docker-devkit 0.1.7__tar.gz → 0.1.8__tar.gz

docker_devkit-0.1.8/.github/workflows/ci.yml

@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Preflight
+        run: uvx --from python-devkit==0.1.5 preflight-python

{docker_devkit-0.1.7 → docker_devkit-0.1.8}/.github/workflows/release.yml

@@ -16,4 +16,10 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - uses: outernet-foundation/release-devkit/.github/actions/publish@098b8e918c50397fef2f6d7ed1bf2452c16267d6
+      # Workaround: fetch-tags is broken with shallow clones
+      - run: git fetch --tags origin
+
+      - uses: astral-sh/setup-uv@v7
+
+      - name: Publish
+        run: uvx --from release-devkit==0.1.3 publish-packages --config publish-config.json

{docker_devkit-0.1.7 → docker_devkit-0.1.8}/AGENTS.md

@@ -8,7 +8,7 @@ The package is `docker_devkit` (src-layout under `src/docker_devkit/`); all depe
 
 ## Release flow
 
-Publishing rides `release.yml`, triggered by a successful CI run on a `main` push: the machinery — release-devkit's publish composite action (pinned by SHA; the uvx invocation runs inside the caller's job, keeping OIDC identity local), never a project dependency (docker-devkit sits inside its own dependency graph; a project-level release-devkit edge is a resolver cycle) — computes the plan from the tag ledger and path-diff, patches the version ephemerally, and publishes to PyPI under OIDC trusted publishing (publisher bound to `release.yml`, no environment). The committed `pyproject.toml` version is permanently the `0.0.0.dev0` sentinel; the `docker-devkit-v*` tags are the version ledger (first release `0.1.0`, patch-auto thereafter). API-breaking changes ship with a manually bumped version — patch-auto assumes additive changes.
+Publishing rides `release.yml`, triggered by a successful CI run on a `main` push: the machinery — release-devkit's `publish-packages` (an inlined, version-pinned `uvx` step in the publish job, keeping OIDC identity local), never a project dependency (docker-devkit sits inside its own dependency graph; a project-level release-devkit edge is a resolver cycle) — computes the plan from the tag ledger and path-diff, patches the version ephemerally, and publishes to PyPI under OIDC trusted publishing (publisher bound to `release.yml`, no environment). The committed `pyproject.toml` version is permanently the `0.0.0.dev0` sentinel; the `docker-devkit-v*` tags are the version ledger (first release `0.1.0`, patch-auto thereafter). API-breaking changes ship with a manually bumped version — patch-auto assumes additive changes.
 
 ## Shape
 

{docker_devkit-0.1.7 → docker_devkit-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: docker-devkit
-Version: 0.1.7
+Version: 0.1.8
 Summary: Docker-stack lifecycle commands (up/down/build) with a native/consumer split
 License-File: LICENSE
 License-File: NOTICE

{docker_devkit-0.1.7 → docker_devkit-0.1.8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "docker-devkit"
-version = "0.1.7"
+version = "0.1.8"
 description = "Docker-stack lifecycle commands (up/down/build) with a native/consumer split"
 requires-python = ">=3.13"
 dependencies = [

{docker_devkit-0.1.7 → docker_devkit-0.1.8}/src/docker_devkit/build_docker.py

@@ -5,6 +5,7 @@ import os
 import platform
 import re
 from pathlib import Path
+from subprocess import CalledProcessError
 from typing import Annotated, Any, Literal
 
 import typer
@@ -15,6 +16,7 @@ from pydantic_settings import BaseSettings
 
 from .context_sha import compute_service_shas
 from .image_refs import bake_base_image_refs, compose_service_refs, resolve_remote_digest
+from .modes import parse_env_file
 
 
 class Settings(BaseSettings):
@@ -35,70 +37,6 @@ Mode = Literal["local", "ci"]
 app = typer.Typer(add_completion=False, pretty_exceptions_show_locals=False)
 
