ghostpkg 0.24.2__tar.gz → 0.24.4__tar.gz

{ghostpkg-0.24.2 → ghostpkg-0.24.4}/.github/workflows/publish.yml

@@ -6,26 +6,24 @@
 # whole subject is supply-chain trust, publishing from a laptop with a token
 # pasted into the shell is the wrong example to set.
 #
-# ONE-TIME SETUP, on pypi.org -> ghostpkg -> Manage -> Publishing:
-#   Owner:              M1rwana12
-#   Repository name:    ghostpkg
-#   Workflow name:      publish.yml
-#   Environment name:   pypi
-# Until that exists, this workflow will fail -- which is why it only runs when
-# started by hand. Once a run has succeeded, add:
+# The publisher is registered on PyPI, so this now runs on its own when a
+# release is published:
 #
-#   release:
-#     types: [published]
+#   Owner: M1rwana12   Repository: ghostpkg
+#   Workflow: publish.yml   Environment: pypi
 #
-# to the triggers below so tagging a release is enough.
+# A manual run is still available for a tag that was released before this was
+# wired up, or to retry one that failed after the release already existed.
 
 name: publish
 
 on:
+  release:
+    types: [published]
   workflow_dispatch:
     inputs:
       tag:
-        description: Tag to build and publish, e.g. v0.18.0
+        description: Tag to build and publish, e.g. v0.24.4
         required: true
 
 permissions:
@@ -37,7 +35,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.tag }}
+          # A release event carries its own tag; a manual run names one.
+          ref: ${{ inputs.tag || github.event.release.tag_name }}
 
       - uses: actions/setup-python@v5
         with:
@@ -50,10 +49,12 @@ jobs:
           python -m twine check dist/*
 
       - name: Check the tag matches the version in the package
+        env:
+          TAG: ${{ inputs.tag || github.event.release.tag_name }}
         run: |
           version=$(python -c "import ghostpkg; print(ghostpkg.__version__)")
-          if [ "v$version" != "${{ inputs.tag }}" ]; then
-            echo "::error::tag ${{ inputs.tag }} does not match __version__ $version"
+          if [ "v$version" != "$TAG" ]; then
+            echo "::error::tag $TAG does not match __version__ $version"
             exit 1
           fi
 

{ghostpkg-0.24.2 → ghostpkg-0.24.4}/.pre-commit-hooks.yaml

@@ -2,7 +2,7 @@
 #
 #   repos:
 #     - repo: https://github.com/M1rwana12/ghostpkg
-#       rev: v0.24.0
+#       rev: v0.24.4
 #       hooks:
 #         - id: ghostpkg
 #

{ghostpkg-0.24.2 → ghostpkg-0.24.4}/2.0

@@ -1 +1 @@
-[REAL PIP] install requests flask
+[REAL PIP] install requests flask

{ghostpkg-0.24.2 → ghostpkg-0.24.4}/CHANGELOG.md

@@ -6,6 +6,37 @@ this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.24.4] - 2026-09-04
+
+### Changed
+- **Releases are published by CI through PyPI Trusted Publishing.** The
+  publisher is registered, so `publish.yml` now runs when a release is
+  published rather than only when started by hand. PyPI mints a short-lived
+  credential for this exact workflow in this exact repository, so there is no
+  long-lived token to leak.
+
+  This is the first release built and uploaded that way rather than from a
+  laptop with a token pasted into the shell. For a tool whose whole subject is
+  supply-chain trust, that was the wrong example to set.
+
+  A manual run is still available, for a tag released before this was wired up
+  or to retry one that failed after the release already existed.
+
+## [0.24.3] - 2026-09-04
+
+### Fixed
+- **The documented snippets pinned `@v0.24.0`, two releases behind.** Each
+  release script replaced the *previous* version string, so a snippet already
+  left on an older one was never touched again. The GitHub Marketplace listing
+  renders that snippet, so it told people to pin a version predating the fixes
+  it advertises.
+
+  Replacement is now by pattern rather than by exact previous string, and a
+  test fails if any documented pin disagrees with `__version__` -- with a
+  second test guarding against the patterns silently matching nothing.
+
+711 tests.
+
 ## [0.24.2] - 2026-09-04
 
 ### Changed
@@ -1015,7 +1046,9 @@ First release.
 - No corpus of hallucinated package names is shipped, following the decision of
   the USENIX'25 authors not to publish theirs.
 
