millwright 2.2.0__tar.gz → 2.3.1__tar.gz

millwright-2.3.1/.github/SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are provided for the latest published Millwright release. Users
+should upgrade to the newest version available on crates.io or PyPI before
+reporting an issue that may already have been corrected.
+
+## Reporting a vulnerability
+
+Please do not open a public issue for a suspected vulnerability. Use
+[GitHub private vulnerability reporting](https://github.com/mi7plus/millwright/security/advisories/new)
+to share the affected version, impact, reproduction steps, and any suggested
+mitigation privately with the maintainers.
+
+You should receive an acknowledgement within seven days. The maintainers will
+then validate the report, coordinate a fix and release where necessary, and
+agree on disclosure timing with the reporter. Please allow a reasonable
+remediation window before publishing details.
+
+## Scope
+
+Reports about the Rust crate, Python wheels, serialization and ONNX handling,
+model registry, inference server, release artifacts, or build and publishing
+pipeline are in scope. Vulnerabilities in an upstream dependency should also be
+reported upstream when appropriate; please still notify Millwright privately if
+the dependency creates a practical risk for Millwright users.

millwright-2.3.1/.github/dependabot.yml

@@ -0,0 +1,59 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      rust-infrastructure:
+        patterns: ["*"]
+        exclude-patterns:
+          # These crates form type/serialization boundaries with the exact-pinned
+          # ML engines. Upgrade them deliberately, with the full feature matrix.
+          - "ndarray"
+          - "prost"
+          - "sha2"
+          - "criterion"
+    ignore:
+      # Engine versions are exact by design. Dependabot PRs cannot safely infer
+      # coordinated upgrades across their ndarray and ONNX type boundaries.
+      - dependency-name: "ndarray"
+      - dependency-name: "prost"
+      - dependency-name: "sha2"
+      - dependency-name: "criterion"
+      - dependency-name: "smartcore"
+      - dependency-name: "imbalance-rs"
+      - dependency-name: "model-selection-rs"
+      - dependency-name: "linfa*"
+      - dependency-name: "hyperopt-rs"
+      - dependency-name: "regression-diagnostics"
+      - dependency-name: "shap-rs"
+      - dependency-name: "plotters-statistical"
+      - dependency-name: "onnx-export-rs"
+      - dependency-name: "driftwatch"
+      - dependency-name: "chronos-ts"
+      - dependency-name: "incremental-rs"
+      - dependency-name: "polars"
+    labels: ["dependencies", "rust"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
+        exclude-patterns: ["dtolnay/rust-toolchain"]
+    ignore:
+      # @1.95 is a Rust toolchain selector, not an action release. It is also
+      # expressed as an input in CI, but keep this guard against regressions.
+      - dependency-name: "dtolnay/rust-toolchain"
+    labels: ["dependencies", "github-actions"]
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+    labels: ["dependencies", "python"]

