kanon-cli 3.3.0__tar.gz → 3.3.2__tar.gz

{kanon_cli-3.3.0 → kanon_cli-3.3.2}/.github/actions/setup-kanon/action.yml

@@ -3,11 +3,17 @@ description: |
   Composite action shared by every job in pr-validation.yml and
   main-validation.yml. Handles checkout, optional simulate-merge,
   Python install, asdf bootstrap (plus plugin install per
-  .tool-versions), pip dependency cache, dev dependency install via
-  `make install-dev`, and uv install. Each parallel CI job calls this
-  action once before invoking its own singular Make target / pytest
-  invocation, so the per-job step list stays minimal and the setup
-  drift between jobs is impossible.
+  .tool-versions), uv install with an uv.lock-keyed cache, and the
+  dependency install itself (`uv sync --locked --all-groups`). Each
+  parallel CI job calls this action once before invoking its own
+  singular Make target, so the per-job step list stays minimal and
+  setup drift between jobs is impossible.
+
+  Every job resolves dependencies from uv.lock and nowhere else. Jobs
+  must invoke Make targets rather than calling pytest/ruff/bandit
+  directly, because those targets run tools through `uv run`; a bare
+  invocation picks up whatever is on PATH and reintroduces the drift
+  this action exists to prevent.
 
 inputs:
   base-ref:
@@ -108,15 +114,20 @@ runs:
         asdf install
         asdf reshim
 
-    - name: Cache Python dependencies
-      uses: actions/cache@v5
+    - name: Install uv
+      # uv must be installed BEFORE the dependency step, because that step is
+      # now `uv sync`. It is also required at test time:
+      # `tests/unit/repo/test_wheel_contents.py`,
+      # `tests/integration/test_wheel_e2e.py`, and
+      # `tests/integration/test_ci_validation.py` shell out to `uv build` to
+      # produce the wheel under test.
+      # `enable-cache` replaces the previous actions/cache pip step; keying on
+      # uv.lock means the cache is invalidated by exactly the file that decides
+      # which versions get installed.
+      uses: astral-sh/setup-uv@v6
       with:
-        path: |
-          ~/.cache/pip
-          ~/.local/lib/python*/site-packages
-        key: ${{ runner.os }}-pip-${{ hashFiles('requirements-dev.txt', 'pyproject.toml') }}
-        restore-keys: |
-          ${{ runner.os }}-pip-
+        enable-cache: true
+        cache-dependency-glob: uv.lock
 
     - name: Install zsh (for shell-completion integration tests)
       if: runner.os == 'Linux'
@@ -140,22 +151,15 @@ runs:
       shell: bash
       run: |
         set -euo pipefail
-        pip install --upgrade pip
-        # `make install-dev` is `pip install -r requirements-dev.txt`. GNU make
-        # is not guaranteed on the windows-latest runner image, so the Windows
-        # leg invokes pip directly (same dependency set, no make dependency)
-        # while Linux keeps the make target for parity with local dev.
-        if [ "$RUNNER_OS" = "Linux" ]; then
-          make install-dev
-        else
-          pip install -r requirements-dev.txt
-        fi
-
-    - name: Install uv
-      # `tests/unit/repo/test_wheel_contents.py`,
-      # `tests/integration/test_wheel_e2e.py`, and
-      # `tests/integration/test_ci_validation.py` shell out to
-      # `uv build` to produce the wheel under test; uv must be on
-      # PATH for any job that runs those suites (including the
-      # full-suite regression job that runs every test together).
-      uses: astral-sh/setup-uv@v6
+        # Single dependency-resolution path for every job. Previously this was
+        # `pip install -r requirements-dev.txt`, which resolved from PyPI at run
+        # time and ignored uv.lock, while `make test` / `make test-scenarios`
+        # ran under `uv run` and honoured it. The two disagreed -- the pip leg
+        # installed pytest 8.3 and an unbounded shtab, so a shtab release broke
+        # the completion golden fixtures in the pip-based jobs only.
+        #
+        # `--locked` fails the job if uv.lock is stale rather than silently
+        # re-resolving, so a dependency change cannot reach CI unlocked.
+        # `uv sync` needs no GNU make, so the Windows leg no longer needs a
+        # separate branch.
+        uv sync --locked --all-groups

