merriv 0.1.0a2__tar.gz

merriv-0.1.0a2/.gitattributes

@@ -0,0 +1,8 @@
+* text=auto eol=lf
+
+*.onnx binary
+*.pdf binary
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.zip binary

merriv-0.1.0a2/.github/CODEOWNERS

@@ -0,0 +1,12 @@
+# Bootstrap ownership. RFCs can split these paths as reviewers are added.
+* @niansia
+
+/schemas/ @niansia
+/src/merriv/core/ @niansia
+/src/merriv/gate/ @niansia
+/src/merriv/reports/ @niansia
+/src/merriv/evidence.py @niansia
+/src/merriv/target.py @niansia
+/rfcs/ @niansia
+/docs/mcr-*.md @niansia
+/.github/workflows/ @niansia

merriv-0.1.0a2/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,32 @@
+name: Bug report
+description: Report incorrect release evidence, behavior, or compatibility
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: Do not include credentials or private model outputs. Use SECURITY.md for vulnerabilities.
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Observed and expected outcome
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Minimal reproduction
+      description: Include sanitized suite/policy fragments and exact exit status.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Merriv and Python versions
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Execution environment
+      description: OS, adapter, executor, and relevant non-secret revisions.

merriv-0.1.0a2/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/niansia/Merriv/security/advisories/new
+    about: Report vulnerabilities privately; never post exploit details in an issue.
+  - name: Support policy
+    url: https://github.com/niansia/Merriv/blob/main/SUPPORT.md
+    about: Read what information to include and which reports belong elsewhere.

merriv-0.1.0a2/.github/ISSUE_TEMPLATE/external-reproduction.yml

@@ -0,0 +1,44 @@
+name: External reproduction
+description: Submit an independently executed corpus or target-GPU result
+title: "[Reproduction]: "
+labels: ["reproduction", "evidence"]
+body:
+  - type: input
+    id: source
+    attributes:
+      label: Source commit
+    validations:
+      required: true
+  - type: input
+    id: target
+    attributes:
+      label: Hardware, runtime, and driver
+    validations:
+      required: true
+  - type: input
+    id: root
+    attributes:
+      label: Target evidence ID and archive SHA-256
+    validations:
+      required: true
+  - type: textarea
+    id: commands
+    attributes:
+      label: Commands and verification results
+    validations:
+      required: true
+  - type: textarea
+    id: deviations
+    attributes:
+      label: Deviations, unavailable fields, and limitations
+    validations:
+      required: true
+  - type: checkboxes
+    id: independence
+    attributes:
+      label: Independence
+      options:
+        - label: I controlled the execution environment and did not reuse the project's generated evidence archive.
+          required: true
+        - label: No credentials, proprietary artifacts, or private model outputs are attached.
+          required: true

merriv-0.1.0a2/.github/ISSUE_TEMPLATE/mcr-compatibility.yml

@@ -0,0 +1,40 @@
+name: Model Change Report compatibility
+description: Report a producer, consumer, schema, or identity interoperability issue
+title: "[Model Change Report compatibility]: "
+labels: ["compatibility", "mcr"]
+body:
+  - type: markdown
+    attributes:
+      value: Do not include private evidence or vulnerability details.
+  - type: input
+    id: implementation
+    attributes:
+      label: Implementation and revision
+    validations:
+      required: true
+  - type: input
+    id: mcr_version
+    attributes:
+      label: Exact Model Change Report version
+    validations:
+      required: true
+  - type: dropdown
+    id: role
+    attributes:
+      label: Role
+      options: [Producer, Consumer, Verifier, Identity implementation]
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Sanitized command and output
+      description: Include exit code and smallest public fixture or receipt.
+    validations:
+      required: true
+  - type: textarea
+    id: mismatch
+    attributes:
+      label: Expected and observed semantics
+    validations:
+      required: true

merriv-0.1.0a2/.github/ISSUE_TEMPLATE/plugin.yml

@@ -0,0 +1,39 @@
+name: Plugin or integration proposal
+description: Propose an adapter, paired metric, executor, or Model Change Report integration
+title: "[Plugin]: "
+labels: ["plugin", "proposal"]
+body:
+  - type: dropdown
+    id: kind
+    attributes:
+      label: Extension kind
+      options: [Adapter, Paired metric, Executor, Model Change Report producer/consumer]
+    validations:
+      required: true
+  - type: textarea
+    id: user
+    attributes:
+      label: User and release workflow
+      description: Who needs this and which release decision does it enable?
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence contract
+      description: Inputs, outputs, capabilities, units/direction, and limitations.
+    validations:
+      required: true
+  - type: textarea
+    id: identity
+    attributes:
+      label: Reproducibility and non-secret identity
+      description: What config/revision enters snapshot, manifest, executor, and cache identity?
+    validations:
+      required: true
+  - type: textarea
+    id: threats
+    attributes:
+      label: Trust boundary and resource limits
+    validations:
+      required: true

