fiberpath 0.5.3__tar.gz → 0.6.1__tar.gz

{fiberpath-0.5.3 → fiberpath-0.6.1}/.github/actions/setup-node/action.yml

@@ -5,7 +5,7 @@ inputs:
   node-version:
     description: Node.js version to use
     required: false
-    default: "20"
+    default: "24"
   working-directory:
     description: Working directory for npm install
     required: false

fiberpath-0.6.1/.github/dependabot.yml

@@ -0,0 +1,122 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    target-branch: "main"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 8
+    labels:
+      - "dependencies"
+      - "python"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      python-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      python-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+
+  - package-ecosystem: "npm"
+    directory: "/fiberpath_gui"
+    target-branch: "main"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:15"
+      timezone: "UTC"
+    open-pull-requests-limit: 8
+    labels:
+      - "dependencies"
+      - "gui"
+      - "node"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      npm-dev-minor-patch:
+        dependency-type: "development"
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      npm-prod-minor-patch:
+        dependency-type: "production"
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      npm-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+    ignore:
+      - dependency-name: "@types/node"
+        versions: ["25.x"]
+
+  - package-ecosystem: "cargo"
+    directory: "/fiberpath_gui/src-tauri"
+    target-branch: "main"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:30"
+      timezone: "UTC"
+    open-pull-requests-limit: 8
+    labels:
+      - "dependencies"
+      - "rust"
+      - "tauri"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      cargo-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      cargo-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    target-branch: "main"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:45"
+      timezone: "UTC"
+    open-pull-requests-limit: 8
+    labels:
+      - "dependencies"
+      - "ci"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      github-actions-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      github-actions-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"

{fiberpath-0.5.3 → fiberpath-0.6.1}/.github/workflows/backend-ci.yml

@@ -1,28 +1,11 @@
 name: Backend CI
 
 on:
-  push:
-    branches: [main, v0.5.1-dev]
-    paths:
-      - "fiberpath/**"
-      - "fiberpath_api/**"
-      - "fiberpath_cli/**"
-      - "tests/**"
-      - "pyproject.toml"
-      - "uv.lock"
-      - "setup.cfg"
-      - ".github/workflows/backend-ci.yml"
-      - ".github/actions/setup-python/**"
-  pull_request:
-    paths:
-      - "fiberpath/**"
-      - "fiberpath_api/**"
-      - "fiberpath_cli/**"
-      - "tests/**"
-      - "pyproject.toml"
-      - "setup.cfg"
-      - ".github/workflows/backend-ci.yml"
-      - ".github/actions/setup-python/**"
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
   lint-and-type-check:
@@ -30,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python
@@ -56,7 +39,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python
@@ -69,7 +52,7 @@ jobs:
 
       - name: Upload coverage
         if: matrix.os == 'ubuntu-latest'
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v6
         with:
           files: ./coverage.xml
           flags: backend

