figgyplot 0.2.1__tar.gz

figgyplot-0.2.1/.gitattributes

@@ -0,0 +1,5 @@
+# Keep first-party package sources identical in every platform wheel.
+/python/figgyplot/** text eol=lf
+# Upstream JS/WASM assets are content-addressed in provenance.json. Preserve
+# their exact bytes on every platform, including Windows core.autocrlf=true.
+/python/figgyplot/assets/* -text

figgyplot-0.2.1/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,41 @@
+name: Bug report
+description: Report a reproducible figgyplot failure.
+title: "[Bug]: "
+body:
+  - type: markdown
+    attributes:
+      value: "For security reports, use SECURITY.md and the private reporting channel."
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Expected and actual behavior
+      description: Describe the failure and what should happen.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Paste runnable Python code with synthetic data. Remove secrets and private datasets.
+      render: python
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Include commit/version, OS/architecture, Python and NumPy, backend, GPU/driver, and browser/Jupyter versions when applicable.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Error message and logs
+      description: Include the full exception and relevant logs, with credentials removed.
+      render: text
+  - type: textarea
+    id: verification
+    attributes:
+      label: Reproduction details
+      description: Mention repeated runs, input size, resize/DPI, or close/reopen behavior when relevant.
+

figgyplot-0.2.1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,9 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Private security report
+    url: mailto:ssy9610@gmail.com
+    about: Send vulnerabilities privately; do not post credentials or exploit details in public issues.
+  - name: Usage and installation documentation
+    url: https://github.com/shim9610/figgy-python/blob/main/README.md
+    about: Read installation, interactive editing and notebook instructions.
+

figgyplot-0.2.1/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,24 @@
+name: Feature request
+description: Suggest a plotting, editing or integration improvement.
+title: "[Feature]: "
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or use case
+      description: Explain what you are trying to do and the current limitation.
+    validations:
+      required: true
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Proposed behavior
+      description: Give an API or interaction example, including the target backend.
+    validations:
+      required: true
+  - type: textarea
+    id: constraints
+    attributes:
+      label: Data size and compatibility needs
+      description: Mention OS, Python/browser versions, data sizes and performance needs.
+

figgyplot-0.2.1/.github/codeql-config.yml

@@ -0,0 +1,5 @@
+name: figgyplot source
+paths-ignore:
+  # Generated, pinned upstream artifacts are verified by provenance hashes.
+  - python/figgyplot/assets/**
+

figgyplot-0.2.1/.github/dependabot.yml

@@ -0,0 +1,37 @@
+version: 2
+# Regular update PRs stay paused during stabilization. Setting the limit to 3
+# after PR CI is enabled activates them. Security alerts/updates are independent
+# repository settings; this file does not enable those switches.
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    groups:
+      actions:
+        patterns: ["*"]
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    groups:
+      python-dependencies:
+        patterns: ["*"]
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    groups:
+      rust-dependencies:
+        patterns: ["*"]
+    # Renderer/host versions must move together in a reviewed compatibility PR.
+    ignore:
+      - dependency-name: figgy-renderer
+      - dependency-name: figgy-model
+      - dependency-name: wgpu
+      - dependency-name: egui*
+      - dependency-name: winit
+

figgyplot-0.2.1/.github/pull_request_template.md

@@ -0,0 +1,18 @@
+Describe the problem and resulting behavior, including a concrete before/after
+example when useful.
+
+## Validation
+
+List checks you actually ran, including the tested OS, Python, backend and GPU.
+Distinguish software-GPU tests from hardware tests and explain skipped checks.
+
+## Compatibility and remaining limits
+
+Mention API/settings changes, data-transfer/resource lifetimes, packaging or
+platform limitations relevant to review. Note any renderer change and why its
+public API is sufficient.
+
+- [ ] Relevant checks pass and formatting is clean.
+- [ ] Upstream JS/WASM hashes remain valid, or an intentional rebuild is documented.
+- [ ] No secrets or private datasets are included.
+

figgyplot-0.2.1/.github/workflows/codeql.yml

@@ -0,0 +1,48 @@
+name: CodeQL
+
+on:
+  workflow_dispatch:
+  # Enable alongside PR CI after its first successful manual scan.
+  # pull_request:
+  #   branches: [main]
+  # push:
+  #   branches: [main]
+  # schedule:
+  #   - cron: '23 3 * * 1'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: CodeQL / ${{ matrix.language }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript-typescript, rust]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-extended
+          config-file: ./.github/codeql-config.yml
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        with:
+          category: /language:${{ matrix.language }}
+

