interlatch 0.22.0__tar.gz

interlatch-0.22.0/.github/dependabot.yml

@@ -0,0 +1,43 @@
+# Weekly updates for the locked Python dependencies, the pinned GitHub Actions, the hub image's base and the images
+# compose.yaml runs (security updates come sooner).
+# A new release waits 7 days before it is proposed, so a compromised one is usually caught and pulled first.
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      python:
+        patterns: ["*"]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]
+  - package-ecosystem: docker  # the hub image's base (docker/Dockerfile)
+    directory: /docker
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    labels: [dependencies, no-changelog]  # a new base image is nothing users notice: no changelog line needed
+  - package-ecosystem: docker-compose  # Caddy and Postgres in docker/compose.yaml
+    directory: /docker
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    ignore:  # a new major is a migration, not an update: Postgres can't read the old major's data, Caddy may change
+      # the Caddyfile
+      - dependency-name: postgres
+        update-types: ["version-update:semver-major"]
+      - dependency-name: caddy
+        update-types: ["version-update:semver-major"]
+    labels: [dependencies, no-changelog]  # updating a hub downloads compose.yaml again (docs/docker.md#update)

interlatch-0.22.0/.github/workflows/changelog.yml

@@ -0,0 +1,28 @@
+name: Changelog
+
+# A pull request that changes what ships (src/, ee/src/, docker/, vscode-extension/) adds a file to changelog.d/
+# saying what users will notice: the Release workflow publishes the files added since the last tag as the release
+# notes and refuses to run when there are none. A line under "## Unreleased" in CHANGELOG.md (the old way) fails the
+# check. The no-changelog label skips it for a change users won't notice.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: changelog-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  entry:
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-changelog') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0  # the merge commit, the base branch it merges into, and the tags (which entries are released)
+      - run: python3 packaging/release.py entry HEAD^1