{kanon_cli-3.3.0 → kanon_cli-3.3.2}/.github/workflows/main-validation.yml

@@ -103,17 +103,14 @@ jobs:
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup-kanon
-      - name: Run unit tests with 90% coverage gate
+      - name: Run unit tests with coverage gate
         shell: bash
-        run: |
-          python -m pytest -n auto --dist loadscope -m "unit" --cov=kanon_cli --cov-report=term-missing
-          coverage json
-          coverage_percent=$(python -c "import json; f=open('coverage.json'); print(json.load(f)['totals']['percent_covered'])")
-          echo "Coverage: $coverage_percent%"
-          if (( $(echo "$coverage_percent < 90" | bc -l) )); then
-            echo "Error: Code coverage is below 90% threshold ($coverage_percent%)"
-            exit 1
-          fi
+        # Delegates to the Make target so the threshold lives in one place
+        # (Makefile: COVERAGE_MIN) instead of being duplicated across both
+        # workflow files, and so the run resolves from uv.lock like every other
+        # job. pytest-cov's own --cov-fail-under replaces the hand-rolled
+        # coverage-json + bc comparison.
+        run: make test-unit-cov
 
   integration-tests-linux:
     name: Integration tests (Linux)
@@ -127,7 +124,7 @@ jobs:
       - uses: ./.github/actions/setup-kanon
       - name: Run integration tests
         shell: bash
-        run: python -m pytest -n auto --dist loadscope -m "integration"
+        run: make test-integration
 
   functional-tests-linux:
     name: Functional tests (Linux)
@@ -141,7 +138,7 @@ jobs:
       - uses: ./.github/actions/setup-kanon
       - name: Run functional tests
         shell: bash
-        run: SMOKE_TEST_TIMEOUT=300 python -m pytest -n auto --dist loadscope -m "functional"
+        run: make test-functional
 
   scenario-tests-linux:
     name: Scenario tests (Linux, docs/integration-testing.md)
@@ -276,22 +273,19 @@ jobs:
           asdf install
           asdf reshim
 
-      - name: Cache Python dependencies for release
-        uses: actions/cache@v5
+      - name: Install uv
+        # Same single resolution path as .github/actions/setup-kanon: deps come
+        # from uv.lock via `make install-dev` (`uv sync --locked`). Replaces the
+        # previous pip cache, which keyed on a requirements-dev.txt that no
+        # longer exists.
+        uses: astral-sh/setup-uv@v6
         with:
-          path: |
-            ~/.cache/pip
-            ~/.local/lib/python*/site-packages
-          key: ${{ runner.os }}-pip-release-${{ hashFiles('requirements-dev.txt', 'pyproject.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-release-
-            ${{ runner.os }}-pip-
+          enable-cache: true
+          cache-dependency-glob: uv.lock
 
       - name: Install dependencies
         shell: bash
-        run: |
-          pip install --upgrade pip
-          make install-dev
+        run: make install-dev
 
       - name: Compute next version
         id: semantic-release
@@ -299,7 +293,7 @@ jobs:
           GH_TOKEN: ${{ steps.generate_token.outputs.token }}
         shell: bash
         run: |
-          NEW_VERSION=$(python -m semantic_release version --print | sed 's/^v//')
+          NEW_VERSION=$(uv run python -m semantic_release version --print | sed 's/^v//')
           echo "New version: $NEW_VERSION"
           if [[ -z "$NEW_VERSION" ]]; then
             echo "No new version detected, using current version"
@@ -313,7 +307,7 @@ jobs:
           GH_TOKEN: ${{ steps.generate_token.outputs.token }}
         shell: bash
         run: |
-          python -m semantic_release version --no-push --no-vcs-release --no-commit
+          uv run python -m semantic_release version --no-push --no-vcs-release --no-commit
 
