groupoid 0.1.0.dev4__tar.gz → 0.1.0.dev6__tar.gz

{groupoid-0.1.0.dev4 → groupoid-0.1.0.dev6}/.github/dependabot.yml

@@ -28,6 +28,15 @@ updates:
     # updates patch vulnerable dependencies regardless of this allow filter.
     allow:
       - dependency-type: "direct"
+    # numpy 2.x is a verified runtime incompatibility, not a routine bump:
+    # geomstats (a required runtime dependency) fails at import under
+    # numpy>=2.0 because `numpy.trapz` was removed, so the tested
+    # numpy>=1.24,<2.0 contract in pyproject.toml cannot widen (see closed
+    # PR #57). Scoped by version, not a blanket numpy ignore: compatible
+    # numpy 1.x version updates and 1.x security updates still flow.
+    ignore:
+      - dependency-name: "numpy"
+        versions: [">=2.0.0"]
     groups:
       # Batch updates by area into a single PR per group to limit noise instead
       # of one PR per package.

groupoid-0.1.0.dev6/.github/workflows/auto-tag-release.yml

@@ -0,0 +1,109 @@
+name: Auto Tag Release
+
+# Creates the tag for a release-cut merge to main, then explicitly dispatches
+# release.yml (build, attestations, PyPI publish, signing, GitHub Release)
+# against that tag.
+#
+# The dispatch is explicit, not a tag-push trigger, because GitHub suppresses
+# push-triggered workflow runs caused by a GITHUB_TOKEN-authored push: pushing
+# the tag here does NOT cause release.yml's `on.push.tags` trigger to fire.
+# workflow_dispatch is the documented exception to that suppression, which is
+# why this workflow calls `gh workflow run` instead of relying on the tag
+# push itself. (An earlier version of this workflow assumed the tag push
+# alone would trigger release.yml; it did not, and no release was produced
+# for v0.1.0.dev4 until this was fixed and the release re-run manually.)
+#
+# release.yml's own `push.tags` trigger remains as a fallback/manual path
+# (a human pushing a tag with their own credentials is not subject to this
+# suppression), alongside its `workflow_dispatch` trigger for republishing an
+# existing tag to PyPI only.
+#
+# If a version needs a tag this workflow's format check rejects (see below),
+# tag it manually -- this automation only ever creates a tag when one is
+# missing, so a pre-existing manual tag always takes precedence and this
+# workflow becomes a no-op for that version.
+
+# Tag only a main commit whose CI run succeeded. The tag-exists check below
+# keeps this idempotent for CI runs on commits that did not bump the version.
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+
+permissions:
+  contents: read
+
+jobs:
+  tag:
+    if: >-
+      ${{ github.event.workflow_run.conclusion == 'success' &&
+          github.event.workflow_run.event == 'push' &&
+          github.event.workflow_run.head_branch == 'main' &&
+          github.event.workflow_run.head_repository.full_name == github.repository }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # push the tag
+      actions: write    # dispatch release.yml via `gh workflow run`
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0   # need full tag history to check for an existing tag
+
+      - name: Create the release tag if this version doesn't have one yet, and dispatch the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CI_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          set -euo pipefail
+
+          # Tag only the exact commit that passed CI, and only while it is
+          # still the head of main.
+          ci_sha="${CI_SHA}"
+          [ "$(git rev-parse HEAD)" = "${ci_sha}" ]
+          main_sha="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/main" --jq .object.sha)"
+          if [ "${main_sha}" != "${ci_sha}" ]; then
+            echo "main advanced past ${ci_sha}; the newer head's CI run decides."
+            exit 0
+          fi
+
+          version=$(grep -m1 '^version = "' pyproject.toml | sed -E 's/version = "(.*)"/\1/')
+          if [ -z "${version}" ]; then
+            echo "::error::could not extract a version from pyproject.toml"
+            exit 1
+          fi
+
+          # PEP 440-ish release/pre-release only: X.Y.Z, optionally with
+          # .devN / aN / bN / rcN. No local version segment (+...), no
+          # anything else. A version that doesn't match this is presumably
+          # intentional and unusual enough to want a human tagging it by
+          # hand rather than this automation guessing.
+          if ! echo "${version}" | grep -Eq '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(\.dev(0|[1-9][0-9]*)|a(0|[1-9][0-9]*)|b(0|[1-9][0-9]*)|rc(0|[1-9][0-9]*))?$'; then
+            echo "::error::version '${version}' is not a recognized release format (expected X.Y.Z, optionally with .devN/aN/bN/rcN, no local metadata); refusing to tag automatically. Tag it manually if this is intentional."
+            exit 1
+          fi
+
+          tag="v${version}"
+
+          if git rev-parse "refs/tags/${tag}" >/dev/null 2>&1; then
+            echo "Tag ${tag} already exists; nothing to do."
+            exit 0
+          fi
+
+          if ! grep -qF "[${version}]" CHANGELOG.md; then
+            echo "::error::CHANGELOG.md has no [${version}] heading; refusing to tag an undocumented release. Add the changelog section as part of the version-bump PR."
+            exit 1
+          fi
+
+          echo "Version ${version} has no matching tag; creating ${tag}."
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "${tag}" -m "Release ${tag}"
+          git push origin "refs/tags/${tag}"
+
+          echo "Dispatching release.yml for ${tag}."
+          gh workflow run release.yml \
+            --repo "${GITHUB_REPOSITORY}" \
+            --ref "${tag}" \
+            -f "ref=${tag}" \
+            -f "create_github_release=true"

