funcsort 0.2.0__tar.gz → 2.0.0__tar.gz

funcsort-2.0.0/.github/workflows/bump-version-by-labels.yml

@@ -0,0 +1,42 @@
+name: Bump Version By Labels
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+
+permissions: {}
+
+jobs:
+  bump-version:
+    # 41898282 is the github-actions[bot] user ID; unlike the actor login it cannot be spoofed.
+    if: github.event.pull_request.merged == true && github.event.sender.id != 41898282
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      issues: write # bump-by-label creates the Major/Minor/Patch labels when missing
+      pull-requests: write
+
+    steps:
+      # skylos: ignore[SKY-D293] bump-by-label runs `git push origin`, which uses the persisted credentials
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.*"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          version: "latest"
+
+      - name: Bump by labels
+        uses: HEROgold/bump-by-label@d657045d32bd21631a0830b73abd5207b8acd85a # v2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          command: "uv version --bump"
+          validate: "uv version"

{funcsort-0.2.0 → funcsort-2.0.0}/.github/workflows/ci.yml

@@ -3,25 +3,30 @@ name: CI
 on:
   push:
     branches: [main]
-    tags:
-      - "v*"
   pull_request:
     branches: [main]
 
+permissions: {}
+
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.13"
 
@@ -37,19 +42,24 @@ jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
     strategy:
       matrix:
         python-version: ["3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -58,29 +68,3 @@ jobs:
 
       - name: Run tests
         run: uv run pytest -v --cov=funcsort --cov-report=term-missing
-
-  publish:
-    name: Publish to PyPI
-    runs-on: ubuntu-latest
-    needs: [lint, test]
-    if: startsWith(github.ref, 'refs/tags/v')
-    permissions:
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.13"
-
-      - name: Build package
-        run: uv build
-
-      - name: Publish to PyPI
-        run: uv publish
-        env:
-          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}

{funcsort-0.2.0 → funcsort-2.0.0}/.github/workflows/coverage.yml

@@ -1,6 +1,7 @@
 name: Coverage
 
 on:
+  # skylos: ignore[SKY-D290] the job only runs for push runs of this repository's main branch
   workflow_run:
     workflows: ["Test"]
     branches: [main]
@@ -13,12 +14,15 @@ permissions:
 jobs:
   coveralls-upload:
     runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    timeout-minutes: 15
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
@@ -34,6 +38,7 @@ jobs:
       - name: Upload coverage data to coveralls.io
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # skylos: ignore[SKY-D299] upload-only Coveralls token; the job never runs untrusted code
           COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
           COVERALLS_SERVICE_NAME: github-actions
           COVERALLS_PARALLEL: true
@@ -42,5 +47,6 @@ jobs:
       - name: Coveralls Finished
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # skylos: ignore[SKY-D299] upload-only Coveralls token; the job never runs untrusted code
           COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
         run: uvx coveralls --finish

funcsort-2.0.0/.github/workflows/docs.yml

@@ -0,0 +1,69 @@
+name: Docs
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+    types: [ opened, reopened, synchronize, closed ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# All deployments push to the shared gh-pages branch, so serialise them to avoid push races.
+# Do NOT cancel in-progress runs as we want to allow deployments to complete.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build-docs:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write       # the site and PR previews are pushed to the gh-pages branch
+      pull-requests: write  # pr-preview-action comments the preview link on the PR
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        if: github.event.action != 'closed'
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        if: github.event.action != 'closed'
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          enable-cache: true
+
+      - name: Build docs (zensical)
+        if: github.event.action != 'closed'
+        run: |
+          uv sync --group docs
+          uv run zensical build
+
+      # Publish the site to the root of gh-pages on pushes to main, keeping PR previews intact.
+      # Gate on the event too: `closed` pull_request events report the base branch as github.ref.
+      - name: Deploy to GitHub Pages
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+        uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 # v4.9.0
+        with:
+          folder: site
+          branch: gh-pages
+          clean-exclude: pr-previews/
+          force: false
+
+      # Deploy the PR preview on open/sync/reopen; remove it when the PR is closed.
+      # pr-preview-action defaults to `action: auto`, which detects the `closed`
+      # event and deletes the preview directory from gh-pages.
+      - name: Deploy PR Preview
+        if: github.event_name == 'pull_request'
+        uses: rossjrw/pr-preview-action@ffa7509e91a3ec8dfc2e5536c4d5c1acdf7a6de9 # v1
+        with:
+          source-dir: site
+          preview-branch: gh-pages
+          umbrella-dir: pr-previews

{funcsort-0.2.0 → funcsort-2.0.0}/.github/workflows/gitleaks.yml

@@ -18,11 +18,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Run Gitleaks
-        uses: gitleaks/gitleaks-action@v2
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

{funcsort-0.2.0 → funcsort-2.0.0}/.github/workflows/lint-public.yml

@@ -20,10 +20,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
@@ -51,15 +53,17 @@ jobs:
             args: "."
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Install uv (Should be cached from setup job)
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
       - name: Cache lint results
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .lint_cache
           key: ${{ runner.os }}-lint-${{matrix.tool}}-${{ hashFiles('**/tests/**/*.py', 'src/**') }}

