git-nested 1.0.5__tar.gz → 1.1.0__tar.gz

{git_nested-1.0.5 → git_nested-1.1.0}/.github/workflows/build-binary.yml

@@ -18,6 +18,10 @@ on:
         type: string
         required: false
         default: git-nested-binary
+    outputs:
+      version:
+        description: 'Version of the built git-nested, e.g. 1.2.3 -- for composing the exact git-nested-<version>-x64-linux.tar.xz filename in a caller'
+        value: ${{ jobs.build.outputs.version }}
 
 jobs:
   build:
@@ -30,6 +34,8 @@ jobs:
     # Fedora 29 / RHEL 8 onwards. glibc-based distros only -- musl ones
     # (Alpine) can never run this binary.
     container: almalinux:8
+    outputs:
+      version: ${{ steps.build.outputs.version }}
     steps:
       # Before the checkout -- without git, actions/checkout silently falls
       # back to downloading a tarball, and a checkout with no .git has no
@@ -50,13 +56,23 @@ jobs:
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
       - name: Build the executable
-        run: scripts/create-python-exe.sh --output dist --python python3.12
+        id: build
+        run: |
+          scripts/create-python-exe.sh --output dist --python python3.12
+          # 'git-nested Version: X.Y.Z' -> X.Y.Z. Exposed as a job output so a
+          # caller can compose the exact git-nested-<version>-x64-linux.tar.xz
+          # filename itself (e.g. release-binary.yml's 'gh release upload')
+          # instead of globbing for it.
+          echo "version=$(dist/git-nested --version | head -1 | cut -d' ' -f3)" >> "$GITHUB_OUTPUT"
 
       # the .tar.xz rather than the bare executable. It is what a release
       # actually ships, and unlike a zipped artifact it keeps the exec bit,
-      # so consumers just untar and run it.
+      # so consumers just untar and run it. Named git-nested-<version>-x64-linux
+      # by create-python-exe.sh, so the version can't be spelled out here --
+      # matched by glob instead (see steps.build.outputs.version for callers
+      # that need the exact name).
       - uses: actions/upload-artifact@v4
         with:
           name: ${{ inputs.artifact }}
-          path: dist/git-nested_x64_Linux.tar.xz
+          path: dist/git-nested-*-x64-linux.tar.xz
           if-no-files-found: error

{git_nested-1.0.5 → git_nested-1.1.0}/.github/workflows/release-binary.yml

@@ -1,9 +1,9 @@
 name: Release binary
 
 # Builds the single-file 'git-nested' executable (see
-# scripts/create-python-exe.sh) and attaches git-nested_x64_Linux.tar.xz to the
-# release, so git-nested can be used on a machine that has no python -- and no
-# pip, no uv -- at all.
+# scripts/create-python-exe.sh) and attaches
+# git-nested-<version>-x64-linux.tar.xz to the release, so git-nested can be
+# used on a machine that has no python -- and no pip, no uv -- at all.
 #
 # Separate from publish.yml on purpose. That one is triggered by the tag push
 # and uploads to PyPI, while attaching an asset needs the GitHub *release* to
@@ -34,7 +34,6 @@ env:
   # produce an executable that misreports itself. Empty on a plain
   # workflow_dispatch -- then the triggering ref is built as-is.
   REF: ${{ github.event.release.tag_name || inputs.tag || github.ref }}
-  ARCHIVE: git-nested_x64_Linux.tar.xz
 
 jobs:
   # the glibc floor and every other build decision live there, shared with
@@ -86,8 +85,10 @@ jobs:
         with:
           name: git-nested-binary
 
+      # Named git-nested-<version>-x64-linux.tar.xz -- resolved by glob since
+      # the version isn't known here.
       - name: Unpack
-        run: tar -xf "$ARCHIVE"
+        run: tar -xf git-nested-*-x64-linux.tar.xz
 
       # git is the one thing that does have to be installed -- git-nested
       # drives it and refuses to start without it. Python deliberately is not:
@@ -127,17 +128,22 @@ jobs:
 
