fsspec-abfs 0.1.0__tar.gz

fsspec_abfs-0.1.0/.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

fsspec_abfs-0.1.0/.github/scripts/with-id-token-file.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Runs a command with GitHub's ID token kept in a file, for Microsoft Entra ID's workload identity federation.
+# DefaultAzureCredential's WorkloadIdentityCredential reads AZURE_FEDERATED_TOKEN_FILE whenever it exchanges it.
+set -euo pipefail
+
+: "${AZURE_CLIENT_ID:?AZURE_CLIENT_ID must be set}"
+: "${AZURE_TENANT_ID:?AZURE_TENANT_ID must be set}"
+token_file="$RUNNER_TEMP/github-id-token"
+
+fetch_token() {
+  local token
+  token=$(curl -sSf -G \
+    -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+    --data-urlencode "audience=api://AzureADTokenExchange" \
+    "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value) || return 1
+  [[ -n "$token" && "$token" != "null" ]] || return 1
+  echo "::add-mask::$token"
+  printf '%s' "$token" > "$token_file.tmp"
+  mv "$token_file.tmp" "$token_file"
+}
+
+fetch_token
+# GitHub's ID tokens are short-lived, and each new exchange reads the one in the file.
+(while sleep 60; do fetch_token || echo "Failed to refresh GitHub's ID token" >&2; done) &
+refresher=$!
+trap 'kill "$refresher"' EXIT
+
+export AZURE_FEDERATED_TOKEN_FILE="$token_file"
+"$@"

fsspec_abfs-0.1.0/.github/workflows/ci.yaml

@@ -0,0 +1,152 @@
+# Lint the code and the workflows, and test, on every push to main and pull
+# request. The offline tests run on the dummy server, with no credentials, on
+# every supported Python version. The coverage is uploaded to Codecov from one
+# Python version: uploading needs the repository secret CODECOV_TOKEN.
+#
+# The live tests then run on Azure, in the GitHub environment `azure`, which
+# DEVELOPMENT.md describes. An environment without AZURE_CLIENT_ID is skipped.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false  # no job pushes: the token is not left in .git/config
+
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3
+        with:
+          version: "0.12.22"  # not the latest uv: the same in every run
+
+      - name: Ruff check
+        run: uvx ruff check .
+
+      - name: Ruff format check
+        run: uvx ruff format --check .
+
+      # The workflows: their security (zizmor) and their syntax (actionlint).
+      - name: Workflow check
+        run: |
+          uvx zizmor --offline .github/workflows
+          uvx --from actionlint-py actionlint
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false  # no job pushes: the token is not left in .git/config
+          fetch-depth: 0  # the version comes from the git tags (hatch-vcs)
+
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3
+        with:
+          version: "0.12.22"  # not the latest uv: the same in every run
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install the project
+        run: uv sync --locked  # fails if uv.lock is out of date
+
+      # The dummy server only, whatever a variable says: this job has no credentials.
+      - name: Test with coverage
+        run: uv run --no-sync pytest --api=dummy --cov --cov-report=term --cov-report=xml:coverage.xml
+
+      - name: Upload coverage to Codecov
+        if: ${{ !cancelled() && matrix.python-version == '3.14' }}
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: coverage.xml
+
+  live:
+    needs: test
+    # Pull requests from forks and Dependabot get neither the environment's
+    # variables nor an OIDC token trusted by Azure: they run offline only.
+    if: >-
+      github.event_name != 'pull_request'
+      || (github.event.pull_request.head.repo.full_name == github.repository
+          && github.actor != 'dependabot[bot]')
+    runs-on: ubuntu-latest
+    environment: azure
+    permissions:
+      contents: read
+      id-token: write  # GitHub's OIDC token, for workload identity federation with Microsoft Entra ID
+    concurrency:
+      # One run at a time: each test works in a folder of its own, but the
+      # accounts' throughput is shared.
+      group: live-${{ github.ref }}
+      cancel-in-progress: false
+    env:
+      # DefaultAzureCredential takes these for its WorkloadIdentityCredential.
+      AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
+      AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
+      FSSPEC_ABFS_TEST_HNS_ACCOUNT_URL: ${{ vars.FSSPEC_ABFS_TEST_HNS_ACCOUNT_URL }}
+      FSSPEC_ABFS_TEST_FLAT_ACCOUNT_URL: ${{ vars.FSSPEC_ABFS_TEST_FLAT_ACCOUNT_URL }}
+      FSSPEC_ABFS_TEST_CONTAINER: ${{ vars.FSSPEC_ABFS_TEST_CONTAINER }}
+    steps:
+      # An environment not set up yet is skipped, not failed. The kinds of
+      # account tested are those whose endpoint is set.
+      - name: Check the environment
+        id: configured
+        run: |
+          if [[ -z "$AZURE_CLIENT_ID" ]]; then
+            echo "::notice::The environment azure has no AZURE_CLIENT_ID: skipped."
+            echo "ok=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if [[ -z "$AZURE_TENANT_ID" || -z "$FSSPEC_ABFS_TEST_CONTAINER" ]]; then
+            echo "::error::AZURE_TENANT_ID and FSSPEC_ABFS_TEST_CONTAINER must be set."
+            exit 1
+          fi
+          if [[ -n "$FSSPEC_ABFS_TEST_HNS_ACCOUNT_URL" && -n "$FSSPEC_ABFS_TEST_FLAT_ACCOUNT_URL" ]]; then
+            hns=both
+          elif [[ -n "$FSSPEC_ABFS_TEST_HNS_ACCOUNT_URL" ]]; then
+            hns=true
+          elif [[ -n "$FSSPEC_ABFS_TEST_FLAT_ACCOUNT_URL" ]]; then
+            hns=false
+          else
+            echo "::error::FSSPEC_ABFS_TEST_HNS_ACCOUNT_URL or FSSPEC_ABFS_TEST_FLAT_ACCOUNT_URL must be set."
+            exit 1
+          fi
+          echo "hns=$hns" >> "$GITHUB_OUTPUT"
+          echo "ok=true" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        if: ${{ steps.configured.outputs.ok == 'true' }}
+        with:
+          persist-credentials: false  # no job pushes: the token is not left in .git/config
+          fetch-depth: 0  # the version comes from the git tags (hatch-vcs)
+
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3
+        if: ${{ steps.configured.outputs.ok == 'true' }}
+        with:
+          version: "0.12.22"  # not the latest uv: the same in every run
+          python-version: "3.14"
+          enable-cache: false  # this job holds credentials: nothing restored from a cache
+
+      - name: Install the project
+        if: ${{ steps.configured.outputs.ok == 'true' }}
+        run: uv sync --locked  # fails if uv.lock is out of date
+
+      - name: Test on the live accounts
+        if: ${{ steps.configured.outputs.ok == 'true' }}
+        env:
+          HNS: ${{ steps.configured.outputs.hns }}
+        run: bash .github/scripts/with-id-token-file.sh uv run --no-sync pytest --api=live --hns="$HNS"

