lme-python 0.1.4__tar.gz → 0.1.8__tar.gz

lme_python-0.1.8/.github/workflows/audit.yml

@@ -0,0 +1,73 @@
+name: Security audit
+
+on:
+  schedule:
+    # Weekly: Mondays 12:00 UTC
+    - cron: "0 12 * * 1"
+  workflow_dispatch:
+  push:
+    branches: [master]
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - "python/pyproject.toml"
+      - "python/requirements-ci.txt"
+  pull_request:
+    branches: [master]
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - "python/pyproject.toml"
+      - "python/requirements-ci.txt"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: audit-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  audit:
+    name: cargo audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit@0.22.1
+
+      - name: Run cargo audit (root)
+        run: cargo audit
+
+      - name: Run cargo audit (python/)
+        working-directory: python
+        run: cargo audit
+
+  pip-audit:
+    name: pip-audit (python lockfile)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: python/requirements-ci.txt
+
+      - name: Install locked CI dependencies
+        working-directory: python
+        run: |
+          set -euo pipefail
+          python -m pip install -U pip
+          python -m pip install -r requirements-ci.txt
+
+      - name: pip-audit
+        working-directory: python
+        run: python -m pip_audit

{lme_python-0.1.4 → lme_python-0.1.8}/.github/workflows/benchmarks.yml

@@ -17,7 +17,6 @@ on:
 
 permissions:
   contents: write
-  pages: write
   id-token: write
 
 env:
@@ -172,63 +171,3 @@ jobs:
           echo "Cross-language benchmark script failed with exit code ${{ steps.cross_language_run.outputs.status }}." >&2
           exit 1
 
-  pages:
-    name: Publish Benchmark Dashboard
-    runs-on: ubuntu-latest
-    needs:
-      - criterion
-      - cross-language
-    if: needs.criterion.result == 'success' && needs.cross-language.result == 'success' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/'))
-    environment:
-      name: github-pages
-      url: ${{ steps.deploy.outputs.page_url }}
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-
-      - name: Download cross-language artifact
-        uses: actions/download-artifact@v5
-        with:
-          name: cross-language-${{ github.sha }}
-          path: site-input
-
-      - name: Resolve release URL
-        id: release_url
-        run: |
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            echo "value=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/tag/${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
-          else
-            echo "value=" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Build benchmark dashboard
-        run: |
-          set -euo pipefail
-          mkdir -p site
-          cp -R docs/. site/
-          mkdir -p site/benchmarks/data
-          cross_json="$(find site-input -name 'cross-language-*.json' -print -quit)"
-          python scripts/build_benchmark_site.py \
-            --cross-language-json "$cross_json" \
-            --output-dir "site/benchmarks/data" \
-            --run-url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
-            --release-url "${{ steps.release_url.outputs.value }}" \
-            --criterion-asset-name "criterion-${GITHUB_SHA}.tar.gz" \
-            --cross-language-asset-name "cross-language-${GITHUB_SHA}.json" \
-            --ref-name "${GITHUB_REF_NAME}"
-
-      - uses: actions/configure-pages@v5
-        with:
-          token: ${{ secrets.REPO_ADMIN_TOKEN != '' && secrets.REPO_ADMIN_TOKEN || github.token }}
-          enablement: ${{ secrets.REPO_ADMIN_TOKEN != '' }}
-
-      - uses: actions/upload-pages-artifact@v3
-        with:
-          path: site
-
-      - name: Deploy to GitHub Pages
-        id: deploy
-        uses: actions/deploy-pages@v4

