frontengine 1.0.78__tar.gz → 1.0.80__tar.gz

{frontengine-1.0.78 → frontengine-1.0.80}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: frontengine
-Version: 1.0.78
+Version: 1.0.80
 Summary: FrontEngine is use-define frontview or only use like screen saver
 Author-email: JE-Chen <jechenmailman@gmail.com>
 Project-URL: Homepage, https://github.com/JeffreyChen-SteamProjects/FrontEngine
@@ -24,6 +24,19 @@ Dynamic: license-file
 
 # FrontEngine
 
+<p align="center">
+  <strong>English</strong> ·
+  <a href="README/README_zh-TW.md">繁體中文</a> ·
+  <a href="README/README_zh-CN.md">简体中文</a> ·
+  <a href="README/README_ja.md">日本語</a> ·
+  <a href="README/README_ko.md">한국어</a> ·
+  <a href="README/README_es.md">Español</a> ·
+  <a href="README/README_fr.md">Français</a> ·
+  <a href="README/README_de.md">Deutsch</a> ·
+  <a href="README/README_pt-BR.md">Português (BR)</a> ·
+  <a href="README/README_ru.md">Русский</a>
+</p>
+
 [![CI](https://github.com/JeffreyChen-SteamProjects/FrontEngine/actions/workflows/ci.yml/badge.svg)](https://github.com/JeffreyChen-SteamProjects/FrontEngine/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/frontengine)](https://pypi.org/project/frontengine/)
 [![Python](https://img.shields.io/pypi/pyversions/frontengine)](https://pypi.org/project/frontengine/)
@@ -399,7 +412,7 @@ pip install -e .
 python -m pytest tests/ -q          # the whole suite, headless (Qt offscreen)
 ```
 
-Static checking uses pyflakes (`pip install pyflakes`), and a clean tree prints
+Static checking uses pyflakes (in `dev_requirements.txt`), and a clean tree prints
 nothing at all:
 
 ```bash

{frontengine-1.0.78 → frontengine-1.0.80}/README.md

@@ -1,5 +1,18 @@
 # FrontEngine
 
+<p align="center">
+  <strong>English</strong> ·
+  <a href="README/README_zh-TW.md">繁體中文</a> ·
+  <a href="README/README_zh-CN.md">简体中文</a> ·
+  <a href="README/README_ja.md">日本語</a> ·
+  <a href="README/README_ko.md">한국어</a> ·
+  <a href="README/README_es.md">Español</a> ·
+  <a href="README/README_fr.md">Français</a> ·
+  <a href="README/README_de.md">Deutsch</a> ·
+  <a href="README/README_pt-BR.md">Português (BR)</a> ·
+  <a href="README/README_ru.md">Русский</a>
+</p>
+
 [![CI](https://github.com/JeffreyChen-SteamProjects/FrontEngine/actions/workflows/ci.yml/badge.svg)](https://github.com/JeffreyChen-SteamProjects/FrontEngine/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/frontengine)](https://pypi.org/project/frontengine/)
 [![Python](https://img.shields.io/pypi/pyversions/frontengine)](https://pypi.org/project/frontengine/)
@@ -375,7 +388,7 @@ pip install -e .
 python -m pytest tests/ -q          # the whole suite, headless (Qt offscreen)
 ```
 
-Static checking uses pyflakes (`pip install pyflakes`), and a clean tree prints
+Static checking uses pyflakes (in `dev_requirements.txt`), and a clean tree prints
 nothing at all:
 
 ```bash

{frontengine-1.0.78 → frontengine-1.0.80}/frontengine.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: frontengine
-Version: 1.0.78
+Version: 1.0.80
 Summary: FrontEngine is use-define frontview or only use like screen saver
 Author-email: JE-Chen <jechenmailman@gmail.com>
 Project-URL: Homepage, https://github.com/JeffreyChen-SteamProjects/FrontEngine
@@ -24,6 +24,19 @@ Dynamic: license-file
 
 # FrontEngine
 
+<p align="center">
+  <strong>English</strong> ·
+  <a href="README/README_zh-TW.md">繁體中文</a> ·
+  <a href="README/README_zh-CN.md">简体中文</a> ·
+  <a href="README/README_ja.md">日本語</a> ·
+  <a href="README/README_ko.md">한국어</a> ·
+  <a href="README/README_es.md">Español</a> ·
+  <a href="README/README_fr.md">Français</a> ·
+  <a href="README/README_de.md">Deutsch</a> ·
+  <a href="README/README_pt-BR.md">Português (BR)</a> ·
+  <a href="README/README_ru.md">Русский</a>
+</p>
+
 [![CI](https://github.com/JeffreyChen-SteamProjects/FrontEngine/actions/workflows/ci.yml/badge.svg)](https://github.com/JeffreyChen-SteamProjects/FrontEngine/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/frontengine)](https://pypi.org/project/frontengine/)
 [![Python](https://img.shields.io/pypi/pyversions/frontengine)](https://pypi.org/project/frontengine/)
@@ -399,7 +412,7 @@ pip install -e .
 python -m pytest tests/ -q          # the whole suite, headless (Qt offscreen)
 ```
 
-Static checking uses pyflakes (`pip install pyflakes`), and a clean tree prints
+Static checking uses pyflakes (in `dev_requirements.txt`), and a clean tree prints
 nothing at all:
 
