.3
+    rev: 57b21406f092110c18776e39b0bda50d37c945c8 # frozen: v2.4.3
     hooks:
       - id: codespell
   - repo: https://github.com/tox-dev/tox-toml-fmt
-    rev: "v1.11.1"
+    rev: 5125f601c3e134347288c3d42f3b34298b7cf1be # frozen: v1.11.1
     hooks:
       - id: tox-toml-fmt
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: "v2.30.3"
+    rev: 50e0f3aee9dc5747a5f173f79a7417403c18dda6 # frozen: v2.30.3
     hooks:
       - id: pyproject-fmt
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: "v0.17.0"
+    rev: 25bcf95026b96e2dd3c0aec3090c3d6ef6ca2e6c # frozen: v0.17.3
     hooks:
       - id: ruff-format
-      - id: ruff
+      - id: ruff-check
         args: ["--fix", "--unsafe-fixes", "--exit-non-zero-on-fix"]
   - repo: https://github.com/google/yamlfmt
-    rev: "v0.21.0"
+    rev: 21ca5323a9c87ee37a434e0ca908efc0a89daa07 # frozen: v0.21.0
     hooks:
       - id: yamlfmt
-  - repo: local
+  - repo: https://github.com/executablebooks/mdformat
+    rev: 82912cdaea4fb830f751504486a7879c70526547 # frozen: 1.0.0
     hooks:
       - id: mdformat
-        name: mdformat
-        entry: mdformat --wrap 120
-        language: python
-        types: [markdown]
+        args: ["--wrap", "120"]
         additional_dependencies:
-          - mdformat-gfm>=1
-          - mdformat-ruff>=0.1.3
+          - mdformat-gfm==1.0.0
+          - mdformat-ruff==0.1.3
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
-    rev: v1.30.1
+    rev: c92afdf2c6ca336aaa8f39e2bd8d48f62dbd8e1f # frozen: v1.31.1
     hooks:
       - id: zizmor
   - repo: meta

devpi_process-1.3.3/CHANGELOG.md

@@ -0,0 +1,132 @@
+# Changelog
+
+<!-- towncrier release notes start -->
+
+<a name="release-1-3-3"></a>
+
+## 1.3.3 (2026-11-04)
+
+<a name="release-1-3-2"></a>
+
+## 1.3.2 (2026-10-27)
+
+<a name="release-1-3-2-fixed"></a>
+
+### Fixed
+
+- Fix repository links in the PyPI project description ([#292](https://github.com/tox-dev/devpi-process/pull/292)) by
+  [@gaborbernat](https://github.com/gaborbernat).
+
+<a name="release-1-3-1"></a>
+
+## 1.3.1 (2026-10-19)
+
+<a name="release-1-3-1-documentation"></a> <a name="release-1-3-1-packaging"></a>
+
+### Packaging
+
+- Publish a GitHub Release with the tagged changelog after each PyPI upload
+  ([#290](https://github.com/tox-dev/devpi-process/pull/290)) by [@gaborbernat](https://github.com/gaborbernat).
+
+<a name="release-1-3-0"></a>
+
+## 1.3.0 (2026-10-10)
+
+<a name="release-1-3-0-changes"></a> <a name="release-1-3-0-added"></a>
+
+### Added
+
+- Require Python 3.11 ([#284](https://github.com/tox-dev/devpi-process/pull/284)) by
+  [@gaborbernat](https://github.com/gaborbernat).
+
+<a name="release-1-2-0"></a>
+
+## 1.2.0 (2026-07-21)
+
+<a name="release-1-2-0-other-changes"></a> <a name="release-1-2-0-added"></a>
+
+### Added
+
+- Add Python 3.15 support ([#262](https://github.com/tox-dev/devpi-process/pull/262)) by
+  [@gaborbernat](https://github.com/gaborbernat).
+
+<a name="release-1-1-1"></a>
+
+## 1.1.1 (2026-02-23)
+
+<a name="release-1-1-0"></a>
+
+## 1.1.0 (2025-10-09)
+
+<a name="release-1-1-0-added"></a>
+
+### Added
+
+- Add Python 3.14 support and end support for Python 3.8 and 3.9
+  ([#196](https://github.com/tox-dev/devpi-process/pull/196)) by [@gaborbernat](https://github.com/gaborbernat).
+
+<a name="release-1-0-2"></a>
+
+## 1.0.2 (2024-09-18)
+
+<a name="release-1-0-1"></a>
+
+## 1.0.1 (2024-09-08)
+
+<a name="release-1-0-1-added"></a>
+
+### Added
+
+- Declare Python 3.13 support ([#130](https://github.com/tox-dev/devpi-process/pull/130)) by
+  [@gaborbernat](https://github.com/gaborbernat).
+
+<a name="release-1-0-0"></a>
+
+## 1.0.0 (2023-08-22)
+
+<a name="release-0-3-1"></a>
+
+## 0.3.1 (2023-06-15)
+
+<a name="release-0-3-0"></a>
+
+## 0.3.0 (2022-12-03)
+
+<a name="release-0-3-0-changes"></a> <a name="release-0-3-0-added"></a>
+
+### Added
+
+- Declare Python 3.11 support ([#31](https://github.com/tox-dev/devpi-process/pull/31)) by
+  [@gaborbernat](https://github.com/gaborbernat).
+
+<a name="release-0-3-0-fixed"></a>
+
+### Fixed
+
+- Show stdout/stderr details if a command fails by [@gaborbernat](https://github.com/gaborbernat).
+
+<a name="release-0-2"></a>
+
+## 0.2 (2021-12-29)
+
+<a name="release-0-2-other-changes"></a> <a name="release-0-2-added"></a>
+
+### Added
+
+- Drop Python 3.6 support by [@gaborbernat](https://github.com/gaborbernat).
+
+<a name="release-0-2-fixed"></a>
+
+### Fixed
+
+- Index URL now ends with `/` to avoid redirect when sending a GET by [@gaborbernat](https://github.com/gaborbernat).
+
+<a name="release-0-1"></a>
+
+## 0.1 (2021-06-17)
+
+<a name="release-0-1-added"></a>
+
+### Added
+
+- First release by [@gaborbernat](https://github.com/gaborbernat).

