portolan-python 0.1.0__tar.gz → 0.1.2__tar.gz

{portolan_python-0.1.0 → portolan_python-0.1.2}/.github/workflows/release.yml

@@ -4,6 +4,15 @@ on:
   push:
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing version tag to publish
+        required: true
+        type: string
+
+env:
+  RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
 
 jobs:
   release:
@@ -12,6 +21,8 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ env.RELEASE_TAG }}
 
       - uses: actions/setup-python@v6
         with:
@@ -25,7 +36,7 @@ jobs:
         shell: bash
         run: |
           package_version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
-          test "${GITHUB_REF_NAME}" = "v${package_version}"
+          test "${RELEASE_TAG}" = "v${package_version}"
 
       - name: Test
         run: pytest
@@ -37,7 +48,7 @@ jobs:
         run: python -m twine check dist/*
 
       - name: Preserve distributions for PyPI
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: distributions
           path: dist/
@@ -45,18 +56,24 @@ jobs:
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release create "${GITHUB_REF_NAME}" dist/* --generate-notes --verify-tag
+        shell: bash
+        run: |
+          if gh release view "${RELEASE_TAG}" >/dev/null 2>&1; then
+            gh release upload "${RELEASE_TAG}" dist/* --clobber
+          else
+            gh release create "${RELEASE_TAG}" dist/* --generate-notes --verify-tag
+          fi
 
   publish-pypi:
     needs: release
-    if: vars.PUBLISH_PYPI == 'true'
+    if: vars.PUBLISH_PYPI == 'true' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     environment: pypi
     permissions:
       id-token: write
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: distributions
           path: dist/

{portolan_python-0.1.0 → portolan_python-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: portolan-python
-Version: 0.1.0
+Version: 0.1.2
 Summary: A lightweight Python implementation of the Portolan specification.
 Author: Portolan contributors
 License: Apache-2.0

{portolan_python-0.1.0 → portolan_python-0.1.2}/docs/distribution.md

@@ -1,7 +1,7 @@
 # Distribution
 
 Tagged releases provide immutable Python source and wheel archives. PyPI is the
-preferred package index once its trusted publisher is configured.
+preferred package index for published versions.
 
 ## Release artifacts
 
@@ -30,25 +30,12 @@ python -m pip install \
 
 This path needs no package index account.
 
-## Publish to PyPI
+## Install from PyPI
 
-The workflow supports PyPI trusted publishing. It uses a short-lived identity
-token, so the repository does not store a permanent PyPI API token.
-
-Complete these steps once:
-
-1. Create the `portolan-python` project on PyPI, or add a pending publisher.
-2. Add a trusted GitHub publisher for `jemacchi/portolan-python`.
-3. Set the workflow name to `release.yml` and the environment to `pypi`.
-4. Create the `pypi` environment in the GitHub repository.
-5. Add the repository variable `PUBLISH_PYPI` with the value `true`.
-
-After this setup, each valid version tag also publishes to PyPI. Consumers can
-then use the normal command:
+Install a published version from PyPI with:
 
 ```bash
 python -m pip install portolan-python==0.1.0
 ```
 
-PyPI does not permit replacing a published version. Increase the version before
-you publish another release.
+Omit the version constraint to install the latest published version.

{portolan_python-0.1.0 → portolan_python-0.1.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "portolan-python"
-version = "0.1.0"
+version = "0.1.2"
 description = "A lightweight Python implementation of the Portolan specification."
 readme = "README.md"
 requires-python = ">=3.10"

{portolan_python-0.1.0 → portolan_python-0.1.2}/src/portolan/registry.py

@@ -73,15 +73,19 @@ def download_registry_catalog(
     fetch_json: Callable[[str], JsonObject] | None = None,
 ) -> Path:
     """Download a published catalog snapshot for local workflows."""
+    _validate_remote_url(catalog_url)
     fetch = fetch_json or _fetch_json
     catalog = fetch(catalog_url)
     catalog_id = str(catalog.get("id") or _fallback_catalog_id(catalog_url))
+    if catalog_id in {"", ".", ".."} or Path(catalog_id).name != catalog_id or "\\" in catalog_id:
+        raise ValueError(f"Catalog id must be a safe directory name: {catalog_id}")
     catalog_root = output_dir / catalog_id
     _write_catalog_tree(catalog_url, catalog, catalog_url, catalog_root, fetch)
     return catalog_root
 
 
 def _fetch_json(url: str) -> JsonObject:
+    _validate_remote_url(url)
     request = Request(url, headers={"User-Agent": "portolan-python"})
     with urlopen(request, timeout=30) as response:
         data = json.loads(response.read().decode("utf-8"))
@@ -90,13 +94,24 @@ def _fetch_json(url: str) -> JsonObject:
     return data
 