millwright-2.3.1/.github/workflows/ci.yml

@@ -0,0 +1,367 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# One in-flight run per ref; a new push cancels the previous.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  # Every job builds against the committed Cargo.lock. `--locked` turns a stale
+  # or drifted lockfile into a hard error — the reproducibility guarantee that
+  # pairs with the exact-version engine pins in Cargo.toml.
+  CARGO_NET_RETRY: "3"
+  RUSTFLAGS: "-D warnings"
+
+jobs:
+  consistency:
+    name: version & links
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.x"
+      - name: verify every public version marker
+        run: python scripts/sync-version.py --check
+      - name: check local and external HTML links
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2
+        with:
+          args: >-
+            --no-progress
+            --accept 200,204,206,429
+            --retry-wait-time 2
+            index.html guide.html docs/*.html README.md CONTRIBUTING.md RELEASING.md
+            .github/SECURITY.md
+          fail: true
+
+  fmt:
+    name: rustfmt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --all --check
+
+  clippy:
+    name: clippy (${{ matrix.features }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - features: "--no-default-features"
+          - features: "" # default features
+          - features: "--features full"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - run: cargo clippy --locked --all-targets ${{ matrix.features }}
+
+  docs:
+    name: doc
+    runs-on: ubuntu-latest
+    env:
+      RUSTDOCFLAGS: "-D warnings"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      # `full` is every Rust-facing feature (python is a cdylib, doc'd separately
+      # by maturin/pyo3), so this exercises the whole documented surface.
+      - run: cargo doc --locked --no-deps --features full
+
+  test:
+    name: test (${{ matrix.name }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # The spine, minimal: no backend at all, then the smartcore spine.
+          - { name: "core-only", features: "--no-default-features" }
+          - { name: "spine", features: "--no-default-features --features smartcore-backend" }
+          # The default install.
+          - { name: "default", features: "" }
+          # Each feature in isolation. Dependencies declared by that feature are
+          # enabled transitively; unrelated defaults cannot hide a bad edge.
+          - { name: "eda", features: "--no-default-features --features eda" }
+          - { name: "calibration", features: "--no-default-features --features calibration" }
+          - { name: "anomaly", features: "--no-default-features --features anomaly" }
+          - { name: "linfa", features: "--no-default-features --features linfa-backend" }
+          - { name: "hpo", features: "--no-default-features --features hpo" }
+          - { name: "diagnostics", features: "--no-default-features --features diagnostics" }
+          - { name: "explain", features: "--no-default-features --features explain" }
+          - { name: "viz", features: "--no-default-features --features viz" }
+          - { name: "onnx", features: "--no-default-features --features onnx" }
+          - { name: "registry", features: "--no-default-features --features registry" }
+          - { name: "monitor", features: "--no-default-features --features monitor" }
+          - { name: "serve", features: "--no-default-features --features serve" }
+          - { name: "timeseries", features: "--no-default-features --features timeseries" }
+          - { name: "incremental", features: "--no-default-features --features incremental" }
+          - { name: "automl", features: "--no-default-features --features automl" }
+          # Everything at once — the superset build, including both ndarray worlds.
+          - { name: "full", features: "--features full" }
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        if: matrix.name == 'full'
+        with:
+          python-version: "3.14"
+      - name: install the official ONNX checker
+        if: matrix.name == 'full'
+        run: python -m pip install --requirement requirements/onnx-check.txt
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+        with:
+          key: ${{ matrix.name }}
+      - run: cargo test --locked ${{ matrix.features }}
+        if: matrix.name != 'full'
+      - name: test full feature set with external ONNX validation
+        if: matrix.name == 'full'
+        run: cargo test --locked ${{ matrix.features }}
+        env:
+          MILLWRIGHT_ONNX_CHECKER: python
+
+  # Cross-platform confidence on the default install, without multiplying the
+  # whole feature matrix across three operating systems.
+  os:
+    name: test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - run: cargo test --locked
+
+  msrv:
+    name: minimum Rust 1.95
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: "1.95"
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - run: cargo check --locked --all-targets --features full
+
+  supply-chain:
+    name: advisories
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - run: cargo install cargo-audit --locked
+      - run: cargo audit
+
+  dependency-policy:
+    name: dependency policy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: taiki-e/install-action@bf681f3be21c0d2daea0ea20bbf590138fc96a2b # cargo-deny
+      - run: cargo deny check
+
+  coverage:
+    name: coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          components: llvm-tools-preview
+      - uses: taiki-e/install-action@d630c3ba8c9bb0648bcefda869fb0d9b98c611d9 # cargo-llvm-cov
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - name: measure full-feature Rust coverage
+        run: cargo llvm-cov --locked --features full --workspace --lcov --output-path lcov.info
+      - name: enforce coverage floor
+        run: >-
+          cargo llvm-cov report --summary-only
+          --fail-under-lines 82
+          --fail-under-functions 75
+          --fail-under-regions 84
