loom-kernel 1.9.2__tar.gz → 1.9.3__tar.gz

{loom_kernel-1.9.2 → loom_kernel-1.9.3}/.github/workflows/ci-main.yml

@@ -3,6 +3,12 @@ name: ci-main
 on:
   push:
     branches: ["master"]
+  # The release helper merges the version bump through the API with
+  # GITHUB_TOKEN, and GitHub deliberately emits no `push` for it, so that commit
+  # would otherwise reach master without ever being validated. `workflow_dispatch`
+  # is the documented exception that does start a run from that token, so the
+  # release asks for this workflow by hand right after it merges.
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -119,8 +125,14 @@ jobs:
         env:
           SNYK_TOKEN: ${{ env.SNYK_TOKEN }}
 
+      # Non-blocking, exactly as the same scan is on a pull request: a scanner
+      # that is unreachable or refusing an expired token says nothing about this
+      # code, and master turning red for it hides the failures that do mean
+      # something. The outcome is reported loudly in the step below instead.
       - name: Snyk monitor by dependency scope (core/dev/extras)
+        id: snyk
         if: ${{ env.SNYK_TOKEN != '' }}
+        continue-on-error: true
         shell: bash
         env:
           SNYK_TOKEN: ${{ env.SNYK_TOKEN }}
@@ -169,6 +181,29 @@ jobs:
               --target-reference="${GITHUB_REF_NAME:-master}"
           done
 
+      - name: Report the Snyk outcome
+        if: ${{ always() && env.SNYK_TOKEN != '' }}
+        env:
+          OUTCOME: ${{ steps.snyk.outcome }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "## Snyk dependency scan: \`${OUTCOME}\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+          if [ "${OUTCOME}" != "success" ]; then
+            {
+              echo
+              echo "The scan did not complete, so **no dependency was cleared and none was"
+              echo "reported vulnerable**. This does NOT block the build: a scanner that is"
+              echo "unreachable, rate-limited or refusing an expired \`SNYK_TOKEN\` says"
+              echo "nothing about this code. Read the step log: an \`Authentication error"
+              echo "(SNYK-0005)\` with \`401 Unauthorized\` means the token needs renewing"
+              echo "in Snyk and updating in the repository secrets."
+            } >> "$GITHUB_STEP_SUMMARY"
+            echo "::warning title=Snyk scan did not complete::No dependency was scanned. This does NOT block the build. A 401 with SNYK-0005 means the SNYK_TOKEN is expired or unprovisioned; renew it in Snyk and update the repository secret."
+          fi
+
   # ---------------------------------------------------------------------------
   # Churn canary (plan.md risk table): run the agent suites against the LATEST
   # published pydantic-ai instead of the locked one.

{loom_kernel-1.9.2 → loom_kernel-1.9.3}/.github/workflows/ci-pr.yml

@@ -10,7 +10,17 @@ permissions:
   security-events: write
 
 jobs:
+  # A release PR carries a version bump and nothing else, and it is the only way
+  # CHANGELOG.md, pyproject.toml and uv.lock reach master. Validating it is not
+  # possible and not useful: the branch and the PR are pushed with GITHUB_TOKEN,
+  # so any run queued against them sits waiting for manual approval and expires
+  # unapproved — a red check nobody can turn green. Worse, the release helper
+  # merges only when every check that reported has passed, so an expired run that
+  # concludes before the helper polls blocks the release outright. Skipping is
+  # what the helper already documents as the normal state. The code the bump
+  # describes was validated in the pull requests that composed it.
   validate:
+    if: ${{ !startsWith(github.head_ref, 'docs/release-') }}
     runs-on: ubuntu-latest
     env:
       SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
@@ -229,6 +239,29 @@ jobs:
               --project-name="loom-py/extra-${extra}"
           done
 
+      - name: Report the Snyk outcome
+        if: ${{ always() && env.SNYK_TOKEN != '' }}
+        env:
+          OUTCOME: ${{ steps.snyk.outcome }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "## Snyk dependency scan: \`${OUTCOME}\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+          if [ "${OUTCOME}" != "success" ]; then
+            {
+              echo
+              echo "The scan did not complete, so **no dependency was cleared and none was"
+              echo "reported vulnerable**. This does NOT block the build: a scanner that is"
+              echo "unreachable, rate-limited or refusing an expired \`SNYK_TOKEN\` says"
+              echo "nothing about this code. Read the step log: an \`Authentication error"
+              echo "(SNYK-0005)\` with \`401 Unauthorized\` means the token needs renewing"
+              echo "in Snyk and updating in the repository secrets."
+            } >> "$GITHUB_STEP_SUMMARY"
+            echo "::warning title=Snyk scan did not complete::No dependency was scanned. This does NOT block the build. A 401 with SNYK-0005 means the SNYK_TOKEN is expired or unprovisioned; renew it in Snyk and update the repository secret."
+          fi
+
       - name: Publish prerelease package to TestPyPI
         if: ${{ github.event.pull_request.head.repo.full_name == github.repository && env.TEST_PYPI_API_TOKEN != '' && steps.version.outputs.deploy == 'true' }}
         env:
@@ -290,6 +323,7 @@ jobs:
   #
   # No `--frozen` and no `uv.lock` here — resolving fresh is the entire point.
   pydantic-ai-canary:
+    if: ${{ !startsWith(github.head_ref, 'docs/release-') }}
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
@@ -402,6 +436,7 @@ jobs:
   # is not evidence that Apache Kafka agrees.
   # ---------------------------------------------------------------------------
   integration:
+    if: ${{ !startsWith(github.head_ref, 'docs/release-') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

