guild-cli 0.7.0__tar.gz → 0.7.2__tar.gz

{guild_cli-0.7.0 → guild_cli-0.7.2}/.github/workflows/tests.yml

@@ -33,12 +33,11 @@ jobs:
       - run: uv run pytest -n auto --cov=guild --cov-report=xml:coverage.xml --cov-report=term -v
 
       - name: SonarCloud Scan
-        # Require BOTH the token and a committed sonar config. The org-level
-        # SONAR_TOKEN is inherited even though guildmaster isn't provisioned on
-        # SonarCloud yet; without a sonar.projectKey/organization the scanner
-        # fails (exit 3). Commit a sonar-project.properties when the project is
-        # created to activate the scan.
-        if: env.SONAR_TOKEN != '' && hashFiles('sonar-project.properties') != ''
+        # Reads sonar-project.properties (projectKey agentculture_guildmaster,
+        # coverage.xml path, qualitygate.wait). Gated only on the token so fork
+        # PRs and token-less repos skip the scan and stay green — `secrets.*`
+        # isn't allowed in `if:`, hence the job-level env promotion above.
+        if: env.SONAR_TOKEN != ''
         uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
         env:
           SONAR_HOST_URL: https://sonarcloud.io

{guild_cli-0.7.0 → guild_cli-0.7.2}/CHANGELOG.md

@@ -5,6 +5,50 @@ All notable changes to this project will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/). This project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.2] - 2026-05-29
+
+### Added
+
+### Changed
+
+- **Ledger: `shushu` → `grant` rename.** `agentculture/shushu` was renamed to
+  `agentculture/grant` ("agent-first secrets manager") on GitHub; the old name
+  redirects. Updated `docs/skill-sources.md` to record `grant` as the live
+  downstream consumer: renamed `shushu` → `grant` in the `run-tests` and
+  `version-bump` Downstream columns, added `grant` to the `cicd` column with a
+  "still named `pr-review`" caveat (its copy is the pre-agex `cicd`), and
+  refreshed the maintenance notes (old-skill-dir-name class, the
+  no-`culture.yaml` class — `grant`'s repo has no committed `culture.yaml` yet —
+  and a `shushu` → `grant` rename note mirroring `agentpypi` → `auntiepypi`).
+  Brings `guild teach`/`overview` framing onto the current name. Pairs with
+  [grant#18](https://github.com/agentculture/grant/issues/18), the
+  `guild teach --all --to grant` issue that brings `grant` to the full canonical
+  kit (3 resyncs — `cicd`/`run-tests`/`version-bump` — plus 8 new skills); the
+  remaining 8 register as downstream once `grant` applies the resync.
+
+### Fixed
+
+## [0.7.1] - 2026-05-29
+
+### Added
+
+- **SonarCloud coverage wiring** — committed `sonar-project.properties`
+  (`agentculture_guildmaster`, `sonar.python.coverage.reportPaths=coverage.xml`,
+  `sonar.qualitygate.wait=true`). CI already produced `coverage.xml`
+  (`--cov=guild --cov-report=xml:coverage.xml`) but the SonarCloud scan was
+  gated off because the config file was absent — guildmaster was the only repo
+  in the fleet without it. The project is already provisioned on SonarCloud, so
+  this activates the scan and feeds coverage to the quality gate.
+
+### Changed
+
+- **`tests.yml` SonarCloud Scan gate** — dropped the now-redundant
+  `hashFiles('sonar-project.properties')` clause (the file is committed) so the
+  step gates only on `env.SONAR_TOKEN != ''`, matching steward and the
+  `culture-agent-template`. Refreshed the stale "not provisioned yet" comment.
+
+### Fixed
+
 ## [0.7.0] - 2026-05-28
 
 ### Added

{guild_cli-0.7.0 → guild_cli-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: guild-cli
-Version: 0.7.0
+Version: 0.7.2
 Summary: guildmaster — an agent and CLI that manages skills for the AgentCulture mesh.
 Project-URL: Homepage, https://github.com/agentculture/guildmaster
 Project-URL: Issues, https://github.com/agentculture/guildmaster/issues

