pinky-core 0.1.0.dev2__tar.gz → 0.1.0.dev4__tar.gz

pinky_core-0.1.0.dev4/.github/workflows/ci.yml

@@ -0,0 +1,65 @@
+name: CI
+
+on:
+  push:
+    branches: [main, develop]
+    paths: ['src/**', 'tests/**', 'pyproject.toml', 'scripts/**', '.pre-commit-config.yaml', '.github/workflows/ci.yml']
+  pull_request:
+    branches: [main, develop]
+    paths: ['src/**', 'tests/**', 'pyproject.toml', 'scripts/**', '.pre-commit-config.yaml', '.github/workflows/ci.yml']
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Run pre-commit hooks
+        # Single source of truth: .pre-commit-config.yaml (ruff, mypy, bandit, gitleaks,
+        # detect-secrets, check-zws, check-forbidden-keywords, interrogate, darglint,
+        # check-typed-api, mdformat) — replaces the hand-duplicated Lint/Format/Type/Security
+        # steps, which only re-implemented 3 of the ~11 hooks and could silently drift from
+        # .pre-commit-config.yaml's actual args/excludes. j178/prek-action (not `pip install
+        # prek`): official action, caches the prek env between runs, defaults to
+        # `prek run --show-diff-on-failure --color=always --all-files`.
+        uses: j178/prek-action@v2
+
+      - name: Install dependencies
+        # All optional extras, not just validate/address/dev — omitting xml/schedule/lint
+        # silently skips their test files at collection time (pytest.importorskip on the
+        # missing package), deflating the coverage number without ever failing CI.
+        run: pip install -e ".[validate,address,schedule,xml,lint,dev]"
+
+      - name: Tests
+        run: pytest
+
+  precommit-windows:
+    # ADR-0023 pilot gate: hermetic pre-commit hooks must run on the brother's
+    # machine (Windows, prek only, no toolchain) — this is the real gate, not the Mac.
+    runs-on: windows-latest
+    strategy:
+      matrix:
+        shell: [cmd, pwsh]
+    defaults:
+      run:
+        shell: ${{ matrix.shell }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Run mdformat hook
+        uses: j178/prek-action@v2
+        with:
+          extra-args: 'mdformat --all-files'

{pinky_core-0.1.0.dev2 → pinky_core-0.1.0.dev4}/.github/workflows/publish.yml

@@ -17,10 +17,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Set up Python 3.11
+      - name: Set up Python 3.12
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: "3.12"
 
       - name: Install build
         run: pip install build

{pinky_core-0.1.0.dev2 → pinky_core-0.1.0.dev4}/.github/workflows/release.yml

@@ -32,10 +32,10 @@ jobs:
           git tag "v${{ steps.version.outputs.version }}"
           git push origin "v${{ steps.version.outputs.version }}"
 
-      - name: Set up Python 3.11
+      - name: Set up Python 3.12
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: "3.12"
 
       - name: Install build
         run: pip install build

{pinky_core-0.1.0.dev2 → pinky_core-0.1.0.dev4}/.gitignore

@@ -17,7 +17,7 @@ venv/
 .conda/
 
 # ── Tools cache ──────────────────────────────────────────────────────────────
-.cache/
+.cache/*
 .pre-commit-cache/
 
 # ── Generated docs ───────────────────────────────────────────────────────────

pinky_core-0.1.0.dev4/.gitleaks.toml

@@ -0,0 +1,14 @@
+# Distributed as-is to every onboarded repo's root (see setup/precommit.py distribute()).
+# gitleaks auto-discovers .gitleaks.toml in the scan root — no pre-commit-side wiring needed.
+[extend]
+useDefault = true
+
+[allowlist]
+# .secrets.baseline stores detect-secrets' accepted findings as SHA1 hashes (hashed_secret),
+# never the raw secret — that's the whole point of a baseline. A high-entropy hash next to a
+# "secret"-shaped key still trips gitleaks' generic-api-key heuristic the moment a repo's baseline
+# records its first real finding (empty result sets don't trigger it, which is why this went
+# unnoticed until pinky-studio).
+paths = [
+  '''\.secrets\.baseline''',
+]

