git-nested 1.1.0__tar.gz → 1.2.0__tar.gz

{git_nested-1.1.0 → git_nested-1.2.0}/.fish.rc

@@ -11,7 +11,8 @@
 #------------------------------------------------------------------------------
 
 set GIT_NESTED_ROOT (dirname (realpath (status --current-filename)))
-set PATH $GIT_NESTED_ROOT/lib $PATH
+set PATH $GIT_NESTED_ROOT/bin $PATH
 
-# Load git-nested completions
-source $GIT_NESTED_ROOT/share/git-nested.fish
+# Tab completion. The script is generated by git-nested itself, from the
+# same tables the argument parser is built from, so it can never drift.
+git-nested completion fish | source

git_nested-1.2.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,23 @@
+---
+name: Bug report
+about: Something git-nested does that it should not
+labels: bug
+---
+
+## What happened
+
+<!-- Paste the command and its output. `-v` or `-d` output helps a lot. -->
+
+## What you expected instead
+
+## How to reproduce
+
+<!-- The shortest sequence of commands that shows it, starting from an empty
+     repository if you can. -->
+
+## Versions
+
+- git-nested: <!-- git nested --version -->
+- git: <!-- git --version -->
+- OS:
+- Installed via: <!-- pip / standalone binary / source .rc -->

git_nested-1.2.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Question or idea
+    url: https://github.com/thorsten-klein/git-nested/discussions
+    about: For anything that is not a bug report or a concrete feature request.
+  - name: Security vulnerability
+    url: https://github.com/thorsten-klein/git-nested/security/advisories/new
+    about: Report privately here, not as a public issue.

git_nested-1.2.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,15 @@
+---
+name: Feature request
+about: Something git-nested cannot do yet
+labels: enhancement
+---
+
+## What you are trying to do
+
+<!-- The workflow, not the feature. It often turns out there is already a way. -->
+
+## What you would like git-nested to do
+
+<!-- If you have a command line in mind, write it out. -->
+
+## What you do instead today

git_nested-1.2.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## What this changes
+
+<!-- One or two sentences. What is different after this is merged? -->
+
+## Why
+
+<!-- The problem it solves. Link the issue if there is one: Fixes #123 -->
+
+## Checklist
+
+- [ ] `uv run poe all` passes (ruff, mypy, pyright, bandit, complexipy, and the
+      tests at 100% coverage)
+- [ ] New behaviour has a test
+- [ ] README / `--help` / the man page updated, if the change is visible to users
+- [ ] The PR title reads as a [Conventional Commit](https://www.conventionalcommits.org)
+      (`feat:`, `fix:`, `docs:`, …) — it becomes the squash-merge commit message
+      and the changelog line

git_nested-1.2.0/.github/dependabot.yml

@@ -0,0 +1,23 @@
+# Dependabot keeps the two things this repository pins up to date: the actions
+# every workflow runs, and the Python dependencies uv.lock records.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      # One pull request for the lot. Action bumps are almost always routine,
+      # and reviewing them together is quicker than reviewing them one by one.
+      actions:
+        patterns: ['*']
+
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      # Dev tooling moves often and breaks nothing users see, so it travels
+      # together; a runtime dependency gets its own pull request.
+      dev:
+        dependency-type: development

git_nested-1.2.0/.github/release.yml

@@ -0,0 +1,22 @@
+# Categories for the notes GitHub generates from merged pull requests. The
+# repository squash-merges with Conventional Commit titles, so the labels
+# below are what sorts a PR into a section -- keep them on the PR, not on the
+# commit.
+changelog:
+  exclude:
+    labels: [skip-changelog]
+  categories:
+    - title: Breaking changes
+      labels: [breaking]
+    - title: Features
+      labels: [enhancement, feature]
+    - title: Fixes
+      labels: [bug, fix]
+    - title: Documentation
+      labels: [documentation]
+    - title: Build, CI and tooling
+      labels: [build, ci, tooling]
+    - title: Dependencies
+      labels: [dependencies]
+    - title: Other changes
+      labels: ['*']

