openretailscience 0.47.0__tar.gz → 0.48.1__tar.gz

openretailscience-0.48.1/.env_sample

@@ -0,0 +1,9 @@
+GCP_PROJECT_ID=
+
+# Snowflake CI Configuration (for integration tests)
+SNOWFLAKE_CI_ACCOUNT=
+SNOWFLAKE_CI_USER=
+SNOWFLAKE_CI_WAREHOUSE=
+SNOWFLAKE_CI_DATABASE=
+SNOWFLAKE_CI_SCHEMA=
+SNOWFLAKE_CI_PRIVATE_KEY_PATH=

{openretailscience-0.47.0 → openretailscience-0.48.1}/.github/workflows/bigquery-integration.yml

@@ -19,16 +19,16 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
 

{openretailscience-0.47.0 → openretailscience-0.48.1}/.github/workflows/claude-code-review.yml

@@ -18,6 +18,9 @@ jobs:
     #   github.event.pull_request.user.login == 'new-developer' ||
     #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
 
+    # Skip automated dependency PRs: Dependabot runs without access to secrets and
+    # claude-code-action refuses to run for bot actors, so the job can only ever fail.
+    if: github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -27,14 +30,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           persist-credentials: false
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
+        uses: anthropics/claude-code-action@b76a0776ae74036e77cd11018083743453d7ad35 # v1.0.179
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           track_progress: true

{openretailscience-0.47.0 → openretailscience-0.48.1}/.github/workflows/claude.yml

@@ -85,7 +85,7 @@ jobs:
 
       - name: Checkout repository
         if: steps.check_permissions.outputs.has_permission == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -93,7 +93,7 @@ jobs:
       - name: Run Claude Code
         if: steps.check_permissions.outputs.has_permission == 'true'
         id: claude
-        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
+        uses: anthropics/claude-code-action@b76a0776ae74036e77cd11018083743453d7ad35 # v1.0.179
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

{openretailscience-0.47.0 → openretailscience-0.48.1}/.github/workflows/cloudflare-docs-preview.yml

@@ -22,24 +22,25 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
-          enable-cache: true
+          # Disabled: a shared cache feeding the preview deploy is a poisoning vector.
+          enable-cache: "false"
 
       - name: Install Dependencies
         run: uv sync --locked
 
       - name: Build docs
-        run: uv run mkdocs build
+        run: uv run mkdocs build --strict
 
       - name: Verify build output
         run: |
@@ -51,14 +52,12 @@ jobs:
 
       - name: Publish to Cloudflare Pages
         id: cloudflare-deploy
-        uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1.5.0
+        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          projectName: openretailscience-docs
-          directory: site
           gitHubToken: ${{ secrets.GITHUB_TOKEN }}
-          branch: ${{ github.head_ref || github.ref_name }}
+          command: pages deploy site --project-name=openretailscience-docs --branch=${{ github.head_ref || github.ref_name }}
 
       - name: Find existing comment
         if: github.event_name == 'pull_request'
@@ -81,8 +80,8 @@ jobs:
 
             ✅ Preview deployed successfully!
 
-            **Preview URL:** ${{ steps.cloudflare-deploy.outputs.url }}
-            **Deployment ID:** ${{ steps.cloudflare-deploy.outputs.id }}
+            **Preview URL:** ${{ steps.cloudflare-deploy.outputs.deployment-url }}
+            **Deployment ID:** ${{ steps.cloudflare-deploy.outputs.pages-deployment-id }}
 
             ---
             *This preview will be updated automatically when you push new changes to this PR.*

{openretailscience-0.47.0 → openretailscience-0.48.1}/.github/workflows/gh-page.yml

