pipseek 2.1.0__tar.gz

pipseek-2.1.0/.github/workflows/ci.yml

@@ -0,0 +1,24 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python: ["3.9", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - run: python -m pip install -e ".[dev]"
+      - run: ruff check src tests
+      - run: pytest -q
+      - run: pipseek --version

pipseek-2.1.0/.github/workflows/index.yml

@@ -0,0 +1,49 @@
+name: Search index
+
+# Rebuilds the full PyPI search index (names, summaries, keywords) and publishes it as the
+# `pypi-index.tsv.gz` asset on the `index` release, which pipseek clients download.
+# Incremental: only projects that changed since the last run are re-fetched.
+
+on:
+  schedule:
+    - cron: "17 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: search-index
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 340
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - run: python -m pip install -e .
+
+      - name: Download previous index
+        run: |
+          gh release download index --pattern pypi-index.tsv.gz --dir prev || echo "No previous index"
+          ls -la prev || true
+
+      - name: Build index
+        run: |
+          PREV=""
+          if [ -f prev/pypi-index.tsv.gz ]; then PREV="--previous prev/pypi-index.tsv.gz"; fi
+          python -m pipseek.build_index $PREV --out pypi-index.tsv.gz --time-budget 18000 --concurrency 32
+
+      - name: Publish
+        run: |
+          if ! gh release view index >/dev/null 2>&1; then
+            gh release create index --title "Search index" --latest=false \
+              --notes "Prebuilt PyPI search index used by pipseek. Updated daily by the Search index workflow."
+          fi
+          gh release upload index pypi-index.tsv.gz --clobber

pipseek-2.1.0/.github/workflows/release.yml

@@ -0,0 +1,66 @@
+name: Release
+
+# Push a tag like v2.1.0 to publish that version to PyPI and create a GitHub release.
+# PyPI uses Trusted Publishing (OIDC), so no API token is stored in this repo.
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Check the tag matches the package version
+        run: |
+          VERSION=$(python -c "import re;print(re.search(r'__version__ = \"(.+?)\"', open('src/pipseek/__init__.py').read()).group(1))")
+          test "v$VERSION" = "$GITHUB_REF_NAME" || { echo "Tag $GITHUB_REF_NAME does not match version $VERSION"; exit 1; }
+      - run: python -m pip install build twine
+      - run: python -m build
+      - run: python -m twine check --strict dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/pipseek/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  github-release:
+    needs: pypi
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Release notes from CHANGELOG.md
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          awk -v v="## $VERSION" '$0 ~ "^"v {on=1; next} on && /^## / {exit} on' CHANGELOG.md > notes.md
+          cat notes.md
+      - run: gh release create "$GITHUB_REF_NAME" dist/* --title "pipseek $GITHUB_REF_NAME" --notes-file notes.md --verify-tag

pipseek-2.1.0/.gitignore

@@ -0,0 +1,80 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+env/
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# Nuitka build files
+*.build/
+*.dist/
+*.onefile-build/
+*.cmd
+pipseek.bin
+pipseek.exe
+pipseek-linux
+pipseek-windows.exe
+pipseek-macos
+
+# Virtual Environment
+venv/
+ENV/
+env/
+.env/
+.venv/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# Build and Release Scripts
+setup.sh
+release.sh
+
+# OS specific
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Logs
+*.log
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+.hypothesis/
+
+# Tooling caches
+.pytest_cache/
+.ruff_cache/

pipseek-2.1.0/CHANGELOG.md

@@ -0,0 +1,50 @@
+# Changelog
+
+## 2.1.0 (2026-11)
+
+### Security
+
+- Known vulnerabilities from OSV.dev (free, no key) for the latest version and for the version you have installed: severity, CVE and the version that fixes each one.  Duplicate advisories (GHSA, PYSEC and CVE ids for the same problem) are merged.
+- A red badge in the detail pane and a flag in the results when your installed version is affected.
+- `pipseek --outdated` checks your whole environment for outdated and vulnerable packages, worst first, and ends with the upgrade command (vulnerable packages first when the list is long).  `--all` lists every package, `--json` gives structured output, and `--strict` exits with status 1 when something installed is vulnerable, for CI.
+- On an OS-managed ("externally managed") system Python, pipseek no longer suggests `pip install` commands or installs with the `i` key.
+
+### Other
+
+- Fix versions prefer final releases over release candidates.
+- Releases are published to PyPI from GitHub Actions with Trusted Publishing, so no API token is stored anywhere.
+- The README now uses absolute image links, so it renders on PyPI too.
+
+## 2.0.0 (2026-11)
+
+A ground-up rewrite.  Written with AI coding agents (Claude), directed, reviewed and tested by [OhMyBahGosh](https://github.com/ohmybahgosh).
+
+### Search
+
+- Replaced scraping of `pypi.org/search` with a self-hosted search index built from PyPI's official Simple and JSON APIs.  v1 got past PyPI's bot challenge to scrape the search page; v2 doesn't touch that page at all, so it can't break when the challenge changes.
+- Searches project summaries and keywords, not just names, through a local SQLite FTS5 database.
+- Ranking blends name matches, BM25 relevance and 30-day download counts.  Tuned against the full index of about 930,000 projects so that empty placeholder packages named after a search term no longer outrank Django or tqdm.
+- "Did you mean?" suggestions for typos.
+- A daily GitHub Action rebuilds the index incrementally, re-fetching only projects whose PyPI serial changed, and publishes it on the `index` release.
+- Summaries for the 15,000 most popular projects ship inside the package as a fallback.  When pipseek only has the fallback, it tries for the full index again every day instead of every week.
+
+### Interface
+
+- New Textual TUI: search box, results list, a detail pane that follows the cursor, five sort orders, paging, clipboard copy, browser shortcuts and one-key install or upgrade.
+- `--plain`, `--json` and `--info` modes for scripts.  Piped output switches to plain mode automatically.
+- Installed and update-available badges for your active environment, even when pipseek itself runs from pipx or uv.
+
+### Data
+
+- Stars, forks, open issues and the OpenSSF Scorecard come from deps.dev, which needs no API key and covers GitHub, GitLab and Bitbucket.  This replaced the GitHub API and its 60-requests-an-hour limit; `GITHUB_TOKEN` is no longer used.  `--no-github` is now `--no-stats` (the old name still works).
+- Release dates, authors and licenses now handle the many ways packages fill in (or leave out) their metadata.
+
+### Packaging and quality
+
+- Installable with pipx, uv or pip, with a real `pipseek` command, replacing the loose `pipseek.py` script.
+- pytest suite and ruff linting, run in CI on Linux, macOS and Windows with Python 3.9 and 3.13.
+- Fixed before release: the plain-table mode crashed on start after an option was renamed.  Caught by running it on a real desktop, and now covered by a test.
+
+## 1.0.0 (2025)
+
+- The original single-file script: scraped PyPI's search page (solving its proof-of-work challenge, based on [work by Long0x0](https://github.com/victorgarric/pip_search/issues/44#issuecomment-2565442916)) and showed results in a Textual app.