pyattacker 0.1.0__tar.gz → 0.2.0__tar.gz

pyattacker-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,115 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # The two versions declared in pyproject.toml classifiers.
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        # The only third-party action in the pipeline, so it carries a commit pin: setup-uv stopped
+        # publishing floating major tags at v8, and pinning to the commit is what its README now
+        # recommends. The actions/* above and below are GitHub's own and track a major tag.
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          enable-cache: true
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv sync --locked
+
+      - name: Lint
+        run: uv run ruff check
+
+      - name: Test
+        # The whole suite is offline; network access is never needed.
+        run: uv run pytest
+
+      - name: CLI smoke test
+        run: uv run pyattacker demo --pipelines 25 --store runs/demo.db
+
+      - name: Example smoke tests
+        # The examples are documentation, and documentation rots: the llm_eval demo also asserts
+        # its own claim about checkpoint granularity, so this catches recovery regressions.
+        run: |
+          uv run python examples/quickstart.py
+          uv run python examples/sharded.py
+          uv run python -m examples.llm_eval.demo
+
+      - name: Build sdist and wheel
+        run: uv build
+
+  no-extra:
+    name: base install, no yaml extra
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          enable-cache: true
+          # Both 3.11 jobs read the same lockfile, so without a suffix they compute the same cache
+          # key and setup-uv warns that one of them could not upload the cache it just built. The
+          # suffix is also honest: this job installs a different set of packages (pytest and the
+          # build backend, rather than the dev group).
+          cache-suffix: no-extra
+          python-version: "3.11"
+
+      - name: Install the library and nothing else
+        # Deliberately not `uv sync`: the dev group carries the yaml extra, and doing without it is
+        # the entire point of this job. Installing into /tmp keeps the venv out of the checkout.
+        run: |
+          uv venv /tmp/no-extra --python 3.11
+          uv pip install --python /tmp/no-extra/bin/python . pytest
+
+      - name: PyYAML really is absent, and importing pyattacker does not want it
+        run: |
+          /tmp/no-extra/bin/python -c "
+          import importlib.util, sys
+          assert importlib.util.find_spec('yaml') is None, 'pyyaml leaked into the base install'
+          import pyattacker
+          assert 'yaml' not in sys.modules, 'importing pyattacker pulled in pyyaml'
+          print('pyattacker imports cleanly with no pyyaml installed')
+          "
+
+      - name: The suite passes without it
+        # The `requires_yaml` tests are deselected rather than skipped, so an accidental loss of the
+        # extra in the *development* environment fails the ordinary suite instead of quietly skipping
+        # a third of it. The optional-dependency tests above are not marked, and run here for real.
+        run: /tmp/no-extra/bin/python -m pytest -q -m "not requires_yaml"
+
+      - name: A YAML config asks for the extra, a JSON one does not
+        run: |
+          /tmp/no-extra/bin/pyattacker --version
+          mkdir -p /tmp/no-extra-check
+          /tmp/no-extra/bin/pyattacker demo --pipelines 10 --store /tmp/no-extra-check/demo.db
+          printf 'pipeline:\n  name: x\n  tasks:\n    - {use: echo}\n' > /tmp/no-extra-check/x.yaml
+          printf '{"pipeline": {"name": "x", "tasks": [{"use": "echo"}]}}' > /tmp/no-extra-check/x.json
+          if /tmp/no-extra/bin/pyattacker validate -c /tmp/no-extra-check/x.yaml 2>/tmp/no-extra-check/err.txt; then
+            echo "::error::a YAML config was accepted without the extra installed"
+            exit 1
+          fi
+          grep -q 'pyattacker\[yaml\]' /tmp/no-extra-check/err.txt || {
+            echo "::error::the YAML error does not name the extra to install"
+            cat /tmp/no-extra-check/err.txt
+            exit 1
+          }
+          /tmp/no-extra/bin/pyattacker validate -c /tmp/no-extra-check/x.json > /dev/null
+          echo "yaml asked for the extra; json validated"

pyattacker-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,288 @@
+name: Release
+
+# Publishing is driven by a tag, so the artifact is always traceable to an exact commit.
+# Pushing v0.2.0 builds, verifies and publishes to PyPI, then attaches the files to a GitHub
+# Release. `workflow_dispatch` runs everything except the PyPI upload, which is how you rehearse
+# a release without spending a version number: PyPI refuses a re-upload, and a version, once
+# published, can be deleted but never reused.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      publish_to_testpypi:
+        description: "Publish to TestPyPI (a dry run needs no version number)"
+        type: boolean
+        default: false
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false # never interrupt an upload in progress
+
+permissions: {}
+
+jobs:
+  # The gate. A tag can point at any commit, including one that never passed CI, so the release
+  # re-runs the full suite instead of trusting that it did.
