kanon-cli 1.3.1__tar.gz → 2.0.0__tar.gz

kanon_cli-2.0.0/.github/actions/setup-kanon/action.yml

@@ -0,0 +1,143 @@
+name: Setup kanon CI environment
+description: |
+  Composite action shared by every job in pr-validation.yml and
+  main-validation.yml. Handles checkout, optional simulate-merge,
+  Python install, asdf bootstrap (plus plugin install per
+  .tool-versions), pip dependency cache, dev dependency install via
+  `make install-dev`, and uv install. Each parallel CI job calls this
+  action once before invoking its own singular Make target / pytest
+  invocation, so the per-job step list stays minimal and the setup
+  drift between jobs is impossible.
+
+inputs:
+  base-ref:
+    description: >-
+      Base ref to simulate-merge against. Leave empty to skip the
+      simulate-merge step (e.g. for push-to-main runs); set to the
+      pull-request base ref for pull_request runs.
+    required: false
+    default: ''
+  head-sha:
+    description: >-
+      Head SHA to merge into the base ref. Required when base-ref is
+      non-empty; ignored otherwise.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    # NOTE: callers MUST run `actions/checkout@v6` BEFORE `uses: ./...setup-kanon`
+    # because GitHub Actions resolves the composite action path against the
+    # runner's working directory; without a prior checkout the action file
+    # is not yet on disk. Every job in pr-validation.yml / main-validation.yml
+    # does its own `actions/checkout@v6` step explicitly.
+    # Configure a global git identity unconditionally so the runner
+    # environment is identical for pull_request and push-to-main runs.
+    # Previously this was nested inside the `if: inputs.base-ref != ''`
+    # Simulate-merge step, which fires only on PR runs; push-to-main
+    # runs ran with no global identity, so any test that depended on
+    # one passed on PR validation but failed on Main Branch Validation.
+    # Tests should not depend on this baseline (each test fixture
+    # configures identity locally on its own repos) but having a
+    # consistent environment across both workflows prevents the same
+    # class of divergence from masking future test fixture bugs at PR
+    # time.
+    - name: Configure default git identity
+      shell: bash
+      run: |
+        git config --global user.name "GitHub Actions"
+        git config --global user.email "actions@github.com"
+        # tests/integration/test_complete_catalog_entries.py and
+        # tests/integration/test_background_refresh.py create fresh git
+        # repos via `git init` and refer to the result by the symbolic ref
+        # `main` (e.g. `KANON_CATALOG_SOURCE=file://<repo>@main`). On the
+        # GitHub-hosted ubuntu-* runners `init.defaultBranch` is `master`
+        # unless explicitly overridden, so without this config the fresh
+        # repos have only `master` and the `@main` lookup returns empty.
+        # The kanon devcontainer already sets this, which is why these
+        # tests pass locally but fail in CI.
+        git config --global init.defaultBranch main
+
+    - name: Simulate merge
+      if: inputs.base-ref != ''
+      shell: bash
+      run: |
+        git fetch origin ${{ inputs.base-ref }}
+        git checkout -b pr-validation origin/${{ inputs.base-ref }}
+        git merge --no-commit --no-ff ${{ inputs.head-sha }}
+
+    - name: Setup Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: '3.14'
+
+    - name: Cache ASDF installation
+      uses: actions/cache@v5
+      with:
+        path: ~/.asdf
+        key: ${{ runner.os }}-asdf-v0.15.0-${{ hashFiles('.tool-versions') }}
+        restore-keys: |
+          ${{ runner.os }}-asdf-v0.15.0-
+
+    - name: Install ASDF
+      shell: bash
+      run: |
+        if [ ! -d ~/.asdf ]; then
+          git clone https://github.com/asdf-vm/asdf.git ~/.asdf --branch v0.15.0
+        fi
+        echo "$HOME/.asdf/bin" >> $GITHUB_PATH
+        echo "$HOME/.asdf/shims" >> $GITHUB_PATH
+        source $HOME/.asdf/asdf.sh
+
+    - name: Install ASDF plugins and tools
+      shell: bash
+      run: |
+        cd $GITHUB_WORKSPACE
+        source $HOME/.asdf/asdf.sh
+        cut -d' ' -f1 .tool-versions | xargs -I{} asdf plugin add {} || true
+        asdf plugin remove python 2>/dev/null || true
+        asdf install
+        asdf reshim
+
+    - name: Cache Python dependencies
+      uses: actions/cache@v5
+      with:
+        path: |
+          ~/.cache/pip
+          ~/.local/lib/python*/site-packages
+        key: ${{ runner.os }}-pip-${{ hashFiles('requirements-dev.txt', 'pyproject.toml') }}
+        restore-keys: |
+          ${{ runner.os }}-pip-
+
+    - name: Install zsh (for shell-completion integration tests)
+      shell: bash
+      run: |
+        # tests/integration/test_completion_zsh.py,
+        # tests/integration/test_preamble_zsh.py, and
+        # tests/integration/test_midtoken_zsh.py shell out to a real zsh to
+        # exercise the dynamic completion machinery. The kanon devcontainer
+        # ships with zsh, but the GitHub Actions ubuntu-latest runners do
+        # not; install it explicitly so the zsh suite has the binary it
+        # asserts on (`assert shutil.which("zsh") is not None`).
+        set -euo pipefail
+        if ! command -v zsh >/dev/null 2>&1; then
+          sudo apt-get update -y
+          sudo apt-get install -y --no-install-recommends zsh
+        fi
+        zsh --version
+
+    - name: Install dependencies
+      shell: bash
+      run: |
+        pip install --upgrade pip
+        make install-dev
+
+    - name: Install uv
+      # `tests/unit/repo/test_wheel_contents.py`,
+      # `tests/integration/test_wheel_e2e.py`, and
+      # `tests/integration/test_ci_validation.py` shell out to
+      # `uv build` to produce the wheel under test; uv must be on
+      # PATH for any job that runs those suites (including the
+      # full-suite regression job that runs every test together).
+      uses: astral-sh/setup-uv@v6