lme_python-0.1.8/.github/workflows/ci.yml

@@ -0,0 +1,247 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+    paths-ignore:
+      - "**/*.md"
+      - "LICENSE"
+  pull_request:
+    branches: [master]
+    paths-ignore:
+      - "**/*.md"
+      - "LICENSE"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  rust-lint:
+    name: Rust fmt & clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install OpenBLAS
+        run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
+      - name: Cache cargo registry & build
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ubuntu-lint-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ubuntu-lint-
+      - name: rustfmt --check
+        run: python3 scripts/ci/lme_ci.py fmt-check
+      - name: clippy
+        run: python3 scripts/ci/lme_ci.py clippy
+
+  test:
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install OpenBLAS (Ubuntu)
+        if: matrix.os == 'ubuntu-latest'
+        run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
+
+      - name: Cache cargo registry & build
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
+
+      - name: Set OpenBLAS target (macOS)
+        if: matrix.os == 'macos-latest'
+        run: echo "OPENBLAS_TARGET=ARMV8" >> "$GITHUB_ENV"
+
+      - name: Build
+        run: cargo build --verbose --locked
+
+      - name: Run tests
+        run: cargo test --verbose --locked
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: python/requirements-ci.txt
+
+      - name: Python bindings (maturin develop, pytest, wheel install, pytest)
+        working-directory: python
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m venv .venv
+          if [ -f .venv/Scripts/python.exe ]; then
+            VPY=.venv/Scripts/python.exe
+          else
+            VPY=.venv/bin/python
+          fi
+          "$VPY" -m pip install -U pip
+          "$VPY" -m pip install -r requirements-ci.txt
+          "$VPY" -m maturin develop --release
+          "$VPY" -m pytest tests/ -v
+          "$VPY" -m maturin build --release -o dist
+          shopt -s nullglob
+          wheels=(dist/lme_python-*.whl)
+          if [ ${#wheels[@]} -eq 0 ]; then
+            echo "No wheel found under python/dist"
+            ls -la dist 2>/dev/null || true
+            exit 1
+          fi
+          "$VPY" -m pip install --force-reinstall "${wheels[0]}"
+          "$VPY" -m pytest tests/ -v
+
+  rust-all-targets:
+    name: Rust check (all targets)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install OpenBLAS
+        run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
+      - name: Cache cargo registry & build
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ubuntu-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ubuntu-cargo-
+      - name: cargo check --workspace --all-targets
+        run: cargo check --workspace --all-targets --locked -v
+
+  production-load:
+    name: Production load & perf gates (ubuntu, release)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install OpenBLAS (Ubuntu)
+        run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
+
+      - name: Cache cargo registry & build
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ubuntu-prodload-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ubuntu-prodload-
+
+      - name: Production load tests (smoke + release wall-clock gates)
+        run: cargo test --release --locked --verbose --test test_production_load
+
+      - name: Heavy production load tests (ignored)
+        run: cargo test --release --locked --verbose --test test_production_load -- --ignored --test-threads=1
+
+  rust-doctests:
+    name: Rust doctests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install OpenBLAS
+        run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
+      - name: Cache cargo registry & build
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ubuntu-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ubuntu-cargo-
+      - name: cargo test --doc
+        run: cargo test --doc --locked --verbose
+
+  python-bindings-versions:
+    name: Python ${{ matrix.python-version }} (ubuntu)
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install OpenBLAS
+        run: sudo apt-get update && sudo apt-get install -y libopenblas-dev
+      - name: Cache cargo registry & build
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ubuntu-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ubuntu-cargo-
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: python/requirements-ci.txt
+      - name: Python bindings (maturin develop, pytest, wheel install, pytest)
+        working-directory: python
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m venv .venv
+          if [ -f .venv/Scripts/python.exe ]; then
+            VPY=.venv/Scripts/python.exe
+          else
+            VPY=.venv/bin/python
+          fi
+          "$VPY" -m pip install -U pip
+          "$VPY" -m pip install -r requirements-ci.txt
+          "$VPY" -m maturin develop --release
+          "$VPY" -m pytest tests/ -v
+          "$VPY" -m maturin build --release -o dist
+          shopt -s nullglob
+          wheels=(dist/lme_python-*.whl)
+          if [ ${#wheels[@]} -eq 0 ]; then
+            echo "No wheel found under python/dist"
+            ls -la dist 2>/dev/null || true
+            exit 1
+          fi
+          "$VPY" -m pip install --force-reinstall "${wheels[0]}"
+          "$VPY" -m pytest tests/ -v
+
+  docs:
+    name: Build docs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Build documentation
+        run: cargo doc --no-deps --verbose --locked

lme_python-0.1.8/.github/workflows/crate-publish-dry-run.yml

@@ -0,0 +1,28 @@
+name: Crate publish (dry-run)
+
+# Verifies `cargo publish` packaging (metadata, README, excluded files) without uploading.
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-dry-run-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dry-run:
+    name: cargo publish --dry-run
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Dry-run publish (root crate)
+        run: cargo publish --dry-run --locked