interlatch-0.22.0/.github/workflows/ci.yml

@@ -0,0 +1,137 @@
+name: CI
+
+# Every pull request and every push to main: the test suite, the Postgres tests against a real database, known
+# vulnerabilities in the locked dependencies, the pre-commit hooks (.pre-commit-config.yaml), and the hub's Docker image
+# (docker/) built from this checkout.
+# `test` is a required check on main.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      - run: uv run --locked pytest -q
+
+  postgres:
+    # The team store and the mirror against a real Postgres: their tests skip without one (INTERLATCH_TEST_PG; set
+    # under its name before the rename too, CHRONICLE_TEST_PG, which a branch from before it reads)
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_USER: chronicle
+          POSTGRES_PASSWORD: chronicle
+          POSTGRES_DB: chronicle
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd "pg_isready -U chronicle" --health-interval 5s --health-timeout 5s --health-retries 12
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      - name: The Postgres tests, none of them skipped
+        run: |
+          printf 'PGHOST=127.0.0.1\nPGPORT=5432\nPGDATABASE=chronicle\nPGUSER=chronicle\nPGPASSWORD=chronicle\nPGSSLMODE=disable\n' > "$RUNNER_TEMP/pg.env"
+          chmod 600 "$RUNNER_TEMP/pg.env"
+          INTERLATCH_TEST_PG="$RUNNER_TEMP/pg.env" CHRONICLE_TEST_PG="$RUNNER_TEMP/pg.env" \
+            uv run --locked --extra postgres pytest -q -rs tests/test_team.py tests/test_mirror.py | tee "$RUNNER_TEMP/pytest.out"
+          if grep -q skipped "$RUNNER_TEMP/pytest.out"; then
+            echo "::error::a Postgres test was skipped"
+            exit 1
+          fi
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      - run: uvx pre-commit run --all-files --show-diff-on-failure
+
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      - name: pip-audit on uv.lock
+        run: |
+          uv export --frozen --all-groups --no-emit-project --format requirements.txt -o "$RUNNER_TEMP/requirements.txt"
+          uvx pip-audit --strict --disable-pip --require-hashes -r "$RUNNER_TEMP/requirements.txt"
+
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      - name: Build the hub's image from this checkout
+        run: |
+          uv build --wheel -o docker/wheels
+          docker build -t interlatch-hub:ci docker
+      - name: It refuses to start without an admin
+        run: |
+          if docker run --rm -e INTERLATCH_HUB_URL=https://hub.example.com interlatch-hub:ci; then
+            echo "::error::the hub started without an admin"
+            exit 1
+          fi
+      - name: With one, it becomes healthy and asks everyone to sign in
+        run: |
+          docker run -d --name hub -p 127.0.0.1:11524:11524 -e INTERLATCH_HUB_URL=https://hub.example.com \
+            -e INTERLATCH_ADMIN_EMAIL=ada@example.com interlatch-hub:ci
+          for _ in $(seq 1 45); do
+            [ "$(docker inspect -f '{{.State.Health.Status}}' hub)" = healthy ] && break
+            sleep 2
+          done
+          docker logs hub
+          docker inspect -f '{{.State.Health.Status}}' hub | grep -qx healthy
+          docker logs hub | grep -q '/signin?code='
+          docker logs hub | grep -q 'Interlatch hub is up: https://hub.example.com'
+          if docker logs hub 2>&1 | grep -q '127.0.0.1'; then  # an editor on the server would forward it
+            echo "::error::the hub's log names 127.0.0.1"
+            exit 1
+          fi
+          code=$(curl -s -o /dev/null -w '%{http_code}' -H 'Host: hub.example.com' http://127.0.0.1:11524/api/people)
+          if [ "$code" != 401 ]; then
+            echo "::error::/api/people answered $code without a sign-in"
+            exit 1
+          fi
+      - name: A hub set up before the rename, with CHRONICLE_* variables, starts the same way
+        run: |
+          docker run -d --name old -e CHRONICLE_HUB_URL=https://old.example.com -e CHRONICLE_ADMIN_EMAIL=ada@example.com \
+            interlatch-hub:ci
+          for _ in $(seq 1 45); do
+            [ "$(docker inspect -f '{{.State.Health.Status}}' old)" = healthy ] && break
+            sleep 2
+          done
+          docker logs old
+          docker inspect -f '{{.State.Health.Status}}' old | grep -qx healthy
+          docker logs old | grep -q 'hub is up: https://old.example.com'
+      - name: compose.yaml reads a .env from before the rename, and keeps that hub's volumes
+        run: |
+          printf 'CHRONICLE_DOMAIN=old.example.com\nCHRONICLE_ADMIN_EMAIL=ada@example.com\nPOSTGRES_PASSWORD=x\n' > "$RUNNER_TEMP/old.env"
+          docker compose -f docker/compose.yaml --env-file "$RUNNER_TEMP/old.env" config > "$RUNNER_TEMP/compose.yaml"
+          grep -q 'INTERLATCH_HUB_URL: https://old.example.com' "$RUNNER_TEMP/compose.yaml"
+          grep -q 'CHRONICLE_DOMAIN: old.example.com' "$RUNNER_TEMP/compose.yaml"  # what that hub's Caddyfile reads
+          grep -q 'name: chronicle_hub-data' "$RUNNER_TEMP/compose.yaml"

interlatch-0.22.0/.github/workflows/docs.yml

@@ -0,0 +1,48 @@
+name: Docs
+
+# Builds the documentation (docs/ and the READMEs, mkdocs.yml) so broken links and anchors fail before they reach
+# main. Chatixia-AI/chronicle-site publishes it at interlatch.com/docs/: when the docs change on main, this
+# asks that site to rebuild (it also rebuilds daily). The request needs the secret SITE_DISPATCH_TOKEN, a
+# fine-grained token with Contents: write on chronicle-site; without it the step is skipped.
+
+on:
+  push:
+    branches: [main]
+    paths: [docs/**, README.md, README.ja.md, mkdocs.yml, packaging/macos/icon.png, pyproject.toml, uv.lock, .github/workflows/docs.yml]
+  pull_request:
+    paths: [docs/**, README.md, README.ja.md, mkdocs.yml, .github/workflows/docs.yml]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docs-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      - run: uv run --locked --only-group docs mkdocs build --strict
+        env:
+          NO_MKDOCS_2_WARNING: "1"
+
+  publish:
+    needs: build
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Ask chronicle-site to rebuild
+        env:
+          GH_TOKEN: ${{ secrets.SITE_DISPATCH_TOKEN }}
+        run: |
+          if [ -z "$GH_TOKEN" ]; then
+            echo "::notice::SITE_DISPATCH_TOKEN isn't set; chronicle-site picks up the docs on its daily build."
+            exit 0
+          fi
+          gh api repos/Chatixia-AI/chronicle-site/dispatches -f event_type=docs-updated

