minidb-sql 1.3.0__tar.gz

minidb_sql-1.3.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,13 @@
+## Summary
+
+Describe the change in a few sentences.
+
+## Verification
+
+List the checks you ran.
+
+## Checklist
+
+- [ ] All commits in this pull request are signed off with `git commit -s`
+- [ ] PR title uses one Conventional Commits prefix (`feat`/`fix`/`docs`/`style`/`refactor`/`perf`/`test`/`build`/`ci`/`chore`/`revert`)
+- [ ] I ran the relevant test, lint, and format steps for the files I changed

minidb_sql-1.3.0/.github/actionlint.yaml

@@ -0,0 +1,3 @@
+# GitHub-hosted runners only. Custom labels belong here if that changes.
+self-hosted-runner:
+  labels: []

minidb_sql-1.3.0/.github/actions/setup-python/action.yml

@@ -0,0 +1,15 @@
+name: Setup Python
+description: Install the Python version used by CI and release jobs.
+
+inputs:
+  python-version:
+    description: CPython version to install
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Setup Python
+      uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
+      with:
+        python-version: ${{ inputs.python-version }}

minidb_sql-1.3.0/.github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+    open-pull-requests-limit: 5
+    groups:
+      actions:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+    open-pull-requests-limit: 5
+    groups:
+      python:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"

minidb_sql-1.3.0/.github/workflows/apply-release-notes.yml

@@ -0,0 +1,44 @@
+# Cheap apply of curated notes onto a GitHub Release.
+# Reads branch release-note-<semver> or vars RELEASE_NOTES +
+# RELEASE_NOTES_TAG. Deletes the notes branch after a successful
+# apply. Does not compile the package.
+name: Apply release notes
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v1.2.0)"
+        required: true
+        type: string
+
+concurrency:
+  group: apply-release-notes-${{ inputs.tag }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  apply:
+    name: Apply notes
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+      TAG: ${{ inputs.tag }}
+      RELEASE_NOTES: ${{ vars.RELEASE_NOTES }}
+      RELEASE_NOTES_TAG: ${{ vars.RELEASE_NOTES_TAG }}
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Apply curated notes
+        run: bash scripts/apply-release-notes.sh

minidb_sql-1.3.0/.github/workflows/auto-approve.yml

@@ -0,0 +1,52 @@
+name: Auto-approve
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: auto-approve-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  auto-approve:
+    name: Auto-approve
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      pull-requests: write
+    # Approve only. This repo has no GitHub App, and a GITHUB_TOKEN
+    # squash would skip the Release workflow on main.
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]' &&
+      github.event.pull_request.user.login != 'github-actions[bot]' &&
+      (github.actor == 'SebTardif' || github.actor == 'minidb-release[bot]')
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - name: Approve pull request
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          set -euo pipefail
+          if gh pr review --approve "$PR_URL"; then
+            echo "Approved"
+            exit 0
+          fi
+          echo "Approve returned non-zero; checking for an existing approval"
+          count=$(gh pr view "$PR_URL" --json reviews --jq '[.reviews[] | select(.state=="APPROVED")] | length')
+          echo "existing approvals=${count}"
+          if [ "$count" = "0" ]; then
+            echo "Pull request has no approving review"
+            exit 1
+          fi