{pinky_core-0.1.0.dev2 → pinky_core-0.1.0.dev4}/.pre-commit-config.yaml

@@ -1,16 +1,22 @@
 ---
 # =============================================================================
-# .pre-commit-config.yaml — snowflake-kit
+# .pre-commit-config.yaml — GENERATED by pinky-workspace/setup.py — DO NOT EDIT
 # =============================================================================
-# Install:
+# Source: pinky-workspace/core/pre-commit/{base,extras/*}.yaml
+# Third-party revs are pinned centrally in this base — bump them here, once.
+# To change which hooks a repo gets, edit the workspace source and re-run setup.py.
+#
+# Install (done automatically by setup.py):
 #   pip install pre-commit
 #   pre-commit install
 #   pre-commit install --hook-type commit-msg
-#
-# Update standard hooks:
-#   pre-commit autoupdate
 # =============================================================================
 default_install_hook_types: [pre-commit, commit-msg]
+# Pin explicite : sans ça, les hooks `language: python` (mdformat, mypy, interrogate, darglint…)
+# créent leur venv avec le python3 ambiant du PATH au moment de l'install, pas une version garantie
+# par le repo — non-déterministe en local (CI est protégée par actions/setup-python en amont).
+default_language_version:
+  python: python3.12
 
 repos:
   # ── Formatting: trailing spaces + newline ─────────────────────────────────
@@ -25,16 +31,36 @@ repos:
       - id: check-merge-conflict
       - id: debug-statements
 
+  # ── Docs generation: README + docs/index.md + quality badges ──────────────
+  # Universal (every repo, not just the snowflake extra — 2026-07-10, renamed/extended from
+  # check-docs-up-to-date). Runs before mdformat below so the regenerated README gets reformatted.
+  - repo: local
+    hooks:
+      - id: generate-docs
+        name: Generate docs (README + index.md + badges)
+        entry: scripts/hooks/generate-docs
+        language: script
+        stages: [pre-commit]
+        pass_filenames: false
+
   # ── Formatting: Markdown ──────────────────────────────────────────────────
   - repo: local
     hooks:
       - id: mdformat
         name: mdformat
         entry: mdformat
-        language: system
+        language: python
+        additional_dependencies: ["mdformat==1.0.0"]
         files: ^README\.md$
 
   # ── Security: secrets & forbidden files ──────────────────────────────────
+  # gitleaks' hook has pass_filenames: false (it scans the repo itself, not a file list pre-commit
+  # hands it) — a pre-commit `exclude:` here would be silently inert. The real exclusion mechanism
+  # is the distributed .gitleaks.toml allowlist (see distribute()/DISTRIBUTED_PATHS): .secrets.baseline
+  # stores detect-secrets' accepted findings as SHA1 hashes, never the raw secret, but a high-entropy
+  # hash next to a "secret"-shaped key still trips gitleaks' generic-api-key heuristic (found rolling
+  # this out to pinky-studio, the first repo whose baseline had a real finding instead of an empty
+  # result set).
   - repo: https://github.com/gitleaks/gitleaks
     rev: v8.30.0
     hooks:
@@ -45,10 +71,38 @@ repos:
     rev: v1.5.0
     hooks:
       - id: detect-secrets
-        args: ["--baseline", ".cache/secrets.baseline"]
+        args: ["--baseline", ".secrets.baseline"]
         exclude: ^docs/
 