lme_python-0.1.8/.github/workflows/fuzz-smoke.yml

@@ -0,0 +1,34 @@
+# Manual libFuzzer smoke (long compile + short run). Trigger from the Actions tab.
+name: Fuzz (manual)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  libfuzzer-smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    defaults:
+      run:
+        working-directory: fuzz
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@nightly
+
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: fuzz
+
+      - name: Build fuzz targets
+        run: cargo fuzz build formula_parse && cargo fuzz build formula_pipeline
+
+      - name: Run formula_parse
+        run: cargo fuzz run formula_parse corpus/formula_parse -- -runs=15000 -max_len=16384
+
+      - name: Run formula_pipeline
+        run: cargo fuzz run formula_pipeline corpus/formula_parse -- -runs=15000 -max_len=16384

{lme_python-0.1.4 → lme_python-0.1.8}/.github/workflows/python-release.yml

@@ -23,8 +23,8 @@ jobs:
       matrix:
         target: [x86_64, aarch64]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.10'
       - name: Build wheels
@@ -44,7 +44,7 @@ jobs:
           CFLAGS: "-std=gnu99"
           CFLAGS_aarch64_unknown_linux_gnu: "-std=gnu99"
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-linux-${{ matrix.target }}
           path: dist
@@ -55,8 +55,8 @@ jobs:
       matrix:
         target: [x64]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.10'
           architecture: ${{ matrix.target }}
@@ -67,7 +67,7 @@ jobs:
           args: --release --out dist --manifest-path python/Cargo.toml
           sccache: 'true'
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-windows-${{ matrix.target }}
           path: dist
@@ -78,12 +78,13 @@ jobs:
       matrix:
         target: [x86_64, aarch64]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.10'
-      - name: Install OpenBLAS
-        run: brew install openblas
+      - name: Set OpenBLAS target (Apple Silicon wheel)
+        if: matrix.target == 'aarch64'
+        run: echo "OPENBLAS_TARGET=ARMV8" >> "$GITHUB_ENV"
       - name: Build wheels
         uses: PyO3/maturin-action@v1
         with:
@@ -91,7 +92,7 @@ jobs:
           args: --release --out dist --manifest-path python/Cargo.toml
           sccache: 'true'
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-macos-${{ matrix.target }}
           path: dist
@@ -99,14 +100,14 @@ jobs:
   sdist:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Build sdist
         uses: PyO3/maturin-action@v1
         with:
           command: sdist
           args: --out dist --manifest-path python/Cargo.toml
       - name: Upload sdist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-sdist
           path: dist
@@ -122,7 +123,7 @@ jobs:
       id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
       contents: write  # needed to create GitHub Release
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
         with:
           path: dist
           pattern: wheels-*

{lme_python-0.1.4 → lme_python-0.1.8}/.github/workflows/repo-metadata.yml

@@ -16,7 +16,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Verify admin token is configured
         env:
@@ -24,10 +24,20 @@ jobs:
         run: |
           if [ -z "$REPO_ADMIN_TOKEN" ]; then
             echo "REPO_ADMIN_TOKEN is not set."
-            echo "Create a fine-grained PAT or GitHub App token with repository Administration: write."
+            echo "Create a fine-grained PAT with repository Administration: Read and write."
+            echo "Add it under Settings → Secrets and variables → Actions → REPO_ADMIN_TOKEN."
             exit 1
           fi
 
+      - name: Dry-run metadata payload
+        run: python scripts/sync_github_repo_metadata.py --dry-run
+
+      - name: Verify admin token is valid
+        env:
+          REPO_ADMIN_TOKEN: ${{ secrets.REPO_ADMIN_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: python scripts/sync_github_repo_metadata.py --verify-token
+
       - name: Sync repository metadata
         env:
           REPO_ADMIN_TOKEN: ${{ secrets.REPO_ADMIN_TOKEN }}

{lme_python-0.1.4 → lme_python-0.1.8}/.gitignore

@@ -1,4 +1,7 @@
 /target
+/fuzz/artifacts/
+/fuzz/coverage/
+/fuzz/target/
 reference/
 rlib/
 julia-portable/