 
-def _load_lock_file(path: Path):
-    return {
-        (p := line.split("=", 1))[0].strip(): p[1].strip()
-        for line in path.read_text(encoding="utf-8").splitlines()
-        if "=" in line and not line.startswith("#")
-    }
-
-
-def _write_lock_file(path: Path, variables: dict[str, str]):
-    path.write_text(
-        "# Generated by lock.py\n" + "\n".join(f"{k}={v}" for k, v in sorted(variables.items())) + "\n",
-        encoding="utf-8",
-    )
-
-
-# Vibe code - Gemini 3
-def _check_gc_limits(min_gb: int = 60):
-    candidates = [Path("/etc/docker/daemon.json"), Path(os.path.expanduser("~/.docker/daemon.json"))]
-    if settings.wsl_distro_name is not None:
-        try:
-            win_home = bash_output('wslpath $(cmd.exe /c "echo %UserProfile%" 2>/dev/null)').strip()
-            candidates.append(Path(win_home) / ".docker" / "daemon.json")
-        except Exception:
-            pass
-
-    config = next((p for p in candidates if p.exists() and os.access(p, os.R_OK)), None)
-    if not config:
-        print(f"    [WARN] No readable daemon.json found. Ensure defaultKeepStorage > {min_gb}GB.")
-        return
-
-    data = json.loads(config.read_text())
-    raw = data.get("builder", {}).get("gc", {}).get("defaultKeepStorage")
-    if not raw:
-        sample = json.dumps({"builder": {"gc": {"defaultKeepStorage": f"{min_gb}GB"}}}, indent=2)
-        raise RuntimeError(
-            f"Missing 'builder.gc.defaultKeepStorage' in {config}; Docker's default is too low for GPU builds "
-            f"(need >= {min_gb}GB). Add the following (merging into any existing keys) and restart Docker:\n\n{sample}"
-        )
-
-    m = re.match(r"^(\d+(?:\.\d+)?)\s*([TGMK]i?B)?$", str(raw), re.IGNORECASE)
-    if not m:
-        raise RuntimeError(f"Could not parse 'defaultKeepStorage' value: {raw}")
-
-    mult = {"T": 1024, "G": 1, "M": 1 / 1024, "K": 1 / 1024**2, "B": 1 / 1024**3}
-    unit = (m.group(2) or "B")[0].upper()
-    val = float(m.group(1)) * mult.get(unit, 1 / 1024**3)
-
-    if val < min_gb:
-        raise RuntimeError(
-            f"UNSAFE GC LIMIT: {val:.1f}GB in {config} (Required: {min_gb}GB). RESTART DOCKER AFTER FIXING."
-        )
-
-    print(f"    [OK] Docker GC Limit verified: {val:.1f}GB")
-
-
-def _load_compose(path: Path) -> dict[str, Any]:
-    data: dict[str, Any] = yaml.safe_load(path.read_text(encoding="utf-8"))
-    for include in data.pop("include", []):
-        include_path = path.parent / (include if isinstance(include, str) else include["path"])
-        included: dict[str, Any] = yaml.safe_load(include_path.read_text(encoding="utf-8"))
-        data.setdefault("services", {}).update(included.get("services", {}))
-    return data
-
-
 @app.command()
 def build(
     upgrade: bool = typer.Option(False, "--upgrade", "-u", help="Re-resolve and rewrite base digests."),
@@ -153,8 +91,12 @@ def run_build(
 
     # Read bake, compose, and lock files
     bake_data: dict[str, Any] = yaml.safe_load(bake_file.read_text(encoding="utf-8"))
-    compose_data: dict[str, Any] = _load_compose(COMPOSE_FILE)
-    lock_data = _load_lock_file(LOCK_FILE) if LOCK_FILE.exists() else {}
+    compose_data: dict[str, Any] = yaml.safe_load(COMPOSE_FILE.read_text(encoding="utf-8"))
+    for include in compose_data.pop("include", []):
+        include_path = COMPOSE_FILE.parent / (include if isinstance(include, str) else include["path"])
+        included: dict[str, Any] = yaml.safe_load(include_path.read_text(encoding="utf-8"))
+        compose_data.setdefault("services", {}).update(included.get("services", {}))
+    lock_data = parse_env_file(LOCK_FILE) if LOCK_FILE.exists() else {}
 