-  # ── Python: ruff lint + format ────────────────────────────────────────────
+  # ── Zero-width spaces (copy-paste from Outlook/Teams) ────────────────────
+  - repo: local
+    hooks:
+      - id: check-zws
+        name: "[ZWS] Invisible characters (zero-width)"
+        entry: python scripts/hooks/check_zws.py
+        language: system
+        pass_filenames: true
+
+  # ── Employer reference guard ──────────────────────────────────────────────
+  - repo: local
+    hooks:
+      - id: check-forbidden-keywords
+        name: "[FORBIDDEN] Employer references"
+        entry: python scripts/hooks/check_forbidden_keywords.py
+        language: system
+        pass_filenames: true
+
+  # ── Commit message format ─────────────────────────────────────────────────
+  - repo: local
+    hooks:
+      - id: commit-msg-format
+        name: Commit message format
+        entry: scripts/hooks/commit-msg
+        language: script
+        stages: [commit-msg]
+
+  # ── EXTRA python — repos with src/ ────────────────────────────────────────
+  # Python: ruff lint + format
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.15.15
     hooks:
@@ -57,57 +111,61 @@ repos:
       - id: ruff-format
         args: [--check]
 
-  # ── Python: type checking ─────────────────────────────────────────────────
+  # Python: type checking
   - repo: local
     hooks:
       - id: mypy
         name: mypy
         entry: mypy
-        language: system
+        # Hermetic (ADR-0026, supersedes ADR-0023's system carve-out): additional_dependencies is
+        # auto-derived per repo by setup.py (build_precommit_config) from THAT repo's own
+        # pyproject.toml runtime `dependencies` — mypy pin + real third-party deps, minus internal
+        # pinky-* packages (pre-release, not on PyPI, excluded from the derivation).
+        # --ignore-missing-imports stays as the residual fallback for those excluded imports only.
+        language: python
+        additional_dependencies: ["mypy==2.0.0", "pydantic>=2.0", "sqlglot", "unidecode"]
         types: [python]
         args: [--ignore-missing-imports]
         files: ^src/
+        # mypy's incremental cache (.mypy_cache/) isn't safe under concurrent access — without
+        # this, prek/pre-commit's default file-batch parallelism spawns multiple mypy processes
+        # against the same cache dir and one crashes with INTERNAL ERROR (reproduced on
+        # pinky-core: a single-process run over the same files passes clean).
+        require_serial: true
 
-  # ── Python: security ─────────────────────────────────────────────────────
-  - repo: local
+  # Python: security
+  # B108 (hardcoded /tmp) is skipped workspace-wide: Snowflake execution only exposes
+  # /tmp as a writable scratch directory, so it is the sanctioned path, not a smell.
+  - repo: https://github.com/PyCQA/bandit
+    rev: "1.9.4"
     hooks:
       - id: bandit
-        name: bandit
-        entry: bandit
-        language: system
         pass_filenames: false
-        args: [-r, src/, -ll]
+        args: [-r, src/, -ll, --skip, B108]
 
-  # ── Docstrings: coverage ──────────────────────────────────────────────────
+  # Docstrings: coverage
   - repo: local
     hooks:
       - id: interrogate
         name: "[DOCSTRING] Coverage"
         entry: interrogate
-        language: system
+        language: python
+        additional_dependencies: ["interrogate==1.7.0"]
         pass_filenames: false
         args: [src/, --ignore-init-method, --ignore-magic, --ignore-module, --ignore-private]
 
-  # ── Docstrings: args/returns match signature ──────────────────────────────
+  # Docstrings: args/returns match signature
   - repo: local
     hooks:
       - id: darglint
         name: "[DOCSTRING] Args/Returns match"
         entry: darglint
-        language: system
+        language: python
+        additional_dependencies: ["darglint==1.8.1"]
         types: [python]
         files: ^src/
 
-  # ── Zero-width spaces (copy-paste from Outlook/Teams) ────────────────────
-  - repo: local
-    hooks:
-      - id: check-zws
-        name: "[ZWS] Invisible characters (zero-width)"
-        entry: python scripts/hooks/check_zws.py
-        language: system
-        pass_filenames: true
-
-  # ── Typed API guard ──────────────────────────────────────────────────────
+  # Typed API guard
   - repo: local
     hooks:
       - id: check-typed-api
@@ -117,30 +175,13 @@ repos:
         types: [python]
         files: ^src/
 