       # The binary and the script are mounted in, so the distro images need
       # neither tar/xz nor anything else to take part beyond git -- the point
-      # is that nothing else is required.
+      # is that nothing else is required. 'git-nested' is now a symlink to the
+      # versioned binary, so both have to be mounted together (into PATH)
+      # rather than just the single file -- a lone symlink mount would
+      # dangle, pointing at a sibling that was never brought along.
       - name: Run on ${{ matrix.image }}
         run: |
           docker run --rm \
-            -v "$PWD/git-nested:/usr/local/bin/git-nested:ro" \
-            -v "$PWD/verify.sh:/verify.sh:ro" \
+            -v "$PWD:/work" -w /work \
             ${{ matrix.image }} \
-            sh -c '${{ matrix.install }} >/dev/null && sh /verify.sh'
+            sh -c '${{ matrix.install }} >/dev/null && export PATH="/work:$PATH" && sh verify.sh'
 
   upload:
-    needs: [test, verify]
+    # 'build' listed directly (not just transitively via 'test'/'verify')
+    # because a job's outputs are only visible to jobs that name it in
+    # 'needs'.
+    needs: [build, test, verify]
     # nothing to attach when workflow_dispatch ran without a tag
     if: github.event_name == 'release' || inputs.tag != ''
     runs-on: ubuntu-latest
@@ -149,9 +155,12 @@ jobs:
           name: git-nested-binary
 
       # --clobber so re-running against an already-attached release replaces
-      # the asset instead of failing halfway.
-      - name: Attach ${{ env.ARCHIVE }} to ${{ env.REF }}
+      # the asset instead of failing halfway. The filename is composed from
+      # 'build's version output -- this is the point that actually names the
+      # release asset, so it uses the real version rather than a glob.
+      - name: Attach git-nested-${{ needs.build.outputs.version }}-x64-linux.tar.xz to ${{ env.REF }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
+          ARCHIVE: git-nested-${{ needs.build.outputs.version }}-x64-linux.tar.xz
         run: gh release upload "$REF" "$ARCHIVE" --clobber

{git_nested-1.0.5 → git_nested-1.1.0}/.github/workflows/test-binary.yml

@@ -61,11 +61,14 @@ jobs:
           name: ${{ inputs.artifact }}
 
       # into its own directory: the env fixture puts the binary's directory on
-      # PATH, and the repo root is not a good thing to put there.
+      # PATH, and the repo root is not a good thing to put there. Named
+      # git-nested-<version>-x64-linux.tar.xz, so matched by glob. 'git-nested'
+      # inside is a symlink to the versioned binary, so both land in bin/
+      # together.
       - name: Unpack the binary
         run: |
           mkdir -p bin
-          tar -C bin -xf git-nested_x64_Linux.tar.xz
+          tar -C bin -xf git-nested-*-x64-linux.tar.xz
           bin/git-nested --version
 
       # no coverage flags: the code being executed lives in another process

{git_nested-1.0.5 → git_nested-1.1.0}/.github/workflows/test.yml

@@ -35,6 +35,11 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          # SonarCloud's blame-based analysis (new-code detection, issue
+          # authorship) needs real history, not the default shallow, tagless
+          # checkout.
+          fetch-depth: 0
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
@@ -61,3 +66,8 @@ jobs:
         uses: codecov/test-results-action@v1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
+      - name: SonarCloud Scan
+        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.14'
+        uses: SonarSource/sonarqube-scan-action@v4
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

{git_nested-1.0.5 → git_nested-1.1.0}/.gitignore

@@ -10,6 +10,7 @@ build/
 .coverage
 htmlcov/
 coverage.xml
+.coverage*
 junit.xml
 *.whl
 *.tar.gz

git_nested-1.1.0/.pre-commit-config.yaml

@@ -0,0 +1,62 @@
+# Repo-wide hygiene gate. Run over the whole tree by `uv run poe pre-commit`,
+# the first step of `uv run poe all`. Nothing installs an actual git hook --
+# that stays a per-developer `pre-commit install` if you want it.
+#
+# Everything language-specific already has its own poe task backed by a version
+# pinned in pyproject.toml's `lint` dependency group -- ruff, mypy, pyright,
+# bandit, pip-audit, complexipy. Duplicating any of them here would mean a
+# second, independently-pinned copy drifting from the one CI runs, so this file
+# deliberately stays limited to the checks nothing else covers.
+repos:
+  # General pre-commit hooks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      # --- whitespace -----------------------------------------------------
+      # .patch/.diff are excluded throughout: trailing whitespace inside a
+      # hunk is content, and git's "-- \n" signature separator is load-bearing.
+      # Rewriting either corrupts the patch.
+      - id: trailing-whitespace
+        exclude: ^.*\.(patch|diff)$
+      - id: end-of-file-fixer
+        exclude: ^.*\.(patch|diff)$
+      - id: mixed-line-ending
+        args: ['--fix=lf']
+        exclude: ^.*\.(patch|diff)$
+
+      # --- parseability of the files that configure everything else -------
+      - id: check-yaml
+      - id: check-toml
+      - id: check-json
+
+      # --- python ---------------------------------------------------------
+      - id: debug-statements
+      - id: name-tests-test
+        args: ['--pytest-test-first']
+
+      # --- scripts --------------------------------------------------------
+      - id: check-executables-have-shebangs
+      - id: check-shebang-scripts-are-executable
+        # share/*.bash and share/*.sh are meant to be *sourced* into a user's
+        # shell (see share/enable-completion.sh), never executed directly --
+        # their shebang is there only so editors pick the right syntax mode.
+        exclude: ^share/
+
+      # --- repo integrity -------------------------------------------------
+      - id: detect-private-key
+      - id: check-added-large-files
+        args: ['--maxkb=500', '--enforce-all']
+      - id: check-case-conflict
+      - id: check-merge-conflict
+      - id: check-symlinks
+      - id: destroyed-symlinks
+      - id: forbid-submodules
+
+
+# Configuration
+default_language_version:
+  python: python3.12
+
+# Minimum pre-commit version -- matches the floor pyproject.toml's `lint`
+# dependency group pins.
+minimum_pre_commit_version: '4.0.0'