devpi_process-1.3.3/CONTRIBUTING.md

@@ -0,0 +1,36 @@
+# Contributing
+
+Run the tests and type checker with `tox -e 3.15,type`. Run `prek run --all-files` before pushing a pull request.
+
+## Release notes
+
+Add a `changelog.d/+short-name.<type>.md` fragment when a pull request changes what package users can use or observe.
+Use one fragment per user-facing change. The release workflow links each fragment to its merged squash pull request.
+
+| Type          | Changelog section | Use for                                                    |
+| ------------- | ----------------- | ---------------------------------------------------------- |
+| `feature`     | Added             | New capabilities and Python support additions or removals  |
+| `change`      | Changes           | Changed behavior that remains available                    |
+| `bugfix`      | Fixed             | Corrected behavior                                         |
+| `doc`         | Documentation     | Documentation changes users need to know about             |
+| `breaking`    | Breaking changes  | Changes that require users to update code or configuration |
+| `security`    | Security          | Security fixes users need to act on                        |
+| `performance` | Performance       | User-visible speed or resource improvements                |
+| `deprecation` | Deprecated        | Supported behavior scheduled for removal                   |
+| `removal`     | Removed           | Removed user-facing capabilities other than Python support |
+| `packaging`   | Packaging         | Install, wheel, or distribution changes                    |
+
+Use `skip news` for a pull request with no user-facing change. The label can be applied after the pull request opens. A
+fragment still has to be valid when the label is present. Dependabot, pre-commit.ci, and repository automation receive
+the label when their pull request has no fragment.
+
+Do not write credits in fragments. The release credits come from the commit authors and `Co-authored-by` trailers, and
+the prepare workflow runs `release-creator contributors` to add first-time contributors to the changelog.
+
+Pending fragments stay in `changelog.d` until a release. The prepare workflow writes the tagged entries to
+`CHANGELOG.md`; maintenance-only releases keep their version heading without a news entry. The GitHub Release uses the
+same entries with unwrapped lines. The PyPI upload runs only after the notes render.
+
+`pylock.toml` records the selectable dependency groups for supported Python versions and platforms. The weekly release
+lock workflow refreshes it after a seven-day cooldown. Release jobs install the specific tool groups they need from this
+lock.