merriv-0.1.0a2/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,25 @@
+## Problem and outcome
+<!-- What user/release-engineering problem does this solve? -->
+
+## Evidence and verification
+
+- [ ] Deterministic tests added or updated
+- [ ] `uv run --frozen ruff check .` passes
+- [ ] `uv run --frozen mypy src` passes
+- [ ] `uv run --frozen pytest` passes
+- [ ] Public schema output checked when contracts changed
+
+## Compatibility and security
+
+- [ ] No public contract or behavior change
+- [ ] Or: RFC/migration notes linked below
+- [ ] Secrets, raw private outputs, and credential hashes are absent from identity,
+      cache, reports, logs, and exceptions
+- [ ] Resource/cost limits and fail-closed behavior were considered
+
+## Plugin/executor changes
+
+- [ ] Not applicable
+- [ ] Manifest/API version and non-secret config identity documented
+- [ ] Capabilities and mutation behavior tested
+- [ ] Trust/isolation boundary documented

merriv-0.1.0a2/.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5

merriv-0.1.0a2/.github/workflows/ci.yml

@@ -0,0 +1,175 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          python-version: ${{ matrix.python-version }}
+          version: "0.11.18"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - run: uv sync --frozen --extra dev --extra onnx --group action-build
+      - run: uv run --frozen ruff check .
+      - run: uv run --frozen mypy src
+      - run: uv run --frozen pytest --cov=merriv --cov-report=term-missing --cov-fail-under=91
+      - run: uv run --frozen python -m pip_audit --local --skip-editable
+      - run: uv pip check
+      - if: matrix.python-version == '3.13'
+        shell: bash
+        run: |
+          uv run --frozen merriv schema export schemas/mcr-0.4
+          git diff --exit-code -- schemas/mcr-0.4
+          test -z "$(git status --porcelain --untracked-files=all -- schemas/mcr-0.4)"
+          uv run --frozen python tools/verify_regression_corpus.py
+          uv run --frozen merriv conformance producer examples/mcr_conformance
+      - if: matrix.python-version == '3.13'
+        run: uv run --frozen python -m build --wheel --no-isolation --outdir wheelhouse
+
+  action-smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Run the repository's composite action
+        id: gate
+        continue-on-error: true
+        uses: ./
+        with:
+          baseline: examples/recorded_compare/baseline.jsonl
+          candidate: examples/recorded_compare/candidate.jsonl
+          suite: examples/recorded_compare/suite.jsonl
+          policy: examples/recorded_compare/policy.yaml
+          output: runs/action-smoke
+          slice-key: frequency
+          resamples: "200"
+          artifact-name: action-smoke-${{ github.run_id }}
+      - name: Assert BLOCK semantics and portable bundle
+        if: always()
+        env:
+          MERRIV_ACTION_OUTCOME: ${{ steps.gate.outcome }}
+          MERRIV_ACTION_EXIT_CODE: ${{ steps.gate.outputs.exit-code }}
+        run: |
+          test "$MERRIV_ACTION_OUTCOME" = "failure"
+          test "$MERRIV_ACTION_EXIT_CODE" = "2"
+          test -f runs/action-smoke/mcr-report.json
+          test -f runs/action-smoke/evidence-manifest.json
+          test -f runs/action-smoke/release-plan.json
+          test -f runs/action-smoke/summary.md
+          test -f runs/action-smoke/junit.xml
+          test -f runs/action-smoke/results.sarif
+          merriv mcr verify runs/action-smoke --strict
+      - name: Verify cross-language content identity vectors
+        run: node examples/content_identity/verify_golden.mjs
+
+  rust-mcr-interop:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          python-version: "3.11"
+          version: "0.11.18"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - name: Install the Python verifier and select the stable Rust toolchain
+        run: |
+          uv sync --frozen
+          rustup toolchain install stable --profile minimal --component rustfmt
+          rustup default stable
+      - name: Verify typed identity vectors in Python, Node, and Rust
+        run: |
+          uv run --frozen python examples/content_identity/generate_vectors.py --check
+          uv run --frozen python examples/content_identity/verify_golden.py
+          node examples/content_identity/verify_golden.mjs
+          cargo fmt --manifest-path reference/mcr-reference-rust/Cargo.toml -- --check
+          cargo test --locked --manifest-path reference/mcr-reference-rust/Cargo.toml
+          cargo run --locked --quiet --manifest-path reference/mcr-reference-rust/Cargo.toml -- vectors examples/content_identity/golden-vectors.json
+          cargo run --locked --quiet --manifest-path reference/mcr-reference-rust/Cargo.toml -- float-vectors examples/content_identity/float-vectors.json
+      - name: Verify bidirectional Python and Rust Model Change Report interoperability
+        run: |
+          uv run --frozen python examples/independent_producer/generate_bundle.py --check
+          uv run --frozen python tools/verify_rust_interop.py
+
+  reproducible-package:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          python-version: "3.13"
+          version: "0.11.18"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - run: uv sync --frozen --extra dev --group action-build
+      - name: Build twice from the same source epoch
+        shell: bash
+        run: |
+          export SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)"
+          reproducibility_root="${RUNNER_TEMP}/merriv-repro-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          mkdir -p "${reproducibility_root}/a" "${reproducibility_root}/b"
+          uv run --frozen python -m build --no-isolation --outdir "${reproducibility_root}/a"
+          uv run --frozen python -m build --no-isolation --outdir "${reproducibility_root}/b"
+          cmp "${reproducibility_root}"/a/*.whl "${reproducibility_root}"/b/*.whl
+          cmp "${reproducibility_root}"/a/*.tar.gz "${reproducibility_root}"/b/*.tar.gz
+          sha256sum "${reproducibility_root}"/a/* "${reproducibility_root}"/b/*
+
+  onnx-demo:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          python-version: "3.11"
+          version: "0.11.18"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - run: uv sync --frozen --extra onnx-demo
+      - run: uv run --frozen python examples/onnx_quantization/run_demo.py --output runs/onnx-quantization
+      - run: uv run --frozen python tools/verify_onnx_demo.py runs/onnx-quantization
+      - run: uv run --frozen python examples/onnx_opset_upgrade/run_demo.py --output runs/onnx-opset-upgrade
+      - name: Upload platform-specific ONNX evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: onnx-release-evidence-${{ matrix.os }}
+          path: |
+            runs/onnx-quantization
+            runs/onnx-opset-upgrade
+          if-no-files-found: error
+          retention-days: 14

