ontary 0.10.0__tar.gz

ontary-0.10.0/.github/workflows/release.yml

@@ -0,0 +1,64 @@
+name: release
+
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - name: Check tag matches project version
+        run: |
+          tag_version="${GITHUB_REF_NAME#v}"
+          project_version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
+          if [ "$tag_version" != "$project_version" ]; then
+            echo "Tag version $tag_version does not match project version $project_version"
+            exit 1
+          fi
+      - name: Install dependencies
+        run: uv sync --all-extras
+      - name: make verify
+        run: make verify
+      - name: Build sdist + wheel
+        run: uv build --out-dir dist
+      - name: Install the wheel into an empty environment
+        run: |
+          uv venv --python 3.12 /tmp/clean
+          VIRTUAL_ENV=/tmp/clean uv pip install dist/*.whl
+      - name: Smoke-test the installed package
+        run: /tmp/clean/bin/python scripts/install_smoke.py
+      - name: Upload the distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    # The only job that can reach PyPI. It holds `id-token: write` so PyPI's
+    # trusted publishing can mint a short-lived token from the OIDC identity of
+    # THIS workflow on THIS repository (registered once on PyPI, see
+    # docs/releasing.md "One-time setup"). No long-lived API token is stored
+    # anywhere. It publishes exactly the bytes `gate` built and smoke-tested;
+    # it never rebuilds.
+    needs: gate
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Download the distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Publish the distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

