judgetap 0.1.1.dev34__tar.gz → 0.1.1.dev3601__tar.gz

{judgetap-0.1.1.dev34 → judgetap-0.1.1.dev3601}/.github/workflows/release.yml

@@ -82,8 +82,15 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ needs.release-please.outputs.tag || github.event.release.tag_name || inputs.tag }}
+          # Always a tag, never a branch that happens to share the name.
+          ref: refs/tags/${{ needs.release-please.outputs.tag || github.event.release.tag_name || inputs.tag }}
       - uses: astral-sh/setup-uv@v6
+      - name: A manual publish needs a GitHub Release for the tag
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.tag }}
+        run: gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null
       - name: Check the tag matches the package version
         # The tag arrives through the environment, never interpolated into the
         # script: a release tag is user-controlled text.
@@ -115,10 +122,13 @@ jobs:
         # and before the next one, and is unique per run.
         env:
           RUN_NUMBER: ${{ github.run_number }}
+          RUN_ATTEMPT: ${{ github.run_attempt }}
         run: |
           uv run --no-project python - <<'EOF'
           import json, os, re, pathlib
-          run = int(os.environ["RUN_NUMBER"])
+          # run_number * 100 + attempt: a rerun (same run number) still gets a
+          # new, higher version; up to 99 attempts per run.
+          run = int(os.environ["RUN_NUMBER"]) * 100 + int(os.environ["RUN_ATTEMPT"])
           current = json.load(open(".release-please-manifest.json"))["."]
           major, minor, patch = (int(x) for x in current.split("."))
           dev = f"{major}.{minor}.{patch + 1}.dev{run}"

{judgetap-0.1.1.dev34 → judgetap-0.1.1.dev3601}/CONTRIBUTING.md

@@ -48,5 +48,5 @@ By contributing you agree your work is licensed under Apache-2.0.
 ## Releases
 
 - Every merge to `main` publishes a dev build to PyPI (`X.Y.Z.devN`), except merging the release PR itself, which publishes the stable version instead. `pip install judgetap` ignores it; `pip install --pre judgetap` gets it.
-- A stable version is published only when a GitHub Release is created: release-please keeps a release PR open with the next version and the changelog, built from conventional commit titles, and merging it tags and publishes. A release published by hand in GitHub is published the same way, after checking the tag matches the package version.
+- A stable version is published only when a GitHub Release is created: release-please keeps a release PR open with the next version and the changelog, built from conventional commit titles, and merging it tags and publishes. A release published by hand in GitHub is published the same way, after checking the tag matches the package version. If a stable publish fails, re-run it from Actions → release → "Run workflow" with the release tag; it only publishes a tag that has a GitHub Release.
 - Publishing uses PyPI Trusted Publishing (OIDC): no tokens are stored anywhere.

{judgetap-0.1.1.dev34 → judgetap-0.1.1.dev3601}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: judgetap
-Version: 0.1.1.dev34
+Version: 0.1.1.dev3601
 Summary: Fast typed decisions (choice, score, yes/no) across Jev-style engines, plus a guard for coding agents. Early development.
 Project-URL: Homepage, https://github.com/mergesafe-ai/judgetap
 Author-email: Omer Bar-Ness <omer@zsquared.io>

{judgetap-0.1.1.dev34 → judgetap-0.1.1.dev3601}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "judgetap"
-version = "0.1.1.dev34"
+version = "0.1.1.dev3601"
 description = "Fast typed decisions (choice, score, yes/no) across Jev-style engines, plus a guard for coding agents. Early development."
 readme = "README.md"
 license = "Apache-2.0"

{judgetap-0.1.1.dev34 → judgetap-0.1.1.dev3601}/src/judgetap/__init__.py

@@ -23,7 +23,7 @@ from judgetap.errors import (
 )
 from judgetap.types import Decision, Question
 
-__version__ = "0.1.1.dev34"  # x-release-please-version
+__version__ = "0.1.1.dev3601"  # x-release-please-version
 
 __all__ = [
     "Cascade",

{judgetap-0.1.1.dev34 → judgetap-0.1.1.dev3601}/src/judgetap/guard/rules.py

@@ -920,6 +920,8 @@ def check_path(
 # python -c, ...) is an unbounded list; a mention is not. Reading the config
 # (`cat guard.toml`) asks too: rare, and cheap to approve.
 GUARD_CONFIG_MENTION = re.compile(
+    # A whole name at both ends: myguard.toml or foo.claude/... is another file.
+    r"(?<![\w.-])"
     r"(?:guard\.toml|\.claude/settings[^\s'\"/]*\.json|\.cursor/hooks\.json"
     r"|\.codex/hooks\.json|\.codex/config\.toml)"
     # A whole name: guard.toml.example or settings.json.bak is another file.

{judgetap-0.1.1.dev34 → judgetap-0.1.1.dev3601}/tests/test_guard_trust.py

@@ -318,3 +318,28 @@ def test_symlink_with_equals_in_its_name_asks(tmp_path):
     (tmp_path / "alias=cfg").symlink_to(tmp_path / "guard.toml")
     assert check_command_writes("echo x >alias=cfg", tmp_path) is not None
     assert check_command_writes("dd if=x of=alias=cfg", tmp_path) is not None
+
+
+@pytest.mark.parametrize(
+    "command", ["cat myguard.toml", "cat x-guard.toml", "ls foo.claude/settings.json"]
+)
+def test_other_files_ending_in_a_config_name_do_not_ask(command, tmp_path):
+    from judgetap.guard.rules import check_command_writes
+
+    assert check_command_writes(command, tmp_path) is None
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "cat guard.toml",
+        "cat ./guard.toml",
+        "echo x >guard.toml",
+        "cp a '.claude/settings.json'",
+        "x=guard.toml",
+    ],
+)
+def test_config_name_at_a_boundary_still_asks(command, tmp_path):
+    from judgetap.guard.rules import check_command_writes
+
+    assert check_command_writes(command, tmp_path) is not None