openbox-langgraph-sdk-python 0.1.1__tar.gz → 0.2.0__tar.gz

openbox_langgraph_sdk_python-0.2.0/.github/CODEOWNERS

@@ -0,0 +1,10 @@
+# Default owner
+* @datle-krnl
+
+# Governance and release controls
+/.github/workflows/ @datle-krnl
+/.github/CODEOWNERS @datle-krnl
+/.gitleaks.toml @datle-krnl
+/SECURITY.md @datle-krnl
+/LICENSE @datle-krnl
+/pyproject.toml @datle-krnl

openbox_langgraph_sdk_python-0.2.0/.github/workflows/pr-governance.yml

@@ -0,0 +1,128 @@
+name: PR Governance
+
+on:
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - edited
+      - ready_for_review
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: pr-governance-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  governance:
+    name: Validate PR governance
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Validate branch naming
+        if: github.event_name == 'pull_request'
+        env:
+          BRANCH_NAME: ${{ github.head_ref }}
+        run: |
+          pattern='^(feat|fix|hotfix|chore|docs|refactor|test|ci|build|release)\/[a-z0-9._-]+$'
+          if [[ ! "${BRANCH_NAME}" =~ ${pattern} ]]; then
+            echo "Invalid branch name: ${BRANCH_NAME}"
+            echo "Expected pattern: <type>/<short-description>"
+            exit 1
+          fi
+
+      - name: Validate PR title convention
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          pattern='^(feat|fix|chore|docs|refactor|test|build|ci|perf|revert)(\([a-z0-9._/-]+\))?!?: .+$'
+          if [[ ! "${PR_TITLE}" =~ ${pattern} ]]; then
+            echo "Invalid PR title: ${PR_TITLE}"
+            echo "Use Conventional Commits, for example: feat(worker): add hook governance"
+            exit 1
+          fi
+
+      - name: Validate commit messages when enabled
+        if: github.event_name == 'pull_request' && vars.ENFORCE_COMMIT_CONVENTION == 'true'
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: |
+          git fetch origin "${BASE_REF}" --depth=1
+          invalid=0
+          while IFS= read -r subject; do
+            if [[ -z "${subject}" ]]; then
+              continue
+            fi
+            if [[ "${subject}" =~ ^Merge\  ]]; then
+              continue
+            fi
+            if [[ ! "${subject}" =~ ^(feat|fix|chore|docs|refactor|test|build|ci|perf|revert)(\([a-z0-9._/-]+\))?!?:\ .+ ]]; then
+              echo "Invalid commit subject: ${subject}"
+              invalid=1
+            fi
+          done < <(git log --format=%s "origin/${BASE_REF}..HEAD")
+          exit "${invalid}"
+
+      - name: Validate sensitive path ownership policy
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: |
+          git fetch origin "${BASE_REF}" --depth=1
+          mapfile -t changed_files < <(git diff --name-only "origin/${BASE_REF}...HEAD")
+
+          if [ ! -f .github/CODEOWNERS ]; then
+            echo ".github/CODEOWNERS is required"
+            exit 1
+          fi
+
+          needs_check=0
+          for file in "${changed_files[@]}"; do
+            case "${file}" in
+              .github/workflows/*|.github/CODEOWNERS|SECURITY.md|.gitleaks.toml)
+                needs_check=1
+                ;;
+            esac
+          done
+
+          if [ "${needs_check}" -eq 0 ]; then
+            exit 0
+          fi
+
+          declare -A required_entries=(
+            ["/.github/workflows/"]="workflow owners"
+            ["/.github/CODEOWNERS"]="codeowners owners"
+            ["/SECURITY.md"]="security owners"
+            ["/.gitleaks.toml"]="secret scanning owners"
+          )
+
+          missing=()
+          for pattern in "${!required_entries[@]}"; do
+            if ! awk '!/^#/ && NF >= 2 {print $1}' .github/CODEOWNERS | grep -Fxq "${pattern}"; then
+              missing+=("${required_entries[$pattern]} (${pattern})")
+            fi
+          done
+
+          if [ "${#missing[@]}" -gt 0 ]; then
+            printf 'Missing CODEOWNERS coverage for:\n'
+            printf ' - %s\n' "${missing[@]}"
+            exit 1
+          fi
+
+          echo "Sensitive file ownership policy is defined in CODEOWNERS."

