kanon-cli 1.2.0__tar.gz → 2.0.0__tar.gz

kanon_cli-2.0.0/.github/actions/setup-kanon/action.yml

@@ -0,0 +1,143 @@
+name: Setup kanon CI environment
+description: |
+  Composite action shared by every job in pr-validation.yml and
+  main-validation.yml. Handles checkout, optional simulate-merge,
+  Python install, asdf bootstrap (plus plugin install per
+  .tool-versions), pip dependency cache, dev dependency install via
+  `make install-dev`, and uv install. Each parallel CI job calls this
+  action once before invoking its own singular Make target / pytest
+  invocation, so the per-job step list stays minimal and the setup
+  drift between jobs is impossible.
+
+inputs:
+  base-ref:
+    description: >-
+      Base ref to simulate-merge against. Leave empty to skip the
+      simulate-merge step (e.g. for push-to-main runs); set to the
+      pull-request base ref for pull_request runs.
+    required: false
+    default: ''
+  head-sha:
+    description: >-
+      Head SHA to merge into the base ref. Required when base-ref is
+      non-empty; ignored otherwise.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    # NOTE: callers MUST run `actions/checkout@v6` BEFORE `uses: ./...setup-kanon`
+    # because GitHub Actions resolves the composite action path against the
+    # runner's working directory; without a prior checkout the action file
+    # is not yet on disk. Every job in pr-validation.yml / main-validation.yml
+    # does its own `actions/checkout@v6` step explicitly.
+    # Configure a global git identity unconditionally so the runner
+    # environment is identical for pull_request and push-to-main runs.
+    # Previously this was nested inside the `if: inputs.base-ref != ''`
+    # Simulate-merge step, which fires only on PR runs; push-to-main
+    # runs ran with no global identity, so any test that depended on
+    # one passed on PR validation but failed on Main Branch Validation.
+    # Tests should not depend on this baseline (each test fixture
+    # configures identity locally on its own repos) but having a
+    # consistent environment across both workflows prevents the same
+    # class of divergence from masking future test fixture bugs at PR
+    # time.
+    - name: Configure default git identity
+      shell: bash
+      run: |
+        git config --global user.name "GitHub Actions"
+        git config --global user.email "actions@github.com"
+        # tests/integration/test_complete_catalog_entries.py and
+        # tests/integration/test_background_refresh.py create fresh git
+        # repos via `git init` and refer to the result by the symbolic ref
+        # `main` (e.g. `KANON_CATALOG_SOURCE=file://<repo>@main`). On the
+        # GitHub-hosted ubuntu-* runners `init.defaultBranch` is `master`
+        # unless explicitly overridden, so without this config the fresh
+        # repos have only `master` and the `@main` lookup returns empty.
+        # The kanon devcontainer already sets this, which is why these
+        # tests pass locally but fail in CI.
+        git config --global init.defaultBranch main
+
+    - name: Simulate merge
+      if: inputs.base-ref != ''
+      shell: bash
+      run: |
+        git fetch origin ${{ inputs.base-ref }}
+        git checkout -b pr-validation origin/${{ inputs.base-ref }}
+        git merge --no-commit --no-ff ${{ inputs.head-sha }}
+
+    - name: Setup Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: '3.14'
+
+    - name: Cache ASDF installation
+      uses: actions/cache@v5
+      with:
+        path: ~/.asdf
+        key: ${{ runner.os }}-asdf-v0.15.0-${{ hashFiles('.tool-versions') }}
+        restore-keys: |
+          ${{ runner.os }}-asdf-v0.15.0-
+
+    - name: Install ASDF
+      shell: bash
+      run: |
+        if [ ! -d ~/.asdf ]; then
+          git clone https://github.com/asdf-vm/asdf.git ~/.asdf --branch v0.15.0
+        fi
+        echo "$HOME/.asdf/bin" >> $GITHUB_PATH
+        echo "$HOME/.asdf/shims" >> $GITHUB_PATH
+        source $HOME/.asdf/asdf.sh
+
+    - name: Install ASDF plugins and tools
+      shell: bash
+      run: |
+        cd $GITHUB_WORKSPACE
+        source $HOME/.asdf/asdf.sh
+        cut -d' ' -f1 .tool-versions | xargs -I{} asdf plugin add {} || true
+        asdf plugin remove python 2>/dev/null || true
+        asdf install
+        asdf reshim
+
+    - name: Cache Python dependencies
+      uses: actions/cache@v5
+      with:
+        path: |
+          ~/.cache/pip
+          ~/.local/lib/python*/site-packages
+        key: ${{ runner.os }}-pip-${{ hashFiles('requirements-dev.txt', 'pyproject.toml') }}
+        restore-keys: |
+          ${{ runner.os }}-pip-
+
+    - name: Install zsh (for shell-completion integration tests)
+      shell: bash
+      run: |
+        # tests/integration/test_completion_zsh.py,
+        # tests/integration/test_preamble_zsh.py, and
+        # tests/integration/test_midtoken_zsh.py shell out to a real zsh to
+        # exercise the dynamic completion machinery. The kanon devcontainer
+        # ships with zsh, but the GitHub Actions ubuntu-latest runners do
+        # not; install it explicitly so the zsh suite has the binary it
+        # asserts on (`assert shutil.which("zsh") is not None`).
+        set -euo pipefail
+        if ! command -v zsh >/dev/null 2>&1; then
+          sudo apt-get update -y
+          sudo apt-get install -y --no-install-recommends zsh
+        fi
+        zsh --version
+
+    - name: Install dependencies
+      shell: bash
+      run: |
+        pip install --upgrade pip
+        make install-dev
+
+    - name: Install uv
+      # `tests/unit/repo/test_wheel_contents.py`,
+      # `tests/integration/test_wheel_e2e.py`, and
+      # `tests/integration/test_ci_validation.py` shell out to
+      # `uv build` to produce the wheel under test; uv must be on
+      # PATH for any job that runs those suites (including the
+      # full-suite regression job that runs every test together).
+      uses: astral-sh/setup-uv@v6

