opskit 0.1.0__tar.gz → 0.1.1__tar.gz

{opskit-0.1.0 → opskit-0.1.1}/.github/workflows/ci.yml

@@ -20,11 +20,11 @@ jobs:
     name: Lint & type-check
     runs-on: ubuntu-latest
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2
         with:
           egress-policy: audit
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
         with:
           enable-cache: true
       - run: uv sync --extra dev
@@ -45,9 +45,12 @@ jobs:
     steps:
       - id: set
         shell: bash
+        # PRs test all three OSes on the min+max Python (catches OS-specific bugs pre-merge —
+        # socket/TLS/filesystem behavior differs on Windows/macOS and is invisible on ubuntu).
+        # main additionally sweeps every Python version.
         run: |
           if [ "${{ github.event_name }}" = "pull_request" ]; then
-            echo 'matrix={"os":["ubuntu-latest"],"python":["3.9","3.13"]}' >> "$GITHUB_OUTPUT"
+            echo 'matrix={"os":["ubuntu-latest","macos-latest","windows-latest"],"python":["3.9","3.13"]}' >> "$GITHUB_OUTPUT"
           else
             echo 'matrix={"os":["ubuntu-latest","macos-latest","windows-latest"],"python":["3.9","3.10","3.11","3.12","3.13"]}' >> "$GITHUB_OUTPUT"
           fi
@@ -60,11 +63,11 @@ jobs:
       matrix: ${{ fromJSON(needs.matrix-setup.outputs.matrix) }}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2
         with:
           egress-policy: audit
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
         with:
           enable-cache: true
           python-version: ${{ matrix.python }}
@@ -76,11 +79,11 @@ jobs:
     name: Dependency audit
     runs-on: ubuntu-latest
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2
         with:
           egress-policy: audit
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
         with:
           enable-cache: true
       - run: uv sync --extra dev
@@ -97,7 +100,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
         with:
           enable-cache: true
       - run: uv sync --extra dev

{opskit-0.1.0 → opskit-0.1.1}/.github/workflows/codeql.yml

@@ -19,8 +19,8 @@ jobs:
       security-events: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
         with:
           languages: python
           queries: security-extended
-      - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      - uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4

{opskit-0.1.0 → opskit-0.1.1}/.github/workflows/release.yml

@@ -43,11 +43,11 @@ jobs:
     permissions:
       id-token: write          # OIDC for PyPI Trusted Publishing
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2
         with:
           egress-policy: audit
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
       - run: uv sync --extra dev
       - name: Final security re-scan (zero-day gate)
         run: uv run pip-audit

{opskit-0.1.0 → opskit-0.1.1}/.github/workflows/scorecard.yml

@@ -30,6 +30,6 @@ jobs:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-      - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      - uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
         with:
           sarif_file: results.sarif

{opskit-0.1.0 → opskit-0.1.1}/.github/workflows/snyk.yml

@@ -25,14 +25,14 @@ jobs:
     env:
       SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2
         with:
           egress-policy: audit
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Notice when unconfigured
         if: ${{ env.SNYK_TOKEN == '' }}
         run: echo "SNYK_TOKEN is not set — skipping Snyk. Add the repo secret to enable."
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1
         if: ${{ env.SNYK_TOKEN != '' }}
       - name: Install Snyk CLI
         if: ${{ env.SNYK_TOKEN != '' }}
@@ -55,13 +55,13 @@ jobs:
         run: snyk code test --severity-threshold=high --sarif-file-output=snyk-code.sarif
       - name: Upload Open Source SARIF
         if: ${{ env.SNYK_TOKEN != '' && hashFiles('snyk-oss.sarif') != '' }}
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
         with:
           sarif_file: snyk-oss.sarif
           category: snyk-oss
       - name: Upload Snyk Code SARIF
         if: ${{ env.SNYK_TOKEN != '' && hashFiles('snyk-code.sarif') != '' }}
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
         with:
           sarif_file: snyk-code.sarif
           category: snyk-code

opskit-0.1.1/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.1.1"
+}

{opskit-0.1.0 → opskit-0.1.1}/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to opskit are documented in this file. The format is based o
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases and this changelog are
 generated automatically by release-please from Conventional Commits.
 
