openretailscience 0.46.0__tar.gz → 0.47.0__tar.gz

{openretailscience-0.46.0 → openretailscience-0.47.0}/.github/dependabot.yml

@@ -5,6 +5,8 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: "chore(deps)"
       prefix-development: "chore(deps-dev)"
@@ -13,3 +15,16 @@ updates:
         dependency-type: "production"
       development-dependencies:
         dependency-type: "development"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      actions-minor-patch:
+        update-types: ["minor", "patch"]

openretailscience-0.47.0/.github/workflows/bigquery-integration.yml

@@ -0,0 +1,48 @@
+name: BigQuery Integration Tests
+
+on:
+  workflow_dispatch:
+  workflow_call:
+    secrets:
+      GCP_SA_KEY:
+        required: true
+      GCP_PROJECT_ID:
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  integration-tests:
+    name: Run BigQuery Integration Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Setup Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+
+      - name: Install Dependencies
+        run: |
+          uv sync --locked
+
+      - name: Set up GCP Authentication
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+        with:
+          credentials_json: ${{ secrets.GCP_SA_KEY }}
+
+      - name: Run Integration Tests
+        env:
+          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
+        run: |
+          uv run pytest tests/integration -k "bigquery" -v

{openretailscience-0.46.0 → openretailscience-0.47.0}/.github/workflows/claude-code-review.yml

@@ -27,13 +27,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           track_progress: true

{openretailscience-0.46.0 → openretailscience-0.47.0}/.github/workflows/claude.yml

@@ -27,7 +27,7 @@ jobs:
     steps:
       - name: Check user permissions
         id: check_permissions
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             let actor;
@@ -60,7 +60,7 @@ jobs:
 
       - name: Comment on permission denied
         if: steps.check_permissions.outputs.has_permission == 'false'
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             let issueNumber;
@@ -85,14 +85,15 @@ jobs:
 
       - name: Checkout repository
         if: steps.check_permissions.outputs.has_permission == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code
         if: steps.check_permissions.outputs.has_permission == 'true'
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

{openretailscience-0.46.0 → openretailscience-0.47.0}/.github/workflows/cloudflare-docs-preview.yml

@@ -22,20 +22,21 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
-
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
 
-      - name: Install uv Package
-        run: |
-          pip install --upgrade pip
-          pip install uv==0.5.30
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
 
       - name: Install Dependencies
-        run: uv sync
+        run: uv sync --locked
 
       - name: Build docs
         run: uv run mkdocs build
@@ -50,7 +51,7 @@ jobs:
 
       - name: Publish to Cloudflare Pages
         id: cloudflare-deploy
-        uses: cloudflare/pages-action@v1
+        uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1.5.0
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -61,7 +62,7 @@ jobs:
 
       - name: Find existing comment
         if: github.event_name == 'pull_request'
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
         id: find-comment
         with:
           issue-number: ${{ github.event.pull_request.number }}
@@ -70,7 +71,7 @@ jobs:
 
       - name: Create or update deployment comment
         if: github.event_name == 'pull_request'
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}
@@ -88,7 +89,7 @@ jobs:
 
       - name: Comment on deployment failure
         if: failure() && github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             github.rest.issues.createComment({

openretailscience-0.47.0/.github/workflows/gh-page.yml

@@ -0,0 +1,46 @@
+name: Page Deploy
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+jobs:
+  docs:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Setup Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.11"
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+      - name: Install Dependencies
+        run: uv sync --locked
+      - name: Build docs
+        run: uv run mkdocs build
+      - name: Setup Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: "site/"
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

openretailscience-0.47.0/.github/workflows/pyspark-integration.yml

@@ -0,0 +1,36 @@
+name: PySpark Integration Tests
+
+on:
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  integration-tests:
+    name: Run PySpark Integration Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Setup Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+
+      - name: Install Dependencies
+        run: |
+          uv sync --locked
+
+      - name: Run Integration Tests
+        run: |
+          uv run pytest tests/integration -k "pyspark" -v

{openretailscience-0.46.0 → openretailscience-0.47.0}/.github/workflows/release.yml

