millwright 2.2.1__tar.gz → 2.3.1__tar.gz

millwright-2.3.1/.github/SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are provided for the latest published Millwright release. Users
+should upgrade to the newest version available on crates.io or PyPI before
+reporting an issue that may already have been corrected.
+
+## Reporting a vulnerability
+
+Please do not open a public issue for a suspected vulnerability. Use
+[GitHub private vulnerability reporting](https://github.com/mi7plus/millwright/security/advisories/new)
+to share the affected version, impact, reproduction steps, and any suggested
+mitigation privately with the maintainers.
+
+You should receive an acknowledgement within seven days. The maintainers will
+then validate the report, coordinate a fix and release where necessary, and
+agree on disclosure timing with the reporter. Please allow a reasonable
+remediation window before publishing details.
+
+## Scope
+
+Reports about the Rust crate, Python wheels, serialization and ONNX handling,
+model registry, inference server, release artifacts, or build and publishing
+pipeline are in scope. Vulnerabilities in an upstream dependency should also be
+reported upstream when appropriate; please still notify Millwright privately if
+the dependency creates a practical risk for Millwright users.

{millwright-2.2.1 → millwright-2.3.1}/.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # One in-flight run per ref; a new push cancels the previous.
 concurrency:
   group: ci-${{ github.ref }}
@@ -24,28 +27,29 @@ jobs:
     name: version & links
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.x"
       - name: verify every public version marker
         run: python scripts/sync-version.py --check
       - name: check local and external HTML links
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2
         with:
           args: >-
             --no-progress
             --accept 200,204,206,429
             --retry-wait-time 2
             index.html guide.html docs/*.html README.md CONTRIBUTING.md RELEASING.md
+            .github/SECURITY.md
           fail: true
 
   fmt:
     name: rustfmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           components: rustfmt
       - run: cargo fmt --all --check
@@ -61,11 +65,11 @@ jobs:
           - features: "" # default features
           - features: "--features full"
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           components: clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
       - run: cargo clippy --locked --all-targets ${{ matrix.features }}
 
   docs:
@@ -74,9 +78,9 @@ jobs:
     env:
       RUSTDOCFLAGS: "-D warnings"
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
       # `full` is every Rust-facing feature (python is a cdylib, doc'd separately
       # by maturin/pyo3), so this exercises the whole documented surface.
       - run: cargo doc --locked --no-deps --features full
@@ -113,12 +117,25 @@ jobs:
           # Everything at once — the superset build, including both ndarray worlds.
           - { name: "full", features: "--features full" }
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        if: matrix.name == 'full'
+        with:
+          python-version: "3.14"
+      - name: install the official ONNX checker
+        if: matrix.name == 'full'
+        run: python -m pip install --requirement requirements/onnx-check.txt
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
         with:
           key: ${{ matrix.name }}
       - run: cargo test --locked ${{ matrix.features }}
+        if: matrix.name != 'full'
+      - name: test full feature set with external ONNX validation
+        if: matrix.name == 'full'
+        run: cargo test --locked ${{ matrix.features }}
+        env:
+          MILLWRIGHT_ONNX_CHECKER: python
 
   # Cross-platform confidence on the default install, without multiplying the
   # whole feature matrix across three operating systems.
@@ -130,28 +147,28 @@ jobs:
       matrix:
         os: [windows-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
       - run: cargo test --locked
 
   msrv:
     name: minimum Rust 1.95
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.95"
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
       - run: cargo check --locked --all-targets --features full
 
   supply-chain:
     name: advisories
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       - run: cargo install cargo-audit --locked
       - run: cargo audit
 
@@ -159,20 +176,20 @@ jobs:
     name: dependency policy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: taiki-e/install-action@cargo-deny
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: taiki-e/install-action@bf681f3be21c0d2daea0ea20bbf590138fc96a2b # cargo-deny
       - run: cargo deny check
 
   coverage:
     name: coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           components: llvm-tools-preview
-      - uses: taiki-e/install-action@cargo-llvm-cov
-      - uses: Swatinem/rust-cache@v2
+      - uses: taiki-e/install-action@d630c3ba8c9bb0648bcefda869fb0d9b98c611d9 # cargo-llvm-cov
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
       - name: measure full-feature Rust coverage
         run: cargo llvm-cov --locked --features full --workspace --lcov --output-path lcov.info
       - name: enforce coverage floor
@@ -181,7 +198,7 @@ jobs:
           --fail-under-lines 82
           --fail-under-functions 75
           --fail-under-regions 84
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: rust-coverage
           path: lcov.info
@@ -191,20 +208,22 @@ jobs:
     name: branch coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       # LLVM branch instrumentation remains a nightly-only cargo-llvm-cov mode.
-      - uses: dtolnay/rust-toolchain@nightly
+      - uses: dtolnay/rust-toolchain@7c8d7d138f5c09cef361f8214cf96882cd029cdb # nightly
         with:
           components: llvm-tools-preview
-      - uses: taiki-e/install-action@cargo-llvm-cov
-      - uses: Swatinem/rust-cache@v2
+      - uses: taiki-e/install-action@d630c3ba8c9bb0648bcefda869fb0d9b98c611d9 # cargo-llvm-cov
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
         with:
           key: branch-coverage
       - name: measure decision coverage
         run: >-
           cargo +nightly llvm-cov --locked --features full --workspace --branch
           --cobertura --output-path branch-coverage.xml
-      - uses: actions/upload-artifact@v7
+      - name: enforce branch coverage floor
+        run: python scripts/check-branch-coverage.py branch-coverage.xml --minimum 65
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: rust-branch-coverage
           path: branch-coverage.xml
@@ -214,8 +233,8 @@ jobs:
     name: public API compatibility
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       - run: cargo install cargo-semver-checks --locked
       - run: cargo semver-checks check-release
 