@@ -20,15 +20,15 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
       - name: Install Dependencies

openretailscience-0.48.1/.github/workflows/oracle-integration.yml

@@ -0,0 +1,46 @@
+name: Oracle Integration Tests
+
+on:
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  integration-tests:
+    name: Run Oracle Integration Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          enable-cache: true
+
+      - name: Install Dependencies
+        run: |
+          uv sync --locked
+
+      # Oracle 23ai Free (the supported LTS); the Compose file pins the gvenzl image.
+      - name: Start Oracle
+        run: |
+          docker compose -f tests/integration/docker/docker-compose.oracle.yml up -d --wait --wait-timeout 600
+
+      - name: Run Integration Tests
+        run: |
+          uv run pytest tests/integration -k "oracle" -v
+
+      - name: Stop Oracle
+        if: always()
+        run: |
+          docker compose -f tests/integration/docker/docker-compose.oracle.yml down -v

{openretailscience-0.47.0 → openretailscience-0.48.1}/.github/workflows/pyspark-integration.yml

@@ -14,16 +14,16 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
 

{openretailscience-0.47.0 → openretailscience-0.48.1}/.github/workflows/release.yml

@@ -22,15 +22,15 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
       - name: Install dependencies
@@ -68,6 +68,14 @@ jobs:
       SNOWFLAKE_CI_DATABASE: ${{ secrets.SNOWFLAKE_CI_DATABASE }}
       SNOWFLAKE_CI_SCHEMA: ${{ secrets.SNOWFLAKE_CI_SCHEMA }}
 
+  sqlserver-integration-tests:
+    name: SQL Server Integration Tests
+    uses: ./.github/workflows/sqlserver-integration.yml
+
+  oracle-integration-tests:
+    name: Oracle Integration Tests
+    uses: ./.github/workflows/oracle-integration.yml
+
   multi-python-tests:
     name: Multi-Python Version Tests
     runs-on: ubuntu-latest
@@ -78,15 +86,15 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
       - name: Install dependencies
@@ -100,7 +108,7 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    needs: [security-audit, pre-commit, bigquery-integration-tests, pyspark-integration-tests, snowflake-integration-tests, multi-python-tests]
+    needs: [security-audit, pre-commit, bigquery-integration-tests, pyspark-integration-tests, snowflake-integration-tests, sqlserver-integration-tests, oracle-integration-tests, multi-python-tests]
     permissions:
       contents: write
       id-token: write
@@ -112,13 +120,13 @@ jobs:
       # tag, so it requires the GITHUB_TOKEN persisted by actions/checkout. Only
       # dist/ is uploaded as an artifact, not .git/, so the token is not exposed.
       - name: Checkout # zizmor: ignore[artipacked]
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
       - name: Install Dependencies
@@ -147,7 +155,7 @@ jobs:
       - name: Build package
         run: uv build
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: "dist/*"
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -185,7 +193,7 @@ jobs:
           name: build
           path: dist
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
         with:
           attestations: true
   deploy-docs:

{openretailscience-0.47.0 → openretailscience-0.48.1}/.github/workflows/security-audit.yml

@@ -12,8 +12,10 @@ name: Security Audit
 #
 # On pull requests the scan runs only when dependencies or this workflow change,
 # and is advisory (results still post to code scanning); pushes to main (same
-# path filter) refresh the default-branch code-scanning state, and scheduled
-# runs, manual dispatches, and release calls are hard gates.
+# path filter) refresh the default-branch code-scanning state, and manual
+# dispatches and release calls are hard gates. Detection of newly-disclosed CVEs
+# against already-pinned dependencies (with no repo change) is left to Dependabot
+# alerts and security updates, so no scheduled scan is needed here.
 
 on:
   pull_request:
@@ -30,8 +32,6 @@ on:
       - "pyproject.toml"
       - "osv-scanner.toml"
       - ".github/workflows/security-audit.yml"
-  schedule:
-    - cron: "0 6 * * 1" # Mondays 06:00 UTC
   workflow_dispatch:
   workflow_call:
 
@@ -51,7 +51,7 @@ jobs:
       security-events: write # upload SARIF to code scanning
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Run OSV-Scanner
@@ -69,7 +69,7 @@ jobs:
         # than erroring and being swallowed by continue-on-error.
         if: always() && hashFiles('results.sarif') != ''
         continue-on-error: true # never let SARIF upload (e.g. missing perms) break the gate
-        uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           sarif_file: results.sarif
           category: osv-scanner