+## [0.1.1](https://github.com/Prabhakar-cg/opskit/compare/opskit-v0.1.0...opskit-v0.1.1) (2026-07-08)
+
+
+### Bug Fixes
+
+* **ci:** cross-platform closed-port test; fix README badges ([#23](https://github.com/Prabhakar-cg/opskit/issues/23)) ([6736872](https://github.com/Prabhakar-cg/opskit/commit/673687205e0f6c205023951e998a76a6ac98c73c))
+
 ## 0.1.0 (2026-07-07)
 
 

{opskit-0.1.0 → opskit-0.1.1}/CLAUDE.md

@@ -91,6 +91,13 @@ Apply these from the start of every new category (`net`/`tls`/`ad`); each one co
 - **Test gotcha (CodeQL):** don't assert `"<host.tld>" in output` — CodeQL's
   `py/incomplete-url-substring-sanitization` flags it as a URL-host check. Assert on record
   values / IPs / non-hostname substrings instead.
+- **A green PR is not a green `main`.** CI runs all three OSes on PRs but only the min+max Python;
+  `main` sweeps every Python version. **Socket / TLS / filesystem / path / subprocess behavior
+  differs across OSes** (e.g. a closed loopback port *refuses* on Linux but *times out* on Windows;
+  trust stores, IPv6, and path separators differ) — write those tests to tolerate platform variance
+  (assert the typed error *class family*, not one exact subclass) and lean on the loopback/mock
+  layers. If a `main`-only matrix leg fails after merge, reproduce by widening the PR matrix, not by
+  guessing. The `net`/`tls` refused-vs-timeout classification is the canonical example.
 
 ## Testing
 

{opskit-0.1.0 → opskit-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: opskit
-Version: 0.1.0
+Version: 0.1.1
 Summary: Cross-platform diagnostics for engineers — one toolkit, every OS.
 Project-URL: Homepage, https://github.com/Prabhakar-cg/opskit
 Project-URL: Repository, https://github.com/Prabhakar-cg/opskit
@@ -25,7 +25,7 @@ Classifier: Topic :: System :: Networking
 Classifier: Topic :: Utilities
 Classifier: Typing :: Typed
 Requires-Python: >=3.9.2
-Requires-Dist: cryptography<49,>=48.0.1
+Requires-Dist: cryptography<50,>=48.0.1
 Requires-Dist: dnspython<3,>=2.6
 Requires-Dist: platformdirs<5,>=4
 Requires-Dist: pyopenssl<27,>=24
@@ -55,7 +55,7 @@ Cross-platform diagnostics for engineers — one toolkit, every OS.
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13462/badge)](https://www.bestpractices.dev/projects/13462)
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=Prabhakar-cg_opskit&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=Prabhakar-cg_opskit)
 [![Known Vulnerabilities](https://snyk.io/test/github/Prabhakar-cg/opskit/badge.svg)](https://snyk.io/test/github/Prabhakar-cg/opskit)
-![CodeRabbit Pull Request Reviews](https://img.shields.io/coderabbit/prs/github/Prabhakar-cg/opskit?utm_source=oss&utm_medium=github&utm_campaign=Prabhakar-cg%2Fopskit&labelColor=171717&color=FF570A&link=https%3A%2F%2Fcoderabbit.ai&label=CodeRabbit+Reviews)
+[![Reviewed by CodeRabbit](https://img.shields.io/badge/reviewed%20by-CodeRabbit-FF570A?labelColor=171717)](https://coderabbit.ai)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Python](https://img.shields.io/badge/python-3.9%20|%203.10%20|%203.11%20|%203.12%20|%203.13-blue)](pyproject.toml)
 
@@ -64,7 +64,7 @@ troubleshooting commands that behave **identically on Windows, macOS, and Linux*
 juggling `nslookup` vs `dig` vs PowerShell cmdlets. It's a **CLI *and* an importable Python
 library**, is pure-Python (nothing to shell out to), and never phones home.
 
-> ⚠️ **Early development.** v1 ships **DNS diagnostics**; network / TLS / AD categories follow.
+> ⚠️ **Early development.** Ships **DNS** and **TLS** diagnostics today; network / AD categories follow.
 