           NEW_VERSION=$(grep '^version = ' pyproject.toml | sed 's/.*version = "\([^"]*\)".*/\1/')
           echo "Updated version: $NEW_VERSION"
@@ -321,6 +315,13 @@ jobs:
           sed -i "s/__version__ = \"[^\"]*\"/__version__ = \"$NEW_VERSION\"/" src/kanon_cli/__init__.py
           echo "Updated __init__.py to version: $NEW_VERSION"
 
+          # uv.lock records the project's own version, so a bump leaves it stale.
+          # Every job installs with `uv sync --locked`, which refuses a stale lock,
+          # so the refresh has to land in the same commit as the version bump --
+          # otherwise the tag build fails in "Build and publish to PyPI".
+          uv lock
+          echo "Refreshed uv.lock to version: $NEW_VERSION"
+
           sed -i 's/[[:space:]]*$//' CHANGELOG.md pyproject.toml src/kanon_cli/__init__.py
 
           rm -rf dist/ build/ src/kanon_cli.egg-info/
@@ -346,7 +347,7 @@ jobs:
           echo "Git status before staging:"
           git status --porcelain
 
-          git add CHANGELOG.md pyproject.toml src/kanon_cli/__init__.py
+          git add CHANGELOG.md pyproject.toml src/kanon_cli/__init__.py uv.lock
 
           echo "Git status after staging:"
           STAGED=$(git status --porcelain)

{kanon_cli-3.3.0 → kanon_cli-3.3.2}/.github/workflows/pr-validation.yml

@@ -130,17 +130,14 @@ jobs:
         with:
           base-ref: ${{ github.base_ref }}
           head-sha: ${{ github.event.pull_request.head.sha }}
-      - name: Run unit tests with 90% coverage gate
+      - name: Run unit tests with coverage gate
         shell: bash
-        run: |
-          python -m pytest -n auto --dist loadscope -m "unit" --cov=kanon_cli --cov-report=term-missing
-          coverage json
-          coverage_percent=$(python -c "import json; f=open('coverage.json'); print(json.load(f)['totals']['percent_covered'])")
-          echo "Coverage: $coverage_percent%"
-          if (( $(echo "$coverage_percent < 90" | bc -l) )); then
-            echo "Error: Code coverage is below 90% threshold ($coverage_percent%)"
-            exit 1
-          fi
+        # Delegates to the Make target so the threshold lives in one place
+        # (Makefile: COVERAGE_MIN) instead of being duplicated across both
+        # workflow files, and so the run resolves from uv.lock like every other
+        # job. pytest-cov's own --cov-fail-under replaces the hand-rolled
+        # coverage-json + bc comparison.
+        run: make test-unit-cov
 
   integration-tests-linux:
     name: Integration tests (Linux)
@@ -157,7 +154,7 @@ jobs:
           head-sha: ${{ github.event.pull_request.head.sha }}
       - name: Run integration tests
         shell: bash
-        run: python -m pytest -n auto --dist loadscope -m "integration"
+        run: make test-integration
 
   functional-tests-linux:
     name: Functional tests (Linux)
@@ -174,7 +171,7 @@ jobs:
           head-sha: ${{ github.event.pull_request.head.sha }}
       - name: Run functional tests
         shell: bash
-        run: SMOKE_TEST_TIMEOUT=300 python -m pytest -n auto --dist loadscope -m "functional"
+        run: make test-functional
 
   scenario-tests-linux:
     name: Scenario tests (Linux, docs/integration-testing.md)

{kanon_cli-3.3.0 → kanon_cli-3.3.2}/.github/workflows/publish.yml

@@ -84,19 +84,18 @@ jobs:
         with:
           python-version: '3.14'
 