git_nested-1.2.0/.github/workflows/build-binary.yml

@@ -0,0 +1,139 @@
+name: Build binary
+
+# Builds the standalone 'git-nested' executable for one target and uploads it
+# as an artifact. Called by test.yml (so every push/PR proves the recipe still
+# builds) and by release-binary.yml (which attaches it to the release) -- so
+# what CI exercises is built by exactly the recipe that ships, rather than a
+# lookalike that can drift away from it.
+#
+# One call builds one target: PyInstaller freezes for the machine it runs on
+# and nothing else, so Linux, macOS and Windows binaries come from three calls
+# with different 'runs-on'/'container', not from one job.
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Commit/tag/branch to build. Empty: whatever triggered the caller.'
+        type: string
+        required: false
+        default: ''
+      artifact:
+        description: 'Name of the uploaded artifact'
+        type: string
+        required: false
+        default: git-nested-binary
+      runs-on:
+        description: 'Runner to build on -- ubuntu-26.04, macos-latest, windows-latest'
+        type: string
+        required: false
+        default: ubuntu-26.04
+      container:
+        description: 'Container to build inside (Linux only). Empty: build on the runner itself.'
+        type: string
+        required: false
+        default: almalinux:8
+      python-version:
+        description: 'Python to freeze, e.g. 3.12'
+        type: string
+        required: false
+        default: '3.12'
+    outputs:
+      archive:
+        description: 'File name of the built archive, e.g. git-nested-1.2.3-x64-linux.tar.xz. Only meaningful for a single (non-matrix) call.'
+        value: ${{ jobs.build.outputs.archive }}
+      version:
+        description: 'Version of the built git-nested, e.g. 1.2.3'
+        value: ${{ jobs.build.outputs.version }}
+
+jobs:
+  build:
+    runs-on: ${{ inputs.runs-on }}
+    # An empty string here means "no container", which is what the macOS and
+    # Windows callers pass -- containers are a Linux-runner feature.
+    #
+    # For Linux the default is almalinux:8, and that is a portability
+    # decision, not a convenience one: a PyInstaller binary links the glibc of
+    # the machine that built it, and glibc is only backward compatible, so
+    # built on ubuntu-26.04 it would refuse to start on anything older than
+    # that runner. AlmaLinux 8 has glibc 2.28, the oldest that still runs the
+    # node20 the actions below need, which covers every distro from Ubuntu
+    # 20.04 / Debian 10 / Fedora 29 / RHEL 8 onwards. glibc-based distros only
+    # -- musl ones (Alpine) can never run this binary.
+    container: ${{ inputs.container }}
+    # bash everywhere, including Windows, where the default is pwsh --
+    # create-python-exe.sh is one script for all three targets.
+    defaults:
+      run:
+        shell: bash
+    outputs:
+      archive: ${{ steps.build.outputs.archive }}
+      version: ${{ steps.build.outputs.version }}
+    steps:
+      # Before the checkout -- without git, actions/checkout silently falls
+      # back to downloading a tarball, and a checkout with no .git has no
+      # tags for setuptools-scm to derive the version from. Only the container
+      # needs this; a hosted runner ships all of it.
+      - name: Install build prerequisites
+        if: inputs.container != ''
+        run: dnf -y install "python${{ inputs.python-version }}" "python${{ inputs.python-version }}-pip" git tar xz
+
+      # ... and the runners get their python from here instead.
+      - uses: actions/setup-python@v7
+        if: inputs.container == ''
+        with:
+          python-version: ${{ inputs.python-version }}
+
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref }}
+          # the version frozen into the binary comes from the tags, and the
+          # default shallow checkout fetches none of them.
+          fetch-depth: 0
+
+      # the checkout is owned by a different user than this container's root,
+      # which git refuses to read from until told it is not a security issue.
+      - name: Trust the checkout
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Build the executable
+        id: build
+        run: |
+          # In the container python is installed under its versioned name; on
+          # a runner setup-python puts a plain 'python' on PATH.
+          if [ -n "${{ inputs.container }}" ]; then
+              PY="python${{ inputs.python-version }}"
+          else
+              PY=python
+          fi
+          scripts/create-python-exe.sh --output dist --python "$PY"
+          # The archive name carries the version and the target
+          # (git-nested-<version>-<arch>-<os>.tar.xz, .zip on Windows), so it
+          # cannot be spelled out ahead of time -- it is published as an
+          # output for callers that need the exact name.
+          #
+          # nullglob: only one of the two patterns ever matches (a build
+          # produces .tar.xz or .zip, never both) -- without it the unmatched
+          # pattern is passed to ls literally, ls exits non-zero trying to
+          # read it, and pipefail+errexit abort the step right here with no
+          # visible error (ls's message went to /dev/null).
+          shopt -s nullglob
+          ARCHIVE="$(ls dist/*.tar.xz dist/*.zip 2>/dev/null | head -1)"
+          test -n "$ARCHIVE" || { echo "no archive produced" >&2; exit 1; }
+          echo "archive=$(basename "$ARCHIVE")" >> "$GITHUB_OUTPUT"
+          # 'git-nested Version: X.Y.Z' -> X.Y.Z
+          EXE=dist/git-nested
+          [ -f "$EXE" ] || EXE=dist/git-nested.exe
+          echo "version=$("$EXE" --version | head -1 | cut -d' ' -f3)" >> "$GITHUB_OUTPUT"
+
+      # the archive rather than the bare executable. It is what a release
+      # actually ships, and on the two platforms where it is a .tar.xz it
+      # keeps the exec bit as well, so consumers just untar and run it.
+      - uses: actions/upload-artifact@v7
+        with:
+          name: ${{ inputs.artifact }}
+          path: |
+            dist/*.tar.xz
+            dist/*.zip
+          if-no-files-found: error
+          # main keeps its builds for a month, branch and PR builds only for two days.
+          retention-days: ${{ github.ref == 'refs/heads/main' && 30 || 2 }}

