nlp2sql 0.2.0rc15__tar.gz → 0.2.0rc16__tar.gz

nlp2sql-0.2.0rc16/.github/scripts/verify_release_tag.py

@@ -0,0 +1,48 @@
+"""Check that a release tag matches the package version before publishing.
+
+The publish workflows run this before building, so a package is only ever
+published from a tag named ``v`` + the ``[project].version`` of pyproject.toml.
+
+Usage: python .github/scripts/verify_release_tag.py v0.2.0rc16
+"""
+
+import argparse
+import re
+import sys
+from pathlib import Path
+from typing import Optional
+
+import tomllib
+
+TAG_PATTERN = re.compile(r"v\d+\.\d+\.\d+(?:(?:a|b|rc)\d+)?")
+PYPROJECT = Path(__file__).resolve().parents[2] / "pyproject.toml"
+SEE_DOCS = "See 'Releasing (maintainers)' in CONTRIBUTING.md."
+
+
+def fail(message: str) -> int:
+    print(f"::error title=Release tag check failed::{message} {SEE_DOCS}")
+    return 1
+
+
+def main(argv: Optional[list[str]] = None) -> int:
+    parser = argparse.ArgumentParser(description="Check that a release tag matches the version in pyproject.toml.")
+    parser.add_argument("tag", help="release tag, for example v0.2.0rc16")
+    tag = parser.parse_args(argv).tag
+
+    if not TAG_PATTERN.fullmatch(tag):
+        return fail(f"'{tag}' is not a release tag: expected vX.Y.Z, optionally followed by aN, bN or rcN.")
+
+    with PYPROJECT.open("rb") as file:
+        version = tomllib.load(file)["project"]["version"]
+    if tag != f"v{version}":
+        return fail(
+            f"Tag {tag} does not match the pyproject.toml version ({version}) of the checked-out commit. "
+            "Was the release created before the version bump was pushed?"
+        )
+
+    print(f"Tag {tag} matches the pyproject.toml version {version}.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

nlp2sql-0.2.0rc16/.github/workflows/ci.yml

@@ -0,0 +1,136 @@
+name: CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v7
+
+    - name: Set up Python 3.12
+      uses: actions/setup-python@v7
+      with:
+        python-version: '3.12'
+
+    - name: Install uv
+      run: python -m pip install uv
+
+    - name: Install dependencies
+      run: |
+        uv pip install --system .
+        uv pip install --system ".[dev]"
+
+    - name: Unit tests
+      env:
+        PYTHONPATH: src
+      run: pytest -m "not integration and not llm" -q
+
+  pgvector-integration:
+    runs-on: ubuntu-24.04
+
+    services:
+      postgres:
+        image: pgvector/pgvector:pg16
+        env:
+          POSTGRES_USER: testuser
+          POSTGRES_PASSWORD: testpass
+          POSTGRES_DB: testdb
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U testuser -d testdb"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v7
+
+    - name: Set up Python 3.12
+      uses: actions/setup-python@v7
+      with:
+        python-version: '3.12'
+
+    - name: Install uv
+      run: python -m pip install uv
+
+    - name: Install dependencies (with pgvector extra)
+      run: |
+        uv pip install --system ".[dev]"
+        uv pip install --system ".[pgvector]"
+
+    - name: Load the e-commerce test schema
+      env:
+        PGPASSWORD: testpass
+      run: psql -h localhost -U testuser -d testdb -v ON_ERROR_STOP=1 -q -f docker/init-schema.sql
+
+    # Scoped suites so the job stays self-contained (the broader integration
+    # suite also needs LocalStack Redshift, out of scope here).
+    # NLP2SQL_REQUIRE_INTEGRATION makes the fixtures FAIL instead of skip, so a
+    # misconfigured service goes red rather than green-via-skip.
+    - name: pgvector integration tests
+      env:
+        PYTHONPATH: src
+        NLP2SQL_REQUIRE_INTEGRATION: "1"
+        NLP2SQL_TEST_POSTGRES_HOST: localhost
+        NLP2SQL_TEST_POSTGRES_PORT: "5432"
+        NLP2SQL_TEST_POSTGRES_USER: testuser
+        NLP2SQL_TEST_POSTGRES_PASS: testpass
+        NLP2SQL_TEST_POSTGRES_DB: testdb
+      run: pytest tests/test_pgvector_example_repository.py -m integration -q
+
+    # README Quick Start per provider and the false-invalid gold set, with the
+    # OpenAI SDK pointed at tests/fakes/fake_openai.py (no keys, no cost).
+    - name: First-run regression tests
+      env:
+        PYTHONPATH: src
+        NLP2SQL_REQUIRE_INTEGRATION: "1"
+        NLP2SQL_TEST_POSTGRES_HOST: localhost
+        NLP2SQL_TEST_POSTGRES_PORT: "5432"
+        NLP2SQL_TEST_POSTGRES_USER: testuser
+        NLP2SQL_TEST_POSTGRES_PASS: testpass
+        NLP2SQL_TEST_POSTGRES_DB: testdb
+      run: pytest tests/test_first_run.py tests/test_false_invalid_regression.py -m integration -q
+
+  # Installs the built wheel the way a user does: fresh environment, no lock
+  # file, latest dependency versions. Catches undeclared dependencies (rc13-rc15
+  # could not be imported without pyyaml) that the locked dev environment hides.
+  clean-install:
+    runs-on: ubuntu-24.04
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v7
+
+    - name: Set up Python 3.12
+      uses: actions/setup-python@v7
+      with:
+        python-version: '3.12'
+
+    - name: Build the wheel
+      run: |
+        python -m pip install build
+        python -m build --wheel
+
+    - name: Install the wheel in a fresh environment
+      run: |
+        python -m venv "$RUNNER_TEMP/clean"
+        "$RUNNER_TEMP/clean/bin/pip" install dist/*.whl
+        "$RUNNER_TEMP/clean/bin/pip" list | grep -iE "^(openai|anthropic|google-generativeai|pyyaml) "
+
+    - name: Import the package and run the CLI
+      working-directory: ${{ runner.temp }}
+      run: |
+        "$RUNNER_TEMP/clean/bin/python" -c "import nlp2sql; print('nlp2sql', nlp2sql.__version__)"
+        "$RUNNER_TEMP/clean/bin/nlp2sql" --help

