lib-cli-exit-tools 2.4.0__tar.gz → 2.4.1__tar.gz

{lib_cli_exit_tools-2.4.0 → lib_cli_exit_tools-2.4.1}/.github/workflows/default_cicd_public.yml

@@ -124,9 +124,36 @@ jobs:
               print("No CI system dependencies configured for macOS.")
 
       - name: Install dev deps
-        shell: bash
+        shell: python
         run: |
-          uv pip install -e .[dev] --system
+          import os, subprocess, tempfile
+          from pathlib import Path
+          try:
+              import tomllib
+          except ModuleNotFoundError:
+              import pip._vendor.tomli as tomllib
+
+          # Push and pull_request runs install exactly the tree uv.lock pins - versions
+          # plus file hashes, which uv verifies - so CI tests what the lock ships and no
+          # release published upstream since the last lock refresh can enter the build.
+          # The nightly schedule run resolves afresh instead (still inside the project's
+          # [tool.uv] exclude-newer cooldown, which uv honours here): it is the canary
+          # that reports upstream breakage before a lock refresh adopts it. A project
+          # without a uv.lock keeps the unlocked install.
+          with open("pyproject.toml", "rb") as f:
+              data = tomllib.load(f)
+          # Asking uv for an extra the project does not declare is a hard error.
+          extra = ["--extra", "dev"] if "dev" in data.get("project", {}).get("optional-dependencies", {}) else []
+          target = ["--system"]  # setup-python's interpreter; the job runs no venv
+          locked = Path("uv.lock").is_file() and os.environ["GITHUB_EVENT_NAME"] != "schedule"
+          if locked:
+              req = Path(tempfile.mkdtemp()) / "locked-requirements.txt"
+              # --locked fails when pyproject.toml changed without a lock refresh.
+              subprocess.check_call(["uv", "export", "--locked", "--no-emit-project", *extra, "-o", str(req), "--quiet"])
+              subprocess.check_call(["uv", "pip", "install", *target, "-r", str(req)])
+              subprocess.check_call(["uv", "pip", "install", *target, "--no-deps", "-e", "."])
+          else:
+              subprocess.check_call(["uv", "pip", "install", *target, "-e", ".[dev]" if extra else "."])
 
       - name: Install CI system dependencies (Windows/choco)
         if: runner.os == 'Windows'
@@ -236,7 +263,7 @@ jobs:
         continue-on-error: true
         shell: python
         run: |
-          import subprocess, sys, tempfile
+          import os, subprocess, sys, tempfile
           import rtoml
           from pathlib import Path
 
@@ -263,9 +290,18 @@ jobs:
 
           tmp = Path(tempfile.mkdtemp())
           req = tmp / "compiled-requirements.txt"
-          subprocess.check_call(
-              ["uv", "pip", "compile", *selector, "pyproject.toml", "-o", str(req), "--quiet"]
-          )
+          # With a uv.lock the install step put exactly the locked tree on the
+          # runner, so audit that tree; the schedule canary and lock-less
+          # projects resolve pyproject.toml afresh, as their install did.
+          if Path("uv.lock").is_file() and os.environ["GITHUB_EVENT_NAME"] != "schedule":
+              subprocess.check_call(
+                  ["uv", "export", "--locked", "--no-emit-project", "--no-hashes", *selector,
+                   "-o", str(req), "--quiet"]
+              )
+          else:
+              subprocess.check_call(
+                  ["uv", "pip", "compile", *selector, "pyproject.toml", "-o", str(req), "--quiet"]
+              )
 
           # Drop direct URL references ("pkg @ git+https://...") before auditing.
           # pip-audit cannot audit those (they are not on PyPI) but, given a

{lib_cli_exit_tools-2.4.0 → lib_cli_exit_tools-2.4.1}/.gitignore

@@ -181,7 +181,6 @@ result
 # Optional lockfiles (for alternative managers)
 poetry.lock
 pdm.lock
-uv.lock
 /.github_bak/
 prompts.md
 CLAUDE.md

{lib_cli_exit_tools-2.4.0 → lib_cli_exit_tools-2.4.1}/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project are documented here. The format follows [Kee
 
 ## [Unreleased]
 
+## [2.4.1] 2026-10-12 22:22:57
+
+### Added
+- Python 3.15 is a supported version: declared in the classifiers, so CI and `make test-all` run it.
+- `uv.lock` is committed, and `[tool.uv] exclude-newer` sets a cooldown that keeps releases younger
+  than it out of the lock. CI installs exactly the locked tree on push and pull request; the nightly
+  scheduled run still resolves afresh to catch upstream breakage early.
+
+### Changed
+- The install section explains why installing with uv protects against supply-chain attacks and why
+  a plain `pip install` from PyPI does not.
+- `rtoml` floor raised to 0.14.0 (dev extra), the first release with Python 3.15 wheels.
+
 ## [2.4.0] 2026-10-05 20:48:53
 
