oxipng-pybind 10.1.1__tar.gz

oxipng_pybind-10.1.1/.github/workflows/api-matrix.yml

@@ -0,0 +1,36 @@
+name: api-matrix
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    tags:
+      - "v*"
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  public-api:
+    name: public api py${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+        with:
+          version: 0.11.12
+      - uses: dtolnay/rust-toolchain@1.95.0
+      - name: Sync dependencies
+        run: uv sync --locked --group dev
+      - name: Build editable extension
+        run: uv run --locked --group dev maturin develop
+      - name: Run public API tests
+        run: uv run --locked --group dev pytest tests/test_api.py -v -ra

oxipng_pybind-10.1.1/.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: ci
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    tags:
+      - "v*"
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    name: source ci
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON: "3.13"
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+        with:
+          version: 0.11.12
+      - uses: dtolnay/rust-toolchain@1.95.0
+        with:
+          components: clippy
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@60ae4ce63c7aeb6e96d7f572c1ec7fafbb17ca80
+        with:
+          tool: cargo-deny@0.19.7
+      - run: make ci

oxipng_pybind-10.1.1/.github/workflows/dependency-health.yml

@@ -0,0 +1,144 @@
+name: dependency-health
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "31 10 * * 2"
+
+permissions:
+  contents: read
+
+jobs:
+  prepare:
+    name: refresh and verify dependencies
+    runs-on: ubuntu-latest
+    outputs:
+      changed: ${{ steps.changes.outputs.changed }}
+      changed-paths: ${{ steps.changes.outputs.paths }}
+      release-needed: ${{ steps.classification.outputs.release-needed }}
+      release-label: ${{ steps.classification.outputs.label }}
+      release-reason: ${{ steps.classification.outputs.reason }}
+    env:
+      UV_PYTHON: "3.13"
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+        with:
+          version: 0.11.12
+      - uses: dtolnay/rust-toolchain@1.95.0
+        with:
+          components: clippy
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@60ae4ce63c7aeb6e96d7f572c1ec7fafbb17ca80
+        with:
+          tool: cargo-deny@0.19.7
+      - name: Refresh lockfiles
+        run: |
+          uv lock --upgrade
+          cargo update
+      - name: Sync refreshed dependencies
+        run: uv sync --locked --group dev
+      - name: Refresh pre-commit hooks
+        run: uv run --locked --group dev pre-commit autoupdate
+      - name: Refresh GitHub Actions
+        run: uv run --locked --group dev python scripts/update_github_actions.py
+      - name: Apply lint and generated-file fixes
+        run: make lint-fix
+      - name: Generate third-party notices
+        run: make third-party-notices
+      - name: Run dependency audits
+        run: make dependency-audit
+      - name: Run CI
+        run: make ci
+      - name: Check for changes
+        id: changes
+        run: |
+          paths="$({
+            git diff --name-only
+            git ls-files --others --exclude-standard
+          } | sort -u)"
+          if [ -z "$paths" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            {
+              echo "paths<<EOF"
+              echo "$paths"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
+          fi
+      - name: Classify dependency refresh
+        id: classification
+        if: steps.changes.outputs.changed == 'true'
+        run: uv run --locked --group dev python scripts/classify_dependency_refresh.py --base-ref origin/main
+      - name: Upload dependency refresh workspace
+        if: steps.changes.outputs.changed == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: dependency-refresh
+          include-hidden-files: true
+          path: ${{ steps.changes.outputs.paths }}
+
+  publish:
+    name: open dependency refresh PR
+    needs: prepare
+    if: needs.prepare.outputs.changed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: dependency-refresh
+          path: .
+      - name: Require dependency refresh token
+        env:
+          DEPENDENCY_REFRESH_TOKEN: ${{ secrets.DEPENDENCY_REFRESH_TOKEN }}
+        run: |
+          if [ -z "$DEPENDENCY_REFRESH_TOKEN" ]; then
+            echo "DEPENDENCY_REFRESH_TOKEN is required so refresh PRs trigger normal CI." >&2
+            exit 1
+          fi
+      - name: Create pull request
+        id: cpr
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
+        with:
+          token: ${{ secrets.DEPENDENCY_REFRESH_TOKEN }}
+          commit-message: "chore: refresh dependency lockfiles"
+          title: "chore: refresh dependency lockfiles"
+          body: |
+            Automated dependency refresh.
+
+            Verification run in the prepare job:
+
+            - `uv run --locked --group dev pre-commit autoupdate`
+            - `uv run --locked --group dev python scripts/update_github_actions.py`
+            - `make lint-fix`
+            - `make dependency-audit`
+            - `make ci`
+
+            Release classification:
+
+            - `${{ needs.prepare.outputs.release-label }}`
+            - `${{ needs.prepare.outputs.release-reason }}`
+
+            `no-release-needed` PRs auto-merge after required checks pass.
+            `release-needed` PRs stay open for an explicit wrapper version bump
+            before merge.
+          branch: automation/dependency-refresh
+          delete-branch: true
+          labels: dependencies, automated, ${{ needs.prepare.outputs.release-label }}
+          add-paths: ${{ needs.prepare.outputs.changed-paths }}
+      - name: Enable auto-merge
+        if: >-
+          needs.prepare.outputs.release-needed == 'false' &&
+          steps.cpr.outputs.pull-request-number != '' &&
+          contains(fromJSON('["created", "updated"]'), steps.cpr.outputs.pull-request-operation)
+        env:
+          GH_TOKEN: ${{ secrets.DEPENDENCY_REFRESH_TOKEN }}
+        run: |
+          gh pr merge "${{ steps.cpr.outputs.pull-request-number }}" --auto --rebase --delete-branch