nlp2sql-0.2.0rc16/.github/workflows/publish-pypi.yml

@@ -0,0 +1,115 @@
+name: Publish Python Package to PyPI
+
+# Production releases are decided by a tag: run this workflow from the release
+# tag (Run workflow -> Use workflow from -> Tags -> vX.Y.Z). A run from a branch
+# fails before anything is checked out. See "Releasing (maintainers)" in
+# CONTRIBUTING.md.
+
+on:
+  workflow_dispatch:
+    inputs:
+      confirm_production:
+        description: 'Type "PRODUCTION" to confirm publishing to live PyPI'
+        required: true
+        default: ''
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+
+    steps:
+    - name: Require a tag ref
+      run: |
+        if [ "$GITHUB_REF_TYPE" != "tag" ]; then
+          echo "::error title=Not a tag::Run this workflow from a release tag (Use workflow from -> Tags), not from '$GITHUB_REF_NAME'."
+          exit 1
+        fi
+
+    - name: Validate production confirmation
+      env:
+        CONFIRM_PRODUCTION: ${{ inputs.confirm_production }}
+      run: |
+        if [ "$CONFIRM_PRODUCTION" != "PRODUCTION" ]; then
+          echo "::error::Production confirmation required. Type PRODUCTION to confirm."
+          exit 1
+        fi
+
+    - name: Require a published GitHub Release for the tag
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        is_draft=$(gh release view "$GITHUB_REF_NAME" -R "$GITHUB_REPOSITORY" --json isDraft -q .isDraft) || {
+          echo "::error::No GitHub Release found for $GITHUB_REF_NAME. Create and publish the release first."
+          exit 1
+        }
+        if [ "$is_draft" != "false" ]; then
+          echo "::error::The GitHub Release for $GITHUB_REF_NAME is still a draft."
+          exit 1
+        fi
+
+    - name: Checkout the tag
+      uses: actions/checkout@v7
+      with:
+        persist-credentials: false
+
+    - name: Set up Python 3.12
+      uses: actions/setup-python@v7
+      with:
+        python-version: '3.12'
+
+    - name: Verify the tag matches the package version
+      run: |
+        echo "Tag: $GITHUB_REF_NAME, commit: $GITHUB_SHA"
+        python .github/scripts/verify_release_tag.py "$GITHUB_REF_NAME"
+
+    - name: Install uv
+      run: python -m pip install uv
+
+    - name: Install project dependencies with uv
+      run: |
+        uv pip install --system .
+        uv pip install --system ".[dev]"
+
+    - name: Install build
+      run: python -m pip install build
+
+    - name: Run tests
+      env:
+        PYTHONPATH: src
+      run: pytest
+
+    - name: Build package
+      run: python -m build
+
+    - name: Upload distributions
+      uses: actions/upload-artifact@v7
+      with:
+        name: dist
+        path: dist/
+        if-no-files-found: error
+
+  publish:
+    needs: build
+    runs-on: ubuntu-24.04
+    environment: pypi
+
+    # Only this job can request a PyPI token (Trusted Publishing via OIDC), and
+    # it runs no project or third-party Python code.
+    permissions:
+      id-token: write
+
+    steps:
+    - name: Download distributions
+      uses: actions/download-artifact@v8
+      with:
+        name: dist
+        path: dist/
+
+    - name: Publish to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        repository-url: https://upload.pypi.org/legacy/

