pushframe 5.0.2__tar.gz → 5.0.3__tar.gz

{pushframe-5.0.2 → pushframe-5.0.3}/.github/workflows/release.yml

@@ -36,7 +36,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Assert tag == pyproject == pushframe.__version__
         id: version
         run: |
@@ -56,8 +56,8 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
       - name: Build sdist + wheel
@@ -70,8 +70,8 @@ jobs:
     needs: check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
       - name: Install uv-managed standalone python (the deb's runtime)
@@ -94,8 +94,8 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
       - name: Restore the APT signing key from the secret
         env:
           PUSHFRAME_APT_SIGNING_KEY: ${{ secrets.PUSHFRAME_APT_SIGNING_KEY }}
@@ -126,8 +126,8 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
       - name: Build sdist + wheel

{pushframe-5.0.2 → pushframe-5.0.3}/.github/workflows/tests.yml

@@ -9,10 +9,10 @@ jobs:
   offline-suite:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
 

pushframe-5.0.3/CHANGELOG.md

@@ -0,0 +1,121 @@
+# Changelog
+
+All notable changes to `pushframe` are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+Each release ships simultaneously to [PyPI](https://pypi.org/project/pushframe/),
+the [signed APT repository](https://coredmp95.github.io/pushframe/), and
+[GitHub Releases](https://github.com/coredmp95/pushframe/releases) — one tag,
+every channel.
+
+`pushframe` is an unofficial community CLI for Aura Frames digital photo
+frames; it is not affiliated with Aura Frames Inc.
+
+## [5.0.2] — 2026-09-29
+
+### Fixed
+
+- **PyPI project page** — 5.0.0/5.0.1 shipped no package description: the
+  wheel metadata now carries the README (`readme`), a one-line summary with
+  the not-affiliated disclaimer, and Homepage/Repository/Issues URLs.
+- **Release pipeline, APT job** (CI-only, no code change vs 5.0.1): the
+  signing-key fingerprint is derived with gpg instead of a grep over the
+  ASCII armor, and the gh-pages orphan commit runs with an explicit git
+  identity — first release where all five jobs (check, pypi-test, deb,
+  apt, pypi) are green end-to-end.
+- **CI actions** — `actions/checkout@v7`, `astral-sh/setup-uv@v10.2.0`
+  (Node 24): clears the Node.js 20 deprecation warnings on the runners.
+
+## [5.0.1] — 2026-09-29
+
+### Fixed
+
+- Wheel/sdist metadata: `readme = README.md`, `description`, and
+  `project.urls` declared (the 5.0.0 PyPI page rendered empty; versions
+  being immutable on PyPI, the fix ships as a new release).
+
+## [5.0.0] — 2026-09-29
+
+The first distribution release — and the first version published outside
+git tags. Aligns with the v5.0 milestone (« Distribution & Rename »).
+
+### Added
+
+- **Debian packaging** (`scripts/build-deb.sh`): hermetic `.deb` embedding
+  its own CPython 3.14 under `/usr/lib/pushframe/` — no system Python is
+  used or modified; lintian-clean (0 errors, 0 warnings); removal leaves
+  no residue (bytecode is package-owned, `PYTHONDONTWRITEBYTECODE` at run
+  time); verified in clean `ubuntu:26.04` containers.
+- **Signed APT repository** at `https://coredmp95.github.io/pushframe/`
+  (dedicated no-passphrase GPG key, InRelease/Release.gpg, keyring +