figgyplot-0.2.1/.github/workflows/pr-tests.yml

@@ -0,0 +1,99 @@
+name: PR tests
+
+on:
+  workflow_dispatch:
+  # The manual run passed; required PR checks have no path filters.
+  pull_request:
+    branches: [main]
+  # merge_group:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pr-tests-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  preflight:
+    name: PR / Workflow and assets
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: PyO3/maturin-action
+          ref: e83996d129638aa358a18fbd1dfb82f0b0fb5d3b
+          path: .ci/maturin-action
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - run: bash scripts/ci-preflight.sh
+
+  integration:
+    name: PR / Linux integration
+    needs: preflight
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      CARGO_BUILD_JOBS: '4'
+      WGPU_BACKEND: vulkan
+      FIGGY_TEST_JUPYTER: '1'
+      FIGGY_TEST_HEADFUL: '1'
+      FIGGYPLOT_MATURIN_ACTION: .ci/maturin-action/action.yml
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: PyO3/maturin-action
+          ref: e83996d129638aa358a18fbd1dfb82f0b0fb5d3b
+          path: .ci/maturin-action
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master
+        with:
+          toolchain: '1.99.0'
+          components: rustfmt
+      - name: Install native software-GPU and X11 runtime
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y git mesa-vulkan-drivers libvulkan1 libxkbcommon0 libxkbcommon-x11-0 xvfb xdotool xclip openbox wmctrl
+      - name: Build and install the exact PR wheel
+        run: |
+          uv python install 3.12
+          uv venv .venv --python 3.12
+          uv pip install --python .venv/bin/python 'maturin>=1.15,<2'
+          .venv/bin/python -m maturin build --release --locked --compatibility linux --out dist -i .venv/bin/python
+          for wheel in dist/*.whl; do
+            uv pip install --python .venv/bin/python --only-binary=:all: "${wheel}[test]"
+          done
+          uv pip install --python .venv/bin/python --only-binary=:all: 'PyYAML>=6,<7' 'playwright>=1.50,<2' 'jupyterlab>=4,<5' 'nbformat>=5,<6' 'ipykernel>=6'
+          .venv/bin/python scripts/check_installed.py
+          .venv/bin/python scripts/check_x11_runtime.py
+      - name: Install Chromium and select software GPU drivers
+        run: |
+          .venv/bin/python -m playwright install --with-deps chromium
+          .venv/bin/python scripts/ci_gpu_env.py
+      - name: Test native surface, editing and real JupyterLab WebGPU
+        run: |
+          cargo fmt --check
+          xvfb-run -a -s '-screen 0 1600x1000x24' bash <<'SCRIPT'
+            set -euo pipefail
+            openbox > /tmp/figgyplot-openbox.log 2>&1 &
+            wm_pid=$!
+            trap 'kill "$wm_pid" 2>/dev/null || true' EXIT
+            .venv/bin/python -m pytest -q --basetemp=ci-results --junitxml=ci-results/junit.xml
+          SCRIPT
+      - name: Save integration results
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: pr-linux-integration-results
+          path: ci-results
+          retention-days: 5
+          if-no-files-found: ignore
+