nlp2sql-0.2.0rc16/.github/workflows/publish-testpypi.yml

@@ -0,0 +1,90 @@
+name: Publish Python Package to Test PyPI
+
+# Runs automatically on the release tag when a GitHub Release is published, and
+# can be re-run manually from a tag (Use workflow from -> Tags -> vX.Y.Z). A run
+# from a branch fails before anything is checked out. See "Releasing
+# (maintainers)" in CONTRIBUTING.md.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+
+    steps:
+    - name: Require a tag ref
+      run: |
+        if [ "$GITHUB_REF_TYPE" != "tag" ]; then
+          echo "::error title=Not a tag::Run this workflow from a release tag (Use workflow from -> Tags), not from '$GITHUB_REF_NAME'."
+          exit 1
+        fi
+
+    - name: Checkout the tag
+      uses: actions/checkout@v7
+      with:
+        persist-credentials: false
+
+    - name: Set up Python 3.12
+      uses: actions/setup-python@v7
+      with:
+        python-version: '3.12'
+
+    - name: Verify the tag matches the package version
+      run: |
+        echo "Tag: $GITHUB_REF_NAME, commit: $GITHUB_SHA"
+        python .github/scripts/verify_release_tag.py "$GITHUB_REF_NAME"
+
+    - name: Install uv
+      run: python -m pip install uv
+
+    - name: Install project dependencies with uv
+      run: |
+        uv pip install --system .
+        uv pip install --system ".[dev]"
+
+    - name: Install build
+      run: python -m pip install build
+
+    - name: Run tests
+      env:
+        PYTHONPATH: src
+      run: pytest
+
+    - name: Build package
+      run: python -m build
+
+    - name: Upload distributions
+      uses: actions/upload-artifact@v7
+      with:
+        name: dist
+        path: dist/
+        if-no-files-found: error
+
+  publish:
+    needs: build
+    runs-on: ubuntu-24.04
+    environment: testpypi
+
+    # Only this job can request a Test PyPI token (Trusted Publishing via OIDC),
+    # and it runs no project or third-party Python code.
+    permissions:
+      id-token: write
+
+    steps:
+    - name: Download distributions
+      uses: actions/download-artifact@v8
+      with:
+        name: dist
+        path: dist/
+
+    - name: Publish to Test PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        repository-url: https://test.pypi.org/legacy/

{nlp2sql-0.2.0rc15 → nlp2sql-0.2.0rc16}/CHANGELOG.md

@@ -22,6 +22,49 @@ pre-1.0.
 
