plugin-scanner 2.0.1115__tar.gz → 2.0.1116__tar.gz

{plugin_scanner-2.0.1115 → plugin_scanner-2.0.1116}/.github/workflows/ci.yml

@@ -8,25 +8,26 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  ci:
+  quality:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
-          python-version: ${{ matrix.python-version }}
+          python-version: "3.12"
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
         with:
           enable-cache: true
-      - run: uv sync --frozen --extra dev --python ${{ matrix.python-version }}
+      - run: uv sync --frozen --extra dev --python 3.12
       - run: uv run --no-sync python -m ruff check src/
       - run: uv run --no-sync python -m ruff format --check src/
-      - if: matrix.python-version == '3.12'
-        run: uv run --no-sync basedpyright --level error
+      - run: uv run --no-sync basedpyright --level error
       - name: Dead-code scan (L329)
         run: uv run --no-sync python -m ruff check src/codex_plugin_scanner/guard/ --select=F401,F811,F841
       - name: TODO/FIXME scan (L330)
@@ -37,7 +38,51 @@ jobs:
             grep -rn "TODO\|FIXME\|HACK\|XXX" src/codex_plugin_scanner/guard/ --include="*.py" | grep -v "# type: ignore"
             exit 1
           fi
-      - run: uv run --no-sync pytest --tb=short
+
+  tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        shard-index: [0, 1, 2, 3]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: ${{ matrix.python-version }}
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --python ${{ matrix.python-version }}
+      - name: Run pytest shard ${{ matrix.shard-index }}
+        shell: bash
+        run: |
+          files_output="$(python scripts/ci/pytest_shard.py \
+            --shard-index "${{ matrix.shard-index }}" \
+            --shard-count 4)"
+          if [[ -z "$files_output" ]]; then
+            echo "pytest shard produced no test files" >&2
+            exit 1
+          fi
+          mapfile -t files <<< "$files_output"
+          uv run --no-sync pytest "${files[@]}" --tb=short
+
+  ci-python-312:
+    name: ci (3.12)
+    if: always()
+    needs: [quality, tests]
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Verify Python CI dependencies
+        env:
+          QUALITY_RESULT: ${{ needs.quality.result }}
+          TESTS_RESULT: ${{ needs.tests.result }}
+        run: |
+          test "$QUALITY_RESULT" = "success"
+          test "$TESTS_RESULT" = "success"
 
   dashboard:
     runs-on: ubuntu-latest

{plugin_scanner-2.0.1115 → plugin_scanner-2.0.1116}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1115
+Version: 2.0.1116
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Documentation, https://github.com/hashgraph-online/hol-guard/tree/main/docs/guard

{plugin_scanner-2.0.1115 → plugin_scanner-2.0.1116}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1115"
+version = "2.0.1116"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1115 → plugin_scanner-2.0.1116}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1115"
+version = "2.0.1116"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.1115/release-metadata/plugin-scanner-v2.0.1115.toolchain.cdx.json → plugin_scanner-2.0.1116/release-metadata/plugin-scanner-v2.0.1116.toolchain.cdx.json

@@ -27,7 +27,7 @@
     "component": {
       "name": "hol-guard-release-toolchain",
       "type": "application",
-      "version": "2.0.1115"
+      "version": "2.0.1116"
     }
   },
   "specVersion": "1.6",