interlatch-0.22.0/.github/workflows/release.yml

@@ -0,0 +1,349 @@
+name: Release
+
+# Releasing is one button: Actions → Release → Run workflow on main, and pick patch, minor or major. The version
+# lives in the git tags (hatch-vcs), so nothing is committed first. The run works out the next version from the
+# latest vX.Y.Z tag, runs the tests, creates the tag and the GitHub release (its notes are the changelog.d/ files
+# added since the previous tag), publishes interlatch to PyPI (trusted publishing, no token) and then agents-chronicle
+# at the same version (its name before the rename, which installs interlatch: packaging/agents-chronicle-farewell),
+# publishes the hub's image ghcr.io/chatixia-ai/interlatch-hub (docker/, built from that PyPI release; also as
+# chronicle-hub, its name before the rename), attaches Interlatch-X.Y.Z-arm64.dmg, and opens a pull request that moves
+# those files' lines into CHANGELOG.md under "## X.Y.Z (date)". The next release doesn't wait for that pull request: a
+# file merged after the tag is simply new since it.
+# "dry run" (the default) runs the tests and keeps the DMG as a workflow artifact, publishing nothing.
+# Publishing a release tagged vX.Y.Z on GitHub by hand runs the same tests, PyPI and DMG jobs.
+#
+# PyPI takes each package only from the trusted publisher it lists for it: this repository, release.yml and the
+# environment pypi, for interlatch and for agents-chronicle alike.
+#
+# The DMG is signed and notarized when these repository secrets exist, otherwise it is ad-hoc signed:
+#   MACOS_CERT_P12            base64 of the "Developer ID Application" certificate + key (.p12)
+#   MACOS_CERT_PASSWORD       its export password
+#   MACOS_CODESIGN_IDENTITY   e.g. "Developer ID Application: Your Name (TEAMID)"
+#   APPLE_ID, APPLE_TEAM_ID, APPLE_APP_PASSWORD   for notarytool (app-specific password)
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: Which part of the version goes up (dry run publishes nothing)
+        type: choice
+        options: [dry run, patch, minor, major]
+        default: dry run
+
+permissions: {}  # each job asks for what it needs
+
+concurrency:
+  group: release  # one release at a time, so two runs never pick the same version
+  cancel-in-progress: false
+
+jobs:
+  plan:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      version: ${{ steps.plan.outputs.version }}  # empty on a dry run
+      create: ${{ steps.plan.outputs.create }}    # "true" when this run creates the release
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0  # every tag, to find the latest
+          persist-credentials: false
+      - id: plan
+        env:
+          EVENT: ${{ github.event_name }}
+          BUMP: ${{ inputs.bump }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          if [ "$EVENT" = release ]; then
+            if ! [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              echo "::error::Release tag $RELEASE_TAG is not vX.Y.Z"
+              exit 1
+            fi
+            echo "version=${RELEASE_TAG#v}" >> "$GITHUB_OUTPUT"
+          elif [ "$BUMP" != "dry run" ]; then
+            if [ "$GITHUB_REF" != refs/heads/main ]; then
+              echo "::error::Releases come from main; this run is on $GITHUB_REF"
+              exit 1
+            fi
+            VERSION=$(python3 packaging/release.py next "$BUMP")
+            echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+            echo "create=true" >> "$GITHUB_OUTPUT"
+            echo "Releasing Interlatch **$VERSION** ($BUMP)" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+  test:
+    needs: plan
+    runs-on: macos-14
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0  # the version comes from the tags
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        with:
+          enable-cache: false  # a release never restores a cache another run could have written
+      - run: uv run --locked pytest -q
+      - name: agents-chronicle builds (the farewell job publishes it)
+        run: uv build --wheel packaging/agents-chronicle-farewell -o "$RUNNER_TEMP/farewell"
+
+  release:
+    needs: [plan, test]
+    if: needs.plan.outputs.create == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write  # create the tag and the release
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0  # the notes are the changelog.d/ files added since the previous tag
+          persist-credentials: false
+      - name: Create the tag and the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.plan.outputs.version }}
+        run: |
+          python3 packaging/release.py notes "$VERSION" > "$RUNNER_TEMP/notes.md"
+          gh release create "v$VERSION" --repo "$GITHUB_REPOSITORY" --target "$GITHUB_SHA" \
+            --title "Interlatch $VERSION" --notes-file "$RUNNER_TEMP/notes.md"
+
+  pypi:
+    needs: [plan, test, release]
+    # on a published release the release job is skipped: the tag is already there
+    if: >-
+      !cancelled() && needs.plan.outputs.version != '' && needs.test.result == 'success'
+      && contains(fromJSON('["success", "skipped"]'), needs.release.result)
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read   # checkout