merriv-0.1.0a2/.github/workflows/dependency-review.yml

@@ -0,0 +1,18 @@
+name: Dependency review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: moderate
+          deny-licenses: GPL-2.0, GPL-3.0, AGPL-1.0, AGPL-3.0

merriv-0.1.0a2/.github/workflows/nvidia-vertical.yml

@@ -0,0 +1,59 @@
+name: NVIDIA vertical
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  modelopt-tensorrt:
+    runs-on: [self-hosted, windows, x64, nvidia-gpu]
+    timeout-minutes: 60
+    env:
+      UV_CACHE_DIR: .uv-cache-${{ github.run_id }}
+      UV_NO_PROGRESS: "1"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: "0.11.18"
+          enable-cache: false
+      - name: Generate the fixed CPU suite
+        shell: pwsh
+        run: |
+          $env:UV_PROJECT_ENVIRONMENT = ".venv-suite"
+          uv sync --frozen --extra onnx-demo
+          .venv-suite/Scripts/python examples/onnx_quantization/run_demo.py --output runs/onnx-quantization
+      - name: Build PyTorch and ModelOpt artifacts
+        shell: pwsh
+        run: |
+          uv venv --python 3.11 .venv-modelopt
+          uv pip sync --python .venv-modelopt/Scripts/python.exe --require-hashes examples/nvidia_tensorrt_vertical/requirements-modelopt.lock
+          .venv-modelopt/Scripts/python examples/nvidia_tensorrt_vertical/build_artifacts.py --fixture examples/onnx_quantization/assets/digits-mlp-fp32.onnx.b64 --output runs/nvidia/artifact-inputs
+      - name: Execute TensorRT, Polygraphy, gate, and bisect
+        shell: pwsh
+        run: |
+          $env:UV_PROJECT_ENVIRONMENT = ".venv-tensorrt"
+          uv sync --frozen --extra onnx-demo
+          uv pip install --python .venv-tensorrt/Scripts/python.exe --no-deps --require-hashes -r examples/nvidia_tensorrt_vertical/requirements-tensorrt-cu125-windows.lock
+          .venv-tensorrt/Scripts/python examples/nvidia_tensorrt_vertical/run_vertical.py --artifacts runs/nvidia/artifact-inputs --suite runs/onnx-quantization/suite.jsonl --output runs/nvidia/live --polygraphy-command .venv-tensorrt/Scripts/polygraphy.exe
+      - name: Verify target receipt and every Model Change Report bundle
+        shell: pwsh
+        run: |
+          .venv-tensorrt/Scripts/python -c "import json,pathlib; p=json.loads(pathlib.Path('runs/nvidia/live/gpu-receipt.json').read_text()); assert p['first_bad_index'] == 2; assert [b['decision'] for b in p['builds']] == ['PASS','PASS','BLOCK','BLOCK']; assert all(b['backend_matched_cases'] == p['case_count'] for b in p['builds'])"
+          .venv-tensorrt/Scripts/merriv.exe mcr verify-target runs/nvidia/live
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Upload exact target evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: nvidia-modelopt-tensorrt-${{ github.run_id }}
+          path: runs/nvidia
+          if-no-files-found: error
+          retention-days: 30