openbox_langgraph_sdk_python-0.2.0/.github/workflows/pr-quality.yml

@@ -0,0 +1,204 @@
+name: PR Quality
+
+on:
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write 
+
+concurrency:
+  group: pr-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  PYTHON_VERSION: "3.11"
+  COVERAGE_THRESHOLD: "60"
+  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+  SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+  CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Install dependencies
+        run: uv sync --all-extras --dev
+
+      - name: Run unit tests with coverage
+        id: unit_tests
+        continue-on-error: true
+        run: |
+          uv run pytest tests/ \
+            --cov=openbox_langgraph \
+            --cov-report=xml:coverage.xml \
+            --cov-report=term-missing \
+            --cov-fail-under=${COVERAGE_THRESHOLD} \
+            -v
+
+      - name: Upload coverage report
+        if: ${{ always() && hashFiles('coverage.xml') != '' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-xml
+          path: coverage.xml
+          if-no-files-found: error
+
+      - name: Upload coverage to Codecov
+        if: ${{ always() && env.CODECOV_TOKEN != '' && hashFiles('coverage.xml') != '' }}
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./coverage.xml
+          flags: unittests
+          name: pr-quality
+          fail_ci_if_error: true
+          verbose: true
+          token: ${{ env.CODECOV_TOKEN }}
+
+      - name: Fail job if tests failed
+        if: ${{ steps.unit_tests.outcome == 'failure' }}
+        run: exit 1
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    if: ${{ always() }}
+    needs:
+      - test
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install build tooling
+        run: python -m pip install --upgrade build
+
+      - name: Build package
+        run: python -m build
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-dist
+          path: dist/
+          if-no-files-found: error
+
+  sonarqube:
+    name: SonarQube
+    runs-on: ubuntu-latest
+    if: ${{ always() }}
+    needs:
+      - test
+
+    steps:
+      - name: Skip when SonarQube secrets are not configured
+        if: ${{ env.SONAR_TOKEN == '' || env.SONAR_HOST_URL == '' }}
+        run: echo "Skipping SonarQube because SONAR_TOKEN or SONAR_HOST_URL is not configured."
+
+      - name: Checkout repository
+        if: ${{ env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Download coverage report
+        if: ${{ env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          name: coverage-xml
+          path: .
+
+      - name: Set up Java
+        if: ${{ env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - name: Cache SonarQube packages
+        if: ${{ env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
+        uses: actions/cache@v4
+        with:
+          path: ~/.sonar/cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
+
+      - name: SonarQube scan
+        if: ${{ env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
+        uses: SonarSource/sonarqube-scan-action@v7
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ env.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ env.SONAR_HOST_URL }}
+
+      - name: SonarQube Quality Gate check
+        id: sonarqube_quality_gate
+        if: ${{ env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
+        continue-on-error: true
+        uses: SonarSource/sonarqube-quality-gate-action@master
+        with:
+          pollingTimeoutSec: 600
+        env:
+          SONAR_TOKEN: ${{ env.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ env.SONAR_HOST_URL }}
+
+      - name: Print SonarQube result
+        if: ${{ always() && env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
+        shell: bash
+        run: |
+          status="${{ steps.sonarqube_quality_gate.outputs.quality-gate-status }}"
+          
+          cat << 'EOF'
+          [QUALITY GATE] Checking NEW CODE conditions...
+          - FAIL IF: New Code Issues > 5
+          - FAIL IF: New Code Security Hotspots Reviewed < 100%
+          - FAIL IF: New Code Coverage < 60.0%
+          - FAIL IF: New Code Duplicated Lines > 3.0%
+
+          [QUALITY GATE] Checking OVERALL CODE conditions...
+          - FAIL IF: Overall High Severity Issues > 1
+          - FAIL IF: Overall Medium Severity Issues > 4
+          EOF
+
+          if [[ -z "${status}" ]]; then
+            status="UNKNOWN"
+          fi
+
+          echo "Quality Gate = ${status}"
+
+      - name: Fail job when SonarQube quality gate fails
+        if: ${{ always() && env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' && steps.sonarqube_quality_gate.outcome == 'failure' }}
+        shell: bash
+        run: |
+          echo "SonarQube Quality Gate failed."
+          exit 1