git_nested-1.2.0/.github/workflows/docs.yml

@@ -0,0 +1,64 @@
+name: Docs
+
+# Builds doc/ (see doc/conf.py) with Sphinx. On pull requests it only
+# builds, so a broken page fails the check. On main it also publishes the
+# site to the gh_pages branch, which GitHub Pages serves.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ['**']
+  # by hand: 'Run workflow' in the Actions tab, or `gh workflow run docs.yml`
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  build:
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          # doc/conf.py shows the version from `git describe`, which needs the tags.
+          fetch-depth: 0
+      - name: Install uv
+        uses: astral-sh/setup-uv@v10.3.0
+        with:
+          python-version: '3.14'
+          enable-cache: true
+      - name: Setup project
+        run: uv sync --frozen
+      - name: Build docs
+        run: uv run poe docs
+      - name: Upload docs
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v7
+        with:
+          name: docs-html
+          path: doc/_build/html
+          include-hidden-files: true
+
+  # A job of its own, so only this one can write to the repository.
+  # Only main is published, also when the workflow is started by hand.
+  publish:
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-26.04
+    permissions:
+      contents: write
+    steps:
+      - name: Download docs
+        uses: actions/download-artifact@v8
+        with:
+          name: docs-html
+          path: site
+      - name: Publish docs
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_branch: gh_pages
+          publish_dir: site
+          force_orphan: true

