kibisis-native 0.1.0a12__tar.gz

kibisis_native-0.1.0a12/.github/dependabot.yml

@@ -0,0 +1,30 @@
+# Weekly, grouped version updates; a release is considered only once it is 7 days old.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns: ["*"]
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      cargo:
+        patterns: ["*"]
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      uv:
+        patterns: ["*"]

kibisis_native-0.1.0a12/.github/workflows/ci.yml

@@ -0,0 +1,119 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test-rust-stable:
+    name: Rust Stable (fmt, clippy, test)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, pinned 2026-10-25
+        with:
+          toolchain: 1.97.1
+          components: rustfmt, clippy
+
+      - name: Check formatting
+        run: |
+          cargo fmt --all -- --check
+          cargo fmt --manifest-path bindings/python/Cargo.toml -- --check
+
+      - name: Clippy linter
+        run: |
+          cargo clippy --all-targets -- -D warnings
+          cargo clippy --manifest-path bindings/python/Cargo.toml --all-targets -- -D warnings
+
+      - name: Run unit & doc tests
+        run: cargo test --verbose
+
+  test-rust-msrv:
+    name: Rust MSRV (1.89)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up MSRV toolchain
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, pinned 2026-10-25
+        with:
+          toolchain: "1.89.0"
+
+      - name: Cargo check on MSRV
+        run: cargo check --verbose
+
+  test-rust-miri:
+    name: Rust Miri (Undefined Behavior Check)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Nightly for Miri
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, pinned 2026-10-25
+        with:
+          toolchain: nightly
+          components: miri
+
+      - name: Run Miri test on lease coordination
+        run: cargo miri test --lib -- tests::test_lease_coordination
+        continue-on-error: true
+
+  test-python:
+    name: Python ${{ matrix.python-version }} (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-15]
+        python-version: ["3.11", "3.12", "3.13"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install pydantic cryptography sqlcipher3 pytest hatchling build maturin
+
+      # K-C: the lease coordinator and the format-3 journal hashes are the crate's; the Python package
+      # requires the kibisis_native extension (no fallback), so it is built and installed first.
+      - name: Build and install the kibisis_native extension
+        run: |
+          (cd bindings/python && maturin build --release --locked --out "$RUNNER_TEMP/native-wheel")
+          pip install "$RUNNER_TEMP"/native-wheel/*.whl
+          python -c "import kibisis_native as n; print('kibisis_native', n.crate_version())"
+
+      # Installs the built wheel the way a user would: dependencies resolved from PyPI, no --no-deps.
+      # The native wheel is not on PyPI yet, so it is offered from the local directory with --find-links.
+      - name: Install the wheel with its dependencies in a clean venv
+        shell: bash
+        run: |
+          python -m build --wheel
+          python -m venv "$RUNNER_TEMP/smoke"
+          PY="$RUNNER_TEMP/smoke/bin/python"
+          "$PY" -m pip install --upgrade pip
+          "$PY" -m pip install --find-links "$RUNNER_TEMP/native-wheel" dist/*.whl
+          "$PY" -c "import platform, sqlcipher3, kibisis; print(platform.system(), platform.machine(), 'kibisis', kibisis.__version__, 'with', sqlcipher3.__name__)"
+
+      - name: Run pytest
+        run: |
+          pytest tests -v