 
+def _validate_remote_url(url: str) -> None:
+    parsed = urlparse(url)
+    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+        raise ValueError(f"Registry URL must use HTTP or HTTPS: {url}")
+
+
 def _write_catalog_tree(
     document_url: str,
     document: JsonObject,
     root_url: str,
     output_root: Path,
     fetch_json: Callable[[str], JsonObject],
+    visited: set[str] | None = None,
 ) -> None:
+    if visited is None:
+        visited = set()
+    visited.add(document_url)
+
     relative_path = _relative_document_path(root_url, document_url)
     target = output_root / relative_path
     target.parent.mkdir(parents=True, exist_ok=True)
@@ -111,9 +126,11 @@ def _write_catalog_tree(
         if not isinstance(href, str):
             continue
         child_url = urljoin(document_url, href)
+        if child_url in visited:
+            continue
         child = fetch_json(child_url)
         if child.get("type") in {"Catalog", "Collection"}:
-            _write_catalog_tree(child_url, child, root_url, output_root, fetch_json)
+            _write_catalog_tree(child_url, child, root_url, output_root, fetch_json, visited)
 
 
 def _with_absolute_asset_hrefs(document_url: str, collection: JsonObject) -> JsonObject:

{portolan_python-0.1.0 → portolan_python-0.1.2}/tests/test_registry_api.py

@@ -169,6 +169,33 @@ def test_download_registry_catalog_writes_snapshot_with_absolute_asset_hrefs(
     assert collection["assets"]["data"]["href"] == "https://example.test/demo/roads/roads.parquet"
 
 
+def test_download_registry_catalog_skips_child_cycles(tmp_path: Path) -> None:
+    root_url = "https://example.test/demo/catalog.json"
+    child_url = "https://example.test/demo/roads/collection.json"
+    responses = {
+        root_url: {
+            "type": "Catalog",
+            "id": "demo",
+            "links": [{"rel": "child", "href": "./roads/collection.json"}],
+        },
+        child_url: {
+            **_collection("roads", {}),
+            "links": [{"rel": "child", "href": "../catalog.json"}],
+        },
+    }
+    fetched_urls: list[str] = []
+
+    def fetch_json(url: str) -> dict[str, Any]:
+        fetched_urls.append(url)
+        if fetched_urls.count(url) > 1:
+            raise AssertionError(f"Fetched document twice: {url}")
+        return responses[url]
+
+    download_registry_catalog(root_url, tmp_path, fetch_json=fetch_json)
+
+    assert fetched_urls == [root_url, child_url]
+
+
 def test_download_registry_catalog_recurses_nested_catalogs_and_uses_fallback_id(
     tmp_path: Path,
 ) -> None:
@@ -280,3 +307,19 @@ def test_download_registry_catalog_handles_collections_without_asset_objects(
         (catalog_root / "roads" / "collection.json").read_text(encoding="utf-8")
     )
     assert collection["assets"] == []
+
+
+def test_download_registry_catalog_rejects_id_outside_output_directory(tmp_path: Path) -> None:
+    catalog = {"type": "Catalog", "id": "../../outside", "links": []}
+
+    with pytest.raises(ValueError, match="safe directory name"):
+        download_registry_catalog(
+            "https://example.test/demo/catalog.json",
+            tmp_path,
+            fetch_json=lambda url: catalog,
+        )
+
+
+def test_download_registry_catalog_rejects_non_http_url(tmp_path: Path) -> None:
+    with pytest.raises(ValueError, match="must use HTTP or HTTPS"):
+        download_registry_catalog("file:///tmp/catalog.json", tmp_path)

{portolan_python-0.1.0 → portolan_python-0.1.2}/uv.lock

@@ -468,7 +468,7 @@ wheels = [
 
 [[package]]
 name = "portolan-python"
-version = "0.1.0"
+version = "0.1.2"
 source = { editable = "." }
 
 [package.optional-dependencies]