oxipng_pybind-10.1.1/.github/workflows/release-tag.yml

@@ -0,0 +1,134 @@
+name: release-tag
+
+on:
+  workflow_dispatch:
+  workflow_run:
+    workflows: ["ci"]
+    types: ["completed"]
+    branches: ["main"]
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  create-release-tag:
+    name: create release tag
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      github.event.workflow_run.conclusion == 'success'
+    permissions:
+      contents: write
+      actions: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Check automated release eligibility
+        id: eligibility
+        shell: bash
+        run: |
+          git fetch --quiet origin main --tags
+          git checkout --quiet origin/main
+          main_sha="$(git rev-parse HEAD)"
+          if [ "${{ github.event_name }}" = "workflow_run" ] &&
+            [ "$main_sha" != "${{ github.event.workflow_run.head_sha }}" ]; then
+            echo "eligible=false" >> "$GITHUB_OUTPUT"
+            echo "latest main commit $main_sha differs from ci head ${{ github.event.workflow_run.head_sha }}"
+            exit 0
+          fi
+          subject="$(git log -1 --pretty=%s)"
+          if [ "$subject" != "chore: bump upstream oxipng" ]; then
+            echo "eligible=false" >> "$GITHUB_OUTPUT"
+            echo "latest main commit is not an automated upstream bump: $subject"
+            exit 0
+          fi
+          before_version="$(
+            git show HEAD^:pyproject.toml |
+              python -c 'import sys,tomllib; print(tomllib.loads(sys.stdin.read())["project"]["version"])'
+          )"
+          version="$(
+            python -c 'import pathlib,tomllib; print(tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"])'
+          )"
+          if [ "$before_version" = "$version" ]; then
+            echo "eligible=false" >> "$GITHUB_OUTPUT"
+            echo "project.version did not change"
+            exit 0
+          fi
+          tag="v$version"
+          python scripts/validate_release_tag.py --tag "$tag" --skip-main-check --skip-pypi-check
+          if git rev-parse "$tag" >/dev/null 2>&1; then
+            echo "eligible=false" >> "$GITHUB_OUTPUT"
+            echo "tag already exists: $tag"
+            exit 0
+          fi
+          echo "eligible=true" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+      - name: Wait for CI on main commit
+        if: steps.eligibility.outputs.eligible == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          sha="$(git rev-parse HEAD)"
+          for attempt in $(seq 1 60); do
+            conclusion="$(
+              gh run list --workflow ci.yml --commit "$sha" \
+                --json status,conclusion \
+                --jq '.[0] | "\(.status) \(.conclusion)"'
+            )"
+            case "$conclusion" in
+              "completed success") exit 0 ;;
+              "completed failure"|"completed cancelled"|"completed timed_out")
+                echo "ci failed: $conclusion"
+                exit 1
+                ;;
+            esac
+            sleep 30
+          done
+          echo "timed out waiting for ci"
+          exit 1
+      - name: Wait for API matrix on main commit
+        if: steps.eligibility.outputs.eligible == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          sha="$(git rev-parse HEAD)"
+          for attempt in $(seq 1 60); do
+            conclusion="$(
+              gh run list --workflow api-matrix.yml --commit "$sha" \
+                --json status,conclusion \
+                --jq '.[0] | "\(.status) \(.conclusion)"'
+            )"
+            case "$conclusion" in
+              "completed success") exit 0 ;;
+              "completed failure"|"completed cancelled"|"completed timed_out")
+                echo "api-matrix failed: $conclusion"
+                exit 1
+                ;;
+            esac
+            sleep 30
+          done
+          echo "timed out waiting for api-matrix"
+          exit 1
+      - name: Check PyPI version does not exist
+        if: steps.eligibility.outputs.eligible == 'true'
+        run: |
+          python scripts/validate_release_tag.py \
+            --tag "${{ steps.eligibility.outputs.tag }}" \
+            --project "oxipng-pybind" \
+            --pypi-url "https://pypi.org" \
+            --skip-main-check
+      - name: Create and push release tag
+        if: steps.eligibility.outputs.eligible == 'true'
+        env:
+          RELEASE_TAG_TOKEN: ${{ secrets.RELEASE_TAG_TOKEN }}
+        run: |
+          tag="${{ steps.eligibility.outputs.tag }}"
+          version="${{ steps.eligibility.outputs.version }}"
+          git config user.name "oxipng-pybind release automation"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "$tag" -m "Release oxipng-pybind $version"
+          git push "https://x-access-token:${RELEASE_TAG_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "$tag"