{openretailscience-0.47.0 → openretailscience-0.48.1}/.github/workflows/slack-notifications.yml

@@ -11,9 +11,12 @@ on:
       - "Tests"
       - "PyPi Package Deploy"
       - "Page Deploy"
+      - "Security Audit"
       - "BigQuery Integration Tests"
       - "PySpark Integration Tests"
       - "Snowflake Integration Tests"
+      - "SQL Server Integration Tests"
+      - "Oracle Integration Tests"
     types: [completed]
 
 permissions: {}
@@ -49,7 +52,10 @@ jobs:
             --arg event "$EVENT_NAME" \
             --arg author "$AUTHOR_NAME" \
             --arg message "$COMMIT_MESSAGE" \
-            '{
+            '# Slack 400s if a section text exceeds 3000 chars. Slice in jq, not bash:
+             # bash slices bytes under a C locale and can split a codepoint.
+             ($message | if length > 2000 then .[0:2000] + "\n…(truncated)" else . end) as $commit_message
+             | {
               attachments: [{
                 color: "danger",
                 fallback: "Workflow failure notification",
@@ -76,7 +82,7 @@ jobs:
                   },
                   {
                     type: "section",
-                    text: {type: "mrkdwn", text: ("*Commit Message:*\n```" + $message + "```")}
+                    text: {type: "mrkdwn", text: ("*Commit Message:*\n```" + $commit_message + "```")}
                   },
                   {
                     type: "actions",

{openretailscience-0.47.0 → openretailscience-0.48.1}/.github/workflows/snowflake-integration.yml

@@ -29,16 +29,16 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
 

openretailscience-0.48.1/.github/workflows/sqlserver-integration.yml

@@ -0,0 +1,64 @@
+name: SQL Server Integration Tests
+
+on:
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  integration-tests:
+    name: Run SQL Server Integration Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        mssql-image:
+          - mcr.microsoft.com/mssql/server:2022-latest
+          - mcr.microsoft.com/mssql/server:2025-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          enable-cache: true
+
+      - name: Install Dependencies
+        run: |
+          uv sync --locked
+
+      - name: Install Microsoft ODBC Driver 18
+        run: |
+          set -euo pipefail
+          curl -fsSL https://packages.microsoft.com/keys/microsoft.asc \
+            | sudo gpg --batch --yes --dearmor -o /usr/share/keyrings/microsoft-prod.gpg
+          source /etc/os-release
+          echo "deb [arch=amd64,arm64,armhf signed-by=/usr/share/keyrings/microsoft-prod.gpg] https://packages.microsoft.com/ubuntu/${VERSION_ID}/prod ${VERSION_CODENAME} main" \
+            | sudo tee /etc/apt/sources.list.d/mssql-release.list
+          sudo apt-get update
+          sudo ACCEPT_EULA=Y apt-get install -y msodbcsql18 unixodbc unixodbc-dev
+
+      - name: Start SQL Server (${{ matrix.mssql-image }})
+        env:
+          MSSQL_IMAGE: ${{ matrix.mssql-image }}
+        run: |
+          docker compose -f tests/integration/docker/docker-compose.sqlserver.yml up -d --wait --wait-timeout 300
+
+      - name: Run Integration Tests
+        run: |
+          uv run pytest tests/integration -k "mssql" -v
+
+      - name: Stop SQL Server
+        if: always()
+        run: |
+          docker compose -f tests/integration/docker/docker-compose.sqlserver.yml down -v

