mailmail 0.1.0__tar.gz

mailmail-0.1.0/.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    # Monthly and grouped into one pull request, because the alternative is a
+    # treadmill: setup-uv ships several releases some weeks, nearly all of them
+    # just checksums for a newly released uv, and a pull request per release on
+    # a two-action workflow would be noise that gets skimmed and then ignored.
+    # Once a month is often enough for what this has to catch: the major bumps,
+    # which an exact pin cannot follow at all.
+    schedule:
+      interval: monthly
+    groups:
+      actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: build

mailmail-0.1.0/.github/workflows/check.yml

@@ -0,0 +1,117 @@
+name: check
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "0 0 * * 1"
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # The floor and the current release. requires-python says >=3.11, so 3.11 is
+        # the version that claim has to actually hold on. Nothing pins the upper end
+        # -- >=3.11 promises every release above it, with no ceiling to read off --
+        # so it tracks whatever CPython currently ships: left behind, it stops being
+        # evidence the promise holds on new releases and becomes a version nobody runs.
+        python-version: ["3.11", "3.14"]
+
+    steps:
+      # Both pinned past a moving tag: @v7 is a pointer its owner can repoint, and the
+      # next run here would execute the new target without a commit of its own. The two
+      # forms differ because the actions do -- setup-uv publishes no moving tag from v8
+      # on and marks its releases immutable, so the version itself cannot move, while
+      # checkout's releases stay mutable and only the commit is fixed. Neither follows
+      # a new release on its own; dependabot proposes both (.github/dependabot.yml).
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: astral-sh/setup-uv@v8.3.2
+
+      - name: Install
+        # A venv per matrix version, not `uv pip --system`: the runner's system
+        # Python is externally managed and is 3.12 whatever the matrix says, so
+        # --system both failed and ignored the version under test. This is also
+        # exactly what the README tells a person to run.
+        run: |
+          uv venv --python ${{ matrix.python-version }}
+          uv pip install -e ".[dev]"
+          .venv/bin/python -c "import sys; print('testing on', sys.version)"
+
+      - name: Test
+        run: .venv/bin/pytest -q
+
+      - name: Lint
+        run: .venv/bin/ruff check src tests scripts
+
+      - name: Types
+        run: .venv/bin/mypy
+
+      - name: Confirm the package still has no runtime dependencies
+        # The zero-dependency claim is in the README and the pyproject comment; a
+        # claim nothing checks is a claim that quietly stops being true. Installed
+        # into a bare environment, mailmail must import with nothing else present.
+        run: |
+          uv venv /tmp/bare --python ${{ matrix.python-version }}
+          uv pip install --python /tmp/bare/bin/python .
+          /tmp/bare/bin/python -c "
+          import importlib.metadata as md
+          requires = md.requires('mailmail') or []
+          runtime = [r for r in requires if 'extra ==' not in r]
+          assert not runtime, f'runtime dependencies appeared: {runtime}'
+          import mailmail
+          print('mailmail', mailmail.__version__, 'imports with no third-party packages')
+          "
+
+      - name: Confirm the console script installed
+        # pyproject declares a `mailmail` entry point; a wheel that dropped it
+        # would leave the CLI, the skill, and the docs pointing at a command that
+        # is not there. `--version` is the cheapest call that proves it runs.
+        run: |
+          uv venv /tmp/cli --python ${{ matrix.python-version }}
+          uv pip install --python /tmp/cli/bin/python .
+          /tmp/cli/bin/mailmail --version
+
+      - name: Confirm a user's type checker can see the hints
+        # Every hint in this package is invisible to a user unless py.typed ships
+        # alongside it (PEP 561), and the source cannot answer whether it did:
+        # src/mailmail/py.typed can sit there in git while the built wheel omits it.
+        # So ask it the way a user does -- install the built package into a clean
+        # environment and run their checker over their code. It shipped without the
+        # marker once, which made `to` being required a promise that held only
+        # inside this repo.
+        run: |
+          uv venv /tmp/typed --python ${{ matrix.python-version }}
+          uv pip install --python /tmp/typed/bin/python . mypy
+          cat > /tmp/user_code.py <<'PY'
+          from mailmail import Message, send
+
+          Message(subject="s", body="b", to="lead@example.com")  # 16 recipients
+          send(subject="s", body="b")                            # no recipient
+          PY
+          /tmp/typed/bin/mypy /tmp/user_code.py > /tmp/mypy_out 2>&1 || true
+          cat /tmp/mypy_out
+          grep -q 'incompatible type "str"' /tmp/mypy_out
+          grep -q 'Missing named argument "to"' /tmp/mypy_out
+
+  blocked-list-drift:
+    # The size limit is asked of the server on every send, so it cannot go stale.
+    # The blocked-extension list can: it is a snapshot of what Google published,
+    # and Google can change it without telling anyone. This is the only part of
+    # what the package knows that has no way of noticing it went wrong.
+    #
+    # Weekly and on demand, never on a push: a code change is not the reason the
+    # list would move, and a Google page edit must not turn someone's pull
+    # request red.
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: astral-sh/setup-uv@v8.3.2
+      - run: |
+          uv venv
+          uv pip install -e .
+      - run: .venv/bin/python scripts/check_blocked_list.py

mailmail-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,34 @@
+name: publish
+
+# Publish to PyPI when a GitHub Release is published. Authentication is PyPI
+# Trusted Publishing (OIDC): no token or password is stored anywhere -- GitHub
+# mints a short-lived identity that PyPI verifies against the publisher
+# registered for this repo (owner seokhoonj / repo mailmail / workflow
+# publish.yml / environment "pypi"). Register that publisher on PyPI first; until
+# the project exists there it is registered as a "pending" publisher.
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      # Naming any permission drops every unnamed one to `none`, so `contents`
+      # has to be listed back: checkout clones with the job token, and this repo
+      # is private, so without read here that clone fails "repository not found".
+      contents: read
+      id-token: write   # required for OIDC; this is what replaces a stored token
+    steps:
+      # Pinned the same way check.yml is: checkout past its mutable tag to a
+      # commit, setup-uv on its immutable v8 tag, and the publish action past its
+      # moving release/v1 branch to a commit. dependabot proposes all three
+      # (.github/dependabot.yml). uv build writes the sdist and wheel to dist/,
+      # which the publish action uploads.
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: astral-sh/setup-uv@v8.3.2
+      - name: Build sdist and wheel
+        run: uv build
+      - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1

mailmail-0.1.0/.gitignore

@@ -0,0 +1,22 @@
+# AI coding agents
+CLAUDE.md
+.claude/
+AGENTS.md
+AGENT.md
+.codex/
+GEMINI.md
+.gemini/
+
+dev/
+
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.venv/
+venv/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/

mailmail-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Seokhoon Joo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.