fiberpath-0.6.1/.github/workflows/ci-check.yml

@@ -0,0 +1,152 @@
+name: CI Check
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "fiberpath/**"
+      - "fiberpath_api/**"
+      - "fiberpath_cli/**"
+      - "fiberpath_gui/**"
+      - "docs/**"
+      - "tests/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "setup.cfg"
+      - "mkdocs.yml"
+      - "README.md"
+      - "scripts/sync_gui_docs.py"
+      - ".github/workflows/ci-check.yml"
+      - ".github/workflows/backend-ci.yml"
+      - ".github/workflows/gui-ci.yml"
+      - ".github/workflows/docs-ci.yml"
+      - ".github/actions/setup-python/**"
+      - ".github/actions/setup-node/**"
+      - ".github/actions/setup-rust/**"
+  pull_request:
+    branches: [main]
+    paths:
+      - "fiberpath/**"
+      - "fiberpath_api/**"
+      - "fiberpath_cli/**"
+      - "fiberpath_gui/**"
+      - "docs/**"
+      - "tests/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "setup.cfg"
+      - "mkdocs.yml"
+      - "README.md"
+      - "scripts/sync_gui_docs.py"
+      - ".github/workflows/ci-check.yml"
+      - ".github/workflows/backend-ci.yml"
+      - ".github/workflows/gui-ci.yml"
+      - ".github/workflows/docs-ci.yml"
+      - ".github/actions/setup-python/**"
+      - ".github/actions/setup-node/**"
+      - ".github/actions/setup-rust/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    name: Detect Changes
+    runs-on: ubuntu-latest
+    outputs:
+      backend: ${{ steps.filter.outputs.backend }}
+      gui: ${{ steps.filter.outputs.gui }}
+      docs: ${{ steps.filter.outputs.docs }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Detect changed areas
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            backend:
+              - "fiberpath/**"
+              - "fiberpath_api/**"
+              - "fiberpath_cli/**"
+              - "tests/**"
+              - "pyproject.toml"
+              - "uv.lock"
+              - "setup.cfg"
+              - ".github/workflows/backend-ci.yml"
+              - ".github/actions/setup-python/**"
+            gui:
+              - "fiberpath_gui/**"
+              - "!fiberpath_gui/docs/**"
+              - ".github/workflows/gui-ci.yml"
+              - ".github/actions/setup-node/**"
+              - ".github/actions/setup-rust/**"
+            docs:
+              - "docs/**"
+              - "fiberpath_gui/docs/**"
+              - "mkdocs.yml"
+              - "scripts/sync_gui_docs.py"
+              - "README.md"
+              - ".github/workflows/docs-ci.yml"
+              - ".github/actions/setup-python/**"
+
+  backend:
+    name: Backend
+    needs: changes
+    if: needs.changes.outputs.backend == 'true'
+    uses: ./.github/workflows/backend-ci.yml
+
+  gui:
+    name: GUI
+    needs: changes
+    if: needs.changes.outputs.gui == 'true'
+    uses: ./.github/workflows/gui-ci.yml
+
+  docs:
+    name: Docs
+    needs: changes
+    if: needs.changes.outputs.docs == 'true'
+    uses: ./.github/workflows/docs-ci.yml
+
+  ci-check:
+    name: CI Check
+    runs-on: ubuntu-latest
+    needs: [changes, backend, gui, docs]
+    if: always()
+    steps:
+      - name: Verify called workflow results
+        run: |
+          echo "changes=${{ needs.changes.result }}"
+          echo "backend=${{ needs.backend.result }}"
+          echo "gui=${{ needs.gui.result }}"
+          echo "docs=${{ needs.docs.result }}"
+
+          FAIL=0
+
+          if [[ "${{ needs.changes.result }}" != "success" ]]; then
+            echo "Change detection did not succeed"
+            FAIL=1
+          fi
+
+          if [[ "${{ needs.backend.result }}" == "failure" || "${{ needs.backend.result }}" == "cancelled" ]]; then
+            echo "Backend workflow failed"
+            FAIL=1
+          fi
+
+          if [[ "${{ needs.gui.result }}" == "failure" || "${{ needs.gui.result }}" == "cancelled" ]]; then
+            echo "GUI workflow failed"
+            FAIL=1
+          fi
+
+          if [[ "${{ needs.docs.result }}" == "failure" || "${{ needs.docs.result }}" == "cancelled" ]]; then
+            echo "Docs workflow failed"
+            FAIL=1
+          fi
+
+          if [[ "$FAIL" -ne 0 ]]; then
+            exit 1
+          fi
+
+          echo "CI Check passed"