oxipng_pybind-10.1.1/.github/workflows/retry-failed-checks.yml

@@ -0,0 +1,32 @@
+name: retry-failed-checks
+
+on:
+  workflow_run:
+    workflows:
+      - ci
+      - api-matrix
+      - wheels
+    types:
+      - completed
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  retry:
+    name: retry failed jobs once
+    if: >-
+      github.event.workflow_run.conclusion == 'failure' &&
+      github.event.workflow_run.run_attempt == 1
+    runs-on: ubuntu-latest
+    steps:
+      - name: Wait before retry
+        run: sleep 600
+      - name: Rerun failed jobs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+          REPOSITORY: ${{ github.event.repository.full_name }}
+        run: |
+          gh run rerun "$RUN_ID" --repo "$REPOSITORY" --failed

oxipng_pybind-10.1.1/.github/workflows/upstream-bump.yml

@@ -0,0 +1,173 @@
+name: upstream-bump
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 9 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  prepare:
+    name: prepare oxipng bump
+    runs-on: ubuntu-latest
+    outputs:
+      changed: ${{ steps.changes.outputs.changed }}
+      target-version: ${{ steps.bump.outputs.target-version }}
+      upstream-crate-available: ${{ steps.bump.outputs.upstream-crate-available }}
+    env:
+      UV_PYTHON: "3.13"
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+        with:
+          version: 0.11.12
+      - uses: dtolnay/rust-toolchain@1.95.0
+        with:
+          components: clippy
+      - name: Install nightly rustdoc JSON toolchain
+        run: rustup toolchain install nightly --profile minimal
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@60ae4ce63c7aeb6e96d7f572c1ec7fafbb17ca80
+        with:
+          tool: cargo-deny@0.19.7
+      - name: Sync dependencies
+        run: uv sync --locked --group dev
+      - name: Bump upstream
+        id: bump
+        run: uv run --locked --group dev python scripts/bump_upstream.py
+      - name: Generate third-party notices
+        run: make third-party-notices
+      - name: Fetch upstream source
+        if: steps.bump.outputs.upstream-crate-available != 'false'
+        run: |
+          version="${{ steps.bump.outputs.target-version }}"
+          git clone --depth 1 --branch "v$version" https://github.com/oxipng/oxipng .cache/upstream/oxipng
+      - name: Prepare API surface manifest
+        if: steps.bump.outputs.upstream-crate-available != 'false'
+        run: |
+          version="${{ steps.bump.outputs.target-version }}"
+          mkdir -p docs/api-surface
+          if [ ! -f "docs/api-surface/oxipng-$version.toml" ]; then
+            previous="$(ls docs/api-surface/oxipng-*.toml | sort -V | tail -n 1)"
+            cp "$previous" "docs/api-surface/oxipng-$version.toml"
+            sed -i "s/^upstream_version = .*/upstream_version = \"$version\"/" "docs/api-surface/oxipng-$version.toml"
+          fi
+      - name: Scan upstream surface
+        if: steps.bump.outputs.upstream-crate-available != 'false'
+        run: uv run --locked --group dev python scripts/scan_upstream_surface.py --update-docs
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Run CI before opening PR
+        if: steps.changes.outputs.changed == 'true'
+        run: make ci
+      - name: Upload bump workspace
+        if: steps.changes.outputs.changed == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: upstream-bump-workspace
+          include-hidden-files: true
+          path: |
+            Cargo.toml
+            Cargo.lock
+            pyproject.toml