+  one-line sources entry), plus container tests proving the full user
+  journey: `apt update` signature-clean → `apt install pushframe` →
+  working CLI.
+- **PyPI distribution** via GitHub Actions **trusted publishing** (OIDC)
+  — no PyPI token exists anywhere; TestPyPI rehearsal gates every real
+  upload.
+- **Release automation** (`release.yml`): pushing a `v*` tag builds the
+  wheel/sdist, the `.deb` (attached to the GitHub Release), republishes
+  the APT repository, and uploads to PyPI — with a version-consistency
+  gate (tag == pyproject == `pushframe.__version__`).
+- **Install journeys as tests**: clean-container proofs for all three
+  channels (`.deb` file, APT, `uv tool install`).
+- `pushframe --version` prints `pushframe <release>` (single-sourced,
+  lockstep-guarded by tests and the release gate).
+
+### Changed
+
+- Project renamed **auraframes → pushframe** (module, binary, config):
+  the old name collided with an existing PyPI package and is
+  trademark-adjacent; config migrates automatically
+  (`~/.config/auraframes/` → `~/.config/pushframe/`, non-destructive).
+- Environment variables: `PUSHFRAME_*` is primary; `AURA_*` still read
+  for one release as a deprecation window.
+
+### Deprecated
+
+- `AURA_*` environment variables (read until 5.x; set `PUSHFRAME_*`).
+- `aura-cli` as an installed command: removed in favor of the single
+  `pushframe` binary.
+
+### Security
+
+- Repository moved to a standalone repo (not a fork); MIT LICENSE with
+  provenance; GitHub security features enabled (secret scanning + push
+  protection, Dependabot, CodeQL).
+
+## Pre-distribution history (git tags only, never published to a package index)
+
+Milestone summary — see `.planning/MILESTONES.md` for the full retros.
+
+- **v4.0 — Local Google Photos Album Sync** (phases 16–19, 2026-09):
+  `google-link` (dedicated Chrome profile, cookie vault `0600`),
+  `google-album` (full walk, exact byte counts), `google-sync`
+  (hide-by-default mirror semantics, pruned cache + persistent manifest,
+  SAFE-01..04 guards); live UAT two-run proof (upload run → zero-upload
+  steady state); debt closeout (AWS config out of code, single logger
+  per process, transport seam).
+- **v3.0 — direct transport rewrite**: `Client` over `httpx` (HTTP/2),
+  boto3 S3/SQS upload path, offline test harness (mocket), full offline
+  suite; the server-side relay approach was abandoned this milestone.
+- **v2.0 — read path hardening**: `status`/`inspect`/`sync`/`push`
+  verbs, asset lifecycle states, anti-abuse paced writes, staged
+  uploads with cleanup on failure.
+- **v1.1 — client transport fixes** (the original author's last tag;
+  revived and extended by the current maintainer in 2026).
+- **v1.0 — initial upstream release** by zmanowar (2023).
+
+## [Unreleased]
+
+- Nothing staged yet; next changes land here before the next tag.
+
+## [5.0.3] — 2026-09-29
+
+### Added
+
+- `CHANGELOG.md` — every release now traced in Keep a Changelog format
+  (Added / Changed / Deprecated / Fixed / Security), exposed as a
+  `Changelog` project URL on PyPI and referenced from the README.
+- `arch=amd64` in the documented APT sources entry: silences apt's
+  i386 notice on multi-arch machines (the repo is amd64-only).