{guild_cli-0.7.0 → guild_cli-0.7.2}/docs/skill-sources.md

@@ -33,13 +33,13 @@ current by `guild overview --scope mesh`.
 | Skill | Upstream | Downstream copies (known) | Notes |
 |-------|----------|---------------------------|-------|
 | `agent-config` | `guildmaster` (`.claude/skills/agent-config/`) | `agenda`, `dominion-breaker`, `convertible`, `jetson` | Inventory variant backing `guild show` ([#12](https://github.com/agentculture/guildmaster/issues/12)); `show.sh` + `data/backend-fingerprints.yaml` vendored verbatim from steward, SKILL.md reframed from alignment-judgment to inventory + `type: command` added. **Forked from steward:** steward retains its own alignment-focused `agent-config` variant; the inventory variant is guildmaster's to supply. |
-| `cicd` | `guildmaster` (`.claude/skills/cicd/`) — layered on `agex pr` (in `agentculture/agex-cli`) | `afi-cli`, `agex-cli` (adapted-thin delegate — owns `agex pr`; see [agex-cli#53](https://github.com/agentculture/agex-cli/pull/53)), `agtag`, `antoine`, `appsec`, `auntiepypi`, `cfafi` (still named `pr-review`), `code-lens-cli`, `culture` (still named `pr-review`), `devague`, `katvan`, `lecodeur`, `lepenseur`, `seer-cli`, `telek`, `agenda`, `dominion-breaker`, `convertible`, `jetson` | Thin delegate to `agex pr` for lint / open / read / reply / delta, plus guildmaster's `status` (SonarCloud quality gate + hotspots + unresolved-thread tally) and `await` (composes `agex pr read --wait` with `status`, non-zero exit on Sonar ERROR / unresolved threads) extensions. **Inverted case:** agex-cli, as the `agex pr` upstream, vendors the skill adapted-thin — a `workflow.sh`-only pure delegate ([agex-cli#53](https://github.com/agentculture/agex-cli/pull/53)). Renamed from `pr-review` in steward 0.7.0; downstream copies may keep the old name on their own cadence. |
+| `cicd` | `guildmaster` (`.claude/skills/cicd/`) — layered on `agex pr` (in `agentculture/agex-cli`) | `afi-cli`, `agex-cli` (adapted-thin delegate — owns `agex pr`; see [agex-cli#53](https://github.com/agentculture/agex-cli/pull/53)), `agtag`, `antoine`, `appsec`, `auntiepypi`, `cfafi` (still named `pr-review`), `code-lens-cli`, `culture` (still named `pr-review`), `devague`, `katvan`, `lecodeur`, `lepenseur`, `seer-cli`, `telek`, `agenda`, `dominion-breaker`, `convertible`, `jetson`, `grant` (still named `pr-review`) | Thin delegate to `agex pr` for lint / open / read / reply / delta, plus guildmaster's `status` (SonarCloud quality gate + hotspots + unresolved-thread tally) and `await` (composes `agex pr read --wait` with `status`, non-zero exit on Sonar ERROR / unresolved threads) extensions. **Inverted case:** agex-cli, as the `agex pr` upstream, vendors the skill adapted-thin — a `workflow.sh`-only pure delegate ([agex-cli#53](https://github.com/agentculture/agex-cli/pull/53)). Renamed from `pr-review` in steward 0.7.0; downstream copies may keep the old name on their own cadence. |
 | `communicate` | `guildmaster` (`.claude/skills/communicate/`) | `afi-cli`, `agex-cli` (identifier-only — vendored steward 0.11.0; scripts current as of 0.18.0), `agtag`, `antoine`, `appsec`, `auntiepypi`, `code-lens-cli`, `culture` (still named `coordinate`), `devague`, `katvan`, `lecodeur`, `lepenseur`, `seer-cli`, `telek`, `agenda`, `dominion-breaker`, `convertible`, `jetson` | Cross-repo + mesh communication: file issues / hand off briefs to sibling-repo agents (auto-signed), comment on existing issues, fetch issues to inline state into briefs, and send live messages to Culture mesh channels (unsigned — nick is the speaker). Renamed from `coordinate` in steward 0.8.0; absorbed `gh-issues` (as `fetch-issues.sh`) in 0.9.1. Issue I/O backed by `agtag` (>=0.1) since steward 0.11.0 — signature resolves from local `culture.yaml` (override via `--as`). |
 | `doc-test-alignment` | `guildmaster` (`.claude/skills/doc-test-alignment/`) | `devague`, `lecodeur`, `lepenseur`, `agenda`, `dominion-breaker`, `convertible`, `jetson` | Stub; real implementation TBD. `scripts/check.sh` exits not-yet-implemented today. |
 | `pypi-maintainer` | `guildmaster` (`.claude/skills/pypi-maintainer/`) | `agtag`, `agenda`, `dominion-breaker`, `convertible`, `jetson` | Switches a PyPI package install between pypi / test-pypi / local. Generalised from the original culture-specific `change-package`. |
-| `run-tests` | `guildmaster` (`.claude/skills/run-tests/`) | `agtag`, `antoine`, `appsec`, `code-lens-cli`, `culture`, `culture-sonar-cli`, `devague`, `lecodeur`, `lepenseur`, `seer-cli`, `shushu`, `telek`, `agenda`, `dominion-breaker`, `convertible`, `jetson` | Coverage source resolves from `[tool.coverage.run]` in `pyproject.toml`, so the script is portable across siblings without modification. |
+| `run-tests` | `guildmaster` (`.claude/skills/run-tests/`) | `agtag`, `antoine`, `appsec`, `code-lens-cli`, `culture`, `culture-sonar-cli`, `devague`, `lecodeur`, `lepenseur`, `seer-cli`, `grant`, `telek`, `agenda`, `dominion-breaker`, `convertible`, `jetson` | Coverage source resolves from `[tool.coverage.run]` in `pyproject.toml`, so the script is portable across siblings without modification. |
 | `sonarclaude` | `guildmaster` (`.claude/skills/sonarclaude/`) | `antoine`, `appsec`, `code-lens-cli`, `devague`, `lecodeur`, `lepenseur`, `seer-cli`, `telek`, `agenda`, `dominion-breaker`, `convertible`, `jetson` | SonarCloud API client. Project key resolves from `$SONAR_PROJECT` or `--project KEY`. |
-| `version-bump` | `guildmaster` (`.claude/skills/version-bump/`) | `afi-cli`, `agtag`, `antoine`, `appsec`, `auntiepypi`, `cfafi`, `code-lens-cli`, `culture`, `devague`, `lecodeur`, `lepenseur`, `seer-cli`, `shushu`, `telek`, `agenda`, `dominion-breaker`, `convertible`, `jetson` | Pure Python, prepends a Keep-a-Changelog entry; no per-repo customization needed. |
+| `version-bump` | `guildmaster` (`.claude/skills/version-bump/`) | `afi-cli`, `agtag`, `antoine`, `appsec`, `auntiepypi`, `cfafi`, `code-lens-cli`, `culture`, `devague`, `lecodeur`, `lepenseur`, `seer-cli`, `grant`, `telek`, `agenda`, `dominion-breaker`, `convertible`, `jetson` | Pure Python, prepends a Keep-a-Changelog entry; no per-repo customization needed. |
 
