linc-cli-kit 0.1.4__tar.gz → 0.1.5__tar.gz

{linc_cli_kit-0.1.4 → linc_cli_kit-0.1.5}/.github/workflows/test.yml

@@ -2,6 +2,8 @@ name: test
 on:
   push: {branches: [main]}
   pull_request:
+permissions:
+  contents: read
 jobs:
   test:
     strategy:

{linc_cli_kit-0.1.4 → linc_cli_kit-0.1.5}/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to linc-cli-kit are listed here.
 
+## [0.1.5]
+
+- Security: the lock moves PyJWT to 2.15.1 and certifi to 2026.10.23, clearing the open
+  advisories against the earlier versions. `tests/test_lock_floors.py` fails if a re-lock
+  drops either one back below its patched version.
+- CI: the public `test.yml` workflow runs with a read-only `GITHUB_TOKEN`
+  (`permissions: contents: read`). No library changes.
+
 ## [0.1.4]
 
 - `strict_tools(server, *, strict_types=False)`: rejects unknown MCP tool arguments. Every

{linc_cli_kit-0.1.4 → linc_cli_kit-0.1.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: linc-cli-kit
-Version: 0.1.4
+Version: 0.1.5
 Summary: Reflect a FastMCP tool registry into Click commands under one agent-grade output contract
 Project-URL: Homepage, https://github.com/LincForge/cli-kit
 Project-URL: Issues, https://github.com/LincForge/cli-kit/issues

{linc_cli_kit-0.1.4 → linc_cli_kit-0.1.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "linc-cli-kit"
-version = "0.1.4"
+version = "0.1.5"
 description = "Reflect a FastMCP tool registry into Click commands under one agent-grade output contract"
 requires-python = ">=3.12"
 license = "Apache-2.0"

linc_cli_kit-0.1.5/tests/test_lock_floors.py

@@ -0,0 +1,69 @@
+"""Security floors for locked dependencies and least-privilege CI permissions."""
+
+import re
+import tomllib
+from pathlib import Path
+
+import pytest
+
+REPO = Path(__file__).resolve().parents[1]
+LOCK = REPO / "uv.lock"
+
+# Patched versions for open Dependabot advisories.
+FLOORS = {
+    "pyjwt": (2, 15, 0),
+    "certifi": (2026, 10, 18),
+}
+
+
+def _version_tuple(version: str) -> tuple[int, ...]:
+    parts = []
+    for piece in version.split("."):
+        match = re.match(r"\d+", piece)
+        if match is None:
+            break
+        parts.append(int(match.group()))
+        if match.group() != piece:
+            break
+    return tuple(parts)
+
+
+def _workflows() -> Path:
+    # Private repo: templates under public/.github (the export maps them to .github).
+    public = REPO / "public" / ".github" / "workflows"
+    return public if public.is_dir() else REPO / ".github" / "workflows"
+
+
+def _top_level_permissions(workflow: str) -> dict[str, str]:
+    lines = workflow.splitlines()
+    start = lines.index("permissions:")
+    perms = {}
+    for line in lines[start + 1 :]:
+        if not line.startswith("  "):
+            break
+        key, _, value = line.strip().partition(":")
+        perms[key] = value.strip()
+    return perms
+
+
+def test_locked_packages_meet_security_floors() -> None:
+    if not LOCK.exists():
+        pytest.skip("uv.lock is not part of the public mirror export")
+    locked = {
+        pkg["name"].lower(): pkg["version"] for pkg in tomllib.loads(LOCK.read_text())["package"]
+    }
+    for name, floor in FLOORS.items():
+        assert name in locked, f"{name} missing from uv.lock"
+        assert _version_tuple(locked[name]) >= floor, (
+            f"{name} {locked[name]} is below the patched floor {floor}"
+        )
+
+
+def test_test_workflow_token_is_read_only() -> None:
+    workflow = (_workflows() / "test.yml").read_text()
+    assert _top_level_permissions(workflow) == {"contents": "read"}
+
+
+def test_version_tuple_parses_prerelease_suffix() -> None:
+    assert _version_tuple("2.15.0rc1") == (2, 15, 0)
+    assert _version_tuple("2026.7.22") < (2026, 10, 18)