+            uv.lock
+            THIRD_PARTY_NOTICES.md
+            CHANGELOG.md
+            docs/api-surface/*.toml
+            docs/architecture/api-compatibility.md
+            docs/architecture/options-surface.md
+            .cache/upstream-bump/target-version.txt
+            .cache/upstream-surface/pr-body-section.md
+
+  publish:
+    name: publish oxipng bump PR
+    needs: prepare
+    if: needs.prepare.outputs.changed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: upstream-bump-workspace
+          path: .
+      - name: Check upstream bump token
+        env:
+          UPSTREAM_BUMP_TOKEN: ${{ secrets.UPSTREAM_BUMP_TOKEN }}
+        run: |
+          if [ -z "$UPSTREAM_BUMP_TOKEN" ]; then
+            echo "UPSTREAM_BUMP_TOKEN is required to create bump PRs with normal PR CI checks and auto-merge."
+            exit 1
+          fi
+      - name: Write pull request body
+        run: |
+          mkdir -p .cache/upstream-bump
+          {
+            echo "Automated upstream oxipng bump."
+            echo
+            cat .cache/upstream-surface/pr-body-section.md
+            echo
+            echo "Auto-merge is enabled only after required CI and wheel checks pass."
+          } > .cache/upstream-bump/pr-body.md
+      - name: Create pull request
+        id: cpr
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
+        with:
+          token: ${{ secrets.UPSTREAM_BUMP_TOKEN }}
+          commit-message: "chore: bump upstream oxipng"
+          title: "chore: bump upstream oxipng"
+          body-path: .cache/upstream-bump/pr-body.md
+          branch: automation/bump-oxipng
+          delete-branch: true
+          labels: dependencies, automated
+      - name: Create or update upstream surface issue
+        env:
+          GH_TOKEN: ${{ secrets.UPSTREAM_BUMP_TOKEN }}
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          from scripts.bump_upstream import upsert_surface_issue
+
+          version = Path(".cache/upstream-bump/target-version.txt").read_text(encoding="utf-8").strip()
+          upsert_surface_issue(version, Path(".cache/upstream-surface/pr-body-section.md"))
+          PY
+      - name: Wait for wheel workflow
+        if: >-
+          steps.cpr.outputs.pull-request-number != '' &&
+          contains(fromJSON('["created", "updated"]'), steps.cpr.outputs.pull-request-operation)
+        env:
+          GH_TOKEN: ${{ secrets.UPSTREAM_BUMP_TOKEN }}
+        run: |
+          pr="${{ steps.cpr.outputs.pull-request-number }}"
+          sha="$(gh pr view "$pr" --json headRefOid --jq .headRefOid)"
+          for attempt in $(seq 1 60); do
+            conclusion="$(gh run list --workflow wheels.yml --commit "$sha" --json status,conclusion --jq '.[0] | "\(.status) \(.conclusion)"')"
+            case "$conclusion" in
+              "completed success") exit 0 ;;
+              "completed failure"|"completed cancelled"|"completed timed_out") echo "wheels workflow failed: $conclusion"; exit 1 ;;
+            esac
+            sleep 30
+          done
+          echo "timed out waiting for wheels workflow"
+          exit 1
+      - name: Enable auto-merge
+        if: >-
+          steps.cpr.outputs.pull-request-number != '' &&
+          contains(fromJSON('["created", "updated"]'), steps.cpr.outputs.pull-request-operation)
+        env:
+          GH_TOKEN: ${{ secrets.UPSTREAM_BUMP_TOKEN }}
+        run: |
+          gh pr merge "${{ steps.cpr.outputs.pull-request-number }}" --auto --rebase --delete-branch