kanon_cli-2.0.0/.github/workflows/pr-validation.yml

@@ -0,0 +1,262 @@
+name: PR Validation
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  pre-commit:
+    name: Pre-commit hooks
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+        with:
+          base-ref: ${{ github.base_ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+      - name: Run pre-commit checks
+        shell: bash
+        run: |
+          source $HOME/.asdf/asdf.sh
+          make pre-commit-check
+
+  lint-check:
+    name: Lint (ruff check)
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+        with:
+          base-ref: ${{ github.base_ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+      - name: Run ruff check
+        shell: bash
+        run: make lint-check
+
+  format-check:
+    name: Format check (ruff format --check)
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+        with:
+          base-ref: ${{ github.base_ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+      - name: Run ruff format --check
+        shell: bash
+        run: make format-check
+
+  security-scan:
+    name: Security scan (bandit)
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+        with:
+          base-ref: ${{ github.base_ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+      - name: Run bandit
+        shell: bash
+        run: make security-scan
+
+  verify-bundled-catalog-removed:
+    name: Verify bundled catalog removed (E6-F2-S1-T1)
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Verify bundled catalog removed
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ -d "src/kanon_cli/catalog" ]; then
+            echo "ERROR: src/kanon_cli/catalog/ must remain removed (see backlog/E6-F2-S1-T1)" >&2
+            exit 1
+          fi
+
+  build:
+    name: Build wheel
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+        with:
+          base-ref: ${{ github.base_ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+      - name: Build distribution
+        shell: bash
+        run: make publish
+
+  unit-tests:
+    name: Unit tests (with coverage gate)
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+        with:
+          base-ref: ${{ github.base_ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+      - name: Run unit tests with 90% coverage gate
+        shell: bash
+        run: |
+          python -m pytest -m unit --cov=kanon_cli --cov-report=term-missing
+          coverage json
+          coverage_percent=$(python -c "import json; f=open('coverage.json'); print(json.load(f)['totals']['percent_covered'])")
+          echo "Coverage: $coverage_percent%"
+          if (( $(echo "$coverage_percent < 90" | bc -l) )); then
+            echo "Error: Code coverage is below 90% threshold ($coverage_percent%)"
+            exit 1
+          fi
+
+  integration-tests:
+    name: Integration tests
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+        with:
+          base-ref: ${{ github.base_ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+      - name: Run integration tests
+        shell: bash
+        run: python -m pytest -m integration
+
+  functional-tests:
+    name: Functional tests
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+        with:
+          base-ref: ${{ github.base_ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+      - name: Run functional tests
+        shell: bash
+        run: make test-functional
+
+  scenario-tests:
+    name: Scenario tests (docs/integration-testing.md)
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+        with:
+          base-ref: ${{ github.base_ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+      - name: Run scenario tests
+        shell: bash
+        run: make test-scenarios
+
+  full-suite-regression:
+    name: Full suite regression (cross-suite isolation guard)
+    # Runs `make test` -- the same `pytest --cov=kanon_cli` invocation
+    # that exercises unit + integration + functional + scenarios in a
+    # single process. The singular jobs above pass individually but
+    # this job catches the class of cross-suite isolation regressions
+    # documented in `git log --grep cross-suite` (e.g. session-scoped
+    # autouse fixtures leaking env state into later suites). It runs
+    # in parallel with the singular jobs so the wall-clock impact on
+    # PR feedback is bounded by the slowest single job, not summed.
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-kanon
+        with:
+          base-ref: ${{ github.base_ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+      - name: Run the full suite together
+        shell: bash
+        run: make test
+
+  code-owners:
+    name: Code owners
+    if: ${{ github.actor != 'caylent-platform-bot[bot]' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Find code owners
+        id: codeowners
+        shell: bash
+        run: |
+          DEFAULT_OWNER=""
+          if [ -f ".github/CODEOWNERS" ]; then
+            DEFAULT_OWNER=$(grep -E "^\*|^/" .github/CODEOWNERS | awk '{print $2}' || true)
+          fi
+
+          CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }} ${{ github.event.pull_request.head.sha }})
+          echo "Changed files: $CHANGED_FILES"
+
+          SPECIFIC_OWNERS=""
+          if [ -f ".github/CODEOWNERS" ]; then
+            for FILE in $CHANGED_FILES; do
+              while [[ "$FILE" == */* ]]; do
+                DIR=$(dirname "$FILE")
+                MATCH=$(grep -E "^$DIR/" .github/CODEOWNERS | awk '{for(i=2;i<=NF;i++) print $i}' || true)
+                if [ -n "$MATCH" ]; then
+                  SPECIFIC_OWNERS="$SPECIFIC_OWNERS $MATCH"
+                  break
+                fi
+                FILE="$DIR"
+              done
+            done
+          fi
+
+          if [ -z "$SPECIFIC_OWNERS" ]; then
+            OWNERS="$DEFAULT_OWNER"
+          else
+            OWNERS="$SPECIFIC_OWNERS"
+          fi
+
+          if [ -n "$OWNERS" ]; then
+            UNIQUE_OWNERS=$(echo "$OWNERS" | tr ' ' '\n' | grep -v '^$' | sort -u | tr '\n' ' ' | xargs)
+          else
+            UNIQUE_OWNERS=""
+          fi
+          echo "Final owners: $UNIQUE_OWNERS"
+          echo "owners=$UNIQUE_OWNERS" >> $GITHUB_OUTPUT