+  verify:
+    name: verify python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true # a release is all-or-nothing; stop at the first failure
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        # The only third-party action in the pipeline, so it carries a commit pin: setup-uv stopped
+        # publishing floating major tags at v8, and pinning to the commit is what its README now
+        # recommends. The actions/* elsewhere in this file are GitHub's own and track a major tag.
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          enable-cache: true
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv sync --locked
+
+      - name: Lint
+        run: uv run ruff check
+
+      - name: Test
+        run: uv run pytest
+
+      - name: CLI smoke test
+        run: uv run pyattacker demo --pipelines 25 --store runs/demo.db
+
+      - name: Example smoke tests
+        run: |
+          uv run python examples/quickstart.py
+          uv run python examples/sharded.py
+          uv run python -m examples.llm_eval.demo
+
+  build:
+    name: build and check artifacts
+    needs: verify
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          enable-cache: true
+          python-version: "3.11"
+
+      - name: Build sdist and wheel
+        run: |
+          rm -rf dist
+          uv build
+
+      - name: Read the version being released
+        id: version
+        run: |
+          version="$(uv run --no-project --with ./dist/*.whl \
+            python -c 'import pyattacker; print(pyattacker.__version__)')"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "building version $version"
+
+      # A tag that disagrees with the package version produces a release nobody can find again.
+      - name: Check the tag matches the package version
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          tag="${GITHUB_REF#refs/tags/v}"
+          if [ "$tag" != "$VERSION" ]; then
+            echo "::error::tag v$tag does not match __version__ $VERSION — fix one of them and re-tag"
+            exit 1
+          fi
+          echo "tag v$tag matches the package version"
+
+      # Metadata has to render on PyPI, and the sdist has to be self-sufficient: these two checks
+      # are what caught a leaked local config file and 16 README links that break off GitHub.
+      - name: Check metadata renders
+        run: uvx twine check --strict dist/*
+
+      - name: Check the sdist carries no local tooling state
+        run: |
+          if tar tzf dist/*.tar.gz | grep -E '(^|/)\.(claude|venv|env|idea|vscode)/|\.pyc$'; then
+            echo "::error::the sdist contains local tooling state; tighten the include list in pyproject.toml"
+            exit 1
+          fi
+          echo "sdist contains no local tooling state"
+
+      - name: Check the sdist rebuilds and passes its own tests
+        run: |
+          mkdir -p /tmp/sdist && tar xzf dist/*.tar.gz -C /tmp/sdist --strip-components=1
+          cd /tmp/sdist
+          uv venv .venv --python 3.11
+          # The extra is requested on purpose here: the whole suite is the point of this check, and
+          # the configuration without PyYAML is the `no-extra` job in ci.yml plus the wheel check below.
+          uv pip install --python .venv/bin/python -e ".[yaml]" pytest
+          .venv/bin/python -m pytest -q
+
+      - name: Check the wheel installs and runs
+        run: |
+          uv venv /tmp/wheel-check --python 3.11
+          uv pip install --python /tmp/wheel-check/bin/python dist/*.whl
+          /tmp/wheel-check/bin/pyattacker --version
+          /tmp/wheel-check/bin/pyattacker demo --pipelines 10 --store /tmp/wheel-check/demo.db
+
+      - name: Check the extra really is optional
+        # A plain install of the wheel must bring in nothing, so this is the one place where the
+        # published metadata is checked rather than the source tree: PyYAML must be absent, importing
+        # pyattacker must not change that, YAML must ask for the extra, and JSON must still work.
