pyinfra-incus 0.1.0__tar.gz

pyinfra_incus-0.1.0/.github/scripts/validate-release.py

@@ -0,0 +1,84 @@
+"""Validate the built distributions before a registry upload."""
+
+from __future__ import annotations
+
+import email
+import pathlib
+import sys
+import tarfile
+import zipfile
+from email.message import Message
+
+DIST = pathlib.Path("dist")
+PACKAGE_NAME = "pyinfra-incus"
+
+
+def fail(message: str) -> None:
+    raise SystemExit(message)
+
+
+def metadata_from_wheel(path: pathlib.Path) -> Message:
+    with zipfile.ZipFile(path) as archive:
+        metadata_files = [
+            name for name in archive.namelist() if name.endswith(".dist-info/METADATA")
+        ]
+        if len(metadata_files) != 1:
+            fail(f"expected one METADATA file in {path}, found {len(metadata_files)}")
+        return email.message_from_bytes(archive.read(metadata_files[0]))
+
+
+def metadata_from_sdist(path: pathlib.Path) -> Message:
+    with tarfile.open(path, "r:gz") as archive:
+        metadata_files = [
+            member for member in archive.getmembers() if member.name.endswith("/PKG-INFO")
+        ]
+        if len(metadata_files) != 1:
+            fail(f"expected one PKG-INFO file in {path}, found {len(metadata_files)}")
+        metadata_file = archive.extractfile(metadata_files[0])
+        if metadata_file is None:
+            fail(f"could not read PKG-INFO from {path}")
+        return email.message_from_bytes(metadata_file.read())
+
+
+def validate_metadata(metadata: Message, expected_version: str | None) -> str:
+    name = metadata.get("Name")
+    version = metadata.get("Version")
+    if name != PACKAGE_NAME:
+        fail(f"expected package name {PACKAGE_NAME!r}, got {name!r}")
+    if not version:
+        fail("distribution metadata has no version")
+    if expected_version is not None and version != expected_version:
+        fail(f"tag version {expected_version!r} does not match package version {version!r}")
+
+    direct_references = [
+        requirement for requirement in metadata.get_all("Requires-Dist", []) if " @ " in requirement
+    ]
+    if direct_references:
+        rendered = "\n".join(f"- {requirement}" for requirement in direct_references)
+        fail(f"public package indexes reject direct dependency references:\n{rendered}")
+
+    return version
+
+
+def main() -> None:
+    expected_version = sys.argv[1] if len(sys.argv) == 2 else None
+    if len(sys.argv) > 2:
+        fail("usage: validate-release.py [expected-version]")
+
+    wheels = sorted(DIST.glob("*.whl"))
+    sdists = sorted(DIST.glob("*.tar.gz"))
+    if len(wheels) != 1 or len(sdists) != 1:
+        fail(
+            f"expected one wheel and one sdist, found {len(wheels)} wheel(s) and {len(sdists)} sdist(s)"
+        )
+
+    wheel_version = validate_metadata(metadata_from_wheel(wheels[0]), expected_version)
+    sdist_version = validate_metadata(metadata_from_sdist(sdists[0]), expected_version)
+    if wheel_version != sdist_version:
+        fail(f"wheel version {wheel_version!r} does not match sdist version {sdist_version!r}")
+
+    print(f"validated {PACKAGE_NAME} {wheel_version}: {wheels[0].name}, {sdists[0].name}")
+
+
+if __name__ == "__main__":
+    main()

pyinfra_incus-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches: [master]
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        with:
+          version: 2026.6.14
+          cache: true
+
+      - name: Resolve uv cache directory
+        id: uv-cache
+        run: echo "dir=$(uv cache dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache uv downloads
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        with:
+          path: ${{ steps.uv-cache.outputs.dir }}
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
+      - name: Run Moon CI
+        run: moon ci root:check --summary minimal

