forge-publish 2.3.0__tar.gz

forge_publish-2.3.0/.github/scripts/pypi-distributions.py

@@ -0,0 +1,54 @@
+"""Verify GitHub release assets and stage only their wheel/sdist for PyPI."""
+
+import argparse
+import hashlib
+import re
+import shutil
+from pathlib import Path
+
+
+def stage_distributions(assets: Path, output: Path, tag: str) -> None:
+    if not re.fullmatch(r"v\d+\.\d+\.\d+", tag):
+        raise ValueError("Expected a stable vMAJOR.MINOR.PATCH release tag")
+    version = tag[1:]
+    distributions = {
+        f"forge_publish-{version}-py3-none-any.whl",
+        f"forge_publish-{version}.tar.gz",
+    }
+    expected = distributions | {"forge-publish.cdx.json"}
+    files = expected | {"SHA256SUMS"}
+    if {path.name for path in assets.iterdir()} != files:
+        raise ValueError("Release assets must contain exactly the expected four files")
+    if any(
+        (assets / name).is_symlink() or not (assets / name).is_file() for name in files
+    ):
+        raise ValueError("Release assets must be regular files")
+    hashes = {}
+    for line in (assets / "SHA256SUMS").read_text(encoding="utf-8").splitlines():
+        match = re.fullmatch(r"([0-9a-f]{64})  (.+)", line)
+        if not match or match[2] not in expected or match[2] in hashes:
+            raise ValueError("Invalid, duplicate or unexpected checksum entry")
+        hashes[match[2]] = match[1]
+    if hashes.keys() != expected:
+        raise ValueError("Checksum manifest must cover every release artifact")
+    for name, digest in hashes.items():
+        with (assets / name).open("rb") as file:
+            if hashlib.file_digest(file, "sha256").hexdigest() != digest:
+                raise ValueError(f"Checksum mismatch: {name}")
+    # Validate everything before creating a directory accepted by the upload action.
+    output.mkdir(parents=True, exist_ok=False)
+    for name in sorted(distributions):
+        shutil.copyfile(assets / name, output / name)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--assets", type=Path, required=True)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--tag", required=True)
+    arguments = parser.parse_args()
+    stage_distributions(arguments.assets, arguments.output, arguments.tag)
+
+
+if __name__ == "__main__":
+    main()

forge_publish-2.3.0/.github/scripts/release-checksums.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Missing a distribution or its SBOM must fail before attestation/publication.
+cd "${1:-dist}"
+sha256sum -- *.whl *.tar.gz forge-publish.cdx.json > SHA256SUMS
+sha256sum --check SHA256SUMS