+        run: |
+          /tmp/wheel-check/bin/python -c "
+          import importlib.util, sys
+          assert importlib.util.find_spec('yaml') is None, 'pyyaml leaked into the base install'
+          import pyattacker
+          assert 'yaml' not in sys.modules, 'importing pyattacker pulled in pyyaml'
+          print('the wheel installs with no dependencies')
+          "
+          mkdir -p /tmp/wheel-check/cfg
+          printf 'pipeline:\n  name: x\n  tasks:\n    - {use: echo}\n' > /tmp/wheel-check/cfg/x.yaml
+          printf '{"pipeline": {"name": "x", "tasks": [{"use": "echo"}]}}' > /tmp/wheel-check/cfg/x.json
+          if /tmp/wheel-check/bin/pyattacker validate -c /tmp/wheel-check/cfg/x.yaml 2>/tmp/wheel-check/err.txt; then
+            echo "::error::a YAML config was accepted without the extra installed"
+            exit 1
+          fi
+          grep -q 'pyattacker\[yaml\]' /tmp/wheel-check/err.txt || {
+            echo "::error::the YAML error does not name the extra to install"
+            cat /tmp/wheel-check/err.txt
+            exit 1
+          }
+          /tmp/wheel-check/bin/pyattacker validate -c /tmp/wheel-check/cfg/x.json > /dev/null
+          echo "yaml asked for the extra; json validated"
+
+      - name: Check the wheel's yaml extra installs and works
+        # The other direction of the same metadata, and the one no source-level test can cover: the
+        # extra has to make `pip install "pyattacker[yaml]"` resolve PyYAML *from the built wheel*, and
+        # that has to be enough to read a real config. A wrong Provides-Extra, a missing marker on
+        # Requires-Dist or a build-backend change would leave the suite green and break this.
+        run: |
+          uv venv /tmp/wheel-yaml-check --python 3.11
+          wheel="$(ls dist/*.whl)"   # exactly one; `dist/` is rebuilt from scratch above
+          uv pip install --python /tmp/wheel-yaml-check/bin/python "${wheel}[yaml]"
+          /tmp/wheel-yaml-check/bin/python -c "
+          import importlib.metadata as md, yaml
+          print('PyYAML', yaml.__version__, 'from', md.requires('pyattacker'))
+          "
+          mkdir -p /tmp/wheel-yaml-check/cfg
+          printf 'pipeline:\n  name: x\n  tasks:\n    - {use: echo}\n' > /tmp/wheel-yaml-check/cfg/x.yaml
+          /tmp/wheel-yaml-check/bin/pyattacker validate -c /tmp/wheel-yaml-check/cfg/x.yaml > /dev/null
+          echo "the extra resolved pyyaml and the config validated"
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  # Publishing lives in its own job so the OIDC token is scoped to it alone: no test or build step
+  # ever holds a credential that can upload a release.
+  testpypi:
+    name: publish to TestPyPI
+    if: github.event_name == 'workflow_dispatch' && inputs.publish_to_testpypi
+    needs: build
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      id-token: write # mint the OIDC token trusted publishing exchanges for an upload token
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          # This job never checks out the repository, so there is no uv.lock to key a cache on:
+          # caching here can only ever warn that the cache will never get invalidated.
+          enable-cache: false
+
+      # --check-url lets a re-run skip files already uploaded instead of failing the job.
+      - name: Publish
+        run: |
+          uv publish \
+            --trusted-publishing always \
+            --publish-url https://test.pypi.org/legacy/ \
+            --check-url https://test.pypi.org/simple/ \
+            dist/*
+
+  pypi:
+    name: publish to PyPI
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          # No checkout in this job, so no lockfile to key a cache on — see the note in `testpypi`.
+          enable-cache: false
+
+      - name: Publish
+        run: |
+          uv publish \
+            --trusted-publishing always \
+            --check-url https://pypi.org/simple/ \
+            dist/*
+
+  github_release:
+    name: create the GitHub release
+    if: startsWith(github.ref, 'refs/tags/v')
+    # `pypi` gates this on the upload having succeeded; `build` is also required because
+    # needs.build.outputs is only readable from a job that lists build as a dependency.
+    needs: [build, pypi]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # create the release and upload the artifacts to it
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+
+      # The section for this version in CHANGELOG.md, so the release notes are the notes we wrote
+      # rather than a list of commit subjects.
+      - name: Extract the changelog section
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          if awk -v v="$VERSION" '
+            $0 ~ "^## \\[" v "\\]" {found=1; next}
+            found && /^## \[/ {exit}
+            found {print}
+          ' CHANGELOG.md > notes.md && [ -s notes.md ]; then
+            echo "using the CHANGELOG.md section for $VERSION"
+          else
+            echo "No changelog section for $VERSION." > notes.md
+            echo "::warning::CHANGELOG.md has no section for $VERSION; publishing with a placeholder"
+          fi
+
+      - name: Create the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          gh release create "${GITHUB_REF#refs/tags/}" \
+            --title "pyattacker $VERSION" \
+            --notes-file notes.md \
+            --verify-tag \
+            dist/*