minidb_sql-1.3.0/.github/workflows/ci.yml

@@ -0,0 +1,278 @@
+name: CI
+
+on:
+  # Recipe A: product tests on PR (and merge_group if a queue is added).
+  # Do not compile again on push to main. Release publish stays in release.yml.
+  # ready_for_review re-runs CI when a draft is marked ready.
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
+  merge_group: {}
+  schedule:
+    - cron: "17 6 * * 1" # Monday, after the 06:00 security scan
+  workflow_dispatch: {}
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    # Docs-only and draft pulls skip the test matrix. Schedule, dispatch,
+    # and merge_group skip this job, and downstream jobs then run.
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    if: github.event_name == 'pull_request' && github.event.pull_request.draft == false
+    permissions:
+      pull-requests: read
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+      workflows: ${{ steps.filter.outputs.workflows }}
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        id: filter
+        with:
+          filters: |
+            code:
+              - 'minidb_sql/**'
+              - 'tests/**'
+              - 'scripts/**'
+              - 'pyproject.toml'
+              - 'main.py'
+              - '.github/actions/**'
+              - '.github/workflows/ci.yml'
+            workflows:
+              - '.github/workflows/**'
+              - '.github/actions/**'
+              - '.github/zizmor.yml'
+              - 'scripts/**'
+              - '.github/actionlint.yaml'
+
+  lint:
+    name: Lint & Format
+    needs: [changes]
+    if: >
+      always()
+      && (github.event_name != 'pull_request' || github.event.pull_request.draft == false)
+      && (needs.changes.result == 'skipped' || needs.changes.outputs.code == 'true')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup-python
+        with:
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: pip install ruff==0.16.6
+
+      - name: Ruff check
+        run: ruff check .
+
+      - name: Ruff format check
+        run: ruff format --check .
+
+  type-check:
+    name: Type Check
+    needs: [changes]
+    if: >
+      always()
+      && (github.event_name != 'pull_request' || github.event.pull_request.draft == false)
+      && (needs.changes.result == 'skipped' || needs.changes.outputs.code == 'true')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup-python
+        with:
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: pip install mypy
+
+      - name: Mypy
+        run: mypy minidb_sql/
+
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    needs: [changes]
+    if: >
+      always()
+      && (github.event_name != 'pull_request' || github.event.pull_request.draft == false)
+      && (needs.changes.result == 'skipped' || needs.changes.outputs.code == 'true')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup-python
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: pip install pytest pytest-cov
+
+      - name: Run tests with coverage
+        run: pytest tests/ --cov=minidb_sql --cov-report=term-missing --cov-report=xml
+
+      - name: Upload coverage
+        if: matrix.python-version == '3.13'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: coverage-report
+          path: coverage.xml
+
+  workflow-sanity:
+    name: Workflow sanity
+    needs: [changes]
+    if: >
+      always()
+      && (github.event_name != 'pull_request' || github.event.pull_request.draft == false)
+      && (needs.changes.result == 'skipped' || needs.changes.outputs.workflows == 'true')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install actionlint
+        run: |
+          set -euo pipefail
+          archive="actionlint_1.7.12_linux_amd64.tar.gz"
+          sha="8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8"
+          curl -sSfL "https://github.com/rhysd/actionlint/releases/download/v1.7.12/${archive}" \
+            -o "/tmp/${archive}"
+          echo "${sha}  /tmp/${archive}" | sha256sum -c -
+          sudo tar -xzf "/tmp/${archive}" -C /usr/local/bin actionlint
+          actionlint -version
+
+      - name: Install zizmor
+        uses: taiki-e/install-action@5488ac5a951645ce95062214902ac4b6bc1a1037 # v2.87.32
+        with:
+          tool: zizmor@1.30.0
+
+      - name: actionlint
+        run: actionlint -color
+
+      - name: zizmor
+        run: zizmor --persona=regular --min-severity=medium .github/workflows .github/actions
+
+      - name: Lock Recipe A and notes-branch apply
+        run: |
+          python3 scripts/test_apply_release_notes.py
+          python3 scripts/test_workflow_triggers.py
+          python3 scripts/test_release_please.py
+          python3 scripts/test_check_dco.py
+          python3 scripts/test_report_scheduled_failure.py
+
+  ci:
+    name: ci
+    needs: [changes, lint, type-check, test, workflow-sanity]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - name: Gate
+        env:
+          CHANGES: ${{ needs.changes.result }}
+          LINT: ${{ needs.lint.result }}
+          TYPE: ${{ needs.type-check.result }}
+          TEST: ${{ needs.test.result }}
+          SANITY: ${{ needs.workflow-sanity.result }}
+        run: |
+          set -euo pipefail
+          for result in "$CHANGES" "$LINT" "$TYPE" "$TEST" "$SANITY"; do
+            if [ "$result" = "failure" ] || [ "$result" = "cancelled" ] || [ "$result" = "abandoned" ]; then
+              echo "Upstream job did not succeed: $result"
+              exit 1
+            fi
+          done
+          echo "ci gate passed"
+
+  report-failure:
+    name: Report CI failure
+    needs: [changes, lint, type-check, test, workflow-sanity]
+    if: always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Open or close the failure issue
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          ASSIGNEE: ${{ vars.NIGHTLY_FAILURE_ASSIGNEE || 'SebTardif' }}
+          RUN_ID: ${{ github.run_id }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          JOB_RESULTS: >-
+            changes=${{ needs.changes.result }}
+            lint=${{ needs.lint.result }}
+            type-check=${{ needs.type-check.result }}
+            test=${{ needs.test.result }}
+            workflow-sanity=${{ needs.workflow-sanity.result }}
+        run: |
+          python3 scripts/report-scheduled-failure.py \
+            --prefix "CI red" \
+            --run-id "$RUN_ID" \
+            --run-url "$RUN_URL" \
+            --label nightly-failure \
+            --label ready