 ### Fixed

{lib_cli_exit_tools-2.4.0 → lib_cli_exit_tools-2.4.1}/Makefile

@@ -1,4 +1,4 @@
-# BMK MAKEFILE 3.18.0
+# BMK MAKEFILE 3.21.0
 # do not alter this file - it might be overwritten on new versions of BMK
 # if You want to alter it, remove the first line # BMK MAKEFILE 1.0 - then it is a custom makefile and will not be overwritten
 # bmk Makefile - thin wrapper using `uv tool upgrade` for persistent bmk
@@ -186,7 +186,7 @@ endif
 # BMK_MIN floors the FALLBACK install. The upgrade path does not consult it: uv re-resolves
 # the requirement recorded at install time, which is itself a `bmk>=...`, so it always lands
 # on the newest release and clears the floor anyway.
-BMK_MIN := 3.18.0
+BMK_MIN := 3.21.0
 
 # Absent env, missing check, or damaged env - all three mean "do not upgrade, rebuild".
 # `test -x` keeps a fresh machine quiet: there is no interpreter to run yet.

{lib_cli_exit_tools-2.4.0 → lib_cli_exit_tools-2.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lib_cli_exit_tools
-Version: 2.4.0
+Version: 2.4.1
 Summary: CLI exit handling helpers: clean signals, exit codes, and error printing
 Project-URL: Homepage, https://github.com/bitranox/lib_cli_exit_tools
 Project-URL: Repository, https://github.com/bitranox/lib_cli_exit_tools.git
@@ -19,6 +19,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Requires-Dist: rich-click>=1.9.9
@@ -27,15 +28,15 @@ Requires-Dist: bandit>=1.9.4; extra == 'dev'
 Requires-Dist: build>=1.6.1; extra == 'dev'
 Requires-Dist: click>=8.5.0; extra == 'dev'
 Requires-Dist: coverage[toml]>=7.16.2; extra == 'dev'
-Requires-Dist: hypothesis>=6.168.4; extra == 'dev'
+Requires-Dist: hypothesis>=6.168.5; extra == 'dev'
 Requires-Dist: import-linter>=2.15; extra == 'dev'
 Requires-Dist: pip-audit>=2.10.1; extra == 'dev'
 Requires-Dist: pyright[nodejs]>=1.1.414; extra == 'dev'
 Requires-Dist: pytest-asyncio>=1.4.0; extra == 'dev'
 Requires-Dist: pytest-cov>=7.1.0; extra == 'dev'
 Requires-Dist: pytest>=9.1.1; extra == 'dev'
-Requires-Dist: rtoml>=0.13.0; extra == 'dev'
-Requires-Dist: ruff>=0.16.10; extra == 'dev'
+Requires-Dist: rtoml>=0.14.0; extra == 'dev'
+Requires-Dist: ruff>=0.17.0; extra == 'dev'
 Requires-Dist: textual>=8.2.8; extra == 'dev'
 Requires-Dist: twine>=7.0.0; extra == 'dev'
 Description-Content-Type: text/markdown
@@ -83,6 +84,36 @@ pip install lib_cli_exit_tools
 
 See [INSTALL.md](INSTALL.md) for editable installs, pipx/uv usage, and troubleshooting tips.
 
+### Why we recommend uv: supply-chain protection
+
+This repository commits a `uv.lock`. It pins every package the project needs, transitive
+dependencies included, to an exact version and to the hashes of that version's files. The
+`exclude-newer` setting under `[tool.uv]` in `pyproject.toml` adds a cooldown: uv leaves any
+release younger than that out of the lock. CI installs from the lock, so a hijacked release that
+gets pulled again within the cooldown never reaches our builds, and a file whose hash does not
+match is refused.
+
+That protection stays in this repository. The installable package declares only lower bounds
+(`>=`) for its dependencies, so a plain `pip install` takes the newest release of every transitive
+dependency at the moment you run it. If one of them was hijacked an hour earlier, you get the
+hijacked version. `pipx install` and `uv tool install` without options do the same.
+
+To install the command line tool with a cooldown of your own (uv then skips any release younger
+than 7 days, transitive ones included), or to run the exact tree our CI tests:
+
+```bash
+uv tool install --exclude-newer "7 days" lib_cli_exit_tools
+git clone https://github.com/bitranox/lib_cli_exit_tools.git && cd lib_cli_exit_tools && uv sync --locked && uv run lib_cli_exit_tools --help
+```
+
+If you depend on lib_cli_exit_tools in your own project, give that project the same cooldown (7 days here, as
+an example) and commit the `uv.lock` that `uv add lib_cli_exit_tools` writes:
+
+```toml
+[tool.uv]
+exclude-newer = "7 days"
+```
+
 ## Usage
 
 Console script (all commands map to ``lib_cli_exit_tools.cli:main``):

{lib_cli_exit_tools-2.4.0 → lib_cli_exit_tools-2.4.1}/README.md

@@ -41,6 +41,36 @@ pip install lib_cli_exit_tools
 
 See [INSTALL.md](INSTALL.md) for editable installs, pipx/uv usage, and troubleshooting tips.
 
