lib-detect-testenv 3.0.2__tar.gz → 3.0.4__tar.gz

{lib_detect_testenv-3.0.2 → lib_detect_testenv-3.0.4}/.github/actions/extract-metadata/action.yml

@@ -29,6 +29,11 @@ outputs:
   BANDIT_SKIP_FLAG:
     description: Bandit skip flag string (e.g. "-s B101,B601") or empty
     value: ${{ steps.meta.outputs.BANDIT_SKIP_FLAG }}
+  PYTEST_MARKER_EXPR:
+    description: >-
+      Marker expression for the CI test run (e.g. "not local_only and not integration"),
+      built from tool.ci.pytest-exclude-markers
+    value: ${{ steps.meta.outputs.PYTEST_MARKER_EXPR }}
 
 runs:
   using: composite
@@ -69,6 +74,15 @@ runs:
         bandit_skips = data.get('tool', {}).get('bandit', {}).get('skips', [])
         bandit_skip_flag = f"-s {','.join(bandit_skips)}" if bandit_skips else ""
 
+        # --- [tool.ci] section ---
+        # CI always skips local_only (those tests need a dev box). A project whose
+        # suite also carries markers CI cannot satisfy - integration tests needing a
+        # container that a separate workflow starts - names them here, rather than
+        # every such repo forking this workflow to edit one -m expression.
+        ci_config = data.get('tool', {}).get('ci', {})
+        exclude_markers = ['local_only', *ci_config.get('pytest-exclude-markers', [])]
+        pytest_marker_expr = ' and '.join(f'not {m}' for m in exclude_markers)
+
         # Write to GITHUB_OUTPUT for composite action outputs
         with open(os.environ['GITHUB_OUTPUT'], 'a', encoding='utf-8') as out:
             out.write(f"PROJECT_NAME={project}\n")
@@ -79,6 +93,7 @@ runs:
             out.write(f"COV_REPORT_FILE={cov_report_file}\n")
             out.write(f"COV_FAIL_UNDER={cov_fail_under}\n")
             out.write(f"BANDIT_SKIP_FLAG={bandit_skip_flag}\n")
+            out.write(f"PYTEST_MARKER_EXPR={pytest_marker_expr}\n")
 
         # Also write to GITHUB_ENV so subsequent steps can use ${{ env.VAR }}
         with open(os.environ['GITHUB_ENV'], 'a', encoding='utf-8') as env:
@@ -90,3 +105,4 @@ runs:
             env.write(f"COV_REPORT_FILE={cov_report_file}\n")
             env.write(f"COV_FAIL_UNDER={cov_fail_under}\n")
             env.write(f"BANDIT_SKIP_FLAG={bandit_skip_flag}\n")
+            env.write(f"PYTEST_MARKER_EXPR={pytest_marker_expr}\n")

{lib_detect_testenv-3.0.2 → lib_detect_testenv-3.0.4}/.github/workflows/codeql.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

{lib_detect_testenv-3.0.2 → lib_detect_testenv-3.0.4}/.github/workflows/default_cicd_public.yml