figgyplot-0.2.1/.github/workflows/publish.yml

@@ -0,0 +1,238 @@
+name: Publish figgyplot (manual only)
+
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: 'TestPyPI build/upload, or promote a successful TestPyPI run to PyPI'
+        type: choice
+        options: [testpypi, pypi]
+        default: testpypi
+        required: true
+      version:
+        description: 'Exact source version (public upload to the selected index)'
+        required: true
+        type: string
+        default: '0.2.1'
+      testpypi-run-id:
+        description: 'Required for PyPI: successful TestPyPI run at this exact main commit'
+        type: string
+        default: ''
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-figgyplot
+  cancel-in-progress: false
+
+jobs:
+  gate:
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+      - name: Require main and the exact source version
+        id: version
+        env:
+          REQUESTED_VERSION: ${{ inputs.version }}
+          RELEASE_TARGET: ${{ inputs.target }}
+          TEST_RUN_ID: ${{ inputs.testpypi-run-id }}
+        run: |
+          python - <<'PY'
+          import ast, os, tomllib
+          from pathlib import Path
+          if os.environ['GITHUB_REF'] != 'refs/heads/main':
+              raise SystemExit('Publication is allowed only from main; select main in Run workflow.')
+          if os.environ['RELEASE_TARGET'] not in ('testpypi', 'pypi'):
+              raise SystemExit('Target must be testpypi or pypi.')
+          if os.environ['RELEASE_TARGET'] == 'pypi' and not (os.environ['TEST_RUN_ID'].isdecimal() and int(os.environ['TEST_RUN_ID']) > 0):
+              raise SystemExit('PyPI promotion requires the successful TestPyPI run ID.')
+          project = tomllib.loads(Path('pyproject.toml').read_text())['project']
+          cargo = tomllib.loads(Path('Cargo.toml').read_text())['package']
+          version = project['version']
+          module = ast.parse(Path('python/figgyplot/__init__.py').read_text())
+          python_version = next(ast.literal_eval(node.value) for node in module.body if isinstance(node, ast.Assign) and any(isinstance(t, ast.Name) and t.id == '__version__' for t in node.targets))
+          if project['name'] != 'figgyplot' or cargo['version'] != version or python_version != version or os.environ['REQUESTED_VERSION'] != version:
+              raise SystemExit('Input, pyproject.toml, Cargo.toml and Python package versions must match exactly.')
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              output.write(f'version={version}\n')
+          PY
+
+  build:
+    needs: gate
+    if: inputs.target == 'testpypi'
+    uses: ./.github/workflows/wheels.yml
+    permissions:
+      contents: read
+
+  validate:
+    needs: [gate, build]
+    if: inputs.target == 'testpypi'
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: wheels-*
+          path: artifacts
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: figgyplot-sdist
+          path: artifacts/figgyplot-sdist
+      - run: python -m pip install 'packaging>=24' 'PyYAML>=6,<7' twine
+      - name: Validate every wheel, sdist, version and packaged asset
+        run: |
+          python scripts/prepare_release.py artifacts dist release-manifest/manifest.json
+          python -m twine check --strict dist/*
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: figgyplot-release-files
+          path: dist/*
+          if-no-files-found: error
+          retention-days: 30
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: figgyplot-release-manifest
+          path: release-manifest/manifest.json
+          if-no-files-found: error
+          retention-days: 30
+
+  promote:
+    name: Verify tested distributions for PyPI
+    needs: gate
+    if: inputs.target == 'pypi'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+      - name: Read the successful TestPyPI run and all installation jobs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TEST_RUN_ID: ${{ inputs.testpypi-run-id }}
+        run: |
+          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$TEST_RUN_ID" > tested-run.json
+          gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/actions/runs/$TEST_RUN_ID/jobs?per_page=100" > tested-jobs.json
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: figgyplot-release-files
+          path: dist
+          run-id: ${{ inputs.testpypi-run-id }}
+          github-token: ${{ github.token }}
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: figgyplot-release-manifest
+          path: release-manifest
+          run-id: ${{ inputs.testpypi-run-id }}
+          github-token: ${{ github.token }}
+      - run: python -m pip install 'packaging>=24' 'PyYAML>=6,<7' twine
+      - name: Verify provenance, complete coverage and every byte before promotion
+        env:
+          TEST_RUN_ID: ${{ inputs.testpypi-run-id }}
+        run: |
+          python scripts/check_promotion.py tested-run.json tested-jobs.json dist release-manifest/manifest.json "$TEST_RUN_ID"
+          python -m twine check --strict dist/*
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: figgyplot-release-files
+          path: dist/*
+          if-no-files-found: error
+          retention-days: 30
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: figgyplot-release-manifest
+          path: release-manifest/manifest.json
+          if-no-files-found: error
+          retention-days: 30
+
+  publish:
+    name: Upload to ${{ inputs.target == 'pypi' && 'PyPI' || 'TestPyPI' }}
+    needs: [gate, validate, promote]
+    # One preparation branch is intentionally skipped; the selected one must pass.
+    if: >-
+      always() && !cancelled() && needs.gate.result == 'success' &&
+      ((inputs.target == 'testpypi' && needs.validate.result == 'success') ||
+       (inputs.target == 'pypi' && needs.promote.result == 'success'))
+    runs-on: ubuntu-24.04
+    environment:
+      name: ${{ inputs.target }}
+      url: https://${{ inputs.target == 'pypi' && 'pypi.org' || 'test.pypi.org' }}/project/figgyplot/
+    # OIDC exists only here; build/test jobs receive no publishing permission.
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: figgyplot-release-files
+          path: dist
+      - name: Publish with Trusted Publishing and attestations
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          repository-url: https://${{ inputs.target == 'pypi' && 'upload.pypi.org' || 'test.pypi.org' }}/legacy/
+          packages-dir: dist/
+          attestations: true
+          skip-existing: false
+
+  install:
+    name: ${{ inputs.target == 'pypi' && 'PyPI' || 'TestPyPI' }} install / ${{ matrix.runner }} / Python ${{ matrix.python }}
+    needs: [gate, publish]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {runner: ubuntu-24.04, python: '3.12'}
+          - {runner: ubuntu-24.04-arm, python: '3.12'}
+          - {runner: windows-latest, python: '3.12'}
+          - {runner: windows-11-arm, python: '3.12'}
+          - {runner: macos-15-intel, python: '3.12'}
+          - {runner: macos-15, python: '3.12'}
+          - {runner: ubuntu-24.04, python: '3.8'}
+          - {runner: ubuntu-24.04, python: '3.15t'}
+          - {runner: windows-11-arm, python: '3.15t'}
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: figgyplot-release-manifest
+          path: release-manifest
+      - name: Download from TestPyPI, compare published bytes and install
+        shell: bash
+        env:
+          TEST_PYTHON: ${{ matrix.python }}
+          RELEASE_VERSION: ${{ needs.gate.outputs.version }}
+          RELEASE_TARGET: ${{ inputs.target }}
+        run: |
+          uv python install "$TEST_PYTHON"
+          uv venv .testpypi --python "$TEST_PYTHON"
+          if [ -f .testpypi/Scripts/python.exe ]; then
+            test_python=.testpypi/Scripts/python.exe
+          else
+            test_python=.testpypi/bin/python
+          fi
+          # Resolve dependencies from PyPI; figgyplot is downloaded ONLY from TestPyPI.
+          uv pip install --python "$test_python" pip 'packaging>=24' 'numpy>=1.24' 'anywidget>=0.9,<1'
+          "$test_python" scripts/check_testpypi.py release-manifest/manifest.json "$RELEASE_VERSION" "$RELEASE_TARGET"
+          "$test_python" scripts/check_installed.py