hyperi-ci 2.2.0__tar.gz → 2.2.1__tar.gz

{hyperi_ci-2.2.0 → hyperi_ci-2.2.1}/CHANGELOG.md

@@ -1,3 +1,12 @@
+## [2.2.1](https://github.com/hyperi-io/hyperi-ci/compare/v2.2.0...v2.2.1) (2026-05-08)
+
+
+### Bug Fixes
+
+* **init:** scaffold ci.yml with tag input on workflow_dispatch ([e6f7470](https://github.com/hyperi-io/hyperi-ci/commit/e6f7470c827ee8013db5ae2ed9b0af27c0226d93))
+* **test:** align spike-channel allocator test with current jemalloc-everywhere policy ([9de19e4](https://github.com/hyperi-io/hyperi-ci/commit/9de19e4a3d897b44caf0c586f5548443c1b8015d))
+* **watch:** accept --repo flag for cross-repo run watching ([378dea3](https://github.com/hyperi-io/hyperi-ci/commit/378dea37b86f7d3c3ca508233c57a9058ee28cdb))
+
 # [2.2.0](https://github.com/hyperi-io/hyperi-ci/compare/v2.1.6...v2.2.0) (2026-05-08)
 
 

{hyperi_ci-2.2.0 → hyperi_ci-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hyperi-ci
-Version: 2.2.0
+Version: 2.2.1
 Summary: HyperI CI/CD CLI tool — multi-language build, test, and publish automation
 License: Proprietary
 License-File: LICENSE

{hyperi_ci-2.2.0 → hyperi_ci-2.2.1}/STATE.md

@@ -157,6 +157,16 @@ PR review and release-worthy pushes run them. The gate is computed
 ONCE in the `plan` job and consumed by every downstream job; do not
 re-implement the condition string elsewhere — `tests/unit/test_workflow_consistency.py` enforces this.
 
+## CI bug-log convention (cross-repo)
+
+CI bugs and fixes surfaced in consumer repos are logged under
+`<consumer>/docs/superpowers/plans/<date>-ci-<topic>.md` (gitignored
+local-only) plus a one-line entry in that consumer's `TODO.md`.
+This is the SSoT location for CI fixes across the org — when canary
+runs surface bugs, look there for the resolution status. The
+hyperi-ci rollout doc references back to those plans so the loop
+is closeable.
+
 ## Architecture
 
 See `docs/DESIGN.md` for full architecture documentation.
@@ -332,6 +342,27 @@ See `docs/MIGRATION-GUIDE.md` for migrating projects from v1 to v2.
 - **dfe-protocol-sdk** — plugin system removed
 - **dfe-receiver-plugin-syslog** — syslog is built-in transport
 
+## Future direction (aspirational)
+
+Today: GitHub for git hosting, GitHub Actions for CI. Likely move when
+budget and time allow:
+
+- **Codeberg** for git hosting — reduce single-vendor lock-in to GitHub.
+- **Buildkite** for CI — stronger pipeline ergonomics, self-hosted
+  runners without ARC's K8s overhead.
+
+Design implications today:
+
+- CI logic stays in the `hyperi-ci` Python CLI, not embedded in
+  workflow YAML. Buildkite (or any successor) calls the same CLI;
+  only the runner glue changes.
+- Workflows stay thin — plan job + gates + handler dispatch.
+- Avoid hard dependencies on GitHub-only features in handler code
+  (Actions-specific matrix syntax, GHCR-only auth flows).
+
+Not on the near-term roadmap; recorded so we don't accidentally make
+choices that paint us into the GitHub-Actions corner.
+
 ## Licensing
 
 Proprietary — HYPERI PTY LIMITED.

{hyperi_ci-2.2.0 → hyperi_ci-2.2.1}/TODO.md

@@ -20,9 +20,14 @@ This is the **single source of truth** for all tasks and progress.
 