{pushframe-5.0.2 → pushframe-5.0.3}/PKG-INFO

@@ -1,10 +1,11 @@
 Metadata-Version: 2.5
 Name: pushframe
-Version: 5.0.2
+Version: 5.0.3
 Summary: Unofficial community CLI for Aura Frames digital photo frames (sync a local folder or a Google Photos album; not affiliated with Aura Frames Inc.)
 Project-URL: Homepage, https://github.com/coredmp95/pushframe
 Project-URL: Repository, https://github.com/coredmp95/pushframe
 Project-URL: Issues, https://github.com/coredmp95/pushframe/issues
+Project-URL: Changelog, https://github.com/coredmp95/pushframe/blob/master/CHANGELOG.md
 License: MIT License
         
         Copyright (c) 2026 Fabrice DIDIERJEAN (coredmp95)
@@ -91,6 +92,9 @@ Any advice or issues are welcome.
   environment, dependency, and interpreter management.
 - A live Aura account (email + password) for any command that actually hits the API.
 
+Release history lives in [CHANGELOG.md](CHANGELOG.md) (Added / Changed /
+Deprecated / Fixed / Security per release, Keep a Changelog format).
+
 ## Install (Ubuntu/Debian)
 
 Pre-built `.deb` packages embed their own Python 3.14 runtime under
@@ -135,8 +139,9 @@ sudo install -d -m 0755 /etc/apt/keyrings
 curl -fsSL https://coredmp95.github.io/pushframe/dists/pushframe.asc \
   | sudo gpg --dearmor -o /etc/apt/keyrings/pushframe.gpg
 
-# 2. add the sources entry
-echo "deb [signed-by=/etc/apt/keyrings/pushframe.gpg] https://coredmp95.github.io/pushframe stable main" \
+# 2. add the sources entry (arch=amd64: the repo is amd64-only — on
+#    multi-arch machines this silences apt's i386 notice)
+echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/pushframe.gpg] https://coredmp95.github.io/pushframe stable main" \
   | sudo tee /etc/apt/sources.list.d/pushframe.list
 
 # 3. install

{pushframe-5.0.2 → pushframe-5.0.3}/README.md

@@ -32,6 +32,9 @@ Any advice or issues are welcome.
   environment, dependency, and interpreter management.
 - A live Aura account (email + password) for any command that actually hits the API.
 
+Release history lives in [CHANGELOG.md](CHANGELOG.md) (Added / Changed /
+Deprecated / Fixed / Security per release, Keep a Changelog format).
+
 ## Install (Ubuntu/Debian)
 
 Pre-built `.deb` packages embed their own Python 3.14 runtime under
@@ -76,8 +79,9 @@ sudo install -d -m 0755 /etc/apt/keyrings
 curl -fsSL https://coredmp95.github.io/pushframe/dists/pushframe.asc \
   | sudo gpg --dearmor -o /etc/apt/keyrings/pushframe.gpg
 
-# 2. add the sources entry
-echo "deb [signed-by=/etc/apt/keyrings/pushframe.gpg] https://coredmp95.github.io/pushframe stable main" \
+# 2. add the sources entry (arch=amd64: the repo is amd64-only — on
+#    multi-arch machines this silences apt's i386 notice)
+echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/pushframe.gpg] https://coredmp95.github.io/pushframe stable main" \
   | sudo tee /etc/apt/sources.list.d/pushframe.list
 
 # 3. install

{pushframe-5.0.2 → pushframe-5.0.3}/pushframe/__init__.py

@@ -1,4 +1,4 @@
 # pushframe — unofficial community CLI for Aura Frames (not affiliated).
 # Version single source for the CLI surface (REL-02); pyproject keeps the
 # packaging metadata version and tests/test_version.py enforces lockstep.
-__version__ = "5.0.2"
+__version__ = "5.0.3"

{pushframe-5.0.2 → pushframe-5.0.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pushframe"
-version = "5.0.2"
+version = "5.0.3"
 description = "Unofficial community CLI for Aura Frames digital photo frames (sync a local folder or a Google Photos album; not affiliated with Aura Frames Inc.)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -31,6 +31,7 @@ dependencies = [
 Homepage = "https://github.com/coredmp95/pushframe"
 Repository = "https://github.com/coredmp95/pushframe"
 Issues = "https://github.com/coredmp95/pushframe/issues"
+Changelog = "https://github.com/coredmp95/pushframe/blob/master/CHANGELOG.md"
 
 [project.optional-dependencies]
 dev = ["pytest>=8"]

{pushframe-5.0.2 → pushframe-5.0.3}/tests/test_version.py

@@ -18,8 +18,8 @@ PYPROJECT = Path(__file__).resolve().parent.parent / "pyproject.toml"
 
 def test_version_is_first_distribution_release():
     """The current distribution release (moved off 0.1.0 at 5.0.0; page
-    metadata fix shipped in 5.0.2)."""
-    assert __version__ == "5.0.2"
+    metadata fix shipped in 5.0.3)."""
+    assert __version__ == "5.0.3"
 
 
 def test_version_matches_pyproject_single_source():