     # TOOD: Create separate commands for ci and local modes so typer can do this validation instead of us
     if mode == "ci" and gpu == "auto":
@@ -185,18 +127,20 @@ def run_build(
         for occurrence in compose_service_refs(compose_data)
     }
 
-    def _needs_resolve(image: str, ref: str) -> bool:
-        if upgrade or image not in lock_data:
-            return True
-        # Re-resolve if the image name in compose.yml changed from what's in the lock file
-        # (e.g. postgres:16-alpine → postgis/postgis:16-3.4-alpine)
-        return not lock_data[image].startswith(ref + "@")
-
-    for image, ref in {image: ref for image, ref in third_party_images.items() if _needs_resolve(image, ref)}.items():
+    # Re-resolve when explicitly requested, when unseen, or when the image name in compose.yml
+    # changed from what's in the lock file (e.g. postgres:16-alpine → postgis/postgres:16-3.4-alpine)
+    for image, ref in {
+        image: ref
+        for image, ref in third_party_images.items()
+        if upgrade or image not in lock_data or not lock_data[image].startswith(ref + "@")
+    }.items():
         lock_data[image] = f"{ref}@{'' if '$' in ref else resolve_remote_digest(ref)}"
 
     # Update main lock file
-    _write_lock_file(LOCK_FILE, lock_data)
+    LOCK_FILE.write_text(
+        "# Generated by lock.py\n" + "\n".join(f"{key}={value}" for key, value in sorted(lock_data.items())) + "\n",
+        encoding="utf-8",
+    )
 
     if lock_only:
         return
@@ -272,6 +216,46 @@ def run_build(
         raise RuntimeError("Baked images do not match target images; something went wrong during the bake.")
 
 
+# Vibe code - Gemini 3
+def _check_gc_limits(min_gb: int = 60):
+    candidates = [Path("/etc/docker/daemon.json"), Path(os.path.expanduser("~/.docker/daemon.json"))]
+    if settings.wsl_distro_name is not None:
+        try:
+            win_home = bash_output('wslpath $(cmd.exe /c "echo %UserProfile%" 2>/dev/null)').strip()
+            candidates.append(Path(win_home) / ".docker" / "daemon.json")
+        except CalledProcessError:
+            pass
+
+    config = next((p for p in candidates if p.exists() and os.access(p, os.R_OK)), None)
+    if not config:
+        print(f"    [WARN] No readable daemon.json found. Ensure defaultKeepStorage > {min_gb}GB.")
+        return
+
+    data = json.loads(config.read_text())
+    raw = data.get("builder", {}).get("gc", {}).get("defaultKeepStorage")
+    if not raw:
+        sample = json.dumps({"builder": {"gc": {"defaultKeepStorage": f"{min_gb}GB"}}}, indent=2)
+        raise RuntimeError(
+            f"Missing 'builder.gc.defaultKeepStorage' in {config}; Docker's default is too low for GPU builds "
+            f"(need >= {min_gb}GB). Add the following (merging into any existing keys) and restart Docker:\n\n{sample}"
+        )
+
+    m = re.match(r"^(\d+(?:\.\d+)?)\s*([TGMK]i?B)?$", str(raw), re.IGNORECASE)
+    if not m:
+        raise RuntimeError(f"Could not parse 'defaultKeepStorage' value: {raw}")
+
+    mult = {"T": 1024, "G": 1, "M": 1 / 1024, "K": 1 / 1024**2, "B": 1 / 1024**3}
+    unit = (m.group(2) or "B")[0].upper()
+    val = float(m.group(1)) * mult.get(unit, 1 / 1024**3)
+
+    if val < min_gb:
+        raise RuntimeError(
+            f"UNSAFE GC LIMIT: {val:.1f}GB in {config} (Required: {min_gb}GB). RESTART DOCKER AFTER FIXING."
+        )
+
+    print(f"    [OK] Docker GC Limit verified: {val:.1f}GB")
+
+
 # x-cross-compile-targets: services declared here are excluded from the default
 # target list because they need special (usually per-arch) treatment; an operator
 # can still opt them in explicitly via --targets. The field is a top-level bake key.