openretailscience-0.48.1/.github/workflows/test.yml

@@ -0,0 +1,104 @@
+name: Tests
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+  push:
+    branches: [main]
+
+permissions: {}
+
+concurrency:
+  group: "test-${{ github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  pre-commit:
+    name: Pre-Commit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.11"
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          enable-cache: true
+      - name: Install dependencies
+        run: uv sync --locked
+      - name: Run Pre-commit
+        run: uv run pre-commit run --all-files
+      - name: Pre-import Codecov uploader signing key
+        if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
+        # Workaround for codecov/codecov-action#1876: the uploader intermittently
+        # fails to fetch its own verification key, producing "Can't check signature:
+        # No public key" and failing the job under fail_ci_if_error. Pre-seed Codecov's
+        # public key (codecovsecops, fingerprint 2703 4E7F DB85 0E0B BC2C 62FF 806B B28A
+        # ED77 9869) so the wrapper's check succeeds even when its own fetch flakes. The
+        # observed wrapper verifies against the default keyring (`gpg --verify`), so that
+        # import is the one that fixes this failure; trustedkeys.gpg is also seeded for
+        # the documented gpgv path. The fetched key's fingerprint is checked against the
+        # expected value BEFORE import, so a DNS hijack or tampered keybase response is
+        # never installed into a trusted keyring. Best-effort: never fails the build, so a
+        # fetch outage or fingerprint mismatch just falls back to the uploader's own check.
+        run: |
+          set +e
+          expected="27034E7FDB850E0BBC2C62FF806BB28AED779869"
+          curl -fsSL https://keybase.io/codecovsecops/pgp_keys.asc -o codecov.asc
+          if gpg --show-keys --with-colons codecov.asc 2>/dev/null | grep -q ":${expected}:"; then
+            gpg --batch --import codecov.asc
+            gpg --batch --no-default-keyring --keyring trustedkeys.gpg --import codecov.asc
+          else
+            echo "WARNING: Codecov signing key not verified (fetch failed or fingerprint mismatch) – skipping pre-import"
+          fi
+          rm -f codecov.asc
+          exit 0
+      - name: Upload coverage to Codecov
+        if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: true
+
+  # Note: This job also exists in release.yml as a final quality gate before publishing.
+  # While it may seem redundant, it serves as a safety check in case of misconfiguration.
+  test-matrix:
+    name: Test Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push'
+    continue-on-error: ${{ matrix.experimental }}
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        experimental: [false]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: |
+          uv sync --locked
+
+      - name: Run tests
+        run: |
+          uv run pytest tests/ --ignore=tests/integration --tb=short -v
+        env:
+          PYTHONDONTWRITEBYTECODE: 1

{openretailscience-0.47.0 → openretailscience-0.48.1}/.gitignore

@@ -142,3 +142,8 @@ cython_debug/
 
 .claude-review
 .claude/scheduled_tasks.lock
+
+# Local Spark artifacts (created by pyspark integration tests)
+spark-warehouse/
+metastore_db/
+derby.log

{openretailscience-0.47.0 → openretailscience-0.48.1}/.pre-commit-config.yaml

@@ -1,35 +1,33 @@
 repos:
   - repo: https://github.com/compilerla/conventional-pre-commit
-    rev: v3.2.0
+    rev: v4.4.0
     hooks:
       - id: conventional-pre-commit
         stages: [commit-msg]
         args: []
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: "v0.11.0"
+    rev: "v0.15.17"
     hooks:
-      - id: ruff
+      - id: ruff-check
         args: ["--fix"]
       - id: ruff-format
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
         exclude: '\.svg$'
-      - id: fix-encoding-pragma
-        args: [--remove]
       - id: check-yaml
       - id: debug-statements
         language_version: python3
   - repo: https://github.com/kynan/nbstripout
-    rev: 0.5.0
+    rev: 0.9.1
     hooks:
       - id: nbstripout
         files: \.(ipynb)$
-        args: [--keep-output, --strip-empty-cells]
-  - repo: https://github.com/nikaro/taplo-pre-commit
-    rev: 0.1.1
+        args: [--keep-output, --drop-empty-cells]
+  - repo: https://github.com/ComPWA/taplo-pre-commit
+    rev: v0.9.3
     hooks:
       - id: taplo-format
         name: Format TOML files
@@ -40,7 +38,7 @@ repos:
         args: ["--config", "taplo.toml"]
         exclude: ^tests/toml_files/corrupt.toml$
   - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: v0.38.0
+    rev: v0.48.0
     hooks:
       - id: markdownlint
         args: ["--config", ".markdownlint.json"]