ontary-0.10.0/.github/workflows/verify.yml

@@ -0,0 +1,180 @@
+name: verify
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - name: Install dependencies
+        run: uv sync --all-extras
+      - name: make verify
+        run: make verify
+
+  # The Postgres backend's real gate (M8a). `verify` above runs the conformance
+  # suite against SQLite and in-memory only, because `make verify` is defined as
+  # offline and no-DB and breaking that would make the gate unrunnable on a
+  # laptop. So the third backend gets a job with a real server: same suite, same
+  # assertions, one more `STORE_FACTORIES` entry. Without this, `PostgresStore`
+  # would be exactly the "nothing ever tested this" hole M6 found in packaging.
+  postgres:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - name: Install dependencies
+        run: uv sync --all-extras
+      - name: Conformance suite + backend tests against Postgres
+        env:
+          ONTARY_TEST_POSTGRES_DSN: postgresql://postgres:postgres@localhost:5432/postgres
+        run: |
+          uv run pytest tests/test_store_conformance.py tests/test_store_postgres.py \
+            tests/test_multi_tenancy.py tests/test_erase.py tests/test_actions.py \
+            tests/test_examples_tickets_e2e.py -q
+
+      # Storage envelope curve (spec `storage-envelope.md` AC1/AC2/AC10). This
+      # is the PUBLISHED, reader-reproducible Postgres curve -- run on this
+      # fixed `postgres:16` service, not a developer machine (spec §4: "a
+      # laptop number is not reproducible by a reader"). It asserts no timing
+      # threshold and never gates the merge (L23); `continue-on-error` means
+      # its failure or absence is reported in this job's own log, never
+      # silently treated as a measured number (L30). `docs/storage.md` now
+      # quotes `PostgresStore` figures derived from this exact step's own CI
+      # runs, not a laptop: the local Homebrew 17.11 run this comment used
+      # to point readers at was superseded by 55ad234 during this feature's own
+      # development, and is kept in that section only as labelled, superseded provenance.
+      # Reconcile a future log against `docs/storage.md#storage-envelope`'s
+      # own publication rule instead: a slower worst point earns a new run
+      # table and lowers the published floor; anything else is recorded in
+      # the observed-run log there without one.
+      - name: Storage envelope curve (informational, non-gating)
+        continue-on-error: true
+        run: |
+          uv run python scripts/scan_curve.py 1000 5000 25000 --uncached \
+            --dsn postgresql://postgres:postgres@localhost:5432/postgres
+
+  upgrade-fixture-honesty:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        tag: [v0.7.0, v0.8.0, v0.9.0, v0.10.0]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Resolve the old ref (tag, or the PR head for the untagged current version)
+        id: resolve-old-ref
+        run: |
+          version=$(grep -m1 '^version = "' pyproject.toml | sed -E 's/^version = "([^"]+)"$/\1/')
+          if git ls-remote --tags origin "refs/tags/${{ matrix.tag }}" | grep -q .; then
+            echo "ref=${{ matrix.tag }}" >> "$GITHUB_OUTPUT"
+            echo "mode=tag" >> "$GITHUB_OUTPUT"
+          elif [ "${{ matrix.tag }}" = "v$version" ]; then
+            echo "ref=${{ github.sha }}" >> "$GITHUB_OUTPUT"
+            echo "mode=untagged-current" >> "$GITHUB_OUTPUT"
+            echo "::warning::upgrade-fixture-honesty (${{ matrix.tag }}): tag not found; running the CURRENT version's leg against the PR head ${{ github.sha }} (mode=untagged-current)"
+          else
+            echo "::error::upgrade-fixture-honesty (${{ matrix.tag }}): tag not found on origin and ${{ matrix.tag }} is not the current version (v$version); a missing tag for a non-current version is a defect, not a fallback"
+            exit 1
+          fi
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.resolve-old-ref.outputs.ref }}
+          path: old
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - name: Prove the old checkout is the exact tag
+        run: |
+          mode="${{ steps.resolve-old-ref.outputs.mode }}"
+          if [ "$mode" = "tag" ]; then
+            actual=$(git -C old describe --tags --exact-match)
+            test "$actual" = "${{ matrix.tag }}"
+          elif [ "$mode" = "untagged-current" ]; then
+            old_version=$(grep -m1 '^version = "' old/pyproject.toml | sed -E 's/^version = "([^"]+)"$/\1/')
+            test "v$old_version" = "${{ matrix.tag }}"
+            echo "::warning::upgrade-fixture-honesty (${{ matrix.tag }}): tag not found; running the CURRENT version's leg against the PR head ${{ github.sha }} (mode=untagged-current)"
+          else
+            echo "::error::upgrade-fixture-honesty (${{ matrix.tag }}): unknown mode '$mode' from the resolve step"
+            exit 1
+          fi
+      - name: Install the tagged package into an isolated environment
+        run: |
+          uv venv old/.venv
+          uv pip install --python old/.venv/bin/python ./old
+      - name: Save the committed fixtures before regeneration
+        run: |
+          cp "tests/fixtures/upgrade/${{ matrix.tag }}/tickets.sqlite" \
+            "$RUNNER_TEMP/committed-tickets.sqlite"
+          cp "tests/fixtures/upgrade/${{ matrix.tag }}/expected.json" \
+            "$RUNNER_TEMP/committed-expected.json"
+      - name: Regenerate with the tagged package and frozen writer
+        run: |
+          tag="${{ matrix.tag }}"
+          writer_version="${tag#v}"
+          writer_version="${writer_version//./_}"
+          PYTHONPATH="$PWD/old" old/.venv/bin/python \
+            "tests/fixtures/upgrade/writers/write_v${writer_version}.py"
+      - name: Compare regenerated fixtures with committed fixtures
+        run: |
+          uv run python scripts/dump_store.py \
+            "tests/fixtures/upgrade/${{ matrix.tag }}/tickets.sqlite" \
+            > "$RUNNER_TEMP/regenerated-store.json"
+          uv run python scripts/dump_store.py "$RUNNER_TEMP/committed-tickets.sqlite" \
+            > "$RUNNER_TEMP/committed-store.json"
+          diff -u "$RUNNER_TEMP/committed-store.json" \
+            "$RUNNER_TEMP/regenerated-store.json"
+          diff -u "$RUNNER_TEMP/committed-expected.json" \
+            "tests/fixtures/upgrade/${{ matrix.tag }}/expected.json"
+
+  # The check that had never existed (M6 step 3). `verify` above runs from the
+  # source tree with every extra installed -- precisely the environment an
+  # outside adopter does NOT have. Their first command is
+  # `pip install ontary`, and nothing verified that path until a manual
+  # clean-venv install turned up `ontary-mcp` dying on a bare
+  # `ModuleNotFoundError`. Deliberately NO extras and no dev dependencies here:
+  # installing pytest would defeat the point, which is why the smoke test is a
+  # plain script rather than a test module.
+  package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - name: Build sdist + wheel
+        run: uv build --out-dir dist
+      - name: Install the wheel into an empty environment
+        run: |
+          uv venv --python 3.12 /tmp/clean
+          VIRTUAL_ENV=/tmp/clean uv pip install dist/*.whl
+      - name: Smoke-test the installed package
+        run: /tmp/clean/bin/python scripts/install_smoke.py
+      - name: Upload the distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/

ontary-0.10.0/.gitignore

@@ -0,0 +1,9 @@
+.venv/
+__pycache__/
+*.egg-info/
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+*.db
+.DS_Store
+uv.lock.bak