{kanon_cli-1.2.0 → kanon_cli-2.0.0}/.github/workflows/main-validation.yml

@@ -13,81 +13,90 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  validate:
-    name: Validate Main
+  pre-commit:
+    name: Pre-commit hooks
     if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
     runs-on: ubuntu-24.04
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.14'
-
-      - name: Cache ASDF installation
-        uses: actions/cache@v5
-        with:
-          path: ~/.asdf
-          key: ${{ runner.os }}-asdf-v0.15.0-${{ hashFiles('.tool-versions') }}
-          restore-keys: |
-            ${{ runner.os }}-asdf-v0.15.0-
-
-      - name: Install ASDF
-        run: |
-          if [ ! -d ~/.asdf ]; then
-            git clone https://github.com/asdf-vm/asdf.git ~/.asdf --branch v0.15.0
-          fi
-          echo "$HOME/.asdf/bin" >> $GITHUB_PATH
-          echo "$HOME/.asdf/shims" >> $GITHUB_PATH
-          source $HOME/.asdf/asdf.sh
+      - uses: ./.github/actions/setup-kanon
+      - name: Run pre-commit checks
         shell: bash
-
-      - name: Install ASDF plugins and tools
         run: |
-          cd $GITHUB_WORKSPACE
           source $HOME/.asdf/asdf.sh
-          cut -d' ' -f1 .tool-versions | xargs -I{} asdf plugin add {} || true
-          asdf plugin remove python 2>/dev/null || true
-          asdf install
-          asdf reshim
-        shell: bash
+          make pre-commit-check
 
-      - name: Cache Python dependencies
-        uses: actions/cache@v5
+  lint-check:
+    name: Lint (ruff check)
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
         with:
-          path: |
-            ~/.cache/pip
-            ~/.local/lib/python*/site-packages
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements-dev.txt', 'pyproject.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-
-
-      - name: Install dependencies
-        run: |
-          pip install --upgrade pip
-          make install-dev
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+      - name: Run ruff check
         shell: bash
+        run: make lint-check
 
-      - name: Run pre-commit checks
-        run: |
-          source $HOME/.asdf/asdf.sh
-          make pre-commit-check
+  format-check:
+    name: Format check (ruff format --check)
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+      - name: Run ruff format --check
         shell: bash
+        run: make format-check
 
-      - name: Lint
-        run: make lint
+  security-scan:
+    name: Security scan (bandit)
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+      - name: Run bandit
         shell: bash
+        run: make security-scan
 
-      - name: Build
-        run: make publish
+  build:
+    name: Build wheel
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+      - name: Build distribution
         shell: bash
+        run: make publish
 
-      - name: Run unit tests with coverage threshold
+  unit-tests:
+    name: Unit tests (with coverage gate)
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+      - name: Run unit tests with 90% coverage gate
+        shell: bash
         run: |
           python -m pytest -m unit --cov=kanon_cli --cov-report=term-missing
           coverage json
@@ -97,16 +106,62 @@ jobs:
             echo "Error: Code coverage is below 90% threshold ($coverage_percent%)"
             exit 1
           fi
+
+  integration-tests:
+    name: Integration tests
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+      - name: Run integration tests
         shell: bash
+        run: python -m pytest -m integration
 
+  functional-tests:
+    name: Functional tests
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
       - name: Run functional tests
+        shell: bash
         run: make test-functional
+
+  scenario-tests:
+    name: Scenario tests (docs/integration-testing.md)
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+      - name: Run scenario tests
         shell: bash
+        run: make test-scenarios
 