-[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.24.2...HEAD
+[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.24.4...HEAD
+[0.24.4]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.24.4
+[0.24.3]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.24.3
 [0.24.2]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.24.2
 [0.24.1]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.24.1
 [0.24.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.24.0

{ghostpkg-0.24.2 → ghostpkg-0.24.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ghostpkg
-Version: 0.24.2
+Version: 0.24.4
 Summary: Catch package names that do not exist before you install them
 Project-URL: Homepage, https://github.com/m1rwana12/ghostpkg
 Project-URL: Issues, https://github.com/m1rwana12/ghostpkg/issues
@@ -445,7 +445,7 @@ length, and only applies to packages young enough to plausibly be a squat.
 ### In CI
 
 ```yaml
-- uses: M1rwana12/ghostpkg@v0.24.0
+- uses: M1rwana12/ghostpkg@v0.24.4
 ```
 
 That is the whole step. It searches the checkout, skips `node_modules` and
@@ -476,7 +476,7 @@ Or without the action, if you prefer:
 ```yaml
 repos:
   - repo: https://github.com/M1rwana12/ghostpkg
-    rev: v0.24.0
+    rev: v0.24.4
     hooks:
       - id: ghostpkg
 ```

{ghostpkg-0.24.2 → ghostpkg-0.24.4}/README.en.md

@@ -397,7 +397,7 @@ length, and only applies to packages young enough to plausibly be a squat.
 ### In CI
 
 ```yaml
-- uses: M1rwana12/ghostpkg@v0.24.0
+- uses: M1rwana12/ghostpkg@v0.24.4
 ```
 
 That is the whole step. It searches the checkout, skips `node_modules` and
@@ -428,7 +428,7 @@ Or without the action, if you prefer:
 ```yaml
 repos:
   - repo: https://github.com/M1rwana12/ghostpkg
-    rev: v0.24.0
+    rev: v0.24.4
     hooks:
       - id: ghostpkg
 ```

{ghostpkg-0.24.2 → ghostpkg-0.24.4}/README.md

@@ -194,7 +194,7 @@ ghostpkg scan ../інший-проєкт
 ### У CI
 
 ```yaml
-- uses: M1rwana12/ghostpkg@v0.24.0
+- uses: M1rwana12/ghostpkg@v0.24.4
 ```
 
 Це весь крок. Він шукає маніфести в чекауті, обходить `node_modules` і подібні
@@ -218,7 +218,7 @@ ghostpkg scan ../інший-проєкт
 ```yaml
 repos:
   - repo: https://github.com/M1rwana12/ghostpkg
-    rev: v0.24.0
+    rev: v0.24.4
     hooks:
       - id: ghostpkg
 ```

{ghostpkg-0.24.2 → ghostpkg-0.24.4}/ghostpkg/__init__.py

@@ -1,6 +1,6 @@
 """ghostpkg -- catch package names that do not exist before you install them."""
 
-__version__ = "0.24.2"
+__version__ = "0.24.4"
 
 from .assess import Finding, Verdict, assess
 from .registries import PackageFacts, RegistryError, fetch