 **Canaries (no SEP fields — fix bugs found, don't dismiss):**
 
-- [ ] **Canary 0: hyperi-ci's own `test-projects/`** — `ci-test-python-app`, `ci-test-go-app`, `ci-test-ts-app` — drives the iteration loop in-repo via `tests/integration/`.
-- [ ] **Canary 1: dfe-loader (Rust)** — most complex Rust example: clickhouse-driver, Arrow, columnar deps. Must produce a tagged R2 + GHCR + GH Release artefact under the new shape, AND a chore: bump must skip build entirely.
-- [ ] **Canary 2: dfe-engine (Python)** — most complex Python example. Same exit criteria.
+- [x] **Canary 0: hyperi-ci's own `test-projects/`** — integration tests green; one stale spike-allocator test fixed (commit `a331a0b`).
+- [x] **Canary 1a: dfe-loader chore-skip** — [run 25531398891](https://github.com/hyperi-io/dfe-loader/actions/runs/25531398891) — 16 seconds total, plan ✅, every other job skipped. **Killer feature validated.**
+- [ ] **Canary 1b: dfe-loader publish-dispatch** — [run 25531808212](https://github.com/hyperi-io/dfe-loader/actions/runs/25531808212) in flight as of 2026-05-08T01:40Z. Plan/Quality/Test green; both Build (linux-amd64, linux-arm64) jobs in_progress. BOLT/PGO; expect 30-45 min.
+- [x] **Canary 2a: dfe-engine chore-skip** — [run 25531462469](https://github.com/hyperi-io/dfe-engine/actions/runs/25531462469) — 33 seconds, all heavy jobs skipped. **Gate validated.**
+- [ ] **Canary 2b: dfe-engine publish-dispatch** — failed at quality stage on real pre-existing CVEs (pytest, cryptography). NOT a gate regression. Handed back to dfe-engine maintainers via [`dfe-engine/docs/superpowers/plans/2026-05-08-ci-canary-publish-fix.md`](../../dfe-engine/docs/superpowers/plans/2026-05-08-ci-canary-publish-fix.md). Blocked on merge coordination (Derek + Kaz have WIP on `feat/transport-filter-helpers`).
+- [ ] **Canary 3 (added 2026-05-08): hyperi-pylib publish-dispatch** — preferred Python canary now: clean lib, no parallel WIP. User to drive.
+
+**Ordering update 2026-05-08:** Python canary order is hyperi-pylib FIRST (clean), then dfe-engine after merge coordination. dfe-engine is the most complex Python case but its current branch state makes it a poor first canary.
 
 **Done means:**
 
@@ -32,7 +37,44 @@ This is the **single source of truth** for all tasks and progress.
 - A `Publish: true` commit on each canary still runs the full pipeline and ships to the right registries
 - v2.2.0+ of hyperi-ci is published to PyPI
 
-**Bugs discovered during rollout (no SEP fields):** populate as the rollout proceeds.
+**Bugs discovered during rollout (no SEP fields):**
+
+- [x] `tests/integration/test_rust_build_optimize.py::test_spike_channel_default_uses_system_allocator` encoded the old "spike → system allocator" policy; current code (and standards/rules/RUST.md Allocator Policy) says jemalloc at every channel. Fixed in commit `a331a0b`.
+- [x] `_release-tail.yml` expects a single `build-dist-*` artifact containing both `dist/` AND `ci-tmp/`. The plan's draft proposed splitting into separate artifacts which would have broken release-tail's download step. Combined-upload pattern preserved.
+- [x] `ts-ci.yml` had a duplicate `setup:` job key (silent YAML override) and `test:` job missing `needs:`/`if:`. Fixed during Task 8.
+- [x] `go-ci.yml` ran quality + test unconditionally before any gate decision (setup ran AFTER them). Fixed during Task 9.
+
+---
+
+### Follow-up: dedicated CI test repos (next plan)
+
+**Why:** in-repo `test-projects/` fixtures validate the CLI, but cannot exercise GitHub-side workflow behaviour (chore-skip, semantic-release tagging, publish flow). Real validation needs separate repos that push commits and trigger real CI runs.
+
+**Proposed minimum:**
+
+- `hyperi-io/ci-test-rust-app` — single-crate binary (chore-skip, R2 + GH Release path)
+- `hyperi-io/ci-test-rust-workspace` — 3-crate workspace (workspace version stamp)
+- `hyperi-io/ci-test-python-pypi` — Python lib for PyPI (sdist clean)
+- `hyperi-io/ci-test-python-app` — Python container app (Tier-3 deployment-contract path)
+- `hyperi-io/ci-test-ts-app` — TypeScript bundle (npm publish)
+- `hyperi-io/ci-test-go-app` — Go binary (cross-compile, GH Release)
+
+**Status:** scoped only — needs its own plan written. Track separately when we pick this up.
+
+---
+
+### Follow-up: deployment artefact distribution (next plan)
+
+**Why:** `hyperi-ci run generate` produces `argocd-application.yaml`, `chart/` (Helm), `Dockerfile.runtime`, `container-manifest.json`. These get uploaded as a CI artifact and then... dropped on the floor. `_release-tail.yml` consumes only the container-manifest. ArgoCD operators have no consumable distribution path.
+
+**Proposed:**
+
+- Helm `chart/` → push to GHCR as OCI artifact (`oci://ghcr.io/hyperi-io/charts/<app>:vX.Y.Z`); ArgoCD ≥2.6 reads OCI natively
+- `argocd-application.yaml` → PR into a `hyperi-io/gitops` cluster-config repo via GitHub App with `contents:write`
+- Versioning: chart version === app version === `next-version` from plan output
+- NOT R2 — Helm and ArgoCD don't read from R2; would need to reinvent chart-museum
+
+**Status:** scoped only — needs its own plan written. Out of scope for the KISS consolidation.
 