minidb_sql-1.3.0/.github/workflows/dco.yml

@@ -0,0 +1,36 @@
+name: DCO
+
+on:
+  pull_request:
+    branches: [main]
+  merge_group: {}
+  workflow_dispatch: {}
+
+concurrency:
+  group: dco-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  dco:
+    name: DCO Sign-off
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Check DCO sign-off
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.sha }}
+        run: bash scripts/check-dco.sh

minidb_sql-1.3.0/.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,90 @@
+name: Dependabot auto-merge
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch: {}
+
+concurrency:
+  group: dependabot-auto-merge-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  auto-merge:
+    name: Auto-merge Dependabot PRs
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    # pull_request_target runs this file from main. Do not check out the
+    # pull request head. Metadata and gh only read the event payload.
+    if: >-
+      github.event_name == 'pull_request_target' &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Detect a SHA pin labeled as a major
+        id: sha-pin
+        env:
+          PREV: ${{ steps.metadata.outputs.previous-version }}
+          DEPS: ${{ steps.metadata.outputs.updated-dependencies-json }}
+        run: |
+          set -euo pipefail
+          sha=false
+          if [ -n "${DEPS}" ] && [ "${DEPS}" != "null" ]; then
+            if printf '%s' "$DEPS" | jq -e '
+              type == "array" and length > 0 and
+              all(.[]; (.prevVersion // "") | test("^[0-9a-f]{40}$"))
+            ' >/dev/null; then
+              sha=true
+            fi
+          elif printf '%s' "$PREV" | grep -Eq '^[0-9a-f]{40}$'; then
+            sha=true
+          fi
+          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
+
+      - name: Approve and enable auto-merge
+        if: >-
+          (steps.metadata.outputs.update-type != 'version-update:semver-major' ||
+           steps.sha-pin.outputs.sha == 'true') &&
+          github.event.pull_request.draft == false
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          set -euo pipefail
+          if ! gh pr review --approve "$PR_URL"; then
+            echo "Approve returned non-zero; continuing when a review is already present"
+          fi
+          if gh pr merge --auto --squash "$PR_URL"; then
+            echo "Auto-merge enabled"
+            exit 0
+          fi
+          enabled=$(gh pr view "$PR_URL" --json autoMergeRequest,state --jq 'if .state=="OPEN" and .autoMergeRequest!=null then "yes" else "no" end')
+          if [ "$enabled" = "yes" ]; then
+            echo "Auto-merge was already enabled"
+            exit 0
+          fi
+          echo "Failed to enable auto-merge"
+          exit 1
+
+      - name: Skip major updates
+        if: >-
+          steps.metadata.outputs.update-type == 'version-update:semver-major' &&
+          steps.sha-pin.outputs.sha != 'true'
+        run: echo "Skipping major version update; requires manual review"