 ---
 

{opskit-0.1.0 → opskit-0.1.1}/README.md

@@ -8,7 +8,7 @@ Cross-platform diagnostics for engineers — one toolkit, every OS.
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13462/badge)](https://www.bestpractices.dev/projects/13462)
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=Prabhakar-cg_opskit&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=Prabhakar-cg_opskit)
 [![Known Vulnerabilities](https://snyk.io/test/github/Prabhakar-cg/opskit/badge.svg)](https://snyk.io/test/github/Prabhakar-cg/opskit)
-![CodeRabbit Pull Request Reviews](https://img.shields.io/coderabbit/prs/github/Prabhakar-cg/opskit?utm_source=oss&utm_medium=github&utm_campaign=Prabhakar-cg%2Fopskit&labelColor=171717&color=FF570A&link=https%3A%2F%2Fcoderabbit.ai&label=CodeRabbit+Reviews)
+[![Reviewed by CodeRabbit](https://img.shields.io/badge/reviewed%20by-CodeRabbit-FF570A?labelColor=171717)](https://coderabbit.ai)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Python](https://img.shields.io/badge/python-3.9%20|%203.10%20|%203.11%20|%203.12%20|%203.13-blue)](pyproject.toml)
 
@@ -17,7 +17,7 @@ troubleshooting commands that behave **identically on Windows, macOS, and Linux*
 juggling `nslookup` vs `dig` vs PowerShell cmdlets. It's a **CLI *and* an importable Python
 library**, is pure-Python (nothing to shell out to), and never phones home.
 
-> ⚠️ **Early development.** v1 ships **DNS diagnostics**; network / TLS / AD categories follow.
+> ⚠️ **Early development.** Ships **DNS** and **TLS** diagnostics today; network / AD categories follow.
 
 ---
 

{opskit-0.1.0 → opskit-0.1.1}/pyproject.toml

@@ -36,7 +36,7 @@ dependencies = [
     "tomli>=2 ; python_version < '3.11'",
     # TLS category: handshake/chain retrieval + certificate parsing (PyCA-maintained).
     "pyopenssl>=24,<27",
-    "cryptography>=48.0.1,<49",  # 48.0.1 fixes GHSA-537c-gmf6-5ccf
+    "cryptography>=48.0.1,<50",  # 48.0.1 fixes GHSA-537c-gmf6-5ccf
 ]
 
 [project.urls]

{opskit-0.1.0 → opskit-0.1.1}/src/opskit/__init__.py

@@ -8,7 +8,7 @@ from __future__ import annotations
 
 import logging
 
-__version__ = "0.1.0"  # x-release-please-version
+__version__ = "0.1.1"  # x-release-please-version
 
 __all__ = ["__version__"]
 

{opskit-0.1.0 → opskit-0.1.1}/tests/unit/test_net_tcp.py

@@ -47,11 +47,22 @@ def test_connect_success_reports_address_and_timing():
     server.close()
 
 
+def _closed_port() -> int:
+    """A loopback port that is closed (bound then released, never listened)."""
+    probe = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    probe.bind(("127.0.0.1", 0))
+    port = int(probe.getsockname()[1])
+    probe.close()
+    return port
+
+
 def test_connect_refused_on_closed_port():
-    server, port = _loopback_listener()
-    server.close()  # port now closed -> RST on connect
-    with pytest.raises(ConnectRefused) as excinfo:
-        connect("127.0.0.1", port, timeout=2.0)
+    # A closed loopback port refuses on Linux/macOS. Windows refuses a never-listened port
+    # (this pattern) but may *time out* on a port that was listen()ed then closed — so accept
+    # either "cannot connect" NetError. The precise refused mapping is asserted deterministically
+    # in test_refusal_wins_over_timeout_for_dual_stack.
+    with pytest.raises((ConnectRefused, ConnectTimeout)) as excinfo:
+        connect("127.0.0.1", _closed_port(), timeout=1.0, retries=0)
     assert excinfo.value.hint
 
 

{opskit-0.1.0 → opskit-0.1.1}/uv.lock

@@ -1257,7 +1257,7 @@ dev = [
 
 [package.metadata]
 requires-dist = [
-    { name = "cryptography", specifier = ">=48.0.1,<49" },
+    { name = "cryptography", specifier = ">=48.0.1,<50" },
     { name = "dnslib", marker = "extra == 'dev'", specifier = ">=0.9" },
     { name = "dnspython", specifier = ">=2.6,<3" },
     { name = "hypothesis", marker = "extra == 'dev'", specifier = ">=6" },

opskit-0.1.0/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.1.0"
-}