kanon_cli-2.0.0/.gitignore

@@ -0,0 +1,33 @@
+__pycache__/
+*.pyc
+*.pyo
+*.egg-info/
+dist/
+build/
+.pytest_cache/
+.ruff_cache/
+.coverage-data/
+.coverage
+coverage.json
+htmlcov/
+
+# Environment files
+shell.env
+devcontainer-environment-variables.json
+.devcontainer/aws-profile-map.json
+.devcontainer/ssh-private-key
+
+# Embedded repo tool runtime artifacts
+TRACE_FILE
+
+# Claude Code local settings
+.claude/settings.local.json
+
+# AI metrics tracking artifacts (generated by Claude Code tooling)
+.ai-sdlc/metrics/
+
+# Temporary test runtime directories (created at runtime, never committed)
+tmp/
+
+# Deleted bundled catalog -- guard against accidental re-addition (E6-F2-S1-T1)
+src/kanon_cli/catalog/

kanon_cli-2.0.0/.markdownlint.json

@@ -0,0 +1,6 @@
+{
+  "default": true,
+  "MD024": {
+    "siblings_only": true
+  }
+}

kanon_cli-2.0.0/.pre-commit-config.yaml

@@ -0,0 +1,30 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: debug-statements
+      - id: check-json
+      - id: check-yaml
+        args: [--unsafe]
+      - id: check-added-large-files
+      - id: detect-aws-credentials
+        args:
+          - '--allow-missing-credentials'
+      - id: check-merge-conflict
+      - id: end-of-file-fixer
+        exclude: ^tests/fixtures/completion/
+      - id: detect-private-key
+        exclude: ^tests/
+
+  - repo: https://github.com/adrienverge/yamllint
+    rev: v1.35.1
+    hooks:
+      - id: yamllint
+        args: [-c=.yamllint]
+        types: [yaml]
+
+  - repo: https://github.com/zricethezav/gitleaks
+    rev: v8.26.0
+    hooks:
+      - id: gitleaks