{docker_devkit-0.1.7 → docker_devkit-0.1.8}/src/docker_devkit/context_sha.py

@@ -1,7 +1,5 @@
 from __future__ import annotations
 
-import os
-import subprocess
 from pathlib import Path, PurePosixPath
 from tempfile import TemporaryDirectory
 
@@ -9,33 +7,21 @@ from typing import Any
 
 import pathspec
 import yaml
+from bashrun.bash import bash, bash_output
 
 
-def _env_var_name(dockerfile_dir: str) -> str:
-    return PurePosixPath(dockerfile_dir).name.upper().replace("-", "_") + "_SHA"
-
+def compute_service_shas(repo_root: Path, bake_file: Path) -> dict[str, str]:
+    repo_root = repo_root.resolve()
 
-def _extract_service_dirs(bake_data: dict[str, Any]) -> set[str]:
+    bake_data: dict[str, Any] = yaml.safe_load(bake_file.read_text(encoding="utf-8"))
     service_dirs: set[str] = set()
-    services: dict[str, Any] = bake_data["services"]
-    for config in services.values():
+    for config in bake_data["services"].values():
         build: dict[str, Any] = config.get("build", {})
         if not build.get("tags"):
             continue
-        dockerfile: str = build.get("dockerfile", "")
-        service_dirs.add(str(PurePosixPath(dockerfile).parent))
-    return service_dirs
-
-
-def compute_service_shas(repo_root: Path, bake_file: Path) -> dict[str, str]:
-    repo_root = repo_root.resolve()
-
-    bake_data: dict[str, Any] = yaml.safe_load(bake_file.read_text(encoding="utf-8"))
-    service_dirs = _extract_service_dirs(bake_data)
+        service_dirs.add(str(PurePosixPath(build.get("dockerfile", "")).parent))
 
-    tree_entries = subprocess.run(
-        ["git", "ls-tree", "-r", "HEAD"], cwd=str(repo_root), capture_output=True, text=True, check=True
-    ).stdout.splitlines()
+    tree_entries = bash_output("git ls-tree -r HEAD", cwd=repo_root).splitlines()
 
     dockerignore = repo_root / ".dockerignore"
     spec = pathspec.PathSpec.from_lines("gitignore", dockerignore.read_text().splitlines())
@@ -67,20 +53,10 @@ def compute_service_shas(repo_root: Path, bake_file: Path) -> dict[str, str]:
         index_input = "\n".join(f"{mode} {obj_hash}\t{path}" for mode, obj_hash, path in entries) + "\n"
 
         with TemporaryDirectory() as tmpdir:
-            env = {**os.environ, "GIT_INDEX_FILE": str(Path(tmpdir) / "index")}
-            subprocess.run(
-                ["git", "update-index", "--index-info"],
-                cwd=str(repo_root),
-                env=env,
-                input=index_input.encode(),
-                capture_output=True,
-                check=True,
-            )
-            tree_hash = subprocess.run(
-                ["git", "write-tree"], cwd=str(repo_root), env=env, capture_output=True, text=True, check=True
-            ).stdout.strip()
+            index_env = {"GIT_INDEX_FILE": str(Path(tmpdir) / "index")}
+            bash("git update-index --index-info", cwd=repo_root, env=index_env, stdin_text=index_input)
+            tree_hash = bash_output("git write-tree", cwd=repo_root, env=index_env).strip()
 
-        var_name = _env_var_name(service_dir)
-        result[var_name] = f"tree-{tree_hash}"
+        result[PurePosixPath(service_dir).name.upper().replace("-", "_") + "_SHA"] = f"tree-{tree_hash}"
 
     return result

{docker_devkit-0.1.7 → docker_devkit-0.1.8}/src/docker_devkit/down.py

@@ -13,11 +13,6 @@ ENV_FILE = Path(".env")
 LOCK_FILE = Path(".env.lock")
 BAKE_FILE = Path("compose.bake.yml")
 
-
-def _resolve_service_shas() -> None:
-    os.environ.update(compute_service_shas(Path.cwd(), BAKE_FILE))
-
-
 app = typer.Typer(add_completion=False)
 
 
@@ -53,7 +48,7 @@ def down(
     resolve_auth_mode(ENV_FILE)
 
     if BAKE_FILE.exists():
-        _resolve_service_shas()
+        os.environ.update(compute_service_shas(Path.cwd(), BAKE_FILE))
 
     if native:
         compose_files = (

{docker_devkit-0.1.7 → docker_devkit-0.1.8}/src/docker_devkit/image_refs.py

@@ -76,6 +76,17 @@ class VersionCoupling:
     sites: tuple[VersionSite, ...]
 