git_nested-1.2.0/.github/workflows/prune-artifacts.yml

@@ -0,0 +1,57 @@
+name: Prune artifacts
+
+# Caps how many binary artifacts pile up against the repository's Actions
+# storage quota, per artifact name and branch: main keeps its newest 3 builds,
+# every other branch (PR branches included) only its newest 1. The upload
+# step's retention-days (30 days main, 2 days elsewhere) is only an upper
+# bound; this caps the count as well.
+#
+# Runs once the workflows that build the artifacts have finished, so the
+# artifact of the run that triggered it already exists and the caps hold
+# exactly. workflow_run only fires for workflow files on the default branch,
+# so changes to this file take effect once merged.
+on:
+  workflow_run:
+    workflows:
+    - Run Tests
+    - Release binary
+    types:
+    - completed
+  # on-demand -- 'Run workflow' in the Actions tab, or `gh workflow run prune-artifacts.yml`
+  workflow_dispatch:
+    inputs:
+      keep:
+        description: 'How many of the newest main artifacts to keep per artifact name (other branches keep 1)'
+        type: number
+        default: 3
+
+permissions:
+  actions: write
+
+# two prunes at once would only race each other deleting the same artifacts.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  prune:
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Delete all but the newest builds
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          KEEP: ${{ inputs.keep || 3 }}
+        run: |
+          # Per artifact name and branch ("git-nested-binary-ci-linux" on
+          # "main", ...), newest first; everything after the first $KEEP on
+          # main, or after the first 1 on any other branch, is deleted. Other
+          # artifacts (dist) are not touched.
+          gh api --paginate "repos/$REPO/actions/artifacts?per_page=100" \
+              --jq '.artifacts[] | select(.expired == false) | select(.name | startswith("git-nested-binary-")) | [.name + " " + .workflow_run.head_branch, .created_at, .id, .workflow_run.head_branch] | @tsv' \
+            | sort -t $'\t' -k1,1 -k2,2r \
+            | awk -F'\t' -v keep="$KEEP" '{ if (++n[$1] > ($4 == "main" ? keep : 1)) print $3, $1 }' \
+            | while read -r id name; do
+                echo "delete $name (artifact $id)"
+                gh api -X DELETE "repos/$REPO/actions/artifacts/$id"
+              done

{git_nested-1.1.0 → git_nested-1.2.0}/.github/workflows/publish.yml

@@ -6,14 +6,14 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v10.3.0
         with:
           python-version: '3.13'
           enable-cache: true
@@ -22,14 +22,14 @@ jobs:
       - name: Build package
         run: uv run poe build
       - name: Upload dist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/
 
   publish:
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment:
       name: pypi
       url: https://pypi.org/project/git-nested/
@@ -37,7 +37,7 @@ jobs:
       id-token: write
     steps:
       - name: Download dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/

{git_nested-1.1.0 → git_nested-1.2.0}/.github/workflows/release-binary.yml

@@ -1,9 +1,9 @@
 name: Release binary
 
-# Builds the single-file 'git-nested' executable (see
-# scripts/create-python-exe.sh) and attaches
-# git-nested-<version>-x64-linux.tar.xz to the release, so git-nested can be
-# used on a machine that has no python -- and no pip, no uv -- at all.
+# Builds the single-file 'git-nested' executable for Linux, macOS and Windows
+# (see scripts/create-python-exe.sh) and attaches each archive to the release,
+# so git-nested can be used on a machine that has no python -- and no pip, no
+# uv -- at all.
 #
 # Separate from publish.yml on purpose. That one is triggered by the tag push
 # and uploads to PyPI, while attaching an asset needs the GitHub *release* to
@@ -40,10 +40,27 @@ jobs:
   # test.yml so both exercise the same executable. 'env.REF' is not available
   # to a reusable workflow's inputs, so the ref is spelled out again.
   build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Intel macOS is deliberately absent: those runners are gone, and
+          # the arm64 binary is what a current Mac needs.
+          - target: linux
+            runs-on: ubuntu-26.04
+            container: almalinux:8
+          - target: macos
+            runs-on: macos-latest
+            container: ''
+          - target: windows
+            runs-on: windows-latest
+            container: ''
     uses: ./.github/workflows/build-binary.yml
     with:
       ref: ${{ github.event.release.tag_name || inputs.tag || github.ref }}
-      artifact: git-nested-binary
+      artifact: git-nested-binary-${{ matrix.target }}
+      runs-on: ${{ matrix.runs-on }}
+      container: ${{ matrix.container }}
 
   # The whole pytest suite, driven through the binary that is about to be
   # attached -- the check that it is functionally complete, not just startable.
@@ -52,14 +69,14 @@ jobs:
     uses: ./.github/workflows/test-binary.yml
     with:
       ref: ${{ github.event.release.tag_name || inputs.tag || github.ref }}
-      artifact: git-nested-binary
+      artifact: git-nested-binary-linux
 