@@ -18,8 +18,8 @@ jobs:
       python-latest: ${{ steps.metadata.outputs.python-latest }}
       os-matrix: ${{ steps.metadata.outputs.os-matrix }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.x"
       - name: Parse pyproject.toml for Python versions and OS matrix
@@ -66,8 +66,8 @@ jobs:
       UV_LINK_MODE: "copy"
       UV_BREAK_SYSTEM_PACKAGES: "1"
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python }}
       - name: Install uv
@@ -169,7 +169,7 @@ jobs:
       - name: Restore ruff cache
         if: runner.environment == 'github-hosted'
         id: ruff-cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: .ruff_cache
           key: ruff-${{ runner.os }}-py${{ matrix.python }}-${{ github.sha }}
@@ -201,7 +201,7 @@ jobs:
           # and stale journal files cause "database is locked" errors.
           COVERAGE_FILE: "${{ runner.temp }}/.coverage"
         run: >-
-          pytest -m "not local_only"
+          pytest -m "${{ env.PYTEST_MARKER_EXPR }}"
           --cov=${{ env.SRC_PATH }}/${{ env.PACKAGE_MODULE }}
           --cov-report=term-missing
           --cov-report=xml:${{ env.COV_REPORT_FILE }}
@@ -236,12 +236,62 @@ jobs:
         continue-on-error: true
         shell: python
         run: |
-          import subprocess, sys
+          import subprocess, sys, tempfile
           import rtoml
           from pathlib import Path
+
+          # Audit the project's OWN resolved dependency tree, not the ambient
+          # environment. "Install dev deps" uses --system, so the interpreter
+          # being audited is the runner image's, and that image ships packages
+          # this project neither declares nor distributes (setuptools, pip,
+          # wheel). Auditing those reported CVEs no consumer of this project is
+          # exposed to, and a scan that is permanently yellow is a scan everyone
+          # learns to ignore. Resolving pyproject.toml here keeps the result
+          # identical on every OS/python and dependent only on what we declare.
           data = rtoml.load(Path("pyproject.toml"))
+
+          # Not every project declares dev dependencies, and those that do may use
+          # either an extra or a PEP 735 group. Asking uv for one that does not
+          # exist is a hard error ("Requested extra not found"), which would leave
+          # the audit permanently broken here rather than merely noisy, so select
+          # the flag from what this project actually declares.
+          selector = []
+          if "dev" in data.get("project", {}).get("optional-dependencies", {}):
+              selector = ["--extra", "dev"]
+          elif "dev" in data.get("dependency-groups", {}):
+              selector = ["--group", "dev"]
+
+          tmp = Path(tempfile.mkdtemp())
+          req = tmp / "compiled-requirements.txt"
+          subprocess.check_call(
+              ["uv", "pip", "compile", *selector, "pyproject.toml", "-o", str(req), "--quiet"]
+          )
+
+          # Drop direct URL references ("pkg @ git+https://...") before auditing.
+          # pip-audit cannot audit those (they are not on PyPI) but, given a
+          # requirements file, first tries to `git clone` each one to resolve a
+          # version - a slow, credential-dependent fetch. No public project here
+          # uses one today, yet "allow-direct-references" is enabled, so this
+          # guards the day one appears and keeps this step identical to the
+          # default_cicd_private template's.
+          audit_req = tmp / "audit-requirements.txt"
+          kept, dropped = [], []
+          for line in req.read_text(encoding="utf-8").splitlines():
+              if " @ " in line and not line.lstrip().startswith("#"):
+                  dropped.append(line.split(" @ ", 1)[0].strip())
+              else:
+                  kept.append(line)
+          audit_req.write_text("\n".join(kept) + "\n", encoding="utf-8")
+          if dropped:
+              # Never drop coverage silently: name what is not being audited here.
+              print(f"::notice::pip-audit: not auditing {len(dropped)} direct-URL dependency/ies "
+                    f"(audited in their own repo): {', '.join(sorted(dropped))}")
+
+          req = audit_req
           vulns = data.get("tool", {}).get("pip-audit", {}).get("ignore-vulns", [])
-          cmd = ["pip-audit", "--skip-editable"]
+          # --no-deps: the compiled file is already a complete pinned resolution,
+          # so pip-audit must audit it verbatim rather than re-resolving it.
+          cmd = ["pip-audit", "--no-deps", "-r", str(req)]
           for v in vulns:
               cmd.extend(["--ignore-vuln", v])
           sys.exit(subprocess.call(cmd))
@@ -293,7 +343,7 @@ jobs:
 
       - name: Save ruff cache
         if: always() && runner.environment == 'github-hosted' && steps.ruff-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         with:
           path: .ruff_cache
           key: ruff-${{ runner.os }}-py${{ matrix.python }}-${{ github.sha }}
@@ -302,8 +352,8 @@ jobs:
     name: pipx/uv verification (ubuntu)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.14"
 
@@ -341,8 +391,8 @@ jobs:
     name: Execute notebooks (ubuntu, Python 3.14)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.14"
 

lib_detect_testenv-3.0.4/.github/workflows/default_release_public.yml

@@ -0,0 +1,95 @@
+name: Release
+
+# The tag push is the only release event bmk guarantees: it runs
+# `git push <remote> <tag>` unconditionally, whereas `gh release create` sits
+# behind a gh-availability check and runs with check=False, so a missing or
+# failing gh would leave nothing to publish. Listening for `release: published`
+# as well fired a second, redundant run that raced the first to the upload and
+# only ever logged "Skipping ... already exists".
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch: {}
+
+# One publish at a time per tag, so a workflow_dispatch re-run cannot overlap
+# the run the tag push started.
+concurrency:
+  group: release-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      UV_LINK_MODE: "copy"
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.14'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          prune-cache: false
+
+      - name: Build artifacts
+        run: uv build
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/*
+
+      - name: Prune uv cache
+        continue-on-error: true
+        run: uv cache prune --ci
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      # id-token is required for OIDC / PyPI Trusted Publisher. It is harmless when
+      # a PYPI_API_TOKEN secret is configured, in which case the token path runs.
+      id-token: write
+    steps:
+      - name: Select PyPI auth method
+        id: auth
+        env:
+          PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+        run: |
+          if [ -n "$PYPI_API_TOKEN" ]; then
+            echo "PYPI_API_TOKEN is set; publishing with the API token."
+            echo "method=token" >> "$GITHUB_OUTPUT"
+          else
+            echo "No PYPI_API_TOKEN; publishing via OIDC Trusted Publisher."
+            echo "method=oidc" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI (API token)
+        if: steps.auth.outputs.method == 'token'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          attestations: false
+          skip-existing: true
+
+      - name: Publish to PyPI (Trusted Publisher / OIDC)
+        if: steps.auth.outputs.method == 'oidc'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true
+          skip-existing: true