fiberpath-0.6.1/.github/workflows/dependency-audit.yml

@@ -0,0 +1,119 @@
+name: Dependency Audit
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 7 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  python-audit:
+    name: Python Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Python environment
+        uses: ./.github/actions/setup-python
+        with:
+          dependencies: ".[dev,api,cli,plot]"
+
+      - name: Export requirements for audit
+        run: uv export --all-extras --no-hashes --format requirements-txt -o requirements-audit.txt
+
+      - name: Run pip-audit (JSON report)
+        run: uvx --with pip-audit pip-audit -r requirements-audit.txt --format json --output pip-audit.json
+
+      - name: Upload pip-audit report
+        uses: actions/upload-artifact@v7
+        with:
+          name: pip-audit-report
+          path: pip-audit.json
+          retention-days: 30
+
+  npm-audit:
+    name: npm Audit
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: fiberpath_gui
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js environment
+        uses: ./.github/actions/setup-node
+
+      - name: Run npm audit (high/critical gate)
+        run: npm audit --audit-level=high --json > npm-audit.json
+
+      - name: Upload npm audit report
+        uses: actions/upload-artifact@v7
+        with:
+          name: npm-audit-report
+          path: fiberpath_gui/npm-audit.json
+          retention-days: 30
+
+  cargo-audit:
+    name: Cargo Audit
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: fiberpath_gui/src-tauri
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup-rust
+        with:
+          install-linux-deps: "false"
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: Run cargo audit (JSON report)
+        run: cargo audit --json > cargo-audit.json
+
+      - name: Enforce CVSS >= 7.0 gate
+        run: |
+          python - <<'PY'
+          import json
+          from pathlib import Path
+
+          report = json.loads(Path("cargo-audit.json").read_text(encoding="utf-8"))
+          vulns = report.get("vulnerabilities", {}).get("list", [])
+
+          blocking = []
+          for item in vulns:
+              advisory = item.get("advisory", {})
+              cvss = advisory.get("cvss")
+              if cvss is None:
+                  continue
+              try:
+                  score = float(cvss)
+              except (TypeError, ValueError):
+                  continue
+              if score >= 7.0:
+                  blocking.append((advisory.get("id", "unknown"), score, advisory.get("title", "")))
+
+          if blocking:
+              print("High/Critical Cargo advisories detected:")
+              for advisory_id, score, title in blocking:
+                  print(f"- {advisory_id} (CVSS {score}): {title}")
+              raise SystemExit(1)
+
+          print("No Cargo advisories with CVSS >= 7.0 detected.")
+          PY
+
+      - name: Upload cargo audit report
+        uses: actions/upload-artifact@v7
+        with:
+          name: cargo-audit-report
+          path: fiberpath_gui/src-tauri/cargo-audit.json
+          retention-days: 30

{fiberpath-0.5.3 → fiberpath-0.6.1}/.github/workflows/docs-ci.yml

@@ -1,25 +1,11 @@
 name: Docs CI
 
 on:
-  push:
-    branches: [main, v0.5.1-dev]
-    paths:
-      - "docs/**"
-      - "fiberpath_gui/docs/**"
-      - "mkdocs.yml"
-      - "scripts/sync_gui_docs.py"
-      - "README.md"
-      - ".github/workflows/docs-ci.yml"
-      - ".github/actions/setup-python/**"
-  pull_request:
-    paths:
-      - "docs/**"
-      - "fiberpath_gui/docs/**"
-      - "mkdocs.yml"
-      - "scripts/sync_gui_docs.py"
-      - "README.md"
-      - ".github/workflows/docs-ci.yml"
-      - ".github/actions/setup-python/**"
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
   validate:
@@ -27,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python

{fiberpath-0.5.3 → fiberpath-0.6.1}/.github/workflows/docs-deploy.yml

@@ -29,11 +29,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Configure GitHub Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python
@@ -47,7 +47,7 @@ jobs:
         run: uv run mkdocs build --strict --site-dir site
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v4
         with:
           path: site
 
@@ -61,4 +61,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

{fiberpath-0.5.3 → fiberpath-0.6.1}/.github/workflows/gui-ci.yml

@@ -1,21 +1,11 @@
 name: GUI CI
 
 on:
-  push:
-    branches: [main, v0.5.1-dev]
-    paths:
-      - "fiberpath_gui/**"
-      - "!fiberpath_gui/docs/**"
-      - ".github/workflows/gui-ci.yml"
-      - ".github/actions/setup-node/**"
-      - ".github/actions/setup-rust/**"
-  pull_request:
-    paths:
-      - "fiberpath_gui/**"
-      - "!fiberpath_gui/docs/**"
-      - ".github/workflows/gui-ci.yml"
-      - ".github/actions/setup-node/**"
-      - ".github/actions/setup-rust/**"
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
   lint-and-type-check:
@@ -26,7 +16,7 @@ jobs:
         working-directory: fiberpath_gui
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js environment
         uses: ./.github/actions/setup-node
@@ -57,7 +47,7 @@ jobs:
         working-directory: fiberpath_gui
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js environment
         uses: ./.github/actions/setup-node
@@ -69,7 +59,7 @@ jobs:
         run: npm run test:coverage
 
       - name: Upload coverage
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v6
         with:
           files: ./fiberpath_gui/coverage/lcov.info
           flags: gui