{funcsort-0.2.0 → funcsort-2.0.0}/.github/workflows/pypi.yml

@@ -12,6 +12,7 @@ jobs:
   publish-to-pypi:
     name: Publish Python 🐍 distribution 📦 to PyPI
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     environment:
       name: pypi
       url: https://pypi.org/p/funcsort
@@ -21,14 +22,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
 
+      # No dependency cache: the published artifacts must not depend on restored CI state.
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
-          enable-cache: true
+          enable-cache: false
 
       - name: Set up Python
         run: uv python install 3.14

{funcsort-0.2.0 → funcsort-2.0.0}/.github/workflows/release.yml

@@ -1,6 +1,7 @@
 name: Auto-release
 
 on:
+  # skylos: ignore[SKY-D290] jobs only act on push runs of this repository's main branch
   workflow_run:
     workflows: ["Test"]
     branches: [main]
@@ -8,27 +9,32 @@ on:
       - completed
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   new-release:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: write
-    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    # Only release from Test runs triggered by a push to this repository, never from a fork PR head named `main`.
+    if: ${{ (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository) || github.event_name == 'workflow_dispatch' }}
     outputs:
       version_changed: ${{ steps.version-check.outputs.version_changed }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0 # Needed to get all tags for version comparison
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.*"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: "latest"
 
@@ -50,7 +56,7 @@ jobs:
 
       - name: Create GitHub Release
         if: steps.version-check.outputs.version_changed == 'true'
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: v${{ steps.version-check.outputs.current_version }}
           name: Release v${{ steps.version-check.outputs.current_version }}
@@ -63,7 +69,7 @@ jobs:
       # because another workflow (this one) created the release. (avoiding inf recursion)
       - name: Trigger PyPI workflow
         if: steps.version-check.outputs.version_changed == 'true'
-        uses: peter-evans/repository-dispatch@v2
+        uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570 # v2.1.2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           event-type: new-release-created

funcsort-2.0.0/.github/workflows/skylos.yml

@@ -0,0 +1,65 @@
+name: Skylos Analysis
+
+"on":
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  skylos:
+    name: Skylos Quality Gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.12'
+
+      - name: Install Skylos
+        run: python -m pip install skylos==4.30.0
+
+      - name: Pull Skylos Cloud Policy
+        run: |
+          skylos sync pull || echo "No Skylos Cloud policy available through GitHub OIDC; continuing with local config."
+
+
+      - name: Run Skylos Analysis
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            pr_base_ref="origin/${GITHUB_BASE_REF:-main}"
+            skylos . --danger --quality --ai-defects --secrets --sca --baseline --diff-base "$pr_base_ref" --diff "$pr_base_ref" --json -o skylos-results.json
+          else
+            skylos . --danger --quality --ai-defects --secrets --sca --baseline --json -o skylos-results.json
+          fi
+
+      - name: Quality Gate
+        if: always()
+        run: skylos cicd gate --input skylos-results.json --summary
+
+      - name: GitHub Annotations
+        if: always()
+        run: skylos cicd annotate --input skylos-results.json
+
+      - name: PR Review Comments
+        if: github.event_name == 'pull_request' && always()
+        run: |
+          pr_base_ref="origin/${GITHUB_BASE_REF:-main}"
+          skylos cicd review --input skylos-results.json --diff-base "$pr_base_ref" --evidence-cards
+        env:
+          GH_TOKEN: ${{ github.token }}

{funcsort-0.2.0 → funcsort-2.0.0}/.github/workflows/test.yml

@@ -22,18 +22,20 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Cache pytest results
         id: cache-pytest
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .pytest_cache
           key: ${{ runner.os }}-pytest-${{ matrix.python-version }}-${{ hashFiles('**/tests/**/*.py', 'src/**') }}
 
       - name: Install uv
         if: steps.cache-pytest.outputs.cache-hit != 'true'
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 

{funcsort-0.2.0 → funcsort-2.0.0}/.gitignore

@@ -135,7 +135,7 @@ venv.bak/
 # Rope project settings
 .ropeproject
 
-# mkdocs documentation
+# zensical documentation
 /site
 
 # mypy
@@ -172,3 +172,6 @@ cython_debug/
 
 # Ruff cache
 .ruff_cache/
+
+# Skylos analysis cache
+.skylos/

{funcsort-0.2.0 → funcsort-2.0.0}/.pre-commit-config.yaml

@@ -34,6 +34,13 @@ repos:
         language: system
         stages: [pre-commit]
         types: [python]
+      - id: no-reflow
+        name: reject reflow-only hunks
+        entry: uv run python scripts/check_reflow.py
+        language: system
+        stages: [pre-commit]
+        always_run: true
+        pass_filenames: false
       - id: uv-sync
         name: uv sync
         entry: uv sync