{loom_kernel-1.9.2 → loom_kernel-1.9.3}/.github/workflows/docs.yml

@@ -26,7 +26,17 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  # A release PR carries a version bump and nothing else, and it is the only way
+  # CHANGELOG.md, pyproject.toml and uv.lock reach master. Validating it is not
+  # possible and not useful: the branch and the PR are pushed with GITHUB_TOKEN,
+  # so any run queued against them sits waiting for manual approval and expires
+  # unapproved — a red check nobody can turn green. Worse, the release helper
+  # merges only when every check that reported has passed, so an expired run that
+  # concludes before the helper polls blocks the release outright. Skipping is
+  # what the helper already documents as the normal state. The code the bump
+  # describes was validated in the pull requests that composed it.
   build:
+    if: ${{ !startsWith(github.head_ref, 'docs/release-') }}
     runs-on: ubuntu-latest
     # contents: read is scoped here — build does not need pages or id-token.
     permissions:

{loom_kernel-1.9.2 → loom_kernel-1.9.3}/.github/workflows/release.yml

@@ -22,6 +22,8 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      # Dispatching ci-main for the merged version bump; see that step.
+      actions: write
     outputs:
       deploy: ${{ steps.version.outputs.deploy }}
       version: ${{ steps.version.outputs.version }}
@@ -228,6 +230,23 @@ jobs:
             --timeout-seconds "${MERGE_TIMEOUT_SECONDS}")
           echo "release_sha=${RELEASE_SHA}" >> "$GITHUB_OUTPUT"
 
+      # The bump is on master now, and no `push` event announced it: GitHub
+      # emits none for a merge performed with GITHUB_TOKEN. Ask for the run
+      # explicitly, so CHANGELOG.md, pyproject.toml and uv.lock are validated on
+      # master like every other commit. Never fatal: this asks for a check, it is
+      # not one, and a release must not fail because a follow-up run could not be
+      # queued. It dispatches on `master`, so what it validates is master's tip,
+      # which is what ci-main validates on any other day.
+      - name: Validate the merged version bump on master
+        if: ${{ steps.version.outputs.deploy == 'true' }}
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          gh workflow run ci-main.yml --repo "${GITHUB_REPOSITORY}" --ref master
+
       - name: Store release notes
         if: ${{ steps.version.outputs.deploy == 'true' }}
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4

{loom_kernel-1.9.2 → loom_kernel-1.9.3}/CHANGELOG.md

@@ -1,3 +1,14 @@
+# 🚀 Release 1.9.3 ([#159](https://github.com/the-reacher-data/loom-py/pull/159)) ([`eedd32c`](https://github.com/the-reacher-data/loom-py/commit/eedd32ca67be84302292aab968b5fe6dd7eb3621))
+
+
+
+
+
+
+
+
+
+
 # 🚀 Release 1.9.2 ([#157](https://github.com/the-reacher-data/loom-py/pull/157)) ([`3b32161`](https://github.com/the-reacher-data/loom-py/commit/3b32161dfcfe12fe25fe05ff7ccb4d6a71a6b64a))
 
 

{loom_kernel-1.9.2 → loom_kernel-1.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: loom-kernel
-Version: 1.9.2
+Version: 1.9.3
 Summary: Loom Python project
 License-File: LICENSE
 Classifier: Typing :: Typed

{loom_kernel-1.9.2 → loom_kernel-1.9.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "loom-kernel"
-version = "1.9.2"
+version = "1.9.3"
 description = "Loom Python project"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -362,7 +362,7 @@ markers = [
 
 [tool.commitizen]
 name = "cz_conventional_commits"
-version = "1.9.2"
+version = "1.9.3"
 tag_format = "v$version"
 version_files = [
     "pyproject.toml:project.version",

{loom_kernel-1.9.2 → loom_kernel-1.9.3}/uv.lock

@@ -2118,7 +2118,7 @@ wheels = [
 
 [[package]]
 name = "loom-kernel"
-version = "1.9.2"
+version = "1.9.3"
 source = { editable = "." }
 dependencies = [
     { name = "aiocache" },