idems-gitstore 0.1.0__tar.gz

idems_gitstore-0.1.0/.forgejo/workflows/ci.yml

@@ -0,0 +1,49 @@
+# Lint and test every push and every pull request, so a PR is checked before it
+# merges rather than on the author's machine alone.
+#
+# The runner serves the whole org and takes one job at a time, so a newer push
+# to a ref cancels the run for the commit it supersedes, and the matrix stays at
+# two: the floor in pyproject.toml, and a current release.
+name: ci
+
+on:
+  push:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    # The runner declares exactly one label, ubuntu-latest. A runs-on that
+    # matches no label is not rejected -- the job queues forever.
+    #
+    # No `container:` here. checkout and setup-python are JavaScript actions and
+    # need node, which the runner's own image has and a bare python image lacks.
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.14"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install
+        run: pip install --no-cache-dir -e ".[dev]"
+
+      - name: Lint
+        run: |
+          ruff check .
+          ruff format --check .
+
+      # No git identity is configured: the test kit isolates git from global
+      # config and passes its author to every commit it makes.
+      - name: Test
+        run: |
+          git --version
+          pytest

idems_gitstore-0.1.0/.forgejo/workflows/release.yml

@@ -0,0 +1,119 @@
+# Build and upload idems-gitstore. RELEASING.md is the procedure; this file is
+# the mechanism, and the comments say why each guard is here.
+#
+# Two ways in:
+#   * publishing a Forgejo release -> PyPI. The release is the trigger, so the
+#     tag, the release notes and the upload are one action rather than three
+#     that can drift apart.
+#   * manual dispatch -> TestPyPI only, for rehearsing a release without
+#     burning a version number. PyPI refuses to replace an existing file, so a
+#     botched real upload cannot be corrected in place -- only yanked and
+#     re-numbered.
+#
+# There is no approval gate between publishing a release and the upload:
+# Forgejo has nothing like a GitHub environment with a required reviewer.
+# Publishing the release *is* the human gate. Anyone with write access can
+# also edit this workflow and reach the secret, which is why the PyPI token
+# is scoped to this one project (RELEASING.md).
+name: release
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+# Never cancel a release run part way: a second run for the same tag would
+# fail at upload anyway, and an upload cut off half way leaves the sdist
+# without its wheel. Queue them instead.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    # Same runner conventions as ci.yml: the only label is ubuntu-latest (any
+    # other queues forever), and no `container:`, because checkout and
+    # setup-python need the node that the runner's own image has.
+    #
+    # One job, not build-then-upload: Forgejo's artifact actions are not
+    # GitHub's, and nothing is gained by passing dist/ between jobs when the
+    # gate is the release itself.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tools
+        run: python -m pip install --no-cache-dir --upgrade pip build twine hatchling
+
+      # The version lives in gitstore/__init__.py and the tag is typed by hand,
+      # so they can disagree. Catch that before building rather than after an
+      # unfixable upload: publishing 0.1.0 from a v0.2.0 tag cannot be undone,
+      # since PyPI will not let a filename be reused even after a yank.
+      #
+      # The version is read by hatchling, the same code the build runs, not by
+      # a second parser of __init__.py that could disagree with it.
+      - name: Tag and package version agree
+        env:
+          EVENT: ${{ github.event_name }}
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          python - <<'PY'
+          import os, sys
+          from hatchling.metadata.core import ProjectMetadata
+          from hatchling.plugin.manager import PluginManager
+
+          version = ProjectMetadata(os.getcwd(), PluginManager()).version
+          if os.environ["EVENT"] != "release":
+              print(f"rehearsal of version {version}; no tag to check")
+              sys.exit(0)
+          tag = os.environ["TAG"]
+          if not tag.startswith("v"):
+              sys.exit(f"release tag {tag!r} must be v<version>, e.g. v{version}")
+          if tag[1:] != version:
+              sys.exit(f"tag {tag!r} != package version {version!r} (gitstore/__init__.py)")
+          print(f"version {version} matches tag {tag}")
+          PY
+
+      # --strict fails on warnings too, such as a README that PyPI would render
+      # as plain text. The page on PyPI cannot be fixed without a new version.
+      - name: Build
+        run: |
+          python -m build
+          twine check --strict dist/*
+
+      # API tokens, not Trusted Publishing: PyPI accepts only a fixed list of
+      # CI providers as trusted publishers, and Forgejo Actions is not one.
+      # An empty secret would otherwise reach twine as an empty password and
+      # fail with a confusing 403, or prompt for input and hang.
+      - name: Upload to TestPyPI
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.TEST_PYPI_API_TOKEN }}
+          TWINE_REPOSITORY_URL: https://test.pypi.org/legacy/
+        run: |
+          if [ -z "$TWINE_PASSWORD" ]; then
+            echo "::error::TEST_PYPI_API_TOKEN is not set. Add it under Settings -> Actions -> Secrets (RELEASING.md)."
+            exit 1
+          fi
+          # A rehearsal should not fail because the same version was rehearsed
+          # before. Never pass this on the PyPI path: there, an existing file
+          # means the version was already released, and that must fail loudly.
+          twine upload --non-interactive --skip-existing dist/*
+
+      - name: Upload to PyPI
+        if: github.event_name == 'release'
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+          TWINE_REPOSITORY_URL: https://upload.pypi.org/legacy/
+        run: |
+          if [ -z "$TWINE_PASSWORD" ]; then
+            echo "::error::PYPI_API_TOKEN is not set. Add it under Settings -> Actions -> Secrets (RELEASING.md)."
+            exit 1
+          fi
+          twine upload --non-interactive dist/*

idems_gitstore-0.1.0/.gitignore

@@ -0,0 +1,10 @@
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+.claude/worktrees/