gitoxide-py 0.87.0__tar.gz

gitoxide_py-0.87.0/.github/windows-check/verify-wheel.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Install the cross-built Windows wheel into a real Windows CPython and import
+# it. Runs inside infra's windows-ci image (Wine plus a Windows Python), which
+# the release workflow uses as a job container with the wheels mounted beside
+# this script.
+#
+# This is the check the GitHub-hosted windows runner never performed: it built
+# a wheel and uploaded it without ever loading the extension. A wheel that
+# links a DLL the target machine lacks fails here rather than on a user's
+# machine after publishing.
+set -euo pipefail
+
+# The directory this script was staged into is the one holding the wheels.
+cd "$(dirname "$0")"
+
+# --only-binary: the sdist would also satisfy `gitoxide-py`, and building it
+# would need a Rust toolchain this image does not have -- a silent fallback
+# would mean testing something other than the wheel under test.
+# --no-index: everything needed is in that directory, and the container may
+# have no route to PyPI.
+xvfb-run --auto-servernum wine C:/Python312/python.exe -m pip install \
+    --no-index --only-binary :all: --find-links . gitoxide-py
+
+xvfb-run --auto-servernum wine C:/Python312/python.exe - <<'PY'
+import pathlib
+
+import gitoxide_py
+
+pkg = pathlib.Path(gitoxide_py.__file__).parent
+assert (pkg / "py.typed").is_file(), "py.typed missing from the wheel"
+assert (pkg / "__init__.pyi").is_file(), "stub missing from the wheel"
+
+# Calls into the extension, so a wheel that imports but cannot execute fails
+# here too.
+print("windows wheel ok:", gitoxide_py.gix_version())
+PY