 ---
 

hyperi_ci-2.2.1/VERSION

@@ -0,0 +1 @@
+2.2.1

{hyperi_ci-2.2.0 → hyperi_ci-2.2.1}/docs/ARCHITECTURE.md

@@ -154,6 +154,23 @@ workflows.
 - ["GitHub Actions Is Slowly Killing Your Engineering Team"](https://www.iankduncan.com/engineering/2026-02-05-github-actions-killing-your-team/) — explicit warning against generic-abstraction-layer reusable workflows
 - [Composite-action path resolution discussion #26245](https://github.com/orgs/community/discussions/26245) — confirms the cross-repo `./` problem is unsolved as of May 2026
 
+## Future portability (aspirational)
+
+We may move from GitHub + GitHub Actions to Codeberg (git) +
+Buildkite (CI) when budget and time allow. Not on the near-term
+roadmap, but it shapes design today:
+
+- The `hyperi-ci` Python CLI owns the work — quality, test, build,
+  publish. The reusable workflows are thin runner glue around it.
+  Porting to Buildkite means rewriting the glue, not the CLI.
+- Handler code (`src/hyperi_ci/languages/<lang>/*.py`) avoids
+  GitHub-only assumptions: no `${{ ... }}` template syntax leaking
+  into Python, no GHCR-only auth flows hardcoded in publish handlers.
+- The plan job + gate-output pattern translates directly to
+  Buildkite's dynamic pipelines.
+
+The shared CI tool keeps the cost of switching CI vendors bounded.
+
 ## Pre-2026-05-08 archaeology
 
 Before this consolidation, `_setup.yml` existed as a shared first-job

{hyperi_ci-2.2.0 → hyperi_ci-2.2.1}/src/hyperi_ci/cli.py

@@ -424,11 +424,23 @@ def watch(
         int,
         typer.Option("--interval", "-i", help="Initial poll interval in seconds"),
     ] = 30,
+    repo: Annotated[
+        str | None,
+        typer.Option(
+            "--repo",
+            "-R",
+            help=(
+                "Target repo as owner/name (e.g. hyperi-io/dfe-loader). "
+                "Defaults to the cwd's git remote — set this when watching "
+                "a run in a different repo than your cwd."
+            ),
+        ),
+    ] = None,
 ) -> None:
     """Watch a GitHub Actions run to completion."""
     from hyperi_ci.watch import watch_run
 
-    rc = watch_run(run_id=run_id, timeout=timeout, interval=interval)
+    rc = watch_run(run_id=run_id, timeout=timeout, interval=interval, repo=repo)
     raise typer.Exit(rc)
 
 

{hyperi_ci-2.2.0 → hyperi_ci-2.2.1}/src/hyperi_ci/gh.py

@@ -91,18 +91,24 @@ def gh_json(
 def get_latest_run(
     branch: str | None = None,
     workflow: str | None = None,
+    repo: str | None = None,
 ) -> dict | None:
     """Find the most recent workflow run.
 