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: rust-coverage
+          path: lcov.info
+          if-no-files-found: error
+
+  branch-coverage:
+    name: branch coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      # LLVM branch instrumentation remains a nightly-only cargo-llvm-cov mode.
+      - uses: dtolnay/rust-toolchain@7c8d7d138f5c09cef361f8214cf96882cd029cdb # nightly
+        with:
+          components: llvm-tools-preview
+      - uses: taiki-e/install-action@d630c3ba8c9bb0648bcefda869fb0d9b98c611d9 # cargo-llvm-cov
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+        with:
+          key: branch-coverage
+      - name: measure decision coverage
+        run: >-
+          cargo +nightly llvm-cov --locked --features full --workspace --branch
+          --cobertura --output-path branch-coverage.xml
+      - name: enforce branch coverage floor
+        run: python scripts/check-branch-coverage.py branch-coverage.xml --minimum 65
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: rust-branch-coverage
+          path: branch-coverage.xml
+          if-no-files-found: error
+
+  semver:
+    name: public API compatibility
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - run: cargo install cargo-semver-checks --locked
+      - run: cargo semver-checks check-release
+
+  # Compile and *run* the examples (the `test` jobs only build the library and
+  # its tests), plus a compile-check of the benchmarks. The dedicated `msrv`
+  # job above proves the declared Rust 1.95 floor independently.
+  examples:
+    name: examples & benches
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - name: run every example
+        run: |
+          for ex in spine explore trust workflow backends insight portability operations specialized automl; do
+            echo "::group::$ex"
+            cargo run --locked --features full --example "$ex"
+            echo "::endgroup::"
+          done
+      - name: compile benchmarks
+        run: cargo bench --locked --features full --no-run
+
+  package:
+    name: package (publish dry-run)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      # No rust-cache here: `cargo publish` builds a copy under target/package,
+      # which the cache action's post-step chokes on.
+      # Prove the crate packages and builds from its packaged form as it would on
+      # crates.io — catches missing files, bad metadata, and path/dev-dep leaks.
+      - run: cargo publish --dry-run --locked
+
+  python:
+    name: python wheel (build & test)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          components: llvm-tools-preview
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          # pytest 9 contains the tmpdir security fix and requires Python 3.10+.
+          # The separate ABI matrix still smoke-tests the wheel on Python 3.9.
+          python-version: "3.10"
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - uses: taiki-e/install-action@d630c3ba8c9bb0648bcefda869fb0d9b98c611d9 # cargo-llvm-cov
+      # The `python` feature can't be linked by `cargo test` (pyo3's
+      # extension-module defers libpython), so it is built the way it ships:
+      # as an abi3 wheel via maturin, then smoke-imported.
+      - run: python -m pip install --requirement requirements/ci-python.txt
+      - name: build instrumented wheel and measure Python binding coverage
+        shell: bash
+        run: |
+          cargo llvm-cov clean --workspace
+          source <(cargo llvm-cov show-env --export-prefix)
+          maturin build --locked --out wheel
+          python -m pip install --force-reinstall wheel/*.whl
+          python -m pytest -q tests/python
+          cargo llvm-cov report --lcov --output-path python-bindings.lcov
+          python scripts/check-lcov-coverage.py python-bindings.lcov \
+            --minimum 45 --file src/python.rs --file src/python_data.rs
+      - run: python -m mypy --strict tests/python/typing_contract.py
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: python-binding-coverage
+          path: python-bindings.lcov
+          if-no-files-found: error
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: python-abi3-wheel
+          path: wheel/*.whl
+          if-no-files-found: error
+
+  python-compat:
+    name: python wheel (${{ matrix.python }})
+    needs: python
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: ${{ matrix.python }}
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: python-abi3-wheel
+          path: wheel
+      - run: python -m pip install --no-deps wheel/*.whl
+      - run: python tests/python/compat_smoke.py
+
+  ci-success:
+    name: CI success
+    if: always()
+    needs:
+      - consistency
+      - fmt
+      - clippy
+      - docs
+      - test
+      - os
+      - msrv
+      - supply-chain
+      - dependency-policy
+      - coverage
+      - branch-coverage
+      - semver
+      - examples
+      - package
+      - python
+      - python-compat
+    runs-on: ubuntu-latest
+    steps:
+      - name: require every CI job to succeed
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+        shell: bash
+        run: |
+          failures="$(jq -r 'to_entries[] | select(.value.result != "success") | "\(.key): \(.value.result)"' <<< "$RESULTS")"
+          if [ -n "$failures" ]; then
+            echo "::error::one or more CI jobs did not succeed"
+            printf '%s\n' "$failures"
+            exit 1
+          fi

millwright-2.3.1/.github/workflows/codeql.yml

@@ -0,0 +1,40 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "17 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: analyze (${{ matrix.language }})
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: rust
+            build-mode: none
+          - language: python
+            build-mode: none
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: initialize CodeQL
+        uses: github/codeql-action/init@4c0873ef8656cb3c50b3f42fb63bc1ade0cfa827 # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+      - name: analyze
+        uses: github/codeql-action/analyze@4c0873ef8656cb3c50b3f42fb63bc1ade0cfa827 # v4