 
+def unpinned_references(root: Path) -> list[str]:
+    return [
+        occurrence.reference
+        for occurrence in collect_repo_references(root)
+        if "/" in (reference := strip_build_args(occurrence.reference))
+        and not BUILD_ARG_PATTERN.search(occurrence.reference)
+        and ":" not in (tail := reference[reference.rfind("/") + 1 :])
+        and "@" not in tail
+    ]
+
+
 def collect_repo_references(
     root: Path,
     compose_glob: str = "compose*.yml",
@@ -121,47 +132,37 @@ def collect_repo_references(
     )
 
 
-def compose_service_refs(document: object) -> list[ImageReference]:
+def version_coupling_violations(root: Path, couplings: list[VersionCoupling]) -> list[str]:
     return [
-        ImageReference(service_name, service.image_ref)
-        for service_name, service in ComposeDocument.model_validate(document).services.items()
-        if service.image_ref is not None
+        f"{coupling.name}: {site.description} at {path}: expected {expected}, found {found}"
+        for coupling in couplings
+        for expected in [re.sub(r"^[^0-9]+", "", _pyproject_value(root, coupling.pyproject_key)).split(",")[0].strip()]
+        for site in coupling.sites
+        for path in sorted(root.glob(site.glob)) or [Path(site.glob)]
+        for found in [_site_version(path, site)]
+        if found != expected
     ]
 
 
-def bake_base_image_refs(document: object) -> list[ImageReference]:
-    return list(starmap(ImageReference, BakeDocument.model_validate(document).base_images.items()))
-
-
-def _load_yaml_document(path: Path) -> object:
-    return yaml.safe_load(path.read_text(encoding="utf-8"))
-
-
-def strip_build_args(reference: str) -> str:
-    return BUILD_ARG_PATTERN.sub("", reference).strip()
+def resolve_remote_digest(reference: str) -> str:
+    print(f"Resolving digest for: {reference}")
+    output = bash_output(f"docker buildx imagetools inspect {shlex.quote(reference)}")
+    match = DIGEST_PATTERN.search(output)
+    if match is None:
+        raise RuntimeError(f"Could not parse digest for image reference: {reference}")
+    return match.group(1)
 
 
-def unpinned_references(root: Path) -> list[str]:
+def compose_service_refs(document: object) -> list[ImageReference]:
     return [
-        occurrence.reference
-        for occurrence in collect_repo_references(root)
-        if "/" in (reference := strip_build_args(occurrence.reference))
-        and not BUILD_ARG_PATTERN.search(occurrence.reference)
-        and ":" not in (tail := reference[reference.rfind("/") + 1 :])
-        and "@" not in tail
+        ImageReference(service_name, service.image_ref)
+        for service_name, service in ComposeDocument.model_validate(document).services.items()
+        if service.image_ref is not None
     ]
 
 
-def version_coupling_violations(root: Path, couplings: list[VersionCoupling]) -> list[str]:
-    return [
-        f"{coupling.name}: {site.description} at {path}: expected {expected}, found {found}"
-        for coupling in couplings
-        for expected in [_declared_version(_pyproject_value(root, coupling.pyproject_key))]
-        for site in coupling.sites
-        for path in _site_paths(root, site)
-        for found in [_site_version(path, site)]
-        if found != expected
-    ]
+def strip_build_args(reference: str) -> str:
+    return BUILD_ARG_PATTERN.sub("", reference).strip()
 
 
 def _pyproject_value(root: Path, dotted_key: str) -> str:
@@ -175,33 +176,27 @@ def _pyproject_value(root: Path, dotted_key: str) -> str:
     return value
 