     Args:
         branch: Filter by branch name.
         workflow: Filter by workflow filename.
+        repo: Optional ``owner/name`` — when set, queries this repo
+            instead of the cwd's git remote. Use this when looking up
+            runs in a different repo than your cwd.
 
     Returns:
         Dict with run info, or None if no runs found.
 
     """
     args = ["run", "list", "--limit", "1"]
+    if repo:
+        args.extend(["--repo", repo])
     if branch:
         args.extend(["--branch", branch])
     if workflow:

{hyperi_ci-2.2.0 → hyperi_ci-2.2.1}/src/hyperi_ci/init.py

@@ -261,15 +261,22 @@ def _render_workflow(
         "  pull_request:\n"
         "    branches: [main]\n"
         "  workflow_dispatch:\n"
+        "    inputs:\n"
+        "      tag:\n"
+        "        type: string\n"
+        "        required: true\n"
+        '        description: "Tag to publish (e.g. v1.3.0)"\n'
         "\n"
         "jobs:\n"
         "  ci:\n"
         f"    uses: {_CI_REPO}/.github/workflows/"
         f"{workflow_file}@{_WORKFLOW_REF}\n"
+        "    with:\n"
+        "      tag: ${{ inputs.tag || '' }}\n"
     )
 
     if publish_target != "internal":
-        base += f"    with:\n      publish-target: {publish_target}\n"
+        base += f"      publish-target: {publish_target}\n"
 
     base += "    secrets: inherit\n"
     return base

{hyperi_ci-2.2.0 → hyperi_ci-2.2.1}/src/hyperi_ci/watch.py

@@ -67,11 +67,16 @@ def _poll_interval(base: int, attempt: int) -> float:
     return min(base * (1.5 ** min(attempt - 1, 4)), 120.0)
 
 
-def _get_run_status(run_id: str) -> dict | None:
+def _get_run_status(run_id: str, repo: str | None = None) -> dict | None:
     """Fetch current run status.
 
     Args:
         run_id: Workflow run ID.
+        repo: Optional ``owner/name`` — pass this when watching a run
+            in a different repo than the current working directory.
+            ``gh run view`` defaults to the cwd's git remote and
+            silently 404s when the run isn't there, which the watch
+            loop misreads as transient network failure.
 
     Returns:
         Dict with status/conclusion/jobs, or None on transient error.
@@ -82,26 +87,28 @@ def _get_run_status(run_id: str) -> dict | None:
     `_MAX_CONSECUTIVE_FETCH_FAILURES`.
 
     """
+    args = [
+        "run",
+        "view",
+        run_id,
+        "--json",
+        "status,conclusion,jobs,url,workflowName,headBranch",
+    ]
+    if repo:
+        args.extend(["--repo", repo])
     try:
-        result = gh_run(
-            [
-                "run",
-                "view",
-                run_id,
-                "--json",
-                "status,conclusion,jobs,url,workflowName,headBranch",
-            ]
-        )
+        result = gh_run(args)
         return json.loads(result.stdout)
     except (subprocess.CalledProcessError, json.JSONDecodeError):
         return None
 
 
-def _resume_command(run_id: str, timeout: int) -> str:
+def _resume_command(run_id: str, timeout: int, repo: str | None = None) -> str:
     """Format a copy-pasteable resume command for the user."""
+    repo_arg = f" --repo {repo}" if repo else ""
     if timeout == 0:
-        return f"hyperi-ci watch {run_id} --timeout 0"
-    return f"hyperi-ci watch {run_id} --timeout {timeout}"
+        return f"hyperi-ci watch {run_id}{repo_arg} --timeout 0"
+    return f"hyperi-ci watch {run_id}{repo_arg} --timeout {timeout}"
 
 
 def _print_summary(run_data: dict) -> None:
@@ -146,6 +153,7 @@ def watch_run(
     run_id: str | None = None,
     timeout: int = _DEFAULT_TIMEOUT,
     interval: int = 30,
+    repo: str | None = None,
 ) -> int:
     """Watch a GitHub Actions run to completion.
 
