portolan-python 0.1.0__tar.gz → 0.1.1__tar.gz

{portolan_python-0.1.0 → portolan_python-0.1.1}/.github/workflows/release.yml

@@ -4,6 +4,15 @@ on:
   push:
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing version tag to publish
+        required: true
+        type: string
+
+env:
+  RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
 
 jobs:
   release:
@@ -12,6 +21,8 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ env.RELEASE_TAG }}
 
       - uses: actions/setup-python@v6
         with:
@@ -25,7 +36,7 @@ jobs:
         shell: bash
         run: |
           package_version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
-          test "${GITHUB_REF_NAME}" = "v${package_version}"
+          test "${RELEASE_TAG}" = "v${package_version}"
 
       - name: Test
         run: pytest
@@ -37,7 +48,7 @@ jobs:
         run: python -m twine check dist/*
 
       - name: Preserve distributions for PyPI
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: distributions
           path: dist/
@@ -45,18 +56,24 @@ jobs:
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release create "${GITHUB_REF_NAME}" dist/* --generate-notes --verify-tag
+        shell: bash
+        run: |
+          if gh release view "${RELEASE_TAG}" >/dev/null 2>&1; then
+            gh release upload "${RELEASE_TAG}" dist/* --clobber
+          else
+            gh release create "${RELEASE_TAG}" dist/* --generate-notes --verify-tag
+          fi
 
   publish-pypi:
     needs: release
-    if: vars.PUBLISH_PYPI == 'true'
+    if: vars.PUBLISH_PYPI == 'true' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     environment: pypi
     permissions:
       id-token: write
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: distributions
           path: dist/

{portolan_python-0.1.0 → portolan_python-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: portolan-python
-Version: 0.1.0
+Version: 0.1.1
 Summary: A lightweight Python implementation of the Portolan specification.
 Author: Portolan contributors
 License: Apache-2.0

{portolan_python-0.1.0 → portolan_python-0.1.1}/docs/distribution.md

@@ -1,7 +1,7 @@
 # Distribution
 
 Tagged releases provide immutable Python source and wheel archives. PyPI is the
-preferred package index once its trusted publisher is configured.
+preferred package index for published versions.
 
 ## Release artifacts
 
@@ -30,25 +30,12 @@ python -m pip install \
 
 This path needs no package index account.
 
-## Publish to PyPI
+## Install from PyPI
 
-The workflow supports PyPI trusted publishing. It uses a short-lived identity
-token, so the repository does not store a permanent PyPI API token.
-
-Complete these steps once:
-
-1. Create the `portolan-python` project on PyPI, or add a pending publisher.
-2. Add a trusted GitHub publisher for `jemacchi/portolan-python`.
-3. Set the workflow name to `release.yml` and the environment to `pypi`.
-4. Create the `pypi` environment in the GitHub repository.
-5. Add the repository variable `PUBLISH_PYPI` with the value `true`.
-
-After this setup, each valid version tag also publishes to PyPI. Consumers can
-then use the normal command:
+Install a published version from PyPI with:
 
 ```bash
 python -m pip install portolan-python==0.1.0
 ```
 
-PyPI does not permit replacing a published version. Increase the version before
-you publish another release.
+Omit the version constraint to install the latest published version.

{portolan_python-0.1.0 → portolan_python-0.1.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "portolan-python"
-version = "0.1.0"
+version = "0.1.1"
 description = "A lightweight Python implementation of the Portolan specification."
 readme = "README.md"
 requires-python = ">=3.10"

{portolan_python-0.1.0 → portolan_python-0.1.1}/src/portolan/registry.py

@@ -73,15 +73,19 @@ def download_registry_catalog(
     fetch_json: Callable[[str], JsonObject] | None = None,
 ) -> Path:
     """Download a published catalog snapshot for local workflows."""
+    _validate_remote_url(catalog_url)
     fetch = fetch_json or _fetch_json
     catalog = fetch(catalog_url)
     catalog_id = str(catalog.get("id") or _fallback_catalog_id(catalog_url))
+    if catalog_id in {"", ".", ".."} or Path(catalog_id).name != catalog_id or "\\" in catalog_id:
+        raise ValueError(f"Catalog id must be a safe directory name: {catalog_id}")
     catalog_root = output_dir / catalog_id
     _write_catalog_tree(catalog_url, catalog, catalog_url, catalog_root, fetch)
     return catalog_root
 
 
 def _fetch_json(url: str) -> JsonObject:
+    _validate_remote_url(url)
     request = Request(url, headers={"User-Agent": "portolan-python"})
     with urlopen(request, timeout=30) as response:
         data = json.loads(response.read().decode("utf-8"))
@@ -90,6 +94,12 @@ def _fetch_json(url: str) -> JsonObject:
     return data
 
 
+def _validate_remote_url(url: str) -> None:
+    parsed = urlparse(url)
+    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+        raise ValueError(f"Registry URL must use HTTP or HTTPS: {url}")
+
+
 def _write_catalog_tree(
     document_url: str,
     document: JsonObject,

{portolan_python-0.1.0 → portolan_python-0.1.1}/tests/test_registry_api.py

@@ -280,3 +280,19 @@ def test_download_registry_catalog_handles_collections_without_asset_objects(
         (catalog_root / "roads" / "collection.json").read_text(encoding="utf-8")
     )
     assert collection["assets"] == []
+
+
+def test_download_registry_catalog_rejects_id_outside_output_directory(tmp_path: Path) -> None:
+    catalog = {"type": "Catalog", "id": "../../outside", "links": []}
+
+    with pytest.raises(ValueError, match="safe directory name"):
+        download_registry_catalog(
+            "https://example.test/demo/catalog.json",
+            tmp_path,
+            fetch_json=lambda url: catalog,
+        )
+
+
+def test_download_registry_catalog_rejects_non_http_url(tmp_path: Path) -> None:
+    with pytest.raises(ValueError, match="must use HTTP or HTTPS"):
+        download_registry_catalog("file:///tmp/catalog.json", tmp_path)

{portolan_python-0.1.0 → portolan_python-0.1.1}/uv.lock

@@ -468,7 +468,7 @@ wheels = [
 
 [[package]]
 name = "portolan-python"
-version = "0.1.0"
+version = "0.1.1"
 source = { editable = "." }
 
 [package.optional-dependencies]