forge_publish-2.3.0/.github/scripts/release-sbom.py

@@ -0,0 +1,245 @@
+"""Generate a validated release SBOM from an installed wheel's runtime closure."""
+
+import argparse
+import hashlib
+import json
+import os
+import subprocess
+import sys
+import tarfile
+import tempfile
+import tomllib
+import zipfile
+from email.parser import BytesParser
+from pathlib import Path
+from urllib.parse import quote, urlsplit
+
+import tomli_w
+from cyclonedx.schema import SchemaVersion
+from cyclonedx.validation.json import JsonStrictValidator
+from packaging.requirements import Requirement
+from packaging.utils import canonicalize_name
+
+ROOT = Path(__file__).resolve().parents[2]
+FILENAME = "forge-publish.cdx.json"
+
+
+def distribution_metadata(path: Path):
+    if path.suffix == ".whl":
+        with zipfile.ZipFile(path) as archive:
+            names = [n for n in archive.namelist() if n.endswith(".dist-info/METADATA")]
+            if len(names) != 1:
+                raise ValueError("Expected one wheel metadata file")
+            data = archive.read(names[0])
+    else:
+        with tarfile.open(path) as archive:
+            members = [
+                m
+                for m in archive
+                if m.name.count("/") == 1 and m.name.endswith("/PKG-INFO")
+            ]
+            if len(members) != 1:
+                raise ValueError("Expected one source distribution metadata file")
+            stream = archive.extractfile(members[0])
+            if stream is None:
+                raise ValueError("Source distribution metadata is not a file")
+            data = stream.read()
+    return BytesParser().parsebytes(data)
+
+
+def runtime_closure(bom: dict) -> None:
+    """Keep only dependencies reachable from the application, excluding bootstrap tools."""
+    root_ref = bom["metadata"]["component"]["bom-ref"]
+    graph = {d["ref"]: d for d in bom["dependencies"]}
+    components = {c["bom-ref"]: c for c in bom["components"]}
+    pending, reachable = [root_ref], set()
+    while pending:
+        ref = pending.pop()
+        if ref in reachable:
+            continue
+        if ref not in graph or (ref != root_ref and ref not in components):
+            raise ValueError("Incomplete runtime dependency graph")
+        reachable.add(ref)
+        pending.extend(graph[ref].get("dependsOn", []))
+    bom["components"] = [c for c in bom["components"] if c["bom-ref"] in reachable]
+    bom["dependencies"] = [d for d in bom["dependencies"] if d["ref"] in reachable]
+
+
+def validate(bom: dict) -> str:
+    text = json.dumps(bom, indent=2, sort_keys=True, ensure_ascii=False) + "\n"
+    if JsonStrictValidator(SchemaVersion.V1_6).validate_str(text) is not None:
+        raise ValueError("SBOM does not conform to the CycloneDX 1.6 JSON schema")
+
+    # Metadata comes from controlled distributions, never from CI environment
+    # variables. Fail closed if a generator/tool update introduces private URLs.
+    def check(value):
+        if isinstance(value, dict):
+            for key, item in value.items():
+                if key == "url":
+                    parsed = urlsplit(item)
+                    if (
+                        parsed.scheme not in {"https", "http"}
+                        or parsed.username
+                        or parsed.password
+                    ):
+                        raise ValueError("SBOM contains a local or authenticated URL")
+                check(item)
+        elif isinstance(value, list):
+            for item in value:
+                check(item)
+
+    check(bom)
+    return text
+
+
+def generate(runtime_python: Path, dist: Path, project_file: Path) -> Path:
+    wheels, sources = sorted(dist.glob("*.whl")), sorted(dist.glob("*.tar.gz"))
+    if len(wheels) != 1 or len(sources) != 1:
+        raise ValueError("Expected exactly one wheel and one source distribution")
+    metadata = distribution_metadata(wheels[0])
+    source_metadata = distribution_metadata(sources[0])
+    project = tomllib.loads(project_file.read_text(encoding="utf-8"))["project"]
+    name, version = metadata["Name"], metadata["Version"]
+    if (name, version) != (project["name"], project["version"]) or (name, version) != (
+        source_metadata["Name"],
+        source_metadata["Version"],
+    ):
+        raise ValueError("Project, wheel and source distribution versions/names differ")
+    environment = json.loads(
+        subprocess.check_output(
+            [
+                str(runtime_python),
+                "-c",
+                (
+                    "import importlib.metadata as m,json,platform,sys; "
+                    "d=m.distribution('forge-publish'); "
+                    "print(json.dumps({'version':d.version,'requires':d.requires,"
+                    "'python':platform.python_version(),'platform':sys.platform,"