{git_nested-1.0.5 → git_nested-1.1.0}/CONTRIBUTING.md

@@ -92,14 +92,31 @@ a release.
 
 ### Code Quality
 
-We use [Ruff](https://github.com/astral-sh/ruff) for both linting and formatting:
+`uv run poe all` runs the full gate CI enforces: repo hygiene, linting,
+formatting, static typing, security, dependency, and complexity checks, then
+the test suite. Each has its own `poe` task if you want to run just one:
 
 ```bash
-# Check code quality
-uv run poe lint
+# Repo-wide hygiene (whitespace, YAML/TOML/JSON parseability, shebangs, ...)
+uv run poe pre-commit
 
-# Auto-format code
+# Lint and auto-format with Ruff (https://github.com/astral-sh/ruff)
+uv run poe lint
 uv run poe format
+
+# Static typing -- mypy and pyright are both run since they catch
+# different things; passing both is required
+uv run poe mypy
+uv run poe pyright
+
+# Security linting (bandit) and dependency vulnerability scanning (pip-audit)
+uv run poe bandit
+uv run poe pip-audit
+
+# Cognitive complexity (complexipy); threshold is set in pyproject.toml's
+# [tool.complexipy] to catch complexity creep in new code, not to demand
+# every existing function be simple
+uv run poe complexity
 ```
 
 Make sure all checks pass before submitting your PR.

{git_nested-1.0.5 → git_nested-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-nested
-Version: 1.0.5
+Version: 1.1.0
 Summary: Git Submodule Alternative
 Author-email: Thorsten Klein <thorsten.klein.git@gmail.com>
 License: MIT
@@ -83,16 +83,23 @@ pip install git+https://github.com/thorsten-klein/git-nested
 #### Method 2: Standalone Executable (no Python needed)
 
 Every [release](https://github.com/thorsten-klein/git-nested/releases) ships
-`git-nested_x64_Linux.tar.xz`: a single file with git-nested, its dependencies
-and a Python interpreter inside. Only git itself has to be installed.
+`git-nested-<version>-x64-linux.tar.xz`: a single file with git-nested, its
+dependencies and a Python interpreter inside. Only git itself has to be
+installed.
 
 ```bash
-curl -L https://github.com/thorsten-klein/git-nested/releases/latest/download/git-nested_x64_Linux.tar.xz | tar -xJ
+# Find the asset from the latest release
+ASSET=$(curl -sSL https://api.github.com/repos/thorsten-klein/git-nested/releases/latest | grep -o 'https://[^"]*\.tar\.xz')
+
+# Download the asset and unpack it
+curl -sSL "$ASSET" | tar -xJ
 sudo install git-nested /usr/local/bin/   # any directory on PATH works
 ```
 
 The file has to keep the name `git-nested` — that is how `git nested ...`
-finds it. The archive also contains the completion scripts from `share/`.
+finds it. The archive also contains a versioned copy of the binary (e.g.
+`git-nested-1.2.3`) that `git-nested` symlinks to, and the completion scripts
+from `share/`.
 