{lib_detect_testenv-3.0.2 → lib_detect_testenv-3.0.4}/.gitignore

@@ -179,3 +179,9 @@ result
 poetry.lock
 pdm.lock
 uv.lock
+
+# Local, per-developer settings (Claude Code etc.) - never commit
+*.local.json
+
+# Python virtual environments (managed by bmk)
+.venv*/

{lib_detect_testenv-3.0.2 → lib_detect_testenv-3.0.4}/CHANGELOG.md

@@ -7,6 +7,41 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.0.4] 2026-08-01 00:14:59
+### Fixed
+- **Console output no longer crashes on a legacy codepage.** A Windows console at codepage 1252
+  hands Python an `errors="strict"` stream, so writing a non-ASCII character such as a check mark
+  raised `UnicodeEncodeError: 'charmap' codec can't encode character` and the command exited
+  non-zero *after* its work had already succeeded. Click does not protect against this, and Rich
+  raises the same way through its own writer. The new `safe_console` module degrades at the sink:
+  a UTF-8 terminal still receives the character, and only a stream that cannot encode it sees
+  `[OK]` / `[X]` / `[!]`. Every `click.echo` call site routes through it, and a test fails if a
+  module reaches for `click.echo` or builds an unwrapped `Console(file=sys.stdout)` again.
+
+
+## [3.0.3] 2026-07-24 16:01:54
+
+### Fixed
+- Fixed CI going red under the latest ruff (0.16 widened its default rule set to ~920 rules on a
+  repo with no explicit `[tool.ruff.lint].select`): pinned the curated bitranox rule select instead
+  of chasing the exploded default set.
+- `raise SystemExit(2)` in the CLI's error handlers now uses `from e` so tracebacks show the
+  original cause (B904).
+- `print_info()` and the `__main__` guard now write via `sys.stdout`/`sys.stderr` instead of `print`,
+  fixing a latent bug where the guard printed a `bytes` literal's repr instead of the plain message.
+
+### Changed
+- Added the curated `[tool.ruff.lint].select` (matching `bitranox_template_py_cli`) plus
+  `pydocstyle` Google convention and a `tests/*.py` per-file-ignore list, replacing the previous
+  no-`select` config that inherited ruff's entire default rule set.
+- Made the Click CLI callback parameters keyword-only (`*,`) so ruff's `PLR0917` no longer fires;
+  Click already invokes command callbacks by keyword, so this is not a call-site change.
+- Simplified boolean-returning `if/return True/False` branches in `lib_detect_testenv.py` to direct
+  `return <condition>` expressions (SIM103).
+- Moved two deferred, no-reason `import sys`/`from rich.style import Style` statements in `cli.py`
+  to the module top (PLC0415).
+- Replaced `Optional[X]` with `X | None` throughout `cli.py` (UP045).
+
 ## [3.0.2] 2026-06-14
 
 ### Changed

{lib_detect_testenv-3.0.2 → lib_detect_testenv-3.0.4}/CLAUDE.md

@@ -9,9 +9,9 @@ When starting a new session, read and apply the following system prompt files fr
 
 ### Bash-Specific Guidelines
 When working with Bash scripts:
-- use skill `bx-bash-reference` when in doubt of bash features or syntax
+- use skill `bitranox:bash-reference` when in doubt of bash features or syntax
 - `core_programming_solid.md`
-- use skill `bx-bash-clean-architecture`
+- use skill `bitranox:bash-clean-architecture`
 - `bash_clean_code.md`
 - `bash_small_functions.md`
 
@@ -19,10 +19,10 @@ When working with Bash scripts:
 When working with Python code:
 - `core_programming_solid.md`
 - `python_solid_architecture_enforcer.md`
-- use skill `bx-python-clean-architecture`
+- use skill `bitranox:python-clean-architecture`
 - `python_clean_code.md`
 - `python_small_functions_style.md`
-- use skill `bx-python-libraries-to-use`
+- use skill `bitranox:python-use-modern-libraries`
 - `python_structure_template.md`
 
 ### Additional Guidelines
@@ -137,7 +137,7 @@ Import rules (enforced by import-linter):
 - `cli` depends on `lib_detect_testenv` and `behaviors`
 - Core detection functions have no internal dependencies
 
-Apply principles use skill `bx-python-clean-architecture` when designing and implementing features.
+Apply principles use skill `bitranox:python-clean-architecture` when designing and implementing features.
 
 ## Security & Configuration