 ## [Unreleased]
 
+## [0.2.0rc16] - 2026-10-19
+
+### Changed
+- Release: packages are published to PyPI only from a release tag whose name
+  matches the `pyproject.toml` version and that has a published GitHub Release.
+  The publish workflows build in one job and upload from another, so only the
+  upload job can request a PyPI token.
+- CI: runs on `ubuntu-24.04` with the Node 24 versions of `actions/checkout` and
+  `actions/setup-python`, and fails when any copy of the package version is out
+  of sync with `pyproject.toml`.
+- CI: a `clean-install` job installs the built wheel in a fresh environment
+  without the lock file, and the integration lane runs the README Quick Start
+  and a false-invalid regression set against a local fake of the OpenAI API.
+
+### Fixed
+- `import nlp2sql` failed on a plain `pip install nlp2sql` since 0.2.0rc13
+  (`No module named 'yaml'`): `pyyaml` is now a declared dependency.
+- `connect()` raised `Unknown embedding provider` with
+  `ProviderConfig(provider="anthropic")` or `"gemini"`, and with OpenAI failed
+  unless `OPENAI_API_KEY` was exported, because the `ProviderConfig` key never
+  reached the embedding adapter. Without an explicit embedding provider,
+  OpenAI chat now uses OpenAI embeddings with the same key; other providers use
+  local embeddings when `nlp2sql[embeddings-local]` is installed and no
+  embeddings otherwise. Few-shot examples share that provider, and are skipped
+  with a warning when there is none.
+- Correct queries came back with `is_valid=False` when they did not use the
+  table the heuristic intent plan guessed from the question (4 of 14 in a
+  sample of realistic questions), even with no semantic layer. Plan-derived
+  expectations are now warnings; rules from a semantic layer are still errors.
+- `is_valid` was `True` for queries that write (`DELETE ...` in the default
+  `generate_only` mode) and for queries whose execution failed. Both are now
+  invalid, with the reason in the validation errors.
+- The read-only check rejected valid queries with keywords inside string
+  literals (`WHERE name = 'Gift Set'`), and allowed functions with side effects
+  such as `pg_terminate_backend`, `set_config`, `nextval` or `dblink`. It now
+  ignores literals and rejects those functions.
+- `generate_sql(max_tokens=...)` and the CLI `--max-tokens` (default 1000) also
+  capped the schema context sent to the model; the schema budget is now always
+  `NLP2SQL_MAX_SCHEMA_TOKENS`.
+- `nlp2sql setup` crashed when configuring a database (it called the
+  nonexistent `click.choice`), and offered MySQL and SQLite, which have no
+  adapter. It now offers PostgreSQL and Redshift.
+
 ## [0.2.0rc15] - 2026-09-18
 
 ### Changed

{nlp2sql-0.2.0rc15 → nlp2sql-0.2.0rc16}/CONTRIBUTING.md

@@ -233,6 +233,22 @@ Brief description of changes and why they're needed.
 4. **Documentation review** for user-facing changes
 5. **Merge** after approval
 
+## Releasing (maintainers)
+
+Packages are published only from a release tag. Both publish workflows refuse to run from a branch and check that the tag name is `v` followed by the `version` in `pyproject.toml`, so the latest commit on `main` never goes to PyPI by accident.
+
+1. **Bump the version** in every copy and move the `CHANGELOG.md` entries from `[Unreleased]` to a new `## [X.Y.Z] - YYYY-MM-DD` section. The copies are `pyproject.toml`, `src/nlp2sql/__init__.py`, `src/nlp2sql/config/settings.py`, `mcp_server/pyproject.toml` (`[project]` and `[tool.mcp]`), `mcp_server/__init__.py` and `uv.lock` (run `uv lock`). `tests/test_version_consistency.py` fails if any of them is out of sync.
+2. **Push the bump to `main` before creating the release.** The new tag points to whatever `main` is at that moment. To check a tag name against the current version, run `python .github/scripts/verify_release_tag.py vX.Y.Z`.
+3. **Create the GitHub Release** with a new tag `vX.Y.Z` targeting `main`. Publishing the release runs "Publish Python Package to Test PyPI" on that tag automatically.
+4. **Run the integration tests locally** on the tagged commit, with the test databases running (see [Development Setup](#development-setup)).
+5. **Publish to PyPI**: in **Actions**, open **Publish Python Package to PyPI**, click **Run workflow**, pick the tag under **Use workflow from** (Tags tab) and type `PRODUCTION`. From the command line:
+
+   ```bash
+   gh workflow run publish-pypi.yml --ref vX.Y.Z -f confirm_production=PRODUCTION
+   ```
+
+The PyPI workflow stops before building if the run is not on a tag, if the tag has no published GitHub Release, or if the tag does not match the package version. Only its final job, which runs no project code, can request a PyPI token.
+
 ## Enterprise Contribution Guidelines
 
 ### Performance Considerations

{nlp2sql-0.2.0rc15 → nlp2sql-0.2.0rc16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: nlp2sql
-Version: 0.2.0rc15
+Version: 0.2.0rc16
 Summary: Enterprise-ready Natural Language to SQL converter with multi-provider support. Built for production scale (1000+ tables) with Clean Architecture.
 Project-URL: Homepage, https://github.com/luiscarbonel1991/nlp2sql
 Project-URL: Bug Tracker, https://github.com/luiscarbonel1991/nlp2sql/issues
@@ -36,6 +36,7 @@ Requires-Dist: psycopg2-binary>=2.9.0
 Requires-Dist: psycopg[binary]>=3.2.13
 Requires-Dist: pydantic-settings>=2.0.0
 Requires-Dist: pydantic>=2.5.0
+Requires-Dist: pyyaml>=6.0
 Requires-Dist: redis>=5.0.0
 Requires-Dist: scikit-learn>=1.3.0
 Requires-Dist: sqlalchemy-redshift>=0.7.0

{nlp2sql-0.2.0rc15 → nlp2sql-0.2.0rc16}/mcp_server/__init__.py

@@ -1,3 +1,3 @@
 """nlp2sql MCP Server - Expose nlp2sql as MCP tools."""
 