gitoxide_py-0.87.0/.github/workflows/ci.yml

@@ -0,0 +1,128 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, feguitv]
+    timeout-minutes: 20
+    # git, uv, and a pinned Rust toolchain (with rustfmt/clippy) all ship in
+    # this image already (infra's roles/python_ci), so no per-run setup is
+    # needed for any of them.
+    container:
+      image: localhost:5000/python-ci:latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          fetch-depth: 0 # full history, so `git describe` can see tags
+
+      - name: Configure git identity for test fixtures
+        run: |
+          git config --global user.name "CI"
+          git config --global user.email "ci@localhost"
+          git config --global --add safe.directory '*'
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+
+      # dunamai derives a version from git state: the exact tag on a tagged
+      # commit (a release build on main), otherwise the last tag plus a
+      # commit-count/short-SHA suffix so a dev build is traceable to the
+      # exact commit it came from. `uv tool run` (the `uvx` shorthand isn't
+      # installed in this image) runs it without adding it to the project's
+      # own dependencies. `--style semver` is required here (not pep440):
+      # Cargo.toml needs strict SemVer, and maturin itself converts a
+      # SemVer prerelease/build version into the equivalent PEP 440 wheel
+      # version at build time.
+      - name: Set package version from git
+        run: |
+          version="$(uv tool run dunamai from git --style semver)"
+          echo "Package version: $version"
+          sed -i "0,/^version = \".*\"/s//version = \"$version\"/" Cargo.toml
+
+      # --locked fails instead of silently updating uv.lock if it's out of
+      # sync with pyproject.toml.
+      - name: uv sync
+        run: uv sync --locked
+
+      - name: cargo fmt --check
+        run: cargo fmt --check
+
+      - name: cargo clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Build extension
+        run: uv run maturin develop --release --generate-stubs
+
+      # `--no-sync` for the same reason the coverage step below needs it: a
+      # plain `uv run pytest` re-syncs the project first and swaps the `.so`
+      # maturin just installed for whatever build its cache holds for this
+      # version, so pytest would import an extension that predates the step
+      # above. `--no-sync` runs pytest against the environment as it stands.
+      - name: pytest
+        run: uv run --no-sync pytest -v
+
+      # `cargo llvm-cov show-env` prints the RUSTC_WRAPPER/LLVM_PROFILE_FILE/etc
+      # that make a `cargo build` instrumented and its profile data land where
+      # `cargo llvm-cov report` expects it. The Rust code here is only ever
+      # exercised through the Python extension module (there's no `cargo
+      # test` harness), so rather than the usual `cargo llvm-cov test`
+      # one-liner, the env is exported once, maturin builds the instrumented
+      # `.so` under it, pytest drives that `.so` to produce the profile data
+      # (the LLVM profiling runtime flushes it when the Python process exits,
+      # same as it would for a native Rust test binary), and only then is the
+      # report generated from the accumulated data.
+      - name: Set up coverage environment
+        run: |
+          cargo llvm-cov show-env --sh | sed -E "s/^export //; s/'//g" >> "$GITHUB_ENV"
+          cargo llvm-cov clean --workspace
+
+      # A debug build, not the `test` job's `--release`: the release profile's
+      # `lto = "thin"` + `codegen-units = 1` (Cargo.toml) inlines and merges
+      # code across unit boundaries aggressively enough to make LLVM's
+      # per-line coverage counters unreliable.
+      - name: Build extension (instrumented)
+        run: uv run maturin develop
+
+      # `--no-sync`: a plain `uv run pytest` re-checks the project against
+      # uv's own build/dependency cache first and, finding the local
+      # gitoxide-py package "out of sync" with what it last built, silently
+      # rebuilds and reinstalls it -- outside the coverage env set up above,
+      # so it clobbers the instrumented `.so` maturin just installed with an
+      # uninstrumented one before pytest ever imports it. `--no-sync` runs
+      # pytest against the environment as it stands.
+      - name: pytest (coverage)
+        run: uv run --no-sync pytest -v
+
+      - name: Generate coverage report
+        run: |
+          echo "## Rust Coverage Summary" >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          cargo llvm-cov report --summary-only >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+
+      # PyO3's `#[pymethods]` macro emits a zero-width coverage region per
+      # generated method trampoline, collapsed onto the attribute's own
+      # line, that never registers a hit regardless of whether the method
+      # actually ran (e.g. Repository.head_commit's shows 0 despite being
+      # called throughout the test suite) -- a coverage-instrumentation
+      # artifact of the macro expansion, not a gap in testing. That caps
+      # this file's realistic ceiling below literal 100%; 97 leaves
+      # headroom for that artifact while still catching real regressions.
+      - name: Enforce coverage threshold
+        run: cargo llvm-cov report --fail-under-lines 97