+                    "'isolated':sys.prefix!=sys.base_prefix and "
+                    "not __import__('site').ENABLE_USER_SITE}))"
+                ),
+            ],
+            text=True,
+        )
+    )
+    if not environment["isolated"]:
+        raise ValueError("SBOM requires an isolated runtime virtual environment")
+    if environment["version"] != version or sorted(
+        environment["requires"] or []
+    ) != sorted(metadata.get_all("Requires-Dist", [])):
+        raise ValueError(
+            "Runtime environment does not contain the release wheel metadata"
+        )
+    # Use the built wheel's metadata, after Semantic Release's version bump.
+    # Optional dev/release extras are intentionally outside this runtime profile.
+    requirements = []
+    for value in metadata.get_all("Requires-Dist", []):
+        requirement = Requirement(value)
+        if requirement.marker is None or "extra" not in str(requirement.marker):
+            requirements.append(value)
+    root_project = {
+        "project": {
+            "name": name,
+            "version": version,
+            "description": metadata["Summary"],
+            "license": metadata["License-Expression"],
+            "dependencies": requirements,
+        }
+    }
+    with tempfile.TemporaryDirectory() as directory:
+        manifest, output = (
+            Path(directory) / "pyproject.toml",
+            Path(directory) / "sbom.json",
+        )
+        manifest.write_text(tomli_w.dumps(root_project), encoding="utf-8")
+        env = os.environ.copy()
+        env.pop("SOURCE_DATE_EPOCH", None)
+        subprocess.run(
+            [
+                sys.executable,
+                "-m",
+                "cyclonedx_py",
+                "environment",
+                str(runtime_python),
+                "--pyproject",
+                str(manifest),
+                "--spec-version",
+                "1.6",
+                "--output-format",
+                "JSON",
+                "--output-reproducible",
+                "--validate",
+                "--output-file",
+                str(output),
+            ],
+            check=True,
+            env=env,
+        )
+        bom = json.loads(output.read_text(encoding="utf-8"))
+    runtime_closure(bom)
+    root = bom["metadata"]["component"]
+    if (root["name"], root["version"]) != (name, version):
+        raise ValueError("Generated SBOM has the wrong release identity")
+    root["purl"] = f"pkg:pypi/{canonicalize_name(name)}@{version}"
+    root["externalReferences"] = [
+        {
+            "type": "distribution",
+            "url": f"https://github.com/Oxelio/forge-publish/releases/download/v{version}/{quote(path.name)}",
+            "hashes": [
+                {
+                    "alg": "SHA-256",
+                    "content": hashlib.sha256(path.read_bytes()).hexdigest(),
+                }
+            ],
+        }
+        for path in [*wheels, *sources]
+    ]
+    bom["metadata"].setdefault("properties", []).extend(
+        [
+            {
+                "name": "forge-publish:runtime-profile",
+                "value": f"{environment['platform']}; Python {environment['python']}; base runtime extras only",
+            },
+            {
+                "name": "forge-publish:dependency-policy",
+                "value": "Resolved with requirements/tooling.txt; dependencies are not vendored; other platforms, Python versions and user resolutions may differ.",
+            },
+        ]
+    )
+    result = validate(bom)
+    # Do not publish local paths from package metadata or future tool behavior.
+    for path in (ROOT, runtime_python.absolute().parent.parent, Path.home()):
+        if str(path).replace("\\", "/") in result.replace("\\\\", "/"):
+            raise ValueError("SBOM contains a local absolute path")
+    target = dist / FILENAME
+    target.write_text(result, encoding="utf-8", newline="\n")
+    return target
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--python",
+        required=True,
+        type=Path,
+        help="Clean runtime wheel environment's Python",
+    )
+    parser.add_argument("--dist", type=Path, default=ROOT / "dist")
+    args = parser.parse_args()
+    try:
+        target = generate(
+            # Resolving Linux venv symlinks selects the global interpreter and
+            # inventories tooling instead of the intended runtime environment.
+            args.python.absolute(),
+            args.dist.resolve(),
+            ROOT / "pyproject.toml",
+        )
+    except (OSError, ValueError, KeyError, subprocess.CalledProcessError) as error:
+        print(f"SBOM generation failed: {error}", file=sys.stderr)
+        return 1
+    print(f"Validated CycloneDX 1.6 SBOM: {target.name}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