+      id-token: write  # OIDC for PyPI trusted publishing
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: v${{ needs.plan.outputs.version }}
+          fetch-depth: 0  # the version comes from the tag
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        with:
+          enable-cache: false  # a release never restores a cache another run could have written
+      - run: uv build
+      - name: Check the build carries the release's version
+        env:
+          VERSION: ${{ needs.plan.outputs.version }}
+        run: |
+          ls dist
+          if [ ! -f "dist/interlatch-$VERSION-py3-none-any.whl" ]; then
+            echo "::error::The build is not version $VERSION"
+            exit 1
+          fi
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+
+  farewell:
+    # agents-chronicle, Interlatch's name before the rename, at the same version: it installs interlatch, so a copy
+    # installed under that name keeps updating, and one from before the rename (which asks PyPI about agents-chronicle)
+    # sees the release. Published after interlatch, so it never names a version PyPI doesn't have. It carries the same
+    # chronicle/ files as interlatch, which pip needs (packaging/agents-chronicle-farewell/pyproject.toml): a wheel only.
+    needs: [plan, pypi]
+    if: ${{ !cancelled() && needs.pypi.result == 'success' }}
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read   # checkout
+      id-token: write  # OIDC for PyPI trusted publishing
+    env:
+      VERSION: ${{ needs.plan.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: v${{ needs.plan.outputs.version }}
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        with:
+          enable-cache: false  # a release never restores a cache another run could have written
+      - name: Wait until PyPI serves interlatch
+        run: |
+          for _ in $(seq 1 30); do
+            if python3 -m pip download --quiet --no-deps --no-cache-dir --dest "$RUNNER_TEMP/probe" \
+                "interlatch==$VERSION"; then
+              exit 0
+            fi
+            sleep 10
+          done
+          echo "::error::PyPI does not serve interlatch $VERSION after 5 minutes"
+          exit 1
+      - name: Build agents-chronicle at the release's version, pinned to the same interlatch
+        run: |
+          sed -i "s/0\.0\.0/$VERSION/g" packaging/agents-chronicle-farewell/pyproject.toml
+          uv build --wheel packaging/agents-chronicle-farewell -o dist
+          ls dist
+          if [ ! -f "dist/agents_chronicle-$VERSION-py3-none-any.whl" ]; then
+            echo "::error::The build is not version $VERSION"
+            exit 1
+          fi
+      - name: Check it carries the chronicle/ files of the interlatch on PyPI
+        run: |
+          python3 - "$RUNNER_TEMP/probe/interlatch-$VERSION-py3-none-any.whl" "dist/agents_chronicle-$VERSION-py3-none-any.whl" <<'EOF'
+          import sys, zipfile
+          def files(wheel):  # chronicle/ path -> hash, from the wheel's RECORD
+              z = zipfile.ZipFile(wheel)
+              record = next(n for n in z.namelist() if n.endswith(".dist-info/RECORD"))
+              return {r.split(",")[0]: r.split(",")[1] for r in z.read(record).decode().splitlines() if r.startswith("chronicle/")}
+          if not files(sys.argv[1]) or files(sys.argv[1]) != files(sys.argv[2]):
+              sys.exit("::error::agents-chronicle's chronicle/ files differ from interlatch's")
+          EOF
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+
+  image:
+    needs: [plan, pypi]
+    if: ${{ !cancelled() && needs.pypi.result == 'success' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read   # checkout
+      packages: write  # push to ghcr.io
+    env:
+      VERSION: ${{ needs.plan.outputs.version }}
+      IMAGE: ghcr.io/chatixia-ai/interlatch-hub
+      # its name before the rename: a hub whose compose.yaml still names it keeps getting each release with
+      # `docker compose pull`, which is what the dashboard tells a container to do
+      OLD_IMAGE: ghcr.io/chatixia-ai/chronicle-hub
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: v${{ needs.plan.outputs.version }}
+          persist-credentials: false
+      - name: Wait until PyPI serves the release
+        run: |
+          for _ in $(seq 1 30); do
+            if python3 -m pip download --quiet --no-deps --no-cache-dir --dest "$RUNNER_TEMP/probe" \
+                "interlatch==$VERSION"; then
+              exit 0
+            fi
+            sleep 10
+          done
+          echo "::error::PyPI does not serve interlatch $VERSION after 5 minutes"
+          exit 1
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1  # v4.4.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
+        with:
+          context: docker
+          platforms: linux/amd64,linux/arm64
+          build-args: INTERLATCH_VERSION=${{ needs.plan.outputs.version }}
+          tags: |
+            ${{ env.IMAGE }}:${{ needs.plan.outputs.version }}
+            ${{ env.IMAGE }}:latest
+            ${{ env.OLD_IMAGE }}:${{ needs.plan.outputs.version }}
+            ${{ env.OLD_IMAGE }}:latest