fsspec_abfs-0.1.0/.github/workflows/codeql.yaml

@@ -0,0 +1,45 @@
+# Scan the code and the workflows for security issues with CodeQL, on pushes
+# to main, pull requests and every week. The results go to the repository's
+# Security tab, under Code scanning.
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "17 4 * * 1"  # Monday, 04:17 UTC: a scan of new queries on unchanged code
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read  # the checkout: a job's permissions replace the workflow's
+      actions: read  # the workflow runs, which CodeQL reads in a private repository
+      security-events: write  # the results, to code scanning
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, actions]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false  # no job pushes: the token is not left in .git/config
+
+      - uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066  # v4.39.3
+        with:
+          languages: ${{ matrix.language }}
+          # Neither is compiled: the source is analysed as it is.
+          build-mode: none
+
+      - uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066  # v4.39.3
+        with:
+          category: /language:${{ matrix.language }}

fsspec_abfs-0.1.0/.github/workflows/release.yaml

@@ -0,0 +1,90 @@
+# Release: on a version tag (e.g. `git push origin v0.1.0`), build the
+# package, check its version is the tag's, create the GitHub release with it,
+# and publish it to PyPI.
+#
+# PyPI publishing uses trusted publishing (no token): the PyPI project
+# fsspec-abfs needs a trusted publisher for this repository, workflow
+# `release.yaml` and environment `pypi` (see DEVELOPMENT.md).
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false  # no job pushes: the token is not left in .git/config
+          fetch-depth: 0  # the version comes from the git tags (hatch-vcs)
+
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3
+        with:
+          version: "0.12.22"  # not the latest uv: the same in every run
+          enable-cache: false  # a release is built from nothing cached
+
+      - name: Build the package
+        run: uv build --out-dir dist
+
+      - name: Check the package
+        run: |
+          uv run --no-project python - <<'EOF'
+          import glob, os, sys
+
+          version = os.environ["GITHUB_REF_NAME"].removeprefix("v")
+          files = sorted(os.path.basename(f) for f in glob.glob("dist/*"))
+          print("\n".join(files))
+          expected = [
+              f"fsspec_abfs-{version}-py3-none-any.whl",
+              f"fsspec_abfs-{version}.tar.gz",
+          ]
+          if files != expected:
+              sys.exit(f"expected {expected} for tag {version}")
+          EOF
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  github-release:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+        with:
+          name: dist
+          path: dist/
+
+      - name: Create the GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: >
+          gh release create "$GITHUB_REF_NAME" dist/*
+          --repo "$GITHUB_REPOSITORY" --verify-tag
+          --title "$GITHUB_REF_NAME" --generate-notes
+
+  pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/fsspec-abfs/
+    permissions:
+      id-token: write  # trusted publishing
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3

fsspec_abfs-0.1.0/.gitignore

@@ -0,0 +1,56 @@
+# --- Python ---
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+
+# Packaging
+build/
+dist/
+*.egg-info/
+*.egg
+.eggs/
+wheels/
+
+# Written by hatch-vcs when the package is built
+src/fsspec_abfs/_version.py
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# Tests, coverage and type checkers
+.pytest_cache/
+.tox/
+.nox/
+.coverage
+.coverage.*
+htmlcov/
+coverage.xml
+.hypothesis/
+.mypy_cache/
+.ruff_cache/
+
+# --- IPython / Jupyter ---
+.ipynb_checkpoints/
+
+# --- JetBrains IDEs (IntelliJ IDEA, PyCharm, ...) ---
+.idea/
+*.iml
+*.ipr
+*.iws
+out/
+
+# --- Claude Code ---
+.claude/worktrees/
+.claude/settings.local.json
+
+# --- Environment and secrets ---
+.env
+.env.*
+
+# --- OS files ---
+.DS_Store
+Thumbs.db
+desktop.ini

fsspec_abfs-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,20 @@
+exclude: >
+  (?x)^(
+      \.tox/.*
+  )$
+repos:
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-json
+      - id: check-yaml
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.17.2
+    hooks:
+      - id: ruff-check
+        args: [ --fix, "--show-fixes"]
+      - id: ruff-format
+        types_or: [python]

fsspec_abfs-0.1.0/.python-version

@@ -0,0 +1 @@
+3.14