@@ -155,6 +163,9 @@ def watch_run(
             (poll until the run reaches a terminal state). Default is
             sized for Tier 2 Rust builds (3600 s = 60 min).
         interval: Base poll interval in seconds.
+        repo: Optional ``owner/name`` — when set, all gh calls target
+            this repo instead of the cwd's git remote. Use this when
+            watching a run in a different repo than your cwd.
 
     Returns:
         Exit code: 0=success, 1=failed/cancelled/unreachable, 2=timeout.
@@ -170,16 +181,17 @@ def watch_run(
             return 1
 
         info(f"Finding latest run on {branch}...")
-        latest = get_latest_run(branch=branch)
+        latest = get_latest_run(branch=branch, repo=repo)
         if not latest:
             error(f"No runs found on {branch}")
             return 1
         run_id = str(latest["databaseId"])
 
+    repo_label = f" in {repo}" if repo else ""
     if timeout == 0:
-        info(f"Watching run {run_id} (no timeout)")
+        info(f"Watching run {run_id}{repo_label} (no timeout)")
     else:
-        info(f"Watching run {run_id} (timeout: {timeout}s)")
+        info(f"Watching run {run_id}{repo_label} (timeout: {timeout}s)")
 
     # `deadline = None` disables the timeout check entirely.
     deadline: float | None = None if timeout == 0 else time.monotonic() + timeout
@@ -192,7 +204,7 @@ def watch_run(
         now = datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%SZ")
         info(f"  [{now}] polling (attempt {attempt})...")
 
-        run_data = _get_run_status(run_id)
+        run_data = _get_run_status(run_id, repo=repo)
         if not run_data:
             consecutive_failures += 1
             if consecutive_failures >= _MAX_CONSECUTIVE_FETCH_FAILURES:
@@ -200,7 +212,7 @@ def watch_run(
                     f"  Failed to fetch run status "
                     f"{consecutive_failures} times in a row — giving up. "
                     f"Last known status: {last_known_status}. "
-                    f"Resume: {_resume_command(run_id, timeout)}"
+                    f"Resume: {_resume_command(run_id, timeout, repo=repo)}"
                 )
                 return 1
             warn(
@@ -232,7 +244,7 @@ def watch_run(
     # in progress) or investigate (stuck / silently failing).
     error(
         f"Timeout after {timeout} seconds — run still {last_known_status}. "
-        f"Resume: {_resume_command(run_id, timeout)} "
+        f"Resume: {_resume_command(run_id, timeout, repo=repo)} "
         f"(or use --timeout 0 to disable timeout)"
     )
     return 2

{hyperi_ci-2.2.0 → hyperi_ci-2.2.1}/tests/integration/test_rust_build_optimize.py

@@ -309,22 +309,25 @@ class TestChannelToBinaryFlow:
         binary = tmp_path / "target" / "release" / "fixture-bin"
         assert _nm_has_symbol(binary, "je_")
 
-    def test_spike_channel_default_uses_system_allocator(self, tmp_path) -> None:
-        # spike channel should default to system allocator — no jemalloc.
+    def test_spike_channel_default_uses_jemalloc(self, tmp_path) -> None:
+        # standards/rules/RUST.md "Allocator Policy" — DFE Rust binaries
+        # use jemalloc at EVERY channel for tooling consistency
+        # (jeprof works on every binary from day one). spike still gets
+        # thin LTO, but allocator is jemalloc.
         _write_fixture_crate(
             tmp_path,
-            with_jemalloc_feature=True,  # Available but not selected
+            with_jemalloc_feature=True,
             wire_global_allocator=True,
         )
 
         profile = resolve_optimization_profile("spike", None)
-        assert profile.allocator == "system"
+        assert profile.allocator == "jemalloc"
 
         result = _run_cargo_build(tmp_path, profile)
         assert result.returncode == 0
 
         binary = tmp_path / "target" / "release" / "fixture-bin"
-        assert not _nm_has_symbol(binary, "je_malloc")
+        assert _nm_has_symbol(binary, "je_")
 
