guild-cli 0.7.0__tar.gz → 0.7.1__tar.gz

{guild_cli-0.7.0 → guild_cli-0.7.1}/.github/workflows/tests.yml

@@ -33,12 +33,11 @@ jobs:
       - run: uv run pytest -n auto --cov=guild --cov-report=xml:coverage.xml --cov-report=term -v
 
       - name: SonarCloud Scan
-        # Require BOTH the token and a committed sonar config. The org-level
-        # SONAR_TOKEN is inherited even though guildmaster isn't provisioned on
-        # SonarCloud yet; without a sonar.projectKey/organization the scanner
-        # fails (exit 3). Commit a sonar-project.properties when the project is
-        # created to activate the scan.
-        if: env.SONAR_TOKEN != '' && hashFiles('sonar-project.properties') != ''
+        # Reads sonar-project.properties (projectKey agentculture_guildmaster,
+        # coverage.xml path, qualitygate.wait). Gated only on the token so fork
+        # PRs and token-less repos skip the scan and stay green — `secrets.*`
+        # isn't allowed in `if:`, hence the job-level env promotion above.
+        if: env.SONAR_TOKEN != ''
         uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
         env:
           SONAR_HOST_URL: https://sonarcloud.io

{guild_cli-0.7.0 → guild_cli-0.7.1}/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to this project will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/). This project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.1] - 2026-05-29
+
+### Added
+
+- **SonarCloud coverage wiring** — committed `sonar-project.properties`
+  (`agentculture_guildmaster`, `sonar.python.coverage.reportPaths=coverage.xml`,
+  `sonar.qualitygate.wait=true`). CI already produced `coverage.xml`
+  (`--cov=guild --cov-report=xml:coverage.xml`) but the SonarCloud scan was
+  gated off because the config file was absent — guildmaster was the only repo
+  in the fleet without it. The project is already provisioned on SonarCloud, so
+  this activates the scan and feeds coverage to the quality gate.
+
+### Changed
+
+- **`tests.yml` SonarCloud Scan gate** — dropped the now-redundant
+  `hashFiles('sonar-project.properties')` clause (the file is committed) so the
+  step gates only on `env.SONAR_TOKEN != ''`, matching steward and the
+  `culture-agent-template`. Refreshed the stale "not provisioned yet" comment.
+
+### Fixed
+
 ## [0.7.0] - 2026-05-28
 
 ### Added

{guild_cli-0.7.0 → guild_cli-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: guild-cli
-Version: 0.7.0
+Version: 0.7.1
 Summary: guildmaster — an agent and CLI that manages skills for the AgentCulture mesh.
 Project-URL: Homepage, https://github.com/agentculture/guildmaster
 Project-URL: Issues, https://github.com/agentculture/guildmaster/issues

{guild_cli-0.7.0 → guild_cli-0.7.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "guild-cli"
-version = "0.7.0"
+version = "0.7.1"
 description = "guildmaster — an agent and CLI that manages skills for the AgentCulture mesh."
 readme = "README.md"
 license = "MIT"

guild_cli-0.7.1/sonar-project.properties

@@ -0,0 +1,24 @@
+# SonarCloud project identity. Matches the project key registered on
+# SonarCloud and used by the cicd skill's Sonar status queries
+# (`agentculture_guildmaster`).
+sonar.projectKey=agentculture_guildmaster
+sonar.organization=agentculture
+
+# Source layout — package lives at the top level (no src/ wrapper).
+sonar.sources=guild
+sonar.tests=tests
+
+# Coverage report produced in CI by `uv run pytest --cov-report=xml:coverage.xml`
+# (see .github/workflows/tests.yml). Path is relative to the repo root.
+sonar.python.coverage.reportPaths=coverage.xml
+sonar.python.version=3.12
+
+# Don't analyze noise (vendored skills are cite-don't-import copies, not source).
+sonar.exclusions=**/__pycache__/**,**/.venv/**,uv.lock,.claude/skills/**
+
+# Block CI on a failing quality gate. The scanner polls SonarCloud and exits
+# non-zero on a red gate (coverage regression, new bugs/vulnerabilities). Only
+# takes effect when the SonarCloud Scan step runs — that step is guarded by
+# `if: env.SONAR_TOKEN != ''` in .github/workflows/tests.yml, so token-less
+# repos and fork PRs (no injected secret) skip the scan and stay green.
+sonar.qualitygate.wait=true

{guild_cli-0.7.0 → guild_cli-0.7.1}/uv.lock

@@ -179,7 +179,7 @@ wheels = [
 
 [[package]]
 name = "guild-cli"
-version = "0.7.0"
+version = "0.7.1"
 source = { editable = "." }
 dependencies = [
     { name = "pyyaml" },