 Built on x86_64 with glibc 2.28, so it runs on any x86_64 Linux from that
 version onwards (Ubuntu 20.04, Debian 10, RHEL/AlmaLinux 8 and newer). Not on

{git_nested-1.0.5 → git_nested-1.1.0}/README.md

@@ -57,16 +57,23 @@ pip install git+https://github.com/thorsten-klein/git-nested
 #### Method 2: Standalone Executable (no Python needed)
 
 Every [release](https://github.com/thorsten-klein/git-nested/releases) ships
-`git-nested_x64_Linux.tar.xz`: a single file with git-nested, its dependencies
-and a Python interpreter inside. Only git itself has to be installed.
+`git-nested-<version>-x64-linux.tar.xz`: a single file with git-nested, its
+dependencies and a Python interpreter inside. Only git itself has to be
+installed.
 
 ```bash
-curl -L https://github.com/thorsten-klein/git-nested/releases/latest/download/git-nested_x64_Linux.tar.xz | tar -xJ
+# Find the asset from the latest release
+ASSET=$(curl -sSL https://api.github.com/repos/thorsten-klein/git-nested/releases/latest | grep -o 'https://[^"]*\.tar\.xz')
+
+# Download the asset and unpack it
+curl -sSL "$ASSET" | tar -xJ
 sudo install git-nested /usr/local/bin/   # any directory on PATH works
 ```
 
 The file has to keep the name `git-nested` — that is how `git nested ...`
-finds it. The archive also contains the completion scripts from `share/`.
+finds it. The archive also contains a versioned copy of the binary (e.g.
+`git-nested-1.2.3`) that `git-nested` symlinks to, and the completion scripts
+from `share/`.
 
 Built on x86_64 with glibc 2.28, so it runs on any x86_64 Linux from that
 version onwards (Ubuntu 20.04, Debian 10, RHEL/AlmaLinux 8 and newer). Not on

{git_nested-1.0.5 → git_nested-1.1.0}/lib/git_nested.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-nested
-Version: 1.0.5
+Version: 1.1.0
 Summary: Git Submodule Alternative
 Author-email: Thorsten Klein <thorsten.klein.git@gmail.com>
 License: MIT
@@ -83,16 +83,23 @@ pip install git+https://github.com/thorsten-klein/git-nested
 #### Method 2: Standalone Executable (no Python needed)
 
 Every [release](https://github.com/thorsten-klein/git-nested/releases) ships
-`git-nested_x64_Linux.tar.xz`: a single file with git-nested, its dependencies
-and a Python interpreter inside. Only git itself has to be installed.
+`git-nested-<version>-x64-linux.tar.xz`: a single file with git-nested, its
+dependencies and a Python interpreter inside. Only git itself has to be
+installed.
 
 ```bash
-curl -L https://github.com/thorsten-klein/git-nested/releases/latest/download/git-nested_x64_Linux.tar.xz | tar -xJ
+# Find the asset from the latest release
+ASSET=$(curl -sSL https://api.github.com/repos/thorsten-klein/git-nested/releases/latest | grep -o 'https://[^"]*\.tar\.xz')
+
+# Download the asset and unpack it
+curl -sSL "$ASSET" | tar -xJ
 sudo install git-nested /usr/local/bin/   # any directory on PATH works
 ```
 
 The file has to keep the name `git-nested` — that is how `git nested ...`
-finds it. The archive also contains the completion scripts from `share/`.
+finds it. The archive also contains a versioned copy of the binary (e.g.
+`git-nested-1.2.3`) that `git-nested` symlinks to, and the completion scripts
+from `share/`.
 
 Built on x86_64 with glibc 2.28, so it runs on any x86_64 Linux from that
 version onwards (Ubuntu 20.04, Debian 10, RHEL/AlmaLinux 8 and newer). Not on

{git_nested-1.0.5 → git_nested-1.1.0}/lib/git_nested.egg-info/SOURCES.txt

@@ -2,11 +2,13 @@
 .fish.rc
 .gitattributes
 .gitignore
+.pre-commit-config.yaml
 .rc
 CONTRIBUTING.md
 LICENSE
 README.md
 pyproject.toml
+sonar-project.properties
 uv.lock
 .github/CODEOWNERS
 .github/workflows/build-binary.yml
@@ -32,6 +34,7 @@ test/conftest.py
 test/test_branch.py
 test/test_clean.py
 test/test_clone.py
+test/test_commit.py
 test/test_completion.py
 test/test_diff.py
 test/test_encode.py
@@ -50,4 +53,8 @@ test/test_version.py
 test/scenarios/test_extraction.py
 test/scenarios/test_filemode.py
 test/scenarios/test_filter.py
-test/unittest/test_logging.py
+test/unittest/conftest.py
+test/unittest/test_command.py
+test/unittest/test_helpers.py
+test/unittest/test_logging.py
+test/unittest/test_repo_business.py