 
 @pytest.mark.skipif(not CARGO_AVAILABLE, reason="cargo not installed")

{hyperi_ci-2.2.0 → hyperi_ci-2.2.1}/tests/unit/test_init.py

@@ -55,6 +55,23 @@ class TestRenderTemplates:
         content = _render_workflow("my-project", "rust-ci.yml")
         assert "secrets: inherit" in content
 
+    def test_workflow_dispatch_accepts_tag_input(self) -> None:
+        # `hyperi-ci publish vX.Y.Z` calls `gh workflow run ci.yml -f
+        # tag=vX.Y.Z`. Without a `tag` input on workflow_dispatch the
+        # GitHub API returns 422 "Unexpected inputs provided" and
+        # publish silently fails. Every scaffolded ci.yml must accept
+        # the tag input AND forward it to the language workflow.
+        for workflow_file in ("python-ci.yml", "rust-ci.yml", "ts-ci.yml", "go-ci.yml"):
+            content = _render_workflow("my-project", workflow_file)
+            assert "workflow_dispatch:" in content
+            assert "inputs:" in content, (
+                f"{workflow_file}: missing workflow_dispatch inputs"
+            )
+            assert "tag:" in content, f"{workflow_file}: missing tag input"
+            assert "tag: ${{ inputs.tag" in content, (
+                f"{workflow_file}: tag input not forwarded to language workflow"
+            )
+
 
 class TestDetectPythonBuildType:
     """Python build type detection from pyproject.toml."""

{hyperi_ci-2.2.0 → hyperi_ci-2.2.1}/tests/unit/test_watch.py

@@ -16,6 +16,7 @@ import pytest
 from hyperi_ci.watch import (
     _DEFAULT_TIMEOUT,
     _MAX_CONSECUTIVE_FETCH_FAILURES,
+    _get_run_status,
     _poll_interval,
     _resume_command,
     watch_run,
@@ -57,6 +58,41 @@ class TestResumeCommand:
     def test_with_zero_timeout(self) -> None:
         assert _resume_command("12345", 0) == "hyperi-ci watch 12345 --timeout 0"
 
+    def test_with_repo(self) -> None:
+        # When watching a run in a different repo than the cwd, the
+        # resume hint must include --repo so the user can copy-paste
+        # without re-deriving the repo from somewhere.
+        assert (
+            _resume_command("12345", 3600, repo="hyperi-io/dfe-loader")
+            == "hyperi-ci watch 12345 --repo hyperi-io/dfe-loader --timeout 3600"
+        )
+
+    def test_with_repo_and_zero_timeout(self) -> None:
+        assert (
+            _resume_command("12345", 0, repo="hyperi-io/dfe-loader")
+            == "hyperi-ci watch 12345 --repo hyperi-io/dfe-loader --timeout 0"
+        )
+
+
+class TestGetRunStatusRepo:
+    """`_get_run_status` must forward --repo to gh when set, so watching
+    a run in a different repo than cwd doesn't 404 on every poll."""
+
+    def test_no_repo_omits_flag(self) -> None:
+        with patch("hyperi_ci.watch.gh_run") as mock_gh:
+            mock_gh.return_value.stdout = '{"status": "in_progress"}'
+            _get_run_status("12345")
+            args = mock_gh.call_args[0][0]
+            assert "--repo" not in args
+
+    def test_repo_set_appends_flag(self) -> None:
+        with patch("hyperi_ci.watch.gh_run") as mock_gh:
+            mock_gh.return_value.stdout = '{"status": "in_progress"}'
+            _get_run_status("12345", repo="hyperi-io/dfe-loader")
+            args = mock_gh.call_args[0][0]
+            assert "--repo" in args
+            assert args[args.index("--repo") + 1] == "hyperi-io/dfe-loader"
+
 
 class TestDefaultTimeout:
     """Default timeout is sized for Tier 2 Rust builds."""

hyperi_ci-2.2.0/VERSION

@@ -1 +0,0 @@
-2.2.0