-      - name: Cache Python dependencies
-        uses: actions/cache@v5
+      - name: Install uv
+        # Same single resolution path as .github/actions/setup-kanon: deps come
+        # from uv.lock via `make install-dev` (`uv sync --locked`). Replaces the
+        # previous pip cache, which keyed on a requirements-dev.txt that no
+        # longer exists.
+        uses: astral-sh/setup-uv@v6
         with:
-          path: |
-            ~/.cache/pip
-            ~/.local/lib/python*/site-packages
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements-dev.txt', 'pyproject.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-
+          enable-cache: true
+          cache-dependency-glob: uv.lock
 
       - name: Install build dependencies
         run: |
-          pip install --upgrade pip
           make install-dev
           asdf reshim
         shell: bash

{kanon_cli-3.3.0 → kanon_cli-3.3.2}/.gitignore

@@ -31,3 +31,6 @@ tmp/
 
 # Deleted bundled catalog -- guard against accidental re-addition (E6-F2-S1-T1)
 src/kanon_cli/catalog/
+
+# Local settings files
+*.local.json

{kanon_cli-3.3.0 → kanon_cli-3.3.2}/.tool-versions

@@ -1,2 +1,3 @@
 jq 1.8.1
 pre-commit 4.3.0
+uv 0.12.1

{kanon_cli-3.3.0 → kanon_cli-3.3.2}/CHANGELOG.md

@@ -2,8 +2,220 @@
 
 
 
