matchbox-db 0.7.14.dev45__tar.gz

matchbox_db-0.7.14.dev45/.github/pull_request_template.md

@@ -0,0 +1,25 @@
+<!-- Give high level context to this PR -->
+
+## 🛠️ Changes proposed in this pull request
+
+* <!-- List the main changes you've made -->
+
+## 👀 Guidance to review
+
+<!-- Help reviewers know where to focus their efforts, or flag controversial decisions -->
+<!-- Add links and diagrams to explain decisions -->
+<!-- Point out any **breaking changes** -->
+
+## 🤖 AI declaration
+
+<!-- Declare code where AI was used, and how you ensured its quality -->
+
+## ✅ Checklist:
+
+- [ ] This is the smallest, simplest solution to the problem
+- [ ] I've read [our code standards](https://uktrade.github.io/matchbox/contributing/) and this code follows them  
+- [ ] All new code is tested
+- I've updated all relevant documentation (select all that apply)
+    - [ ] API documentation (docstrings and indexes)
+    - [ ] Tutorials
+    - [ ] Developer docs

matchbox_db-0.7.14.dev45/.github/workflows/ci.yml

@@ -0,0 +1,132 @@
+name: CI
+on:
+  pull_request:
+    branches:
+      - main
+      - "feature/**"
+  workflow_dispatch:
+
+jobs:
+  format-and-lint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@v6
+
+      - name: Install just
+        uses: extractions/setup-just@v2
+
+      - name: Format and lint
+        run: just format
+
+  test:
+    name: test ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        python-version:
+          - "3.11"
+          - "3.12"
+          - "3.13"
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install the project
+        run: uv sync --frozen --all-extras --dev
+
+      - name: Copy environment variables
+        run: cp environments/development.env .env
+
+      - name: Run databases and API
+        run: docker compose --env-file .env --env-file environments/containers.env up -d --wait
+
+      - name: Run Python tests
+        run: uv run pytest
+
+      - name: Dump docker logs
+        if: failure()
+        uses: jwalton/gh-docker-logs@v2
+
+  scan-for-secrets:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Run TruffleHog scan
+        run: |
+          docker run --rm -v ${{ github.workspace }}:/repo \
+            trufflesecurity/trufflehog:latest \
+            git file:///repo \
+            --since-commit main \
+            --branch ${{ github.head_ref }} \
+            --github-actions \
+            --fail
+
+  build-docs:
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install the project
+        run: uv sync --frozen --all-extras --dev
+
+      - name: Build with MkDocs
+        run: uv run mkdocs build
+
+  build-package:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.11"
+
+      - name: Build package
+        run: uv build
+
+  ci-success:
+    needs: [format-and-lint, test, scan-for-secrets, build-docs, build-package]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    
+    steps:
+      - name: CI success
+        run: echo "All CI checks passed!"

matchbox_db-0.7.14.dev45/.github/workflows/codeql.yml

@@ -0,0 +1,49 @@
+# Custom CodeQL workflow
+# 
+# More or less autogenerated by GitHub. Matchbox maintains its own workflow in order
+# to scan PRs from forks.
+# 
+# See https://github.com/actions/starter-workflows/blob/main/code-scanning/codeql.yml
+# 
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ["main"]
+  schedule:
+    - cron: "36 17 * * 3"
+  workflow_dispatch:
+
+jobs:
+  analyse:
+    name: Analyse
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["python", "actions"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Initialise CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+
+          # Details on CodeQL's query packs refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+          queries: security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{matrix.language}}"