kibisis_native-0.1.0a12/.github/workflows/release.yml

@@ -0,0 +1,311 @@
+name: Release
+
+# A tag builds the kibisis_native extension wheels (manylinux x86_64, macOS universal2, plus an sdist),
+# builds and tests the crate and the Python package, attests them, checks that the wheel installs with
+# its dependencies (kibisis_native resolved from the same release files) on Ubuntu and macOS arm64, and
+# creates a GitHub release that names the commit. Publishing to PyPI and crates.io runs in the protected `pypi` and `crates-io`
+# environments, so nothing is published until a required reviewer approves the deployment.
+# Pull requests run the same build and install jobs; attestation, release and publishing are tag-only.
+
+on:
+  push:
+    tags:
+      - "v*"
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  native:
+    name: kibisis_native wheel (${{ matrix.name }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { name: manylinux-x86_64, os: ubuntu-latest, target: x86_64, manylinux: auto, sdist: true }
+          - { name: macos-universal2, os: macos-15, target: universal2-apple-darwin, manylinux: "", sdist: false }
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      # The sdist goes first: the manylinux wheel builds inside a container that leaves native-dist root-owned.
+      - name: Build the extension sdist
+        if: matrix.sdist
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          working-directory: bindings/python
+          command: sdist
+          args: --out ../../native-dist
+
+      # abi3-py311: one wheel per platform covers every CPython >= 3.11.
+      - name: Build the extension wheel
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          working-directory: bindings/python
+          target: ${{ matrix.target }}
+          manylinux: ${{ matrix.manylinux }}
+          args: --release --locked --out ../../native-dist
+          sccache: "false"
+
+      - name: Upload the extension distributions
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: native-${{ matrix.name }}
+          path: native-dist/
+          if-no-files-found: error
+
+  build:
+    name: Build, test and attest
+    needs: native
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, pinned 2026-10-25
+        with:
+          toolchain: 1.97.1
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Check the tag matches every version string
+        shell: python
+        run: |
+          import os, pathlib, re, tomllib
+          ref = os.environ["GITHUB_REF"]
+          tag = os.environ["GITHUB_REF_NAME"] if ref.startswith("refs/tags/") else None
+          cargo = tomllib.loads(pathlib.Path("Cargo.toml").read_text())["package"]["version"]
+          python = tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"]
+          native_cargo = tomllib.loads(pathlib.Path("bindings/python/Cargo.toml").read_text())["package"]["version"]
+          native_python = tomllib.loads(pathlib.Path("bindings/python/pyproject.toml").read_text())["project"]["version"]
+          pep440 = re.sub(r"-(alpha|beta|rc)\.", lambda m: {"alpha": "a", "beta": "b", "rc": "rc"}[m.group(1)], cargo)
+          problems = []
+          if tag is not None and tag != f"v{cargo}":
+              problems.append(f"tag {tag} != Cargo.toml v{cargo}")
+          if python != pep440:
+              problems.append(f"pyproject.toml {python} != {pep440}")
+          if native_cargo != cargo:
+              problems.append(f"bindings/python/Cargo.toml {native_cargo} != {cargo}")
+          if native_python != pep440:
+              problems.append(f"bindings/python/pyproject.toml {native_python} != {pep440}")
+          deps = tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["dependencies"]
+          if f"kibisis-native=={pep440}" not in deps:
+              problems.append(f"pyproject.toml dependencies lack kibisis-native=={pep440}: {deps}")
+          for init in pathlib.Path("src").glob("*/__init__.py"):
+              found = re.search(r'^__version__ = "([^"]+)"', init.read_text(), re.M)
+              if found and found.group(1) != python:
+                  problems.append(f"{init} __version__ {found.group(1)} != {python}")
+          if problems:
+              raise SystemExit("; ".join(problems))
+          print(f"{tag or ref}: crate {cargo}, Python {python}, commit {os.environ['GITHUB_SHA']}")
+
+      - name: Run Rust tests
+        run: cargo test --release
+
+      - name: Package crate
+        run: cargo package
+
+      # The tests run against a wheel built here with --locked (same source as the published ones); the
+      # published extension wheels come from the `native` job above.
+      - name: Build and install the kibisis_native extension for the tests
+        run: |
+          python -m pip install --upgrade pip maturin
+          (cd bindings/python && maturin build --release --locked --out "$RUNNER_TEMP/native-wheel")
+          python -m pip install "$RUNNER_TEMP"/native-wheel/*.whl
+          python -c "import kibisis_native as n; print('kibisis_native', n.crate_version())"
+
+      - name: Run Python tests
+        run: |
+          python -m pip install build pytest .
+          python -m pytest tests -q
+
+      - name: Build sdist and wheel
+        run: python -m build
+
+      - name: Download the extension distributions
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: native-*
+          path: native-dist
+          merge-multiple: true
+
+      - name: Collect release files and checksums
+        run: |
+          mkdir release
+          cp dist/*.whl dist/*.tar.gz native-dist/*.whl native-dist/*.tar.gz target/package/*.crate release/
+          ls release
+          cd release && sha256sum * > SHA256SUMS && cat SHA256SUMS
+
+      - name: Attest build provenance