{ghostpkg-0.24.2 → ghostpkg-0.24.4}/ghostpkg/policy.py

@@ -1,181 +1,181 @@
-"""Suppressing findings you have already decided about.
-
-One false positive is enough for a team to remove a security check from CI, so
-there has to be a way to say "we know about this one". Three things make that
-safe rather than a hole:
-
-**The file is never read from the project directory.** ghostpkg is meant to sit
-in front of a coding agent, and an agent with shell access can edit files in the
-repository it is working on. A `.ghostpkgignore` next to the code would be a
-suppression list the thing being guarded can rewrite. So the file comes from an
-explicit path, an environment variable, or the user's own config directory --
-never from the tree being scanned.
-
-**A reason is required.** An entry nobody can justify in one sentence is an
-entry nobody will dare remove later.
-
-**A malformed file is an error, not a shrug.** Degrading quietly to "no
-suppressions" would be the safe direction; degrading quietly to "no protection"
-would not, and from the outside the two are indistinguishable. Failing loudly
-is the only honest option.
-"""
-
-from __future__ import annotations
-
-import fnmatch
-import json
-import os
-import sys
-from dataclasses import dataclass
-from datetime import date
-from pathlib import Path
-
-CONFIG_ENV = "GHOSTPKG_CONFIG"
-CONFIG_NAME = "ignore.json"
-
-
-class PolicyError(ValueError):
-    """The ignore file exists but could not be used."""
-
-
-@dataclass(frozen=True)
-class Rule:
-    """One suppression. `package` and `rule` accept glob patterns."""
-
-    package: str
-    reason: str
-    ecosystem: str = "*"
-    rule: str = "*"
-    expires: date | None = None
-
-    def expired(self, today: date | None = None) -> bool:
-        return self.expires is not None and self.expires < (today or date.today())
-
-    def matches(self, name: str, ecosystem: str, rule_id: str | None) -> bool:
-        if self.ecosystem != "*" and self.ecosystem != ecosystem:
-            return False
-        if self.rule != "*" and not fnmatch.fnmatch(rule_id or "", self.rule):
-            return False
-        return fnmatch.fnmatch(name.lower(), self.package.lower())
-
-
-def config_dir() -> Path:
-    if sys.platform == "win32":
-        base = os.environ.get("APPDATA") or os.path.expanduser("~")
-        return Path(base) / "ghostpkg"
-    if sys.platform == "darwin":
-        return Path(os.path.expanduser("~/Library/Application Support")) / "ghostpkg"
-    base = os.environ.get("XDG_CONFIG_HOME") or os.path.expanduser("~/.config")
-    return Path(base) / "ghostpkg"
-
-
-def locate(explicit: str | Path | None = None) -> Path | None:
-    """Where the ignore file lives, or None. Never the project directory."""
-    if explicit:
-        return Path(explicit)
-    from_env = os.environ.get(CONFIG_ENV)
-    if from_env:
-        return Path(from_env)
-    candidate = config_dir() / CONFIG_NAME
-    return candidate if candidate.is_file() else None
-
-
-def _parse_date(value, where: str) -> date | None:
-    if value is None:
-        return None
-    try:
-        return date.fromisoformat(str(value))
-    except ValueError:
-        raise PolicyError(
-            f"{where}: 'expires' must be a date like 2026-12-31, got {value!r}"
-        ) from None
-
-
-def parse(text: str, origin: str = "ignore file") -> list[Rule]:
-    try:
-        data = json.loads(text)
-    except ValueError as exc:
-        raise PolicyError(f"{origin}: not valid JSON ({exc})") from None
-
-    entries = data.get("ignore") if isinstance(data, dict) else data
-    if not isinstance(entries, list):
-        raise PolicyError(f"{origin}: expected a list under 'ignore'")
-
-    rules: list[Rule] = []
-    for index, entry in enumerate(entries, 1):
-        where = f"{origin}, entry {index}"
-        if not isinstance(entry, dict):
-            raise PolicyError(f"{where}: expected an object")
-        package = entry.get("package")
-        reason = entry.get("reason")
-        if not package or not isinstance(package, str):
-            raise PolicyError(f"{where}: 'package' is required")
-        if not reason or not isinstance(reason, str):
-            raise PolicyError(
-                f"{where}: 'reason' is required -- a suppression nobody can "
-                f"justify is one nobody will dare remove"
-            )
-        rules.append(
-            Rule(
-                package=package,
-                reason=reason,
-                ecosystem=str(entry.get("ecosystem") or "*"),
-                rule=str(entry.get("rule") or "*"),
-                expires=_parse_date(entry.get("expires"), where),
-            )
-        )
-    return rules
-
-
-def load(explicit: str | Path | None = None) -> tuple[list[Rule], Path | None]:
-    """Read the ignore file. Missing is fine; malformed is not."""
-    path = locate(explicit)
-    if path is None:
-        return [], None
-    try:
-        text = path.read_text(encoding="utf-8-sig")
-    except OSError as exc:
-        raise PolicyError(f"could not read {path}: {exc}") from None
-    return parse(text, str(path)), path
-
-
-def apply(finding, rules: list[Rule], today: date | None = None):
-    """Drop suppressed reasons and re-derive the verdict.
-
-    Returns the finding and the rules that fired, so the caller can say what was
-    suppressed rather than silently showing a clean result.
-    """
-    from .assess import Verdict  # noqa: PLC0415 - avoids a circular import
-
-    if not rules:
-        return finding, []
-
-    kept, used = [], []
-    for reason in finding.reasons:
-        rule_id = getattr(reason, "rule", None)
-        match = next(
-            (
-                r
-                for r in rules
-                if not r.expired(today)
-                and r.matches(finding.name, finding.ecosystem, rule_id)
-            ),
-            None,
-        )
-        if match is None:
-            kept.append(reason)
-        else:
-            used.append(match)
-
-    if not used:
-        return finding, []
-
-    finding.reasons = kept
-    if not kept:
-        finding.verdict = Verdict.OK
-    elif finding.verdict is Verdict.BLOCK and not any(
-        getattr(r, "rule", None) in finding.blocking for r in kept
-    ):
-        # The reason that blocked is gone; what remains is only advisory.
-        finding.verdict = Verdict.WARN