-  # ── Employer reference guard ──────────────────────────────────────────────
+  # ── EXTRA snowflake — Snowpark / Core API repos ───────────────────────────
+  # Snowpark / Core API conventions (no session.sql(), canonical method names)
   - repo: local
     hooks:
-      - id: check-forbidden-keywords
-        name: "[FORBIDDEN] Employer references"
-        entry: python scripts/hooks/check_forbidden_keywords.py
+      - id: check-snowpark-api
+        name: "[SNOWPARK-API] No session.sql(), canonical method names"
+        entry: python scripts/hooks/check_snowpark_api.py
         language: system
-        pass_filenames: true
-
-  # ── Docs up-to-date check ─────────────────────────────────────────────────
-  - repo: local
-    hooks:
-      - id: check-docs-up-to-date
-        name: Docs up-to-date (README + pdoc)
-        entry: scripts/hooks/check-docs-up-to-date
-        language: script
-        stages: [pre-commit]
-        pass_filenames: false
-
-  # ── Commit message format ─────────────────────────────────────────────────
-  - repo: local
-    hooks:
-      - id: commit-msg-format
-        name: Commit message format
-        entry: scripts/hooks/commit-msg
-        language: script
-        stages: [commit-msg]
+        types: [python]
+        files: ^src/

pinky_core-0.1.0.dev4/.secrets.baseline

@@ -0,0 +1,127 @@
+{
+  "version": "1.5.0",
+  "plugins_used": [
+    {
+      "name": "ArtifactoryDetector"
+    },
+    {
+      "name": "AWSKeyDetector"
+    },
+    {
+      "name": "AzureStorageKeyDetector"
+    },
+    {
+      "name": "Base64HighEntropyString",
+      "limit": 4.5
+    },
+    {
+      "name": "BasicAuthDetector"
+    },
+    {
+      "name": "CloudantDetector"
+    },
+    {
+      "name": "DiscordBotTokenDetector"
+    },
+    {
+      "name": "GitHubTokenDetector"
+    },
+    {
+      "name": "GitLabTokenDetector"
+    },
+    {
+      "name": "HexHighEntropyString",
+      "limit": 3.0
+    },
+    {
+      "name": "IbmCloudIamDetector"
+    },
+    {
+      "name": "IbmCosHmacDetector"
+    },
+    {
+      "name": "IPPublicDetector"
+    },
+    {
+      "name": "JwtTokenDetector"
+    },
+    {
+      "name": "KeywordDetector",
+      "keyword_exclude": ""
+    },
+    {
+      "name": "MailchimpDetector"
+    },
+    {
+      "name": "NpmDetector"
+    },
+    {
+      "name": "OpenAIDetector"
+    },
+    {
+      "name": "PrivateKeyDetector"
+    },
+    {
+      "name": "PypiTokenDetector"
+    },
+    {
+      "name": "SendGridDetector"
+    },
+    {
+      "name": "SlackDetector"
+    },
+    {
+      "name": "SoftlayerDetector"
+    },
+    {
+      "name": "SquareOAuthDetector"
+    },
+    {
+      "name": "StripeDetector"
+    },
+    {
+      "name": "TelegramBotTokenDetector"
+    },
+    {
+      "name": "TwilioKeyDetector"
+    }
+  ],
+  "filters_used": [
+    {
+      "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
+    },
+    {
+      "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
+      "min_level": 2
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_indirect_reference"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_likely_id_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_lock_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_potential_uuid"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_sequential_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_swagger_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_templated_secret"
+    }
+  ],
+  "results": {},
+  "generated_at": "2026-05-10T19:21:47Z"
+}