-__version__ = "0.2.0rc15"
+__version__ = "0.2.0rc16"

{nlp2sql-0.2.0rc15 → nlp2sql-0.2.0rc16}/mcp_server/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "nlp2sql-mcp"
-version = "0.2.0rc15"
+version = "0.2.0rc16"
 description = "MCP server for nlp2sql - Natural Language to SQL conversion"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -21,4 +21,4 @@ build-backend = "hatchling.build"
 [tool.mcp]
 name = "nlp2sql"
 description = "Convert natural language queries to SQL using multiple AI providers"
-version = "0.2.0rc15"
+version = "0.2.0rc16"

{nlp2sql-0.2.0rc15 → nlp2sql-0.2.0rc16}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "nlp2sql"
-version = "0.2.0rc15"
+version = "0.2.0rc16"
 description = "Enterprise-ready Natural Language to SQL converter with multi-provider support. Built for production scale (1000+ tables) with Clean Architecture."
 readme = "README.md"
 license = {text = "MIT"}
@@ -43,6 +43,7 @@ dependencies = [
     "pandas>=2.0.0",
     "greenlet>=3.2.3",
     "click>=8.0.0",
+    "pyyaml>=6.0",
     "psycopg[binary]>=3.2.13",
     "sqlalchemy-redshift>=0.7.0",
 ]

{nlp2sql-0.2.0rc15 → nlp2sql-0.2.0rc16}/src/nlp2sql/__init__.py

@@ -46,7 +46,7 @@ from .ports.semantic_validator import SemanticValidatorPort
 from .schema.example_store import ExampleStore
 from .services.query_service import QueryGenerationService
 
-__version__ = "0.2.0rc15"
+__version__ = "0.2.0rc16"
 __author__ = "Luis Carbonel"
 __email__ = "devhighlevel@gmail.com"
 
@@ -303,9 +303,10 @@ def create_query_service(
     if embedding_provider is None:
         if embedding_provider_type is not None:
             # Explicit provider requested - raise error if dependencies missing
+            # Reuse the chat key (from api_key or provider_config) only when chat is also OpenAI
             embedding_provider = create_embedding_provider(
                 provider=embedding_provider_type,
-                api_key=api_key if embedding_provider_type == "openai" else None,
+                api_key=_api_key if embedding_provider_type == "openai" and _provider_name == "openai" else None,
             )
         else:
             # No explicit provider - try local silently, fallback to None if deps missing

{nlp2sql-0.2.0rc15 → nlp2sql-0.2.0rc16}/src/nlp2sql/cli.py

@@ -602,29 +602,17 @@ def _setup_database():
     click.echo("\n[STATS] Database Configuration")
     click.echo("-" * 30)
 
-    db_type = click.choice(["postgresql", "mysql", "sqlite"], prompt="Select database type")
+    # Only the databases nlp2sql has adapters for
+    db_type = click.prompt("Select database type", type=click.Choice(["postgresql", "redshift"]), default="postgresql")
+    default_port = "5432" if db_type == "postgresql" else "5439"
 
-    if db_type == "postgresql":
-        host = click.prompt("Host", default="localhost")
-        port = click.prompt("Port", default="5432")
-        username = click.prompt("Username")
-        password = click.prompt("Password", hide_input=True)
-        database = click.prompt("Database name")
+    host = click.prompt("Host", default="localhost")
+    port = click.prompt("Port", default=default_port)
+    username = click.prompt("Username")
+    password = click.prompt("Password", hide_input=True)
+    database = click.prompt("Database name")
 
-        db_url = f"postgresql://{username}:{password}@{host}:{port}/{database}"
-
-    elif db_type == "mysql":
-        host = click.prompt("Host", default="localhost")
-        port = click.prompt("Port", default="3306")
-        username = click.prompt("Username")
-        password = click.prompt("Password", hide_input=True)
-        database = click.prompt("Database name")
-
-        db_url = f"mysql://{username}:{password}@{host}:{port}/{database}"
-
-    else:  # sqlite
-        db_path = click.prompt("Database file path")
-        db_url = f"sqlite:///{db_path}"
+    db_url = f"{db_type}://{username}:{password}@{host}:{port}/{database}"
 
     click.echo(f"\nNote: Connection string: {db_url}")
     click.echo("Hint: Save this to your environment:")