gitoxide_py-0.87.0/.github/workflows/release.yml

@@ -0,0 +1,273 @@
+name: Release
+
+# Distributions are built for every push to main so a broken build surfaces
+# then, not at tag time. Publishing happens only for a tag, which is also
+# where the version comes from.
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      testpypi:
+        description: >-
+          Upload to TestPyPI. Exercises the publish path -- the OIDC exchange
+          and the upload itself -- which a tag would otherwise be the first
+          thing to try.
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+# Every job below mounts the same host directory at /dist, so the wheels move
+# between images without going through actions/upload-artifact -- a billed,
+# org-wide quota a release has no reason to depend on. This works because all
+# three jobs land on the same machine: `feguitv` is a single host, and its
+# runner requires a job container, which is what lets the Windows check simply
+# *be* the Wine image rather than start one by hand. The run id keeps
+# concurrent releases out of each other's directory.
+
+jobs:
+  # macOS has no self-hosted equivalent here and cannot be cross-compiled to
+  # from Linux without an Apple SDK, so it runs on GitHub-hosted runners:
+  # minutes, and artifact storage to carry the wheel back. Set the repository
+  # variable HOSTED_RUNNERS to `true` to include them; with it unset a release
+  # ships the Linux, Windows and source distributions, and macOS builds from
+  # the sdist, which needs a Rust toolchain on the installing machine.
+  wheels-hosted:
+    name: ${{ matrix.target }}
+    if: vars.HOSTED_RUNNERS == 'true'
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { runner: ubuntu-latest, target: aarch64-unknown-linux-gnu, args: "--zig" }
+          - { runner: macos-latest, target: x86_64-apple-darwin, args: "" }
+          - { runner: macos-latest, target: aarch64-apple-darwin, args: "" }
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      # `gix` is pure Rust with no C dependencies (see Cargo.toml), so a
+      # cross-compile needs no target toolchain beyond what --zig provides.
+      - name: Set package version from git
+        shell: bash
+        run: |
+          pipx install dunamai
+          version="$(dunamai from git --style semver)"
+          echo "Package version: $version"
+          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
+            python scripts/check_version_tracks_gix.py "$version"
+          fi
+          python - "$version" <<'PY'
+          import re, sys
+          from pathlib import Path
+          path = Path("Cargo.toml")
+          text = path.read_text()
+          path.write_text(re.sub(r'^version = ".*"', f'version = "{sys.argv[1]}"', text, count=1, flags=re.M))
+          PY
+
+      - name: Build wheel
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist --generate-stubs ${{ matrix.args }}
+          manylinux: auto
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ matrix.target }}
+          path: dist
+
+  # Everything buildable on Linux: the native wheel, the Windows wheel
+  # (cross-compiled with the mingw-w64 toolchain the image carries, see
+  # infra's roles/python_ci) and the sdist.
+  build:
+    name: Build
+    runs-on: [self-hosted, feguitv]
+    timeout-minutes: 40
+    container:
+      image: localhost:5000/python-ci:latest
+      volumes:
+        - /var/tmp/gitoxide-py-release/${{ github.run_id }}:/dist
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          fetch-depth: 0 # full history, so the version can be derived from tags
+
+      - run: git config --global --add safe.directory '*'
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+
+      - name: Set package version from git
+        env:
+          TESTPYPI: ${{ inputs.testpypi }}
+        run: |
+          # An untagged build's version carries a local segment (`+<sha>`),
+          # which PyPI and TestPyPI both reject on upload, so drop it when the
+          # run is going to upload. A tagged build has no such segment.
+          style=(--style semver)
+          if [ "$TESTPYPI" = "true" ]; then style+=(--no-metadata); fi
+          version="$(uv tool run dunamai from git "${style[@]}")"
+          echo "Package version: $version"
+          # A tagged build is a release: its version has to track the gix it
+          # links, or the number stops meaning what RELEASING.md says it does.
+          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
+            uv run --no-project python scripts/check_version_tracks_gix.py "$version"
+          fi
+          sed -i "0,/^version = \".*\"/s//version = \"$version\"/" Cargo.toml
+
+      - name: uv sync
+        run: uv sync --locked
+
+      # --generate-stubs bundles the .pyi and py.typed into the wheel; without
+      # it the package ships untyped and the Typing :: Typed classifier lies.
+      # maturin extracts the stub from the built binary rather than importing