-    return finding, used
+"""Suppressing findings you have already decided about.
+
+One false positive is enough for a team to remove a security check from CI, so
+there has to be a way to say "we know about this one". Three things make that
+safe rather than a hole:
+
+**The file is never read from the project directory.** ghostpkg is meant to sit
+in front of a coding agent, and an agent with shell access can edit files in the
+repository it is working on. A `.ghostpkgignore` next to the code would be a
+suppression list the thing being guarded can rewrite. So the file comes from an
+explicit path, an environment variable, or the user's own config directory --
+never from the tree being scanned.
+
+**A reason is required.** An entry nobody can justify in one sentence is an
+entry nobody will dare remove later.
+
+**A malformed file is an error, not a shrug.** Degrading quietly to "no
+suppressions" would be the safe direction; degrading quietly to "no protection"
+would not, and from the outside the two are indistinguishable. Failing loudly
+is the only honest option.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import json
+import os
+import sys
+from dataclasses import dataclass
+from datetime import date
+from pathlib import Path
+
+CONFIG_ENV = "GHOSTPKG_CONFIG"
+CONFIG_NAME = "ignore.json"
+
+
+class PolicyError(ValueError):
+    """The ignore file exists but could not be used."""
+
+
+@dataclass(frozen=True)
+class Rule:
+    """One suppression. `package` and `rule` accept glob patterns."""
+
+    package: str
+    reason: str
+    ecosystem: str = "*"
+    rule: str = "*"
+    expires: date | None = None
+
+    def expired(self, today: date | None = None) -> bool:
+        return self.expires is not None and self.expires < (today or date.today())
+
+    def matches(self, name: str, ecosystem: str, rule_id: str | None) -> bool:
+        if self.ecosystem != "*" and self.ecosystem != ecosystem:
+            return False
+        if self.rule != "*" and not fnmatch.fnmatch(rule_id or "", self.rule):
+            return False
+        return fnmatch.fnmatch(name.lower(), self.package.lower())
+
+
+def config_dir() -> Path:
+    if sys.platform == "win32":
+        base = os.environ.get("APPDATA") or os.path.expanduser("~")
+        return Path(base) / "ghostpkg"
+    if sys.platform == "darwin":
+        return Path(os.path.expanduser("~/Library/Application Support")) / "ghostpkg"
+    base = os.environ.get("XDG_CONFIG_HOME") or os.path.expanduser("~/.config")
+    return Path(base) / "ghostpkg"
+
+
+def locate(explicit: str | Path | None = None) -> Path | None:
+    """Where the ignore file lives, or None. Never the project directory."""
+    if explicit:
+        return Path(explicit)
+    from_env = os.environ.get(CONFIG_ENV)
+    if from_env:
+        return Path(from_env)
+    candidate = config_dir() / CONFIG_NAME
+    return candidate if candidate.is_file() else None
+
+
+def _parse_date(value, where: str) -> date | None:
+    if value is None:
+        return None
+    try:
+        return date.fromisoformat(str(value))
+    except ValueError:
+        raise PolicyError(
+            f"{where}: 'expires' must be a date like 2026-12-31, got {value!r}"
+        ) from None
+
+
+def parse(text: str, origin: str = "ignore file") -> list[Rule]:
+    try:
+        data = json.loads(text)
+    except ValueError as exc:
+        raise PolicyError(f"{origin}: not valid JSON ({exc})") from None
+
+    entries = data.get("ignore") if isinstance(data, dict) else data
+    if not isinstance(entries, list):
+        raise PolicyError(f"{origin}: expected a list under 'ignore'")
+
+    rules: list[Rule] = []
+    for index, entry in enumerate(entries, 1):
+        where = f"{origin}, entry {index}"
+        if not isinstance(entry, dict):
+            raise PolicyError(f"{where}: expected an object")
+        package = entry.get("package")
+        reason = entry.get("reason")
+        if not package or not isinstance(package, str):
+            raise PolicyError(f"{where}: 'package' is required")
+        if not reason or not isinstance(reason, str):
+            raise PolicyError(
+                f"{where}: 'reason' is required -- a suppression nobody can "
+                f"justify is one nobody will dare remove"
+            )
+        rules.append(
+            Rule(
+                package=package,
+                reason=reason,
+                ecosystem=str(entry.get("ecosystem") or "*"),
+                rule=str(entry.get("rule") or "*"),
+                expires=_parse_date(entry.get("expires"), where),
+            )
+        )
+    return rules
+
+
+def load(explicit: str | Path | None = None) -> tuple[list[Rule], Path | None]:
+    """Read the ignore file. Missing is fine; malformed is not."""
+    path = locate(explicit)
+    if path is None:
+        return [], None
+    try:
+        text = path.read_text(encoding="utf-8-sig")
+    except OSError as exc:
+        raise PolicyError(f"could not read {path}: {exc}") from None
+    return parse(text, str(path)), path
+
+
+def apply(finding, rules: list[Rule], today: date | None = None):
+    """Drop suppressed reasons and re-derive the verdict.
+
+    Returns the finding and the rules that fired, so the caller can say what was
+    suppressed rather than silently showing a clean result.
+    """
+    from .assess import Verdict  # noqa: PLC0415 - avoids a circular import
+
+    if not rules:
+        return finding, []
+
+    kept, used = [], []
+    for reason in finding.reasons:
+        rule_id = getattr(reason, "rule", None)
+        match = next(
+            (
+                r
+                for r in rules
+                if not r.expired(today)
+                and r.matches(finding.name, finding.ecosystem, rule_id)
+            ),
+            None,
+        )
+        if match is None:
+            kept.append(reason)
+        else:
+            used.append(match)
+
+    if not used:
+        return finding, []
+
+    finding.reasons = kept
+    if not kept:
+        finding.verdict = Verdict.OK
+    elif finding.verdict is Verdict.BLOCK and not any(
+        getattr(r, "rule", None) in finding.blocking for r in kept
+    ):
+        # The reason that blocked is gone; what remains is only advisory.
+        finding.verdict = Verdict.WARN
+    return finding, used