+          push: true
+
+  macos-app:
+    needs: [plan, test, release]
+    if: >-
+      !cancelled() && needs.test.result == 'success'
+      && contains(fromJSON('["success", "skipped"]'), needs.release.result)
+    runs-on: macos-14  # Apple silicon; PyInstaller cannot cross-build, so an Intel build needs an Intel runner
+    permissions:
+      contents: write  # upload the DMG to the release
+    env:
+      HAS_CERT: ${{ secrets.MACOS_CERT_P12 != '' }}
+      VERSION: ${{ needs.plan.outputs.version }}  # empty on a dry run
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ needs.plan.outputs.version != '' && format('v{0}', needs.plan.outputs.version) || github.sha }}
+          fetch-depth: 0  # the version comes from the tags
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        with:
+          enable-cache: false  # a release never restores a cache another run could have written
+
+      - name: Import signing certificate
+        if: env.HAS_CERT == 'true'
+        env:
+          MACOS_CERT_P12: ${{ secrets.MACOS_CERT_P12 }}
+          MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
+        run: |
+          KC="$RUNNER_TEMP/signing.keychain-db"
+          KCPW=$(uuidgen)
+          security create-keychain -p "$KCPW" "$KC"
+          security set-keychain-settings -lut 21600 "$KC"
+          security unlock-keychain -p "$KCPW" "$KC"
+          echo "$MACOS_CERT_P12" | base64 --decode > "$RUNNER_TEMP/cert.p12"
+          security import "$RUNNER_TEMP/cert.p12" -P "$MACOS_CERT_PASSWORD" -A -t cert -f pkcs12 -k "$KC"
+          security set-key-partition-list -S apple-tool:,apple: -k "$KCPW" "$KC"
+          security list-keychains -d user -s "$KC" $(security list-keychains -d user | tr -d '"')
+          rm "$RUNNER_TEMP/cert.p12"
+
+      - name: Build Interlatch.app and DMG
+        env:
+          INTERLATCH_CODESIGN_IDENTITY: ${{ env.HAS_CERT == 'true' && secrets.MACOS_CODESIGN_IDENTITY || '' }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
+        run: ./packaging/macos/build.sh
+
+      - name: Attach DMG to the release
+        if: env.VERSION != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "v$VERSION" dist/Interlatch-*.dmg --repo "$GITHUB_REPOSITORY" --clobber
+
+      - name: Keep DMG as a workflow artifact
+        if: env.VERSION == ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: Interlatch-dmg
+          path: dist/Interlatch-*.dmg
+
+  changelog:
+    needs: [plan, pypi]
+    if: needs.plan.outputs.create == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write       # push the branch
+      pull-requests: write  # open the pull request
+      actions: write        # start CI on the branch: a push made with this token starts no workflows
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: main
+          fetch-depth: 0  # the tags, to find which changelog.d/ files this release took
+          persist-credentials: false
+      - name: Open a pull request that moves the release's changelog.d/ files into CHANGELOG.md
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.plan.outputs.version }}
+        run: |
+          BRANCH="changelog-$VERSION"
+          python3 packaging/release.py fold "$VERSION" "$(date -u +%F)" > "$RUNNER_TEMP/released.txt"
+          # one commit through the API: the new CHANGELOG.md, minus the files it took (ones merged since stay)
+          TREE=$(jq -n --rawfile changelog CHANGELOG.md --rawfile released "$RUNNER_TEMP/released.txt" \
+              --arg base "$(git rev-parse 'HEAD^{tree}')" \
+              '{base_tree: $base, tree: ([{path: "CHANGELOG.md", mode: "100644", type: "blob", content: $changelog}]
+                + [$released | split("\n")[] | select(. != "") | {path: ., mode: "100644", type: "blob", sha: null}])}' \
+            | gh api "repos/$GITHUB_REPOSITORY/git/trees" --input - -q .sha)
+          COMMIT=$(jq -n --arg tree "$TREE" --arg parent "$(git rev-parse HEAD)" --arg message "Changelog: $VERSION" \
+              '{message: $message, tree: $tree, parents: [$parent]}' \
+            | gh api "repos/$GITHUB_REPOSITORY/git/commits" --input - -q .sha)
+          gh api "repos/$GITHUB_REPOSITORY/git/refs" -f ref="refs/heads/$BRANCH" -f sha="$COMMIT" > /dev/null
+          gh workflow run ci.yml --repo "$GITHUB_REPOSITORY" --ref "$BRANCH"  # the required test check
+          if URL=$(gh pr create --repo "$GITHUB_REPOSITORY" --base main --head "$BRANCH" --title "Changelog: $VERSION" \
+              --body "Moves the changelog.d/ files released in $VERSION into CHANGELOG.md. Merge it any time: the next release doesn't wait for it."); then
+            echo "Changelog pull request: $URL" >> "$GITHUB_STEP_SUMMARY"
+          else
+            # the release is out and the next one doesn't need this, but CHANGELOG.md stays behind until it's merged
+            OPEN="https://github.com/$GITHUB_REPOSITORY/compare/main...$BRANCH?expand=1"
+            echo "Open the changelog pull request: $OPEN" >> "$GITHUB_STEP_SUMMARY"
+            echo "::error::$VERSION is released, but its changelog pull request could not be opened: $OPEN"
+            exit 1
+          fi