-      - name: Print coverage summary
-        run: |
-          python -m pytest -m unit --cov=kanon_cli --cov-report=term-missing
+  full-suite-regression:
+    name: Full suite regression (cross-suite isolation guard)
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+      - name: Run the full suite together
         shell: bash
+        run: make test
 
   codeql:
     name: CodeQL Analysis
@@ -134,7 +189,18 @@ jobs:
   manual-approval:
     name: Manual QA Approval
     if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
-    needs: [validate, codeql]
+    needs:
+      - pre-commit
+      - lint-check
+      - format-check
+      - security-scan
+      - build
+      - unit-tests
+      - integration-tests
+      - functional-tests
+      - scenario-tests
+      - full-suite-regression
+      - codeql
     runs-on: ubuntu-24.04
     environment:
       name: qa-approval
@@ -142,6 +208,7 @@ jobs:
 
     steps:
       - name: QA Approval
+        shell: bash
         run: echo "QA has been approved"
 
   create-release:
@@ -180,6 +247,7 @@ jobs:
             ${{ runner.os }}-asdf-v0.15.0-
 
       - name: Install ASDF
+        shell: bash
         run: |
           if [ ! -d ~/.asdf ]; then
             git clone https://github.com/asdf-vm/asdf.git ~/.asdf --branch v0.15.0
@@ -187,9 +255,9 @@ jobs:
           echo "$HOME/.asdf/bin" >> $GITHUB_PATH
           echo "$HOME/.asdf/shims" >> $GITHUB_PATH
           source $HOME/.asdf/asdf.sh
-        shell: bash
 
       - name: Install ASDF plugins and tools
+        shell: bash
         run: |
           cd $GITHUB_WORKSPACE
           source $HOME/.asdf/asdf.sh
@@ -197,7 +265,6 @@ jobs:
           asdf plugin remove python 2>/dev/null || true
           asdf install
           asdf reshim
-        shell: bash
 
       - name: Cache Python dependencies for release
         uses: actions/cache@v5
@@ -211,15 +278,16 @@ jobs:
             ${{ runner.os }}-pip-
 
       - name: Install dependencies
+        shell: bash
         run: |
           pip install --upgrade pip
           make install-dev
-        shell: bash
 
       - name: Compute next version
         id: semantic-release
         env:
           GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+        shell: bash
         run: |
           NEW_VERSION=$(python -m semantic_release version --print | sed 's/^v//')
           echo "New version: $NEW_VERSION"
@@ -229,11 +297,11 @@ jobs:
             echo "Current version: $NEW_VERSION"
           fi
           echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
-        shell: bash
 
       - name: Generate changelog and update version files
         env:
           GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+        shell: bash
         run: |
           python -m semantic_release version --no-push --no-vcs-release --no-commit
 
@@ -246,12 +314,12 @@ jobs:
           sed -i 's/[[:space:]]*$//' CHANGELOG.md pyproject.toml src/kanon_cli/__init__.py
 
           rm -rf dist/ build/ src/kanon_cli.egg-info/
-        shell: bash
 
       - name: Commit changelog and version bump
         id: commit-changes
         env:
           GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+        shell: bash
         run: |
           VERSION=$(grep '^version = ' pyproject.toml | sed 's/.*version = "\([^"]*\)".*/\1/')
           echo "VERSION: $VERSION"
@@ -275,7 +343,7 @@ jobs:
           echo "$STAGED"
 
           if [[ -z "$STAGED" ]]; then
-            echo "No file changes detected — no version bump needed. Skipping release."
+            echo "No file changes detected -- no version bump needed. Skipping release."
             echo "skip_release=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
@@ -297,12 +365,12 @@ jobs:
 
           gh pr merge ${PR_URL} --admin --merge
           echo "Pull request merged successfully"
-        shell: bash
 
       - name: Wait for PR to merge and create Git tag
         if: steps.commit-changes.outputs.skip_release != 'true'
         env:
           GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+        shell: bash
         run: |
           set -euo pipefail
 
@@ -341,13 +409,12 @@ jobs:
 
           echo "Cleaning up release branch: release-$NEW_VERSION"
           git push origin --delete release-$NEW_VERSION || echo "Branch already deleted or doesn't exist"
-        shell: bash
 
       - name: Trigger publish workflow
         if: steps.commit-changes.outputs.skip_release != 'true'
         env:
           GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+        shell: bash
         run: |
           NEW_VERSION=$(grep '^version = ' pyproject.toml | sed 's/.*version = "\([^"]*\)".*/\1/')
           gh workflow run publish.yml -f tag="$NEW_VERSION"
-        shell: bash