+## v3.3.2 (2026-08-05)
+
+### Fix
+
+* fix(ci): refresh uv.lock during the release version bump (#107)
+
+`Build and publish to PyPI` failed on the 3.3.1 tag:
+
+    uv sync --locked --all-groups
+    error: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided.
+
+uv.lock records the project's own version alongside its dependencies.
+semantic-release bumps `pyproject.toml` and `src/kanon_cli/__init__.py`
+via version_toml / version_variable, but knows nothing about uv.lock, and
+the release job staged only those two files plus CHANGELOG.md. Every
+release therefore left uv.lock one version behind: after 3.3.1,
+pyproject.toml said 3.3.1 and uv.lock still said 3.3.0.
+
+The drift is not new -- before #97, uv.lock said 2.1.0 against a
+pyproject at 3.3.0, six releases of silent skew. What is new is that
+`make install-dev` is now `uv sync --locked`, which refuses a stale lock
+instead of quietly re-resolving, so a latent inconsistency became a hard
+failure at tag-build time.
+
+The release job now runs `uv lock` immediately after the version bump and
+stages uv.lock with the other version files, so the release commit is
+self-consistent and the tag it points at can be installed. Verified that
+`uv lock` against the current tree changes exactly one line
+(kanon-cli 3.3.0 -> 3.3.1) with no dependency churn, so this does not turn
+a release into an unrelated dependency update.
+
+uv.lock is also corrected here so main is self-consistent again.
+
+Adds `test_uv_lock_records_the_declared_project_version`, which compares
+the kanon-cli entry in uv.lock against `[project] version`. Verified RED
+against the stale lock, failing with the same mismatch the publish job
+hit. It has to be run without `uv run` to fail, which is the reason this
+class of drift stays invisible in local development: `uv run` implicitly
+re-locks before executing, so a developer never sees the inconsistency
+that a `--locked` install in CI rejects.
+
+Note the existing 3.3.1 tag still points at a commit carrying the stale
+lock, so republishing that exact tag will keep failing until the tag is
+moved or a further release is cut. ([`00714e6`](https://github.com/caylent-solutions/kanon/commit/00714e648a42bea706945e7a38a66fa6dca8df28))
+
+
+## v3.3.1 (2026-08-04)
+
+### Chore
+
+* chore(release): 3.3.1 ([`71621d5`](https://github.com/caylent-solutions/kanon/commit/71621d50a72c412cae40b1886f6c73adc08e9fc0))
+
+* chore(git): ignore local settings files ([`61ceade`](https://github.com/caylent-solutions/kanon/commit/61ceade79f79a73b11316866572a71b3abce3052))
+
+* chore: add uv to toolchain via asdf
+
+Pin uv 0.12.1 in .tool-versions alongside the project's existing
+asdf-managed tools, and refresh uv.lock's kanon-cli editable entry
+to match the current pyproject.toml version. ([`300b979`](https://github.com/caylent-solutions/kanon/commit/300b979ae0dae98f200efd21be99fad0b5106658))
+
+### Fix
+
+* fix: let repo sync own <linkfile>, removing the duplicate copy pass (#105)
+
+* fix: skip linkfile copy when dest already resolves to src
+
+repo sync materializes every <linkfile> as a symlink before
+_process_manifest_linkfiles runs. For a file-level src the helper then
+called shutil.copy2 on the same inode pair, raising SameFileError and
+aborting the install with exit 1.
+
+Closes #93
+
+* fix: let repo sync own <linkfile>, removing the duplicate copy pass
+
+`_process_manifest_linkfiles` re-processed the same `<linkfile>` elements
+`repo sync` had just materialized. It read only the root manifest's direct
+`<project>` children (no `<include>` traversal) and skipped any non-file
+`src`, so in a real install it covered a strict subset of what sync had
+already done. Its three possible outcomes were: crash on the same inode
+(issue 93), write through a foreign symlink and clobber that link's target,
+or nothing. It had no branch that produced a correct result sync had not
+already produced.
+
+It existed to compensate for tests that replace `repo_sync` with a no-op,
+which its own docstring stated. The compensation belongs in the double, not
+in production, so it moves to `tests.conftest.materialize_linkfiles_for_sync`
+-- delegating to the production `_LinkFile` so the double cannot drift from
+what `repo` does. Mocked-sync tests now leave a symlink where a real sync
+leaves one, instead of a copy.
+
+Runtime behaviour is unchanged for every input except the crash: with
+`repo sync` succeeding, the deleted pass was already a no-op. No exported
+symbol is removed; `__all__` is byte-identical.
+
+Replaces the unit-level regression test, which imported the deleted
+function, with one that drives a real `repo init` + `repo sync` against
+local file:// fixtures. Verified RED against the pre-fix code: it reproduces
+`shutil.SameFileError` on the flagged/file-src case only, matching the scope
+table in issue 93.
+
+`test_only_flagged_source_registers_marketplace` asserted that an unflagged
+source cannot register a marketplace. Under a sync that behaves like the real
+one it registers anyway: `run_repo_sync` is unconditional, `_LinkFile._Link`
+knows nothing about kanon flags, `CLAUDE_MARKETPLACES_DIR` is exported to
+every source, and `install_marketplace_plugins` scans the directory once with
+no per-source attribution. The flag genuinely gates only
+`register_direct_checkout_marketplaces`, so the fixture now uses
+direct-checkout entries and the docstring records what the flag does not gate.
+
+Closes #93
+
+* ci: resolve every job from uv.lock, deleting the pip dependency path