   # Proves the "runs on any x86_64 Linux" claim rather than assuming it. The
   # binary is dropped into stock distro images that have no python installed,
   # and has to drive a real nested repo end to end there.
   verify:
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: false
       matrix:
@@ -81,14 +98,14 @@ jobs:
           - image: archlinux:latest
             install: pacman -Sy --noconfirm git
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
-          name: git-nested-binary
+          name: git-nested-binary-linux
 
-      # Named git-nested-<version>-x64-linux.tar.xz -- resolved by glob since
-      # the version isn't known here.
+      # Named git-nested-<version>-<arch>-linux.tar.xz -- resolved by glob
+      # since the version isn't known here.
       - name: Unpack
-        run: tar -xf git-nested-*-x64-linux.tar.xz
+        run: tar -xf git-nested-*-linux.tar.xz
 
       # git is the one thing that does have to be installed -- git-nested
       # drives it and refuses to start without it. Python deliberately is not:
@@ -146,21 +163,26 @@ jobs:
     needs: [build, test, verify]
     # nothing to attach when workflow_dispatch ran without a tag
     if: github.event_name == 'release' || inputs.tag != ''
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      # every target's artifact, unpacked side by side. 'build' is a matrix,
+      # and a matrix job's outputs are last-one-wins, so the exact file names
+      # are read off disk here rather than composed from an output.
+      - uses: actions/download-artifact@v8
         with:
-          name: git-nested-binary
+          pattern: git-nested-binary-*
+          merge-multiple: true
 
       # --clobber so re-running against an already-attached release replaces
-      # the asset instead of failing halfway. The filename is composed from
-      # 'build's version output -- this is the point that actually names the
-      # release asset, so it uses the real version rather than a glob.
-      - name: Attach git-nested-${{ needs.build.outputs.version }}-x64-linux.tar.xz to ${{ env.REF }}
+      # the assets instead of failing halfway.
+      - name: Attach the binaries to ${{ env.REF }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
-          ARCHIVE: git-nested-${{ needs.build.outputs.version }}-x64-linux.tar.xz
-        run: gh release upload "$REF" "$ARCHIVE" --clobber
+        run: |
+          mapfile -t assets < <(ls git-nested-*.tar.xz git-nested-*.zip 2>/dev/null)
+          test "${#assets[@]}" -gt 0 || { echo "no archives downloaded" >&2; exit 1; }
+          printf '%s\n' "${assets[@]}"
+          gh release upload "$REF" "${assets[@]}" --clobber

{git_nested-1.1.0 → git_nested-1.2.0}/.github/workflows/test-binary.yml

@@ -1,7 +1,7 @@
 name: Test binary
 
-# Runs the *whole* pytest suite against the standalone executable instead of
-# against the git_nested module in the checkout: conftest's GIT_NESTED_EXE
+# Runs the *whole* pytest suite against the standalone Linux executable rather
+# than against the git_nested module in the checkout: conftest's GIT_NESTED_EXE
 # routes every cmd_git_nested() call through `git nested ...` on PATH, so the
 # ~130 tests drive the frozen binary as a user would. That is what catches the
 # failures unique to freezing -- a module PyInstaller did not collect, package
@@ -28,9 +28,9 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
           # no fetch-depth: 0 needed -- the version under test is read out of
@@ -38,7 +38,7 @@ jobs:
           # tags of this checkout.
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v10.3.0
         with:
           python-version: '3.13'
           enable-cache: true
@@ -56,19 +56,19 @@ jobs:
           git config --global --add safe.directory "$PWD";
           git config --global --add safe.directory "$PWD.git";
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.artifact }}
 
       # into its own directory: the env fixture puts the binary's directory on
       # PATH, and the repo root is not a good thing to put there. Named
-      # git-nested-<version>-x64-linux.tar.xz, so matched by glob. 'git-nested'
+      # git-nested-<version>-<arch>-linux.tar.xz, so matched by glob. 'git-nested'
       # inside is a symlink to the versioned binary, so both land in bin/
       # together.
       - name: Unpack the binary
         run: |
           mkdir -p bin
-          tar -C bin -xf git-nested-*-x64-linux.tar.xz
+          tar -C bin -xf git-nested-*-linux.tar.xz
           bin/git-nested --version
 
       # no coverage flags: the code being executed lives in another process