 ```bash

{frontengine-1.0.78 → frontengine-1.0.80}/frontengine.egg-info/SOURCES.txt

@@ -1,4 +1,5 @@
 LICENSE
+README
 README.md
 pyproject.toml
 frontengine/__init__.py
@@ -281,4 +282,5 @@ frontengine/utils/window_pin/window_pin.py
 frontengine/utils/window_replica/__init__.py
 frontengine/utils/window_replica/dwm_thumbnail.py
 frontengine/utils/workshop/__init__.py
-frontengine/utils/workshop/workshop_content.py
+frontengine/utils/workshop/workshop_content.py
+tests/test_workflow_actions.py

{frontengine-1.0.78 → frontengine-1.0.80}/pyproject.toml

@@ -1,12 +1,11 @@
-# Rename to dev version
-# This is dev version
+# Stable channel: the frontengine package. pyproject.toml builds frontengine_dev.
 [build-system]
 requires = ["setuptools>=82.0.1"]
 build-backend = "setuptools.build_meta"
 
 [project]
 name = "frontengine"
-version = "1.0.78"
+version = "1.0.80"
 authors = [
     { name = "JE-Chen", email = "jechenmailman@gmail.com" },
 ]

frontengine-1.0.80/tests/test_workflow_actions.py

@@ -0,0 +1,93 @@
+"""Every GitHub Actions step pins its action to a commit SHA.
+
+A tag such as ``@v4`` can be moved to new code at any time (the 2025
+tj-actions/changed-files compromise rewrote tags), so each ``uses:`` names a
+full 40-hex commit and carries the release it corresponds to as a comment,
+which is what Dependabot reads and updates. Pinning also keeps Node 20 actions
+from lingering unnoticed: GitHub removed Node 20 from its runners on 2026-09-23.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import pytest
+
+_ROOT = next(p for p in Path(__file__).resolve().parents if (p / ".github" / "workflows").is_dir())
+_WORKFLOWS = sorted((_ROOT / ".github" / "workflows").glob("*.yml"))
+_USES = re.compile(r"^\s*(?:-\s*)?uses:\s*(\S+)(.*)$")
+_PINNED = re.compile(r"^[\w.-]+/[\w./-]+@[0-9a-f]{40}$")
+_LOCAL = re.compile(r"^\./")
+_VERSION_COMMENT = re.compile(r"^\s+#\s*v\d+(\.\d+)*\s*$")
+
+
+def _uses(path: Path) -> list[tuple[int, str, str]]:
+    """Return ``(line number, action reference, rest of line)`` for each remote ``uses:``."""
+    found = []
+    for number, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
+        match = _USES.match(line)
+        if match and not _LOCAL.match(match.group(1)):
+            found.append((number, match.group(1), match.group(2)))
+    return found
+
+
+def test_workflows_exist():
+    assert _WORKFLOWS
+
+
+@pytest.mark.parametrize("workflow", _WORKFLOWS, ids=lambda p: p.name)
+def test_every_action_is_pinned_to_a_commit_with_its_version(workflow):
+    bad = [f"{workflow.name}:{number} {ref}{rest}"
+           for number, ref, rest in _uses(workflow)
+           if not (_PINNED.match(ref) and _VERSION_COMMENT.match(rest))]
+    assert bad == []
+
+
+def test_one_version_per_action():
+    # The same action at two different commits means a partial upgrade.
+    seen: dict[str, set[str]] = {}
+    for workflow in _WORKFLOWS:
+        for _number, ref, _rest in _uses(workflow):
+            action, _, sha = ref.partition("@")
+            seen.setdefault(action, set()).add(sha)
+    assert {action: shas for action, shas in seen.items() if len(shas) > 1} == {}
+
+
+def test_dependabot_keeps_pins_current_on_dev():
+    # Pinned SHAs only stay current if something bumps them; every update
+    # goes to dev because main is the release branch. Parsed as text: PyYAML
+    # is not a test dependency.
+    text = (_ROOT / ".github" / "dependabot.yml").read_text(encoding="utf-8")
+    blocks = re.split(r"^\s*-\s*package-ecosystem:", text, flags=re.MULTILINE)[1:]
+    ecosystems = {block.split()[0].strip("\"'") for block in blocks}
+    assert {"pip", "github-actions"} <= ecosystems
+    assert all(re.search(r"^\s*target-branch:\s*\"dev\"", block, re.MULTILINE)
+               for block in blocks)
+
+
+def _checkout_steps(path: Path) -> list[tuple[int, str]]:
+    """Return ``(line number, step text)`` for each ``actions/checkout`` step."""
+    lines = path.read_text(encoding="utf-8").splitlines()
+    steps = []
+    for index, line in enumerate(lines):
+        if not re.search(r"uses:\s*actions/checkout@", line):
+            continue
+        column = line.index("uses:")
+        body = [line]
+        for following in lines[index + 1:]:
+            indent = len(following) - len(following.lstrip())
+            if following.strip() and (indent < column or following.lstrip().startswith("- ")):
+                break
+            body.append(following)
+        steps.append((index + 1, "\n".join(body)))
+    return steps
+
+
+@pytest.mark.parametrize("workflow", _WORKFLOWS, ids=lambda p: p.name)
+def test_every_checkout_decides_on_persisted_credentials(workflow):
+    # actions/checkout leaves the job token in .git/config unless told not
+    # to, where every later step (and any uploaded workspace) can read it.
+    # Only jobs that push keep it, and they say so.
+    bad = [f"{workflow.name}:{number}" for number, step in _checkout_steps(workflow)
+           if not re.search(r"^\s*persist-credentials:\s*(true|false)\b", step, re.MULTILINE)]
+    assert bad == []