{ghostpkg-0.24.2 → ghostpkg-0.24.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ghostpkg"
-version = "0.24.2"
+version = "0.24.4"
 description = "Catch package names that do not exist before you install them"
 readme = "README.en.md"  # English page for PyPI; the repo main page is Ukrainian
 requires-python = ">=3.9"

{ghostpkg-0.24.2 → ghostpkg-0.24.4}/tests/test_action.py

@@ -189,3 +189,30 @@ class TestTheHookIsWellFormed:
     )
     def test_unrelated_files_are_not_matched(self, path):
         assert not re.search(hook()["files"], path)
+
+
+class TestTheDocumentedVersionIsTheRealOne:
+    """Every release script replaced the *previous* version string, so a
+    snippet left on an older one was never touched again. `README.md` sat on
+    `@v0.24.0` through two releases, and the GitHub Marketplace renders that
+    snippet -- so the listing told people to pin a version that predates the
+    fixes it advertises."""
+
+    @pytest.mark.parametrize(
+        "path", ["README.md", "README.en.md", ".pre-commit-hooks.yaml"]
+    )
+    def test_every_pinned_version_matches_the_package(self, path):
+        from ghostpkg import __version__
+
+        text = read(ROOT / path)
+        pinned = set(re.findall(r"M1rwana12/ghostpkg@v([0-9.]+)", text))
+        pinned |= set(re.findall(r"rev: v([0-9.]+)", text))
+        assert pinned <= {__version__}, f"{path} pins {pinned}, package is {__version__}"
+
+    def test_at_least_one_snippet_is_pinned(self):
+        """A guard on the guard: if the patterns stop matching, the test above
+        passes for the wrong reason."""
+        from ghostpkg import __version__
+
+        text = read(ROOT / "README.en.md") + read(ROOT / "README.md")
+        assert f"M1rwana12/ghostpkg@v{__version__}" in text