{groupoid-0.1.0.dev4 → groupoid-0.1.0.dev6}/.github/workflows/ci.yml

@@ -13,8 +13,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -40,8 +40,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
@@ -58,8 +58,8 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -83,20 +83,27 @@ jobs:
       - name: Audit dependencies for known vulnerabilities (pip-audit)
         # pip-audit (OSV-backed, maintained) replaces the deprecated `safety check`
         # (deprecated in safety 3.x in favour of the account-gated `safety scan`).
-        # HARD gate: any advisory with a fix version fails the job. The single
-        # documented exception is CVE-2025-3000 (torch): no fixed release exists
-        # upstream, and OSV expresses the affected range (listed versions up to
-        # v2.6.0) as a Git/commit boundary pip-audit cannot version-resolve, so it
-        # conservatively flags the installed torch. Disclosed in SECURITY.md; the
-        # torch.load / JIT deserialization path is not exercised by GROUPOID. Revisit
-        # the ignore once upstream publishes a fixed release.
-        run: pip-audit --ignore-vuln CVE-2025-3000
+        # HARD gate: any advisory with a fix version fails the job. Two documented
+        # exceptions, both disclosed in SECURITY.md:
+        # - CVE-2025-3000 (torch): no fixed release exists upstream, and OSV
+        #   expresses the affected range (listed versions up to v2.6.0) as a
+        #   Git/commit boundary pip-audit cannot version-resolve, so it
+        #   conservatively flags the installed torch. The torch.load / JIT
+        #   deserialization path is not exercised by GROUPOID. Revisit the ignore
+        #   once upstream publishes a fixed release.
+        # - PYSEC-2026-3447 (CVE-2026-59890, setuptools <83): the fix (83.0.0) is
+        #   unreachable while torch requires setuptools<82 (see the install step
+        #   above). The flaw is a macOS-only (APFS/HFS+) Unicode-normalization
+        #   bypass of MANIFEST.in exclude rules when building sdists; all CI and
+        #   release builds run on ubuntu-latest. Drop the ignore once torch
+        #   permits setuptools>=83.
+        run: pip-audit --ignore-vuln CVE-2025-3000 --ignore-vuln PYSEC-2026-3447
 
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install pre-commit
@@ -107,8 +114,8 @@ jobs:
   benchmark:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -137,8 +144,8 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies

{groupoid-0.1.0.dev4 → groupoid-0.1.0.dev6}/.github/workflows/docs-deploy.yml

@@ -16,8 +16,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -42,4 +42,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5