matchbox_db-0.7.14.dev45/.github/workflows/prerelease.yml

@@ -0,0 +1,110 @@
+name: Prerelease
+on:
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    outputs:
+      mb_version: ${{ steps.get_version.outputs.mb_version }}
+    permissions:
+      contents: write
+      packages: write
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Log in to GitHub packages Docker registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with: 
+          python-version: "3.11"
+
+      - name: Extract development version
+        id: get_version
+        run: |
+          echo "mb_version=$(uv run --frozen python -m setuptools_scm | sed 's/+.*//')" \
+          >> "$GITHUB_OUTPUT"
+
+      - name: Build package
+        env:
+          SETUPTOOLS_SCM_PRETEND_VERSION: ${{ steps.get_version.outputs.mb_version }}
+        run: uv build
+
+      - name: Upload package artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: package-dist
+          path: ./dist
+
+      - name: Extract tag metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ steps.get_version.outputs.mb_version }}
+            type=raw,value=development
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: src/matchbox/server/Dockerfile
+          push: true
+          build-args: |
+            MB_VERSION=${{ steps.get_version.outputs.mb_version }}
+          tags: ${{ steps.meta.outputs.tags }}
+
+      - name: Delete existing development release if it exists
+        run: |
+          gh release delete development --yes || true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create development prerelease
+        uses: ncipollo/release-action@v1
+        with:
+          tag: development
+          name: Development
+          prerelease: true
+          body: |
+            This is a development build, usually from the latest main branch. 
+            
+            May be unstable.
+            
+            **Version:** ${{ steps.get_version.outputs.mb_version }}
+            **Commit:** ${{ github.sha }}
+
+  deploy-package:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    
+    environment: pypi
+    
+    steps:
+      - name: Download package artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: package-dist
+          path: ./dist
+
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

matchbox_db-0.7.14.dev45/.github/workflows/release.yml

@@ -0,0 +1,208 @@
+name: Release
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to release (e.g., 1.2.3)'
+        required: true
+        type: string
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      packages: write
+      attestations: write
+      id-token: write
+    
+    outputs:
+      tag: ${{ steps.version.outputs.tag }}
+      version: ${{ steps.version.outputs.version }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Validate we're on main branch
+        run: |
+          current_branch=$(git branch --show-current)
+          if [ "$current_branch" != "main" ]; then
+            echo "Error: Must be on main branch"
+            exit 1
+          fi
+
+      - name: Process version and tag
+        id: version
+        run: |
+          input_version="${{ github.event.inputs.version }}"
+          clean_version=${input_version#v}
+          
+          # Validate version format
+          if ! echo "$clean_version" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "Error: Version must be in format x.x.x (with or without v prefix)"
+            exit 1
+          fi
+          
+          git_tag="v$clean_version"
+          
+          # Check if tag already exists
+          if git rev-parse "$git_tag" >/dev/null 2>&1; then
+            echo "Error: Tag $git_tag already exists"
+            exit 1
+          fi
+          
+          echo "version=$clean_version" >> $GITHUB_OUTPUT
+          echo "tag=$git_tag" >> $GITHUB_OUTPUT
+          echo "Clean version: $clean_version"
+          echo "Git tag: $git_tag"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with: 
+          python-version: "3.11"
+
+      - name: Build package
+        env:
+          SETUPTOOLS_SCM_PRETEND_VERSION: ${{ steps.version.outputs.version }}
+        run: uv build
+
+      - name: Upload package artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: package-dist
+          path: ./dist
+
+      - name: Install the project
+        run: uv sync --frozen --all-extras --dev
+
+      - name: Build documentation
+        run: uv run mkdocs build
+
+      - name: Upload documentation artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: site/
+
+      - name: Log in to GitHub packages Docker registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract tag metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ steps.version.outputs.version }}
+            type=raw,value=latest
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: src/matchbox/server/Dockerfile
+          push: false
+          load: true
+          build-args: |
+            MB_VERSION=${{ steps.version.outputs.version }}
+          tags: ${{ steps.meta.outputs.tags }}
+
+      - name: Save Docker image
+        run: |
+          # Save all tags created by the build
+          docker save ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} \
+            > ${{ runner.temp }}/docker-image.tar
+
+      - name: Upload Docker image artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: docker-image
+          path: ${{ runner.temp }}/docker-image.tar
+
+  deploy-package:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    
+    environment: pypi
+    
+    steps:
+      - name: Download package artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: package-dist
+          path: ./dist
+
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  deploy-docs:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+      contents: read
+    
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    
+    steps:
+      - name: Deploy documentation to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4
+
+  deploy-docker:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
+    
+    steps:
+      - name: Download Docker image artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: docker-image
+          path: ${{ runner.temp }}
+
+      - name: Load Docker image
+        run: docker load --input ${{ runner.temp }}/docker-image.tar
+
+      - name: Log in to GitHub packages Docker registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push Docker image
+        run: docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} --all-tags
+
+  create-release:
+    needs: [build, deploy-package, deploy-docs, deploy-docker]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Create tag and GitHub release
+        uses: ncipollo/release-action@v1
+        with:
+          tag: ${{ needs.build.outputs.tag }}
+          name: ${{ needs.build.outputs.tag }}
+          generateReleaseNotes: true