@@ -11,9 +11,7 @@ on:
           - minor
           - patch
 permissions:
-  contents: write
-  deployments: write
-  packages: write
+  contents: read
 concurrency:
   group: "release"
   cancel-in-progress: false
@@ -21,92 +19,79 @@ jobs:
   pre-commit:
     name: Pre-Commit Checks
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
-      - name: Install UV
-        run: |
-          pip install --upgrade pip
-          pip install uv==0.5.30
-          uv sync
-      - name: Install Pre-commit in uv environment
-        run: uv run pip install pre-commit
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+      - name: Install dependencies
+        run: uv sync --locked
       - name: Run Pre-commit
-        run: pre-commit run --all-files
+        run: uv run pre-commit run --all-files
+
+  security-audit:
+    name: Dependency Security Audit
+    uses: ./.github/workflows/security-audit.yml
+    permissions:
+      contents: read
+      security-events: write
 
   bigquery-integration-tests:
     name: BigQuery Integration Tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-      - name: Install uv Package
-        run: |
-          pip install --upgrade pip
-          pip install uv==0.5.30
-      - name: Install Dependencies
-        run: |
-          uv sync
-      - name: Set up GCP Authentication
-        uses: google-github-actions/auth@v2
-        with:
-          credentials_json: ${{ secrets.GCP_SA_KEY }}
-      - name: Run BigQuery Integration Tests
-        env:
-          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
-        run: |
-          uv run pytest tests/integration -k "bigquery" -v
+    uses: ./.github/workflows/bigquery-integration.yml
+    secrets:
+      GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+      GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
 
   pyspark-integration-tests:
     name: PySpark Integration Tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-      - name: Install uv Package
-        run: |
-          pip install --upgrade pip
-          pip install uv==0.5.30
-      - name: Install Dependencies
-        run: |
-          uv sync
-      - name: Run PySpark Integration Tests
-        run: |
-          uv run pytest tests/integration -k "pyspark" -v
+    uses: ./.github/workflows/pyspark-integration.yml
+
+  snowflake-integration-tests:
+    name: Snowflake Integration Tests
+    uses: ./.github/workflows/snowflake-integration.yml
+    secrets:
+      GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+      GCP_INFRA_PROJECT_ID: ${{ secrets.GCP_INFRA_PROJECT_ID }}
+      SNOWFLAKE_CI_ACCOUNT: ${{ secrets.SNOWFLAKE_CI_ACCOUNT }}
+      SNOWFLAKE_CI_USER: ${{ secrets.SNOWFLAKE_CI_USER }}
+      SNOWFLAKE_CI_WAREHOUSE: ${{ secrets.SNOWFLAKE_CI_WAREHOUSE }}
+      SNOWFLAKE_CI_DATABASE: ${{ secrets.SNOWFLAKE_CI_DATABASE }}
+      SNOWFLAKE_CI_SCHEMA: ${{ secrets.SNOWFLAKE_CI_SCHEMA }}
 
   multi-python-tests:
     name: Multi-Python Version Tests
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
-      - name: Install UV
-        run: |
-          pip install --upgrade pip
-          pip install uv==0.5.30
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
       - name: Install dependencies
         run: |
-          uv sync
+          uv sync --locked
       - name: Run tests (excluding integration)
         run: |
           uv run pytest tests/ --ignore=tests/integration --tb=short -v
@@ -114,23 +99,30 @@ jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
-    needs: [pre-commit, bigquery-integration-tests, pyspark-integration-tests, multi-python-tests]
+    timeout-minutes: 15
+    needs: [security-audit, pre-commit, bigquery-integration-tests, pyspark-integration-tests, snowflake-integration-tests, multi-python-tests]
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
     env:
       CI_COMMIT_MESSAGE: Continuous Integration Version Bump ${{ inputs.release }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      # zizmor: ignore[artipacked] this job pushes the version-bump commit and
+      # tag, so it requires the GITHUB_TOKEN persisted by actions/checkout. Only
+      # dist/ is uploaded as an artifact, not .git/, so the token is not exposed.
+      - name: Checkout # zizmor: ignore[artipacked]
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
-      - name: Install uv Package
-        run: |
-          pip install --upgrade pip
-          pip install build
-          pip install uv==0.5.30
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
       - name: Install Dependencies
-        run: uv sync --group dev
+        run: uv sync --locked --group dev
       - name: Bump Version
         run: |
           uv run python - <<EOF
@@ -153,8 +145,12 @@ jobs:
           EOF
           echo "RELEASE_TAG=$(uv run python -c 'from tomlkit.toml_file import TOMLFile; print(TOMLFile("pyproject.toml").read()["project"]["version"])')" >> $GITHUB_ENV
       - name: Build package
-        run: python -m build
-      - uses: actions/upload-artifact@v4
+        run: uv build
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        with:
+          subject-path: "dist/*"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: build
           path: dist/
@@ -164,38 +160,19 @@ jobs:
           git config user.name 'github-actions[bot]'
           git config user.email 'github-actions[bot]@users.noreply.github.com'
           git add pyproject.toml
-          git commit -m "${{ env.CI_COMMIT_MESSAGE }}"
+          git commit -m "$CI_COMMIT_MESSAGE"
           git push
           echo "Tagging new version: $RELEASE_TAG"
           git tag -a "$RELEASE_TAG" -m "Auto-generated tag"
           git push origin "$RELEASE_TAG"
-      - name: "Create release"
-        uses: actions/github-script@v7
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-          script: |
-            if (!process.env.RELEASE_TAG) {
-              core.setFailed("The environment variable RELEASE_TAG is not defined.");
-              return;
-            }
-            try {
-              const response = await github.rest.repos.createRelease({
-                draft: false,
-                generate_release_notes: true,
-                name: process.env.RELEASE_TAG,
-                owner: context.repo.owner,
-                prerelease: false,
-                repo: context.repo.repo,
-                tag_name: process.env.RELEASE_TAG,
-              });
-              core.exportVariable('RELEASE_ID', response.data.id);
-              core.exportVariable('RELEASE_UPLOAD_URL', response.data.upload_url);
-            } catch (error) {
-              core.setFailed(error.message);
-            }
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release create "$RELEASE_TAG" --generate-notes
   pypi-publish:
     name: Upload release to PyPI
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: build
     environment:
       name: production
@@ -203,13 +180,14 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: build
           path: dist
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
-
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        with:
+          attestations: true
   deploy-docs:
     name: Deploy Documentation
     needs: pypi-publish