interlatch-0.22.0/.gitignore

@@ -0,0 +1,13 @@
+__pycache__/
+*.pyc
+.venv/
+.pytest_cache/
+dist/
+build/
+*.egg-info/
+.playwright-mcp/
+site/
+.env
+docs/images/demo.mp4
+packaging/icons3d/blueprint-cast.js
+packaging/icons3d/out/

interlatch-0.22.0/.pre-commit-config.yaml

@@ -0,0 +1,48 @@
+# Checks run on `git commit` (install once: `uvx pre-commit install`), and on every pull request in CI.
+# Run them all by hand: `uvx pre-commit run --all-files`. Revisions are pinned to commits; `uvx pre-commit autoupdate --freeze` moves them.
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
+    hooks:
+      - id: check-merge-conflict
+      - id: check-case-conflict
+      - id: check-yaml
+        args: [--unsafe]  # syntax only: mkdocs.yml uses !!python tags
+      - id: check-toml
+      - id: check-json
+      - id: check-added-large-files
+        args: [--maxkb=600]
+      - id: detect-private-key
+      - id: trailing-whitespace
+        exclude: \.excalidraw\.svg$  # written by the Excalidraw exporter
+      - id: end-of-file-fixer
+        exclude: \.excalidraw\.svg$
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: f12be1ebaa5351c1fc76472de98db2c3446c8253  # frozen: v0.16.10
+    hooks:
+      - id: ruff-check  # rules in pyproject.toml: likely bugs, not style
+
+  - repo: https://github.com/astral-sh/uv-pre-commit
+    rev: 0f4b65a503cc866b9b5e62dda2020f7943b01a65  # frozen: 0.12.22
+    hooks:
+      - id: uv-lock
+        args: [--check]  # pyproject.toml and uv.lock agree
+
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e  # frozen: v8.30.1
+    hooks:
+      - id: gitleaks
+
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: fa412071e4f5d44d44f9e365f4676f9df92456a2  # frozen: v1.30.1
+    hooks:
+      - id: zizmor
+
+  - repo: local
+    hooks:
+      - id: node-check
+        name: node --check (dashboard and VS Code extension JavaScript parses)
+        language: system
+        entry: node --check
+        files: ^(src/chronicle/web|vscode-extension)/.*\.js$

interlatch-0.22.0/.python-version

@@ -0,0 +1 @@
+3.13