forge_publish-2.3.0/.github/scripts/tooling-constraints.py

@@ -0,0 +1,122 @@
+"""Regenerate universal pip constraints and align isolated pre-commit hooks."""
+
+import argparse
+import re
+import subprocess
+import sys
+import tempfile
+from importlib.metadata import PackageNotFoundError, version
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+HEADER = (
+    "# Generated by python .github/scripts/tooling-constraints.py; do not edit pins.\n"
+    "# Sources: pyproject.toml [dev,release] and requirements/tooling.in.\n"
+    "# Targets: Python 3.11-3.14, Linux and Windows (pyproject.toml [tool.uv]).\n"
+    "# Build isolation remains separately constrained by requirements/build.txt.\n\n"
+)
+HOOKS = {
+    "https://github.com/astral-sh/ruff-pre-commit": "ruff",
+    "https://github.com/commitizen-tools/commitizen": "commitizen",
+}
+
+
+def align_hooks(config: str, constraints: str) -> str:
+    for repository, package in HOOKS.items():
+        versions = set(
+            re.findall(rf"^{package}==([^;\s]+)", constraints, flags=re.MULTILINE)
+        )
+        if len(versions) != 1:
+            raise ValueError(f"Expected one universal version for hook {package}")
+        pattern = rf"(repo: {re.escape(repository)}\s+rev: )\S+"
+        config, count = re.subn(pattern, rf"\g<1>v{versions.pop()}", config)
+        if count != 1:
+            raise ValueError(f"Expected one configured hook repository for {package}")
+    return config
+
+
+def generate(root: Path, *, check: bool, upgrades: list[str]) -> bool:
+    bootstrap = (root / "requirements/generator.txt").read_text(encoding="utf-8")
+    expected = re.search(r"^uv==([^\s]+)$", bootstrap, flags=re.MULTILINE)
+    if expected is None or version("uv") != expected.group(1):
+        raise ValueError(
+            "Install the pinned requirements/generator.txt before generating"
+        )
+
+    target = root / "requirements/tooling.txt"
+    hooks = root / ".pre-commit-config.yaml"
+    original = target.read_text(encoding="utf-8")
+    config = hooks.read_text(encoding="utf-8")
+    # Seed uv's output preferences with the reviewed pins, without making them
+    # hard constraints: the resolver can update a coupled dependency if needed.
+    with tempfile.TemporaryDirectory() as directory:
+        output = Path(directory) / "tooling.txt"
+        output.write_text(original, encoding="utf-8")
+        command = [
+            sys.executable,
+            "-m",
+            "uv",
+            "pip",
+            "compile",
+            "pyproject.toml",
+            "requirements/tooling.in",
+            "--extra",
+            "dev",
+            "--extra",
+            "release",
+            "--universal",
+            "--python-version",
+            "3.11",
+            "--python",
+            sys.executable,
+            "--no-python-downloads",
+            "--no-sources",
+            "--no-header",
+            "--no-annotate",
+            "--output-file",
+            str(output),
+        ]
+        for package in upgrades:
+            command.extend(["--upgrade-package", package])
+        subprocess.run(command, cwd=root, check=True, stdout=subprocess.DEVNULL)
+        generated = HEADER + output.read_text(encoding="utf-8")
+    aligned = align_hooks(config, generated)
+    if check:
+        return original == generated and config == aligned
+    target.write_text(generated, encoding="utf-8", newline="\n")
+    hooks.write_text(aligned, encoding="utf-8", newline="\n")
+    return True
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--check", action="store_true", help="Verify without changing files"
+    )
+    parser.add_argument(
+        "--upgrade-package", action="append", default=[], metavar="PACKAGE"
+    )
+    args = parser.parse_args()
+    if args.check and args.upgrade_package:
+        parser.error("--check cannot be combined with --upgrade-package")
+    try:
+        current = generate(ROOT, check=args.check, upgrades=args.upgrade_package)
+    except (
+        PackageNotFoundError,
+        ValueError,
+        OSError,
+        subprocess.CalledProcessError,
+    ) as error:
+        print(f"Constraints generation failed: {error}", file=sys.stderr)
+        return 1
+    if not current:
+        print(
+            "Constraints/hooks are stale; run python .github/scripts/tooling-constraints.py"
+        )
+        return 1
+    print("Constraints and hook versions are current.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

forge_publish-2.3.0/.github/scripts/typecheck.py

@@ -0,0 +1,36 @@
+"""Run the locked Pyright CLI against this Python interpreter's environment."""
+
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def main() -> int:
+    checker = ROOT / ".github/typecheck/node_modules/pyright/index.js"
+    node = shutil.which("node")
+    if node is None or not checker.is_file():
+        print(
+            "Install Node.js and run npm ci --prefix .github/typecheck --ignore-scripts",
+            file=sys.stderr,
+        )
+        return 1
+    return subprocess.run(
+        [
+            node,
+            str(checker),
+            "--project",
+            str(ROOT / "pyproject.toml"),
+            "--pythonpath",
+            sys.executable,
+            "--warnings",
+        ],
+        cwd=ROOT,
+        check=False,
+    ).returncode
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

forge_publish-2.3.0/.github/typecheck/package-lock.json

@@ -0,0 +1,45 @@
+{
+  "name": "forge-publish-typecheck",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "forge-publish-typecheck",
+      "devDependencies": {
+        "pyright": "1.1.414"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/pyright": {
+      "version": "1.1.414",
+      "resolved": "https://registry.npmjs.org/pyright/-/pyright-1.1.414.tgz",
+      "integrity": "sha512-FPZZb51jepDX4eP7TEYDeNFtmE3WgwkkEcJpvH3/QmUSsj0EAy3LXu+xB4T/FWDejtsXlCfFr/rbWFjwuwuXww==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "pyright": "index.js",
+        "pyright-langserver": "langserver.index.js"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      }
+    }
+  }
+}

forge_publish-2.3.0/.github/typecheck/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "forge-publish-typecheck",
+  "private": true,
+  "devDependencies": {
+    "pyright": "1.1.414"
+  }
+}

forge_publish-2.3.0/.pre-commit-config.yaml

@@ -0,0 +1,16 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.16.9
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+        stages: [pre-commit]
+
+      - id: ruff-format
+        stages: [pre-commit]
+
+  - repo: https://github.com/commitizen-tools/commitizen
+    rev: v4.19.0
+    hooks:
+      - id: commitizen
+        stages: [commit-msg]