 
-def _declared_version(specifier: str) -> str:
-    return re.sub(r"^[^0-9]+", "", specifier).split(",")[0].strip()
-
-
-def _site_paths(root: Path, site: VersionSite) -> list[Path]:
-    return sorted(root.glob(site.glob)) or [Path(site.glob)]
-
-
 def _site_version(path: Path, site: VersionSite) -> str:
     if not path.exists():
         return MISSING_VERSION
-    haystack = _bake_base_image(path, site.base_image) if site.base_image else path.read_text(encoding="utf-8")
+    if site.base_image:
+        haystack = next(
+            (
+                reference.reference
+                for reference in bake_base_image_refs(_load_yaml_document(path))
+                if reference.name == site.base_image
+            ),
+            "",
+        )
+    else:
+        haystack = path.read_text(encoding="utf-8")
     match = re.search(site.pattern, haystack)
     return match.group(1) if match else MISSING_VERSION
 
 
-def _bake_base_image(path: Path, key: str) -> str:
-    return next(
-        (reference.reference for reference in bake_base_image_refs(_load_yaml_document(path)) if reference.name == key),
-        "",
-    )
+def bake_base_image_refs(document: object) -> list[ImageReference]:
+    return list(starmap(ImageReference, BakeDocument.model_validate(document).base_images.items()))
 
 
-def resolve_remote_digest(reference: str) -> str:
-    print(f"Resolving digest for: {reference}")
-    output = bash_output(f"docker buildx imagetools inspect {shlex.quote(reference)}")
-    match = DIGEST_PATTERN.search(output)
-    if match is None:
-        raise RuntimeError(f"Could not parse digest for image reference: {reference}")
-    return match.group(1)
+def _load_yaml_document(path: Path) -> object:
+    return yaml.safe_load(path.read_text(encoding="utf-8"))

{docker_devkit-0.1.7 → docker_devkit-0.1.8}/src/docker_devkit/up.py

@@ -14,11 +14,6 @@ ENV_FILE = Path(".env")
 LOCK_FILE = Path(".env.lock")
 BAKE_FILE = Path("compose.bake.yml")
 
-
-def _resolve_service_shas() -> None:
-    os.environ.update(compute_service_shas(Path.cwd(), BAKE_FILE))
-
-
 app = typer.Typer(add_completion=False)
 
 
@@ -77,7 +72,7 @@ def up(
         run_build(gpu=gpu)
 
     if BAKE_FILE.exists():
-        _resolve_service_shas()
+        os.environ.update(compute_service_shas(Path.cwd(), BAKE_FILE))
 
     profile_flag = "--profile keycloak " if auth_mode == "keycloak" else ""
     if native:

docker_devkit-0.1.7/.github/workflows/ci.yml

@@ -1,15 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  check:
-    uses: outernet-foundation/python-devkit/.github/workflows/check.yml@19b4656947784ce1d3225e35a96a21c45f7725f9

{docker_devkit-0.1.7 → docker_devkit-0.1.8}/src/docker_devkit/modes.py

@@ -6,17 +6,6 @@ VALID_AUTH_MODES = ("keycloak", "disabled")
 DEFAULT_AUTH_MODE = "keycloak"
 
 
-def parse_env_file(path: Path) -> dict[str, str]:
-    result: dict[str, str] = {}
-    for raw_line in path.read_text().splitlines():
-        line = raw_line.strip()
-        if not line or line.startswith("#") or "=" not in line:
-            continue
-        key, _, value = line.partition("=")
-        result[key.strip()] = value.strip().strip("'\"")
-    return result
-
-
 def resolve_auth_mode(env_file: Path) -> str:
     file_values = parse_env_file(env_file)
     public_url = environ.get("PUBLIC_URL") or file_values.get("PUBLIC_URL")
@@ -37,3 +26,14 @@ def resolve_auth_mode(env_file: Path) -> str:
         )
 
     return auth_mode
+
+
+def parse_env_file(path: Path) -> dict[str, str]:
+    result: dict[str, str] = {}
+    for raw_line in path.read_text().splitlines():
+        line = raw_line.strip()
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+        key, _, value = line.partition("=")
+        result[key.strip()] = value.strip().strip("'\"")
+    return result