merriv-0.1.0a2/.github/workflows/release.yml

@@ -0,0 +1,106 @@
+name: Build release artifacts
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          python-version: "3.13"
+          version: "0.11.18"
+          enable-cache: false
+      - name: Install the locked build frontend
+        run: uv sync --frozen --extra dev --group action-build
+      - name: Build wheel and source distribution
+        shell: bash
+        run: |
+          export SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)"
+          uv run --frozen python -m build --no-isolation
+      - name: Verify wheel installation
+        run: |
+          uv venv release-smoke --python 3.13
+          uv pip install --python release-smoke/bin/python --require-hashes -r action-requirements.lock
+          uv pip install --python release-smoke/bin/python --no-deps dist/*.whl
+          release-smoke/bin/merriv --help
+          release-smoke/bin/python -c "import importlib.util, merriv; assert importlib.util.find_spec('m2' + 'riv') is None"
+          legacy_command="m2""riv"
+          test ! -e "release-smoke/bin/${legacy_command}"
+      - name: Generate SPDX SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          path: dist
+          format: spdx-json
+          output-file: dist/merriv.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+      - name: Write SHA-256 checksums
+        run: cd dist && sha256sum *.whl *.tar.gz *.spdx.json > SHA256SUMS
+      - name: Upload release bundle
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: merriv-distributions-${{ github.ref_name }}
+          path: dist/*
+          if-no-files-found: error
+          retention-days: 30
+
+  attest:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      attestations: write
+      contents: read
+      id-token: write
+    steps:
+      - name: Download release bundle as inert data
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: merriv-distributions-${{ github.ref_name }}
+          path: dist
+      - name: Attest release files
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: dist/*
+
+  publish:
+    needs: [build, attest]
+    if: startsWith(github.ref, 'refs/tags/v') && vars.MERRIV_BRAND_CLEARED == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: pypi
+      url: https://pypi.org/p/merriv
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Download attested distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: merriv-distributions-${{ github.ref_name }}
+          path: dist
+      - name: Isolate package files from checksums and SBOM
+        run: |
+          mkdir publish-dist
+          cp dist/*.whl dist/*.tar.gz publish-dist/
+      - name: Publish with PyPI Trusted Publishing
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          packages-dir: publish-dist

merriv-0.1.0a2/.github/workflows/scorecard.yml

@@ -0,0 +1,39 @@
+name: OpenSSF Scorecard
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "30 1 * * 6"
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - name: Checkout without persisted credentials
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Run OpenSSF Scorecard
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - name: Retain the exact SARIF result
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: openssf-scorecard-sarif
+          path: results.sarif
+          retention-days: 5
+      - name: Publish findings to code scanning
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        with:
+          sarif_file: results.sarif

merriv-0.1.0a2/.gitignore

@@ -0,0 +1,45 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/
+.env
+.env.*
+!.env.example
+.coverage
+coverage.xml
+htmlcov/
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.hypothesis/
+.nox/
+.tox/
+.venv/
+node_modules/
+build/
+target/
+dist/
+runs/
+tmp/
+output/
+*.log
+*.whl
+*.tar.gz
+*.zip
+*.7z
+*.pdf
+*.ppt
+*.pptx
+*.onnx
+*.engine
+*.plan
+*.pt
+*.pth
+*.safetensors
+*.pem
+*.key
+*.p12
+*.pfx