+      # it, which is why it works for the cross-compiled target too.
+      - name: Build Linux wheel
+        run: uv run maturin build --release --out /dist --generate-stubs
+
+      - name: Build Windows wheel
+        run: |
+          uv run maturin build --release --target x86_64-pc-windows-gnu \
+            --out /dist --generate-stubs
+
+      - name: Build sdist
+        run: uv tool run maturin sdist --out /dist
+
+      - name: Check the Linux wheel is installable and typed
+        run: |
+          uv venv /tmp/wheel-check
+          uv pip install --python /tmp/wheel-check/bin/python \
+            --no-index --find-links /dist gitoxide-py
+          /tmp/wheel-check/bin/python -c "
+          import gitoxide_py, pathlib
+          pkg = pathlib.Path(gitoxide_py.__file__).parent
+          assert (pkg / 'py.typed').is_file(), 'py.typed missing from the wheel'
+          assert (pkg / '__init__.pyi').is_file(), 'stub missing from the wheel'
+          print('wheel ok:', gitoxide_py.open('.').head_id)
+          "
+
+      # Travels with the wheels so the Wine job needs no checkout of its own:
+      # that image has no git, and the only thing it needs from the repository
+      # is this script.
+      - name: Stage the Windows check
+        run: cp .github/windows-check/verify-wheel.sh /dist/
+
+  # A real Windows CPython, under Wine, importing the wheel that will be
+  # published -- the check a GitHub-hosted windows runner never performed,
+  # since it uploaded a wheel it had never loaded.
+  windows-check:
+    name: Windows wheel under Wine
+    needs: build
+    runs-on: [self-hosted, feguitv]
+    timeout-minutes: 20
+    container:
+      image: localhost:5000/windows-ci:latest
+      volumes:
+        - /var/tmp/gitoxide-py-release/${{ github.run_id }}:/dist
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Import the Windows wheel
+        run: bash /dist/verify-wheel.sh
+
+  # The same upload the real release performs, against TestPyPI, so the parts
+  # a tag would otherwise try for the first time -- the OIDC exchange and the
+  # upload -- have been exercised before one is pushed. Needs its own trusted
+  # publisher registered on test.pypi.org, with environment `testpypi`.
+  publish-testpypi:
+    name: Publish to TestPyPI
+    needs: [build, windows-check]
+    if: inputs.testpypi
+    runs-on: [self-hosted, feguitv]
+    timeout-minutes: 20
+    container:
+      image: localhost:5000/python-ci:latest
+      volumes:
+        - /var/tmp/gitoxide-py-release/${{ github.run_id }}:/dist
+    defaults:
+      run:
+        shell: bash
+    environment: testpypi
+    permissions:
+      # A job-level block replaces the workflow-level one rather than adding to
+      # it, so `contents: read` has to be repeated or the checkout fails.
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Upload
+        run: uv run --no-project python scripts/publish.py https://test.pypi.org /dist
+
+  publish:
+    name: Publish to PyPI
+    needs: [build, windows-check, wheels-hosted]
+    # `wheels-hosted` is skipped unless HOSTED_RUNNERS is set, and a skipped
+    # job would otherwise skip this one too; a *failed* one still blocks.
+    if: |
+      always() && !cancelled()
+      && startsWith(github.ref, 'refs/tags/v')
+      && needs.build.result == 'success'
+      && needs.windows-check.result == 'success'
+      && needs.wheels-hosted.result != 'failure'
+    runs-on: [self-hosted, feguitv]
+    timeout-minutes: 20
+    container:
+      image: localhost:5000/python-ci:latest
+      volumes:
+        - /var/tmp/gitoxide-py-release/${{ github.run_id }}:/dist
+    defaults:
+      run:
+        shell: bash
+    environment: pypi
+    permissions:
+      contents: read
+      # Trusted Publishing: PyPI verifies this workflow's OIDC identity, so
+      # there is no API token to store or rotate. Configure the publisher at
+      # https://pypi.org/manage/project/gitoxide-py/settings/publishing/
+      id-token: write
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Collect the hosted wheels
+        if: vars.HOSTED_RUNNERS == 'true'
+        uses: actions/download-artifact@v4
+        with:
+          pattern: wheels-*
+          merge-multiple: true
+          path: /dist
+
+      - name: Upload
+        run: uv run --no-project python scripts/publish.py https://pypi.org /dist
+
+  # The shared directory lives on the runner, outside any workspace, so
+  # nothing else reclaims it.
+  cleanup:
+    name: Clean up
+    needs: [build, windows-check, publish, publish-testpypi]
+    if: always()
+    runs-on: [self-hosted, feguitv]
+    timeout-minutes: 10
+    container:
+      image: localhost:5000/python-ci:latest
+      volumes:
+        - /var/tmp/gitoxide-py-release/${{ github.run_id }}:/dist
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Empty the shared directory
+        run: rm -rf /dist/* /dist/.[!.]* 2>/dev/null || true

gitoxide_py-0.87.0/.gitignore

@@ -0,0 +1,8 @@
+/target
+/.venv
+__pycache__/
+*.so
+*.pyd
+/dist
+/*.egg-info
+*.profraw