 > **How the downstream column is maintained.** The "Downstream copies (known)"
 > entries are kept in sync with guildmaster's own drift detector:
@@ -49,14 +49,20 @@ current by `guild overview --scope mesh`.
 > (deliberate follow-up, not oversight):
 >
 > - **No `culture.yaml`** (invisible to the detector): `tipalti`,
->   `cultureagent`, `cultureflare`, `irc-lens`, `agentirc`, `zehut`.
+>   `cultureagent`, `cultureflare`, `irc-lens`, `agentirc`, `zehut`, `grant`
+>   (renamed from `shushu`; the repo has no committed `culture.yaml` yet, so
+>   `--scope mesh` cannot see it until one is added).
 > - **Old skill-dir name** (`pr-review` / `coordinate`, which the detector
->   doesn't canonicalize): `daria`, `shushu`, `culture-sonar-cli` vendor `cicd`
->   under `pr-review`. `cfafi` / `culture` are already listed with a "still
->   named `pr-review`/`coordinate`" note.
+>   doesn't canonicalize): `daria`, `culture-sonar-cli` vendor `cicd`
+>   under `pr-review`. `cfafi` / `culture` / `grant` are already listed with a
+>   "still named `pr-review`/`coordinate`" note.
 >
 > `agentpypi` was **renamed to `auntiepypi`** on GitHub (the old name redirects);
-> `auntiepypi` is the live consumer recorded above.
+> `auntiepypi` is the live consumer recorded above. Likewise `shushu` was
+> **renamed to `grant`** on GitHub (the old name redirects); `grant` is the live
+> consumer recorded above. guildmaster is bringing `grant` to the full canonical
+> kit (`guild teach --all --to grant`); the remaining canonical skills register
+> as downstream once `grant` applies the resync issue.
 
 ## Inbound workflow skills (origin = `devague`, re-broadcast by `guildmaster`)
 

{guild_cli-0.7.0 → guild_cli-0.7.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "guild-cli"
-version = "0.7.0"
+version = "0.7.2"
 description = "guildmaster — an agent and CLI that manages skills for the AgentCulture mesh."
 readme = "README.md"
 license = "MIT"

guild_cli-0.7.2/sonar-project.properties

@@ -0,0 +1,24 @@
+# SonarCloud project identity. Matches the project key registered on
+# SonarCloud and used by the cicd skill's Sonar status queries
+# (`agentculture_guildmaster`).
+sonar.projectKey=agentculture_guildmaster
+sonar.organization=agentculture
+
+# Source layout — package lives at the top level (no src/ wrapper).
+sonar.sources=guild
+sonar.tests=tests
+
+# Coverage report produced in CI by `uv run pytest --cov-report=xml:coverage.xml`
+# (see .github/workflows/tests.yml). Path is relative to the repo root.
+sonar.python.coverage.reportPaths=coverage.xml
+sonar.python.version=3.12
+
+# Don't analyze noise (vendored skills are cite-don't-import copies, not source).
+sonar.exclusions=**/__pycache__/**,**/.venv/**,uv.lock,.claude/skills/**
+
+# Block CI on a failing quality gate. The scanner polls SonarCloud and exits
+# non-zero on a red gate (coverage regression, new bugs/vulnerabilities). Only
+# takes effect when the SonarCloud Scan step runs — that step is guarded by
+# `if: env.SONAR_TOKEN != ''` in .github/workflows/tests.yml, so token-less
+# repos and fork PRs (no injected secret) skip the scan and stay green.
+sonar.qualitygate.wait=true

{guild_cli-0.7.0 → guild_cli-0.7.2}/uv.lock

@@ -179,7 +179,7 @@ wheels = [
 
 [[package]]
 name = "guild-cli"
-version = "0.7.0"
+version = "0.7.2"
 source = { editable = "." }
 dependencies = [
     { name = "pyyaml" },