plugin_scanner-2.0.1116/scripts/ci/pytest_shard.py

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+"""Select a deterministic, balanced shard of pytest files."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+
+def discover_test_files(root: Path) -> list[Path]:
+    return sorted(path for path in (root / "tests").rglob("test_*.py") if path.is_file())
+
+
+def build_test_shards(root: Path, shard_count: int) -> list[list[Path]]:
+    if shard_count < 1:
+        raise ValueError("shard_count must be positive")
+
+    files = discover_test_files(root)
+    if shard_count > len(files):
+        raise ValueError("shard_count cannot exceed the number of test files")
+
+    shards: list[list[Path]] = [[] for _ in range(shard_count)]
+    weights = [0] * shard_count
+    weighted_files = sorted(
+        ((path.stat().st_size, path) for path in files),
+        key=lambda item: (-item[0], item[1].as_posix()),
+    )
+    for weight, path in weighted_files:
+        shard_index = min(range(shard_count), key=lambda index: (weights[index], index))
+        shards[shard_index].append(path)
+        weights[shard_index] += weight
+
+    for shard in shards:
+        shard.sort()
+    return shards
+
+
+def select_test_files(root: Path, shard_index: int, shard_count: int) -> list[Path]:
+    if shard_index < 0 or shard_index >= shard_count:
+        raise ValueError("shard_index must be between zero and shard_count - 1")
+    return build_test_shards(root, shard_count)[shard_index]
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--shard-count", type=int, required=True)
+    parser.add_argument("--shard-index", type=int, required=True)
+    args = parser.parse_args()
+
+    root = Path(__file__).resolve().parents[2]
+    for path in select_test_files(root, args.shard_index, args.shard_count):
+        print(path.relative_to(root).as_posix())
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{plugin_scanner-2.0.1115 → plugin_scanner-2.0.1116}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.1115"
+__version__ = "2.0.1116"

plugin_scanner-2.0.1116/tests/test_ci_pytest_shard.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPT_PATH = ROOT / "scripts" / "ci" / "pytest_shard.py"
+SPEC = importlib.util.spec_from_file_location("pytest_shard", SCRIPT_PATH)
+assert SPEC is not None and SPEC.loader is not None
+pytest_shard = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(pytest_shard)
+
+
+def test_ci_shards_cover_every_test_file_once_and_deterministically() -> None:
+    expected = pytest_shard.discover_test_files(ROOT)
+    shards = pytest_shard.build_test_shards(ROOT, 4)
+
+    assert shards == pytest_shard.build_test_shards(ROOT, 4)
+    assert all(shards)
+    assert sorted(path for shard in shards for path in shard) == expected
+    assert sum(len(shard) for shard in shards) == len(set().union(*map(set, shards)))
+
+
+def test_ci_workflow_cancels_stale_runs_and_executes_each_shard() -> None:
+    workflow = (ROOT / ".github" / "workflows" / "ci.yml").read_text(encoding="utf-8")
+
+    assert "cancel-in-progress: true" in workflow
+    assert "python scripts/ci/pytest_shard.py" in workflow
+    assert "name: ci (3.12)" in workflow
+    assert "needs: [quality, tests]" in workflow

{plugin_scanner-2.0.1115 → plugin_scanner-2.0.1116}/tests/test_guard_headless_daemon_api.py

@@ -577,7 +577,9 @@ def test_supply_chain_package_firewall_connect_repairs_local_auth_and_unlocks_pa
         assert status == 200
         assert running["connect_flow"]["state"] == "running"
         assert running["connect_flow"]["authorize_url"] == "https://hol.org/mock-authorize"
-        for _ in range(20):
+        deadline = time.monotonic() + 10.0
+        refreshed: dict[str, object] = {}
+        while time.monotonic() < deadline:
             status, refreshed = _read_json_response(
                 _request(
                     daemon.port,
@@ -591,9 +593,14 @@ def test_supply_chain_package_firewall_connect_repairs_local_auth_and_unlocks_pa
                 assert refreshed["entitlement"]["reason"] == "paid_oauth_entitlement_active"
                 assert refreshed["connect_flow"] is None
                 break
+            connect_flow = refreshed.get("connect_flow")
+            if isinstance(connect_flow, dict) and connect_flow.get("state") == "failed":
+                pytest.fail(f"Guard Cloud connect failed: {connect_flow.get('detail', 'unknown error')}")
             time.sleep(0.1)
         else:
-            raise AssertionError("package firewall status never unlocked after local connect repair")
+            raise AssertionError(
+                f"package firewall status never unlocked after local connect repair: last response={refreshed!r}"
+            )
     finally:
         daemon.stop()
 

{plugin_scanner-2.0.1115 → plugin_scanner-2.0.1116}/uv.lock

@@ -1171,7 +1171,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.1115"
+version = "2.0.1116"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner" },