openretailscience-0.47.0/.github/workflows/security-audit.yml

@@ -0,0 +1,86 @@
+name: Security Audit
+
+# Scans the resolved dependency lockfile (uv.lock) for known vulnerabilities
+# using OSV-Scanner. Because it reads uv.lock statically, it audits every pinned
+# version across all supported Python versions (3.10-3.13) and platforms.
+# Results are uploaded to GitHub code scanning (Security tab) as SARIF, so a
+# newly-disclosed CVE in a pinned dependency surfaces as a failing check and a
+# code-scanning alert rather than a passive Dependabot alert.
+#
+# Suppressions (each with a rationale, and an ignoreUntil expiry where a fix may
+# yet appear) live in osv-scanner.toml at the repo root.
+#
+# On pull requests the scan runs only when dependencies or this workflow change,
+# and is advisory (results still post to code scanning); pushes to main (same
+# path filter) refresh the default-branch code-scanning state, and scheduled
+# runs, manual dispatches, and release calls are hard gates.
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+    paths:
+      - "uv.lock"
+      - "pyproject.toml"
+      - "osv-scanner.toml"
+      - ".github/workflows/security-audit.yml"
+  push:
+    branches: [main]
+    paths:
+      - "uv.lock"
+      - "pyproject.toml"
+      - "osv-scanner.toml"
+      - ".github/workflows/security-audit.yml"
+  schedule:
+    - cron: "0 6 * * 1" # Mondays 06:00 UTC
+  workflow_dispatch:
+  workflow_call:
+
+permissions: {}
+
+concurrency:
+  group: "security-audit-${{ github.ref }}-${{ github.event_name }}"
+  cancel-in-progress: true
+
+jobs:
+  osv-scan:
+    name: OSV-Scanner (uv.lock)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      security-events: write # upload SARIF to code scanning
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Run OSV-Scanner
+        id: osv
+        continue-on-error: true # gate is enforced explicitly below, after SARIF upload
+        uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
+        with:
+          scan-args: |-
+            --config=osv-scanner.toml
+            --format=sarif
+            --output=results.sarif
+            --lockfile=uv.lock
+      - name: Upload results to code scanning
+        # Skip cleanly if the scanner errored before writing the SARIF, rather
+        # than erroring and being swallowed by continue-on-error.
+        if: always() && hashFiles('results.sarif') != ''
+        continue-on-error: true # never let SARIF upload (e.g. missing perms) break the gate
+        uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
+        with:
+          sarif_file: results.sarif
+          category: osv-scanner
+      - name: Enforce gate
+        # Pull requests are advisory only (results still post to code scanning);
+        # every other trigger is a hard gate. Fail closed: block unless the scan
+        # completed successfully, so a failed, errored, or skipped scan never
+        # passes the gate. !cancelled() (rather than always()) avoids marking a
+        # concurrency-superseded run as failed; a real timeout still blocks
+        # downstream via the job's needs dependency.
+        if: ${{ !cancelled() && github.event_name != 'pull_request' && steps.osv.outcome != 'success' }}
+        run: |
+          echo "::error::OSV-Scanner did not complete cleanly (vulnerabilities found or scan failed) — see the SARIF results in the Security tab."
+          exit 1