+
+CI resolved dependencies two ways. The tiered test jobs ran bare
+`python -m pytest` against a `pip install -r requirements-dev.txt`
+environment, which resolves from PyPI at run time; `make test` and
+`make test-scenarios` ran under `uv run`, which honours uv.lock. The two
+manifests disagreed -- requirements-dev.txt pinned pytest ~=8.3.0 while
+[dependency-groups] dev asked for >=9.0.3, so the same suite ran on two
+different runners depending on the job.
+
+That split is what let a shtab release break CI. `shtab>=1.7.0` had no
+upper bound, shtab 1.9.0 (2026-07-31) changed its generated output, and
+the pip-based jobs installed 1.9.3 against completion golden fixtures
+generated with 1.8.0. The uv-based jobs stayed on uv.lock's 1.8.0 and
+passed. main has not run CI since 2026-07-17, before that release, so it
+is green in history and broken in fact; every PR branched from it fails
+the same two tests.
+
+Reproduced directly: a venv built from requirements-dev.txt resolves
+shtab 1.9.3 and pytest 8.3.5, and fails
+test_completion_stdout_matches_committed_golden[bash,zsh] with the same
+16098-vs-15657 byte mismatch CI reports. Installing shtab==1.8.0 into
+that same venv turns it green.
+
+9869ee7 pins shtab, which fixes the instance. This removes the cause:
+
+- [dependency-groups] dev absorbs ruff, bandit, twine, pre-commit and
+  python-semantic-release, the tools only requirements-dev.txt declared.
+  Existing pins carry over unchanged. ruff stays ~=0.11.0 for the same
+  reason shtab is pinned: `ruff format --check` is a byte-level gate.
+- requirements-dev.txt is deleted rather than kept in sync.
+- requirements.txt is deleted too. It declared packaging and nothing
+  else, one of three runtime dependencies, and `make install` was
+  referenced nowhere; pyproject's [project] dependencies supersedes it.
+- Every Makefile target invokes its tools through `uv run`. Previously
+  `make security-scan` was `uv run bandit` with bandit in no dependency
+  group, so uv fell through to PATH and silently ran a system-wide
+  bandit -- verified resolving to /usr/local/py-utils/bin/bandit.
+- The unit coverage gate moves into `make test-unit-cov` behind a
+  COVERAGE_MIN variable, replacing the coverage-json + bc comparison
+  duplicated across both workflow files with pytest-cov's own
+  --cov-fail-under.
+- setup-kanon installs uv before dependencies and runs
+  `uv sync --locked --all-groups`; --locked fails the job on a stale
+  lock instead of silently re-resolving. setup-uv's cache, keyed on
+  uv.lock, replaces the pip cache. The Windows leg no longer needs its
+  own branch because uv sync does not require GNU make.
+- The release and publish jobs move to the same path, and
+  `python -m semantic_release` becomes `uv run python -m semantic_release`.
+
+The CI-shape tests are updated rather than loosened. The tier assertions
+followed the existing `make test-scenarios` precedent and now check both
+halves of the contract: the workflow invokes the tier's Make target
+exactly once with no per-OS override, and that target selects the bare
+marker. Previously the marker was asserted but the delegation was not;
+now both are. test_ci_includes_repo_tests searches the Makefile as well,
+since --cov=kanon_cli moved there.
+
+Verified from a clean `uv sync --locked --all-groups`: ruff, bandit,
+twine, pre-commit and pytest all resolve inside .venv with no PATH
+fallthrough. All ten CI jobs pass locally with counts identical to the
+pre-change baseline -- full suite 17168 passed / 0 failed / 95%, unit
+11712 passed / 93.22%, integration 1947, functional 3089, scenario 413.
+
+---------
+
+Co-authored-by: Ryan Gross <ryan.gross@caylent.com> ([`23b320e`](https://github.com/caylent-solutions/kanon/commit/23b320e7818bf564cbc3b9dcb65acc3e7f4626ef))
+
+* fix: pin shtab to exact version to stop completion-fixture CI drift
+
+pyproject.toml declared shtab>=1.7.0 with no upper bound. CI installs
+dependencies via `pip install -r requirements-dev.txt` (-e .), resolving
+shtab independently of uv.lock's exact pin; PyPI's latest shtab (1.9.2)
+changed its generated output, breaking the byte-for-byte comparison
+against the committed completion golden fixtures in both the
+integration and functional test suites. Exact-pinning to 1.8.0 (already
+locked in uv.lock) makes both install paths deterministic. ([`9869ee7`](https://github.com/caylent-solutions/kanon/commit/9869ee7b720829c329ad3c1afdcf2057a14427aa))
+
+* fix(test): put safeguards in place for pre-commit failures in devcontainer environment on macos ([`1f38b25`](https://github.com/caylent-solutions/kanon/commit/1f38b25ea3205cac983c0952baed76c4a976b3ee))
+
+* fix(tests): patch to avoid ioctl environment issues when running tests in devcontainer under uv ([`4931c10`](https://github.com/caylent-solutions/kanon/commit/4931c101c4cec06e778958e62b1af68ee9ada022))
+
+### Unknown
+
+* Merge pull request #106 from caylent-solutions/release-3.3.1
+
+Release 3.3.1 ([`35f709f`](https://github.com/caylent-solutions/kanon/commit/35f709f1f5e0c26a2bcf6317e573ca56303e49bd))
+
+* Merge pull request #97 from caylent-solutions/chore/add-uv-tool-version
+
+chore: add uv toolchain support and fix progress-bar ioctl crash
+
+Includes the issue-93 linkfile fix and the CI dependency-resolution
+consolidation merged into this branch via #105. ([`bfab7a3`](https://github.com/caylent-solutions/kanon/commit/bfab7a319ade76111057696ee049b6d6ab5c41ab))
+
+
 ## v3.3.0 (2026-07-17)
 