openbox_langgraph_sdk_python-0.2.0/.github/workflows/pr-security.yml

@@ -0,0 +1,173 @@
+name: PR Security
+
+on:
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  pull-requests: read
+  security-events: write
+
+concurrency:
+  group: pr-security-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  GITLEAKS_VERSION: "8.30.0"
+
+jobs:
+  trivy-fs:
+    name: Trivy Filesystem Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Trivy
+        uses: aquasecurity/setup-trivy@e07451d2e059ed86c2870430ea286b3a9e0bf241
+        with:
+          cache: true
+          version: v0.69.2
+
+
+      - name: Run Trivy filesystem scan for console output
+        id: trivy_console
+        continue-on-error: true
+        shell: bash
+        run: |
+          set -euo pipefail
+          trivy fs . \
+            --scanners vuln,misconfig \
+            --vuln-type os,library \
+            --ignore-unfixed \
+            --severity HIGH,CRITICAL \
+            --include-dev-deps \
+            --format table \
+            --exit-code 1
+
+      - name: Run Trivy filesystem scan for SARIF
+        id: trivy_sarif
+        if: always()
+        continue-on-error: true
+        shell: bash
+        run: |
+          set -euo pipefail
+          trivy fs . \
+            --scanners vuln,misconfig \
+            --vuln-type os,library \
+            --ignore-unfixed \
+            --severity HIGH,CRITICAL \
+            --include-dev-deps \
+            --format sarif \
+            --output trivy-fs-results.sarif \
+            --exit-code 1
+
+      - name: Upload Trivy SARIF to GitHub Security
+        if: always()
+        continue-on-error: true
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: trivy-fs-results.sarif
+          category: trivy-fs
+
+      - name: Upload Trivy SARIF artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-fs-results
+          path: trivy-fs-results.sarif
+          if-no-files-found: error
+
+      - name: Fail job when Trivy detects issues
+        if: always()
+        shell: bash
+        run: |
+          if [[ "${{ steps.trivy_console.outcome }}" == "failure" || "${{ steps.trivy_sarif.outcome }}" == "failure" ]]; then
+            echo "Trivy detected HIGH/CRITICAL findings."
+            exit 1
+          fi
+
+  gitleaks:
+    name: Gitleaks
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run Gitleaks SARIF scan
+        id: gitleaks_scan
+        continue-on-error: true
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+          GITLEAKS_CONFIG: .gitleaks.toml
+          GITLEAKS_VERSION: ${{ env.GITLEAKS_VERSION }}
+          GITLEAKS_ENABLE_COMMENTS: "false"
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"
+
+      - name: Ensure Gitleaks SARIF exists
+        if: always()
+        shell: bash
+        run: |
+          if [ ! -s results.sarif ]; then
+            cat > results.sarif <<'SARIF'
+          {
+            "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+            "version": "2.1.0",
+            "runs": [
+              {
+                "tool": {
+                  "driver": {
+                    "name": "gitleaks",
+                    "informationUri": "https://github.com/gitleaks/gitleaks",
+                    "rules": []
+                  }
+                },
+                "results": []
+              }
+            ]
+          }
+          SARIF
+          fi
+
+      - name: Upload Gitleaks SARIF to GitHub Security
+        if: always()
+        continue-on-error: true
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: results.sarif
+          category: gitleaks
+
+      - name: Upload Gitleaks SARIF artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: gitleaks-results
+          path: results.sarif
+          if-no-files-found: error
+
+      - name: Fail job when Gitleaks detects issues
+        if: always()
+        shell: bash
+        run: |
+          if [[ "${{ steps.gitleaks_scan.outcome }}" == "failure" ]]; then
+            echo "Gitleaks detected potential secrets."
+            exit 1
+          fi