+### Why we recommend uv: supply-chain protection
+
+This repository commits a `uv.lock`. It pins every package the project needs, transitive
+dependencies included, to an exact version and to the hashes of that version's files. The
+`exclude-newer` setting under `[tool.uv]` in `pyproject.toml` adds a cooldown: uv leaves any
+release younger than that out of the lock. CI installs from the lock, so a hijacked release that
+gets pulled again within the cooldown never reaches our builds, and a file whose hash does not
+match is refused.
+
+That protection stays in this repository. The installable package declares only lower bounds
+(`>=`) for its dependencies, so a plain `pip install` takes the newest release of every transitive
+dependency at the moment you run it. If one of them was hijacked an hour earlier, you get the
+hijacked version. `pipx install` and `uv tool install` without options do the same.
+
+To install the command line tool with a cooldown of your own (uv then skips any release younger
+than 7 days, transitive ones included), or to run the exact tree our CI tests:
+
+```bash
+uv tool install --exclude-newer "7 days" lib_cli_exit_tools
+git clone https://github.com/bitranox/lib_cli_exit_tools.git && cd lib_cli_exit_tools && uv sync --locked && uv run lib_cli_exit_tools --help
+```
+
+If you depend on lib_cli_exit_tools in your own project, give that project the same cooldown (7 days here, as
+an example) and commit the `uv.lock` that `uv add lib_cli_exit_tools` writes:
+
+```toml
+[tool.uv]
+exclude-newer = "7 days"
+```
+
 ## Usage
 
 Console script (all commands map to ``lib_cli_exit_tools.cli:main``):

{lib_cli_exit_tools-2.4.0 → lib_cli_exit_tools-2.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lib_cli_exit_tools"
-version = "2.4.0"
+version = "2.4.1"
 description = "CLI exit handling helpers: clean signals, exit codes, and error printing"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -20,6 +20,7 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
   "Programming Language :: Python :: 3.14",
+  "Programming Language :: Python :: 3.15",
 ]
 
 # System packages required for CI runners (read by GitHub Actions workflow template)
@@ -38,8 +39,6 @@ Issues = "https://github.com/bitranox/lib_cli_exit_tools/issues"
 
 [project.optional-dependencies]
 dev = [
-  # 1.5.1 was yanked upstream (unintended breaking changes), so 1.5.0 is the newest usable
-  # release; a >=1.5.1 floor has ZERO candidates and makes this extra unresolvable.
   "build>=1.6.1",
   # codecov-cli is disabled, not dropped: it requires click<8.3.0, which drags click back to
   # 8.2.1 - the version with CVE-2026-7246 (command injection in click.edit(), fixed in 8.3.3).
@@ -51,7 +50,7 @@ dev = [
   # Transitive CVE pins
   "click>=8.5.0",                # CVE-2026-7246
   "coverage[toml]>=7.16.2",
-  "hypothesis>=6.168.4",
+  "hypothesis>=6.168.5",
   "import-linter>=2.15",
   "bandit>=1.9.4",
   "pip-audit>=2.10.1",
@@ -59,9 +58,9 @@ dev = [
   "pytest>=9.1.1",
   "pytest-asyncio>=1.4.0",
   "pytest-cov>=7.1.0",
-  "ruff>=0.16.10",
+  "ruff>=0.17.0",
   "textual>=8.2.8",
-  "rtoml>=0.13.0",
+  "rtoml>=0.14.0",
   "twine>=7.0.0"
 ]
 
@@ -244,3 +243,7 @@ ignore-vulns = [
   "GHSA-mj87-hwqh-73pj",          # alias of CVE-2026-40347
   "GHSA-pjjw-68hj-v9mw",          # uv <0.11.6 wheel RECORD path traversal on uninstall, dev tooling
 ]
+
+[tool.uv]
+exclude-newer = "1 day"
+exclude-newer-package = {rtoml = "2026-10-12T00:17:16Z"}

{lib_cli_exit_tools-2.4.0 → lib_cli_exit_tools-2.4.1}/src/lib_cli_exit_tools/__init__conf__.py

@@ -26,7 +26,7 @@ name = "lib_cli_exit_tools"
 #: Human-readable summary shown in CLI help output.
 title = "CLI exit handling helpers: clean signals, exit codes, and error printing"
 #: Current release version pulled from ``pyproject.toml`` by automation.
-version = "2.4.0"
+version = "2.4.1"
 #: Repository homepage presented to users.
 homepage = "https://github.com/bitranox/lib_cli_exit_tools"
 #: Author attribution surfaced in CLI output.