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: |
+            release/*.whl
+            release/*.tar.gz
+            release/*.crate
+
+      - name: Upload release files
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-files
+          path: release/
+          if-no-files-found: error
+
+  install-check:
+    name: Install the wheel (${{ matrix.os }})
+    needs: build
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-15]
+    steps:
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Download release files
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: release-files
+          path: release
+
+      # No --no-deps: dependencies resolve from PyPI exactly as `pip install kibisis` would; kibisis_native,
+      # not yet on PyPI at this point of the run, resolves from the release files for this platform.
+      - name: Install the wheel and open an encrypted vault
+        shell: bash
+        run: |
+          python -m venv "$RUNNER_TEMP/venv"
+          PY="$RUNNER_TEMP/venv/bin/python"
+          "$PY" -m pip install --upgrade pip
+          "$PY" -m pip install --find-links release release/kibisis-*.whl
+          "$PY" - <<'EOF'
+          import pathlib, platform, tempfile
+          import sqlcipher3
+          import kibisis, kibisis_native
+          from kibisis import FileLeaseCoordinator, SQLiteMemoryVault
+          with tempfile.TemporaryDirectory() as tmp:
+              vault = SQLiteMemoryVault(pathlib.Path(tmp) / "smoke.db", passphrase="release install smoke test")
+              vault.put("smoke", "check", "installed from the release wheel")
+              assert vault.get("smoke", "check").content == "installed from the release wheel"
+              vault.close()
+              lease = FileLeaseCoordinator(pathlib.Path(tmp) / "leases").acquire("smoke", "holder-a", ttl_seconds=5)
+              assert lease.fencing_token == 1, lease
+          print(platform.system(), platform.machine(), "kibisis", kibisis.__version__, "kibisis_native",
+                kibisis_native.crate_version(), "with", sqlcipher3.__name__)
+          EOF
+
+  github-release:
+    name: GitHub release
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [build, install-check]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download release files
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: release-files
+          path: release
+
+      - name: Create the release, naming its commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          {
+            echo "Built and tested by CI from commit ${GITHUB_SHA}."
+            echo
+            echo "Build provenance: https://github.com/${GITHUB_REPOSITORY}/attestations"
+            echo
+            echo '```'
+            cat release/SHA256SUMS
+            echo '```'
+          } > notes.md
+          gh release create "$GITHUB_REF_NAME" release/* --repo "$GITHUB_REPOSITORY" \
+            --title "$GITHUB_REF_NAME" --notes-file notes.md --verify-tag --prerelease
+
+  publish-pypi:
+    name: Publish to PyPI
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: github-release
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/kibisis/
+    permissions:
+      id-token: write
+    steps:
+      - name: Download release files
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: release-files
+          path: release
+
+      - name: Keep only the Python distributions, one project per directory
+        run: |
+          mkdir dist-native dist
+          cp release/kibisis_native-*.whl release/kibisis_native-*.tar.gz dist-native/
+          cp release/kibisis-*.whl release/kibisis-*.tar.gz dist/
+          ls dist-native dist
+
+      # Trusted publishing: no stored token. PyPI records the repository, workflow and commit. Both projects
+      # (kibisis-native, kibisis) carry this workflow + environment as their trusted publisher; the extension
+      # publishes first so `pip install kibisis==<version>` resolves the moment the second upload lands.
+      - name: Publish kibisis-native
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          packages-dir: dist-native
+
+      - name: Publish kibisis
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          packages-dir: dist
+
+  publish-crates:
+    name: Publish to crates.io
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: github-release
+    runs-on: ubuntu-latest
+    environment:
+      name: crates-io
+      url: https://crates.io/crates/kibisis
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, pinned 2026-10-25
+        with:
+          toolchain: 1.97.1
+
+      # Trusted publishing: exchanges this job's OIDC token for a short-lived crates.io token.
+      - name: Authenticate to crates.io
+        id: auth
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+
+      - name: Publish
+        run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

kibisis_native-0.1.0a12/.github/workflows/scorecard.yml

@@ -0,0 +1,36 @@
+# OpenSSF Scorecard. Results go to code scanning only: publish_results stays false until main is protected by a ruleset.
+name: Scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "27 4 * * 1"
+  push:
+    branches: [main]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # upload the SARIF to code scanning
+      id-token: write # needed once publish_results is true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: false
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: scorecard-sarif
+          path: results.sarif
+          retention-days: 5
+      - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        with:
+          sarif_file: results.sarif

kibisis_native-0.1.0a12/.gitignore

@@ -0,0 +1,12 @@
+/target
+__pycache__/
+*.py[cod]
+*.class
+*.so
+.pytest_cache/
+dist/
+build/
+*.egg-info/
+.venv/
+env/
+bindings/python/target/