+### Chore
+
+* chore(release): 3.3.0 ([`5100db5`](https://github.com/caylent-solutions/kanon/commit/5100db56a01818a5914474d7ddb95c96b7ab6de9))
+
 ### Feature
 
 * feat: kanon list command + usage telemetry, full install-graph capture, and update-warning enhancement (#91)
@@ -100,6 +312,12 @@ subprocess tests do not need coverage of the child; the 90% coverage gate is
 measured in-process on the unit tier, which uses its own runner and is
 unaffected. ([`57246f8`](https://github.com/caylent-solutions/kanon/commit/57246f8a8a46b99ad2b35a954289d7a9e7d1966c))
 
+### Unknown
+
+* Merge pull request #92 from caylent-solutions/release-3.3.0
+
+Release 3.3.0 ([`56f49b9`](https://github.com/caylent-solutions/kanon/commit/56f49b9c98b2dfd9b5fac5d847fcb6350a6fafe4))
+
 
 ## v3.2.0 (2026-07-13)
 

{kanon_cli-3.3.0 → kanon_cli-3.3.2}/CONTRIBUTING.md

@@ -15,6 +15,12 @@ Thank you for your interest in contributing to the Kanon CLI! This document prov
    make install-dev
    ```
 
+   This runs `uv sync --locked --all-groups`, so the toolchain comes from
+   `uv.lock` and matches CI exactly. [uv](https://docs.astral.sh/uv/) is a
+   prerequisite. Every `make` target invokes its tools through `uv run`; running
+   `ruff`, `pytest`, or `bandit` directly picks up whatever is on your `PATH`
+   instead of the locked version, which is how CI and local results drift apart.
+
 3. Set up git hooks to ensure code quality:
    ```bash
    make install-hooks

{kanon_cli-3.3.0 → kanon_cli-3.3.2}/Makefile

@@ -2,33 +2,37 @@ SHELL := /bin/bash
 .SHELLFLAGS := -euo pipefail -c
 .DEFAULT_GOAL := help
 
-.PHONY: help install install-dev lint lint-check lint-no-comments lint-markdown format format-check check test test-unit test-integration test-functional test-cov test-scenarios test-operator-path validate clean build distcheck publish pre-commit-check install-hooks coverage-json security-scan update-completion-snapshots
+.PHONY: help install install-dev lint lint-check lint-no-comments lint-markdown format format-check check test test-unit test-unit-cov test-integration test-functional test-cov test-scenarios test-operator-path validate clean build distcheck publish pre-commit-check install-hooks coverage-json security-scan update-completion-snapshots
+
+# Minimum total coverage enforced by `test-unit-cov`. Overridable so the
+# threshold is not hard-coded at its only call site.
+COVERAGE_MIN ?= 90
 
 help: ## Show available targets
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'
 
-install: ## Install runtime dependencies
-	pip install -r requirements.txt
+install: ## Install the project and its runtime dependencies from uv.lock
+	uv sync --locked --no-dev
 
-install-dev: ## Install development dependencies (editable + ruff + pytest)
-	pip install -r requirements-dev.txt
+install-dev: ## Install development dependencies from uv.lock (editable project + dev tool group)
+	uv sync --locked --all-groups
 
 lint: lint-check format-check ## Run all lint checks (ruff check + ruff format --check)
 
 lint-check: lint-no-comments ## Lint Python files (ruff check + no-comments gate)
-	ruff check .
+	uv run ruff check .
 