@@ -226,9 +245,9 @@ jobs:
     name: examples & benches
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
       - name: run every example
         run: |
           for ex in spine explore trust workflow backends insight portability operations specialized automl; do
@@ -243,8 +262,8 @@ jobs:
     name: package (publish dry-run)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       # No rust-cache here: `cargo publish` builds a copy under target/package,
       # which the cache action's post-step chokes on.
       # Prove the crate packages and builds from its packaged form as it would on
@@ -252,19 +271,97 @@ jobs:
       - run: cargo publish --dry-run --locked
 
   python:
-    name: python wheel
+    name: python wheel (build & test)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          components: llvm-tools-preview
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.9"
-      - uses: Swatinem/rust-cache@v2
+          # pytest 9 contains the tmpdir security fix and requires Python 3.10+.
+          # The separate ABI matrix still smoke-tests the wheel on Python 3.9.
+          python-version: "3.10"
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - uses: taiki-e/install-action@d630c3ba8c9bb0648bcefda869fb0d9b98c611d9 # cargo-llvm-cov
       # The `python` feature can't be linked by `cargo test` (pyo3's
       # extension-module defers libpython), so it is built the way it ships:
       # as an abi3 wheel via maturin, then smoke-imported.
-      - run: pip install maturin pytest
-      - run: maturin build --locked --release
-      - run: pip install --find-links target/wheels millwright
-      - run: pytest -q tests/python
+      - run: python -m pip install --requirement requirements/ci-python.txt
+      - name: build instrumented wheel and measure Python binding coverage
+        shell: bash
+        run: |
+          cargo llvm-cov clean --workspace
+          source <(cargo llvm-cov show-env --export-prefix)
+          maturin build --locked --out wheel
+          python -m pip install --force-reinstall wheel/*.whl
+          python -m pytest -q tests/python
+          cargo llvm-cov report --lcov --output-path python-bindings.lcov
+          python scripts/check-lcov-coverage.py python-bindings.lcov \
+            --minimum 45 --file src/python.rs --file src/python_data.rs
+      - run: python -m mypy --strict tests/python/typing_contract.py
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: python-binding-coverage
+          path: python-bindings.lcov
+          if-no-files-found: error
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: python-abi3-wheel
+          path: wheel/*.whl
+          if-no-files-found: error
+
+  python-compat:
+    name: python wheel (${{ matrix.python }})
+    needs: python
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: ${{ matrix.python }}
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: python-abi3-wheel
+          path: wheel
+      - run: python -m pip install --no-deps wheel/*.whl
+      - run: python tests/python/compat_smoke.py
+
+  ci-success:
+    name: CI success
+    if: always()
+    needs:
+      - consistency
+      - fmt
+      - clippy
+      - docs
+      - test
+      - os
+      - msrv
+      - supply-chain
+      - dependency-policy
+      - coverage
+      - branch-coverage
+      - semver
+      - examples
+      - package
+      - python
+      - python-compat
+    runs-on: ubuntu-latest
+    steps:
+      - name: require every CI job to succeed
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+        shell: bash
+        run: |
+          failures="$(jq -r 'to_entries[] | select(.value.result != "success") | "\(.key): \(.value.result)"' <<< "$RESULTS")"
+          if [ -n "$failures" ]; then
+            echo "::error::one or more CI jobs did not succeed"
+            printf '%s\n' "$failures"
+            exit 1
+          fi

millwright-2.3.1/.github/workflows/codeql.yml

@@ -0,0 +1,40 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "17 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: analyze (${{ matrix.language }})
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: rust
+            build-mode: none
+          - language: python
+            build-mode: none
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: initialize CodeQL
+        uses: github/codeql-action/init@4c0873ef8656cb3c50b3f42fb63bc1ade0cfa827 # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+      - name: analyze
+        uses: github/codeql-action/analyze@4c0873ef8656cb3c50b3f42fb63bc1ade0cfa827 # v4