 lint-no-comments: ## Forbid '#' comments in all first-party kanon Python (allows line-1 shebang + PEP 263 encoding cookie)
-	python tools/lint/check_no_comments.py
+	uv run python tools/lint/check_no_comments.py
 
 lint-markdown: ## Lint kanon's own Markdown under docs/ and README.md (pymarkdownlnt, config in [tool.pymarkdown]: MD013 off, MD024 siblings_only; vendored docs/repo/ excluded)
 	uv run pymarkdownlnt scan -r -e 'docs/repo/*' docs/ README.md
 
 format: ## Auto-format Python files (ruff format)
-	ruff format .
+	uv run ruff format .
 
 format-check: ## Verify formatting without modifying files (ruff format --check)
-	ruff format --check .
+	uv run ruff format --check .
 
 check: lint ## Run all static analysis checks
 
@@ -40,6 +44,9 @@ test: ## Run full test suite with coverage
 test-unit: ## Run unit tests only
 	uv run pytest -n auto --dist loadscope -m "unit"
 
+test-unit-cov: ## Run unit tests with coverage and enforce the COVERAGE_MIN gate (CI's unit job)
+	uv run pytest -n auto --dist loadscope -m "unit" --cov=kanon_cli --cov-report=term-missing --cov-fail-under=$(COVERAGE_MIN)
+
 test-integration: ## Run integration tests only
 	uv run pytest -n auto --dist loadscope -m "integration"
 
@@ -67,11 +74,11 @@ clean: ## Remove build artifacts and caches
 	find . -depth -type f -name '*.pyc' -delete
 
 build: ## Build the package
-	python -m build
+	uv run python -m build
 
 distcheck: ## Check the built distribution
-	twine check dist/*
-	python scripts/check_archive_no_duplicates.py dist/
+	uv run twine check dist/*
+	uv run python scripts/check_archive_no_duplicates.py dist/
 
 publish: clean build distcheck ## Build package (publishing is automated via CI pipeline)
 
@@ -80,12 +87,12 @@ coverage-json: ## Generate JSON coverage report
 	@echo "Coverage report generated in coverage.json"
 
 pre-commit-check: ## Run all pre-commit hooks
-	pre-commit run --all-files
+	uv run pre-commit run --all-files
 
 install-hooks: ## Install git hooks for pre-commit and pre-push
 	@echo "Installing git hooks..."
 	@git config --unset-all core.hooksPath || true
-	@pre-commit install || echo "pre-commit not found, skipping pre-commit installation"
+	@uv run pre-commit install || echo "pre-commit not found, skipping pre-commit installation"
 	@git config core.hooksPath git-hooks
 	@chmod +x git-hooks/pre-commit git-hooks/pre-push
 	@echo "Git hooks installed successfully!"

{kanon_cli-3.3.0 → kanon_cli-3.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kanon-cli
-Version: 3.3.0
+Version: 3.3.2
 Summary: Kanon (Kanon Package Manager) CLI tool
 Project-URL: Homepage, https://github.com/caylent-solutions/kanon
 Project-URL: Issues, https://github.com/caylent-solutions/kanon/issues
@@ -17,7 +17,7 @@ Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.11
 Requires-Dist: defusedxml>=0.7.1
 Requires-Dist: packaging>=23.0
-Requires-Dist: shtab>=1.7.0
+Requires-Dist: shtab==1.8.0
 Description-Content-Type: text/markdown
 
 # Kanon (Kanon Package Manager)
@@ -1415,6 +1415,12 @@ git config --global --get-regexp url
 make install-dev
 ```
 
+Installs the project plus the dev toolchain from `uv.lock` via
+`uv sync --locked --all-groups`. `--locked` fails rather than silently
+re-resolving if the lock is stale, so local and CI environments cannot diverge.
+Run tooling through the `make` targets (or `uv run`) so it resolves from the
+lock instead of your `PATH`.
+
 ### Set Up Git Hooks
 
 ```bash