pyinfra_incus-0.1.0/.github/workflows/integration.yml

@@ -0,0 +1,122 @@
+name: Integration
+
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  incus:
+    name: Incus ${{ matrix.label }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: 7.0 LTS
+            repository: lts-7.0
+            package_pattern: '1:7.0.*'
+          - label: stable
+            repository: stable
+            package_pattern: '1:7.*'
+    env:
+      INCUS_REPOSITORY: ${{ matrix.repository }}
+      INCUS_PACKAGE_PATTERN: ${{ matrix.package_pattern }}
+      PYINFRA_INCUS_TEST_SOCKET: /var/lib/incus/unix.socket
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        with:
+          version: 2026.6.14
+          cache: true
+
+      - name: Resolve uv cache directory
+        id: uv-cache
+        run: echo "dir=$(uv cache dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache uv downloads
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        with:
+          path: ${{ steps.uv-cache.outputs.dir }}
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
+      - name: Check KVM availability
+        run: test -c /dev/kvm
+
+      - name: Isolate Incus client configuration
+        run: echo "INCUS_CONF=$RUNNER_TEMP/incus-user" >> "$GITHUB_ENV"
+
+      - name: Configure Zabbly package repository
+        run: |
+          curl -fsSL https://pkgs.zabbly.com/key.asc -o "$RUNNER_TEMP/zabbly.asc"
+          fingerprint=$(gpg --show-keys --with-colons "$RUNNER_TEMP/zabbly.asc" | awk -F: '$1 == "fpr" { print $10; exit }')
+          test "$fingerprint" = "4EFC590696CB15B87C73A3AD82CC8797C838DCFD"
+
+          sudo install -d -m 0755 /etc/apt/keyrings
+          sudo install -m 0644 "$RUNNER_TEMP/zabbly.asc" /etc/apt/keyrings/zabbly.asc
+          printf '%s\n' \
+            'Enabled: yes' \
+            'Types: deb' \
+            "URIs: https://pkgs.zabbly.com/incus/${INCUS_REPOSITORY}" \
+            'Suites: noble' \
+            'Components: main' \
+            'Architectures: amd64' \
+            'Signed-By: /etc/apt/keyrings/zabbly.asc' \
+            | sudo tee /etc/apt/sources.list.d/zabbly-incus.sources >/dev/null
+
+      - name: Install Incus
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y acl incus incus-agent qemu-system-x86 qemu-utils ovmf virtiofsd
+
+          package_version=$(dpkg-query -W -f='${Version}' incus)
+          echo "Incus package: $package_version"
+          case "$package_version" in
+            $INCUS_PACKAGE_PATTERN) ;;
+            *)
+              echo "::error::Unexpected Incus package version: $package_version"
+              exit 1
+              ;;
+          esac
+
+          sudo env INCUS_CONF=/root/.config/incus incus admin init --minimal
+          sudo env INCUS_CONF=/root/.config/incus incus image copy images:alpine/edge/amd64 local: --alias ci-base
+          sudo env INCUS_CONF=/root/.config/incus incus version
+          uv run --locked python -c 'from importlib.metadata import version; print("pyincusd", version("pyincusd"))'
+
+          sudo test -S "$PYINFRA_INCUS_TEST_SOCKET"
+          sudo setfacl -m "u:${USER}:rw" "$PYINFRA_INCUS_TEST_SOCKET"
+          incus image info images:alpine/3.23/amd64 >/dev/null
+          incus image info images:alpine/3.23/amd64 --vm >/dev/null
+
+      - name: Run Incus integration tests
+        run: moon run root:test-integration --summary minimal
+
+      - name: Diagnostics on failure
+        if: failure()
+        run: |
+          sudo env INCUS_CONF=/root/.config/incus incus list || true
+          sudo env INCUS_CONF=/root/.config/incus incus image list || true
+          sudo env INCUS_CONF=/root/.config/incus incus storage list || true
+          sudo env INCUS_CONF=/root/.config/incus incus network list || true
+          sudo journalctl -u incus --no-pager -n 200 || true
+          df -h || true

pyinfra_incus-0.1.0/.github/workflows/release-dry-run.yml

@@ -0,0 +1,48 @@
+# Rehearse the publishable package on Release Please PRs without uploading it.
+# Keeping the trigger broad ensures the check still reports as skipped on
+# ordinary pull requests.
+
+name: Release Dry Run
+
+on:
+  pull_request:
+    branches:
+      - master
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  package-release-dry-run:
+    name: Package Release Dry Run
+    if: ${{ github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please--') }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        with:
+          version: 2026.6.14
+          cache: true
+
+      - name: Build publishable distributions
+        run: uv build --no-sources --clear
+
+      - name: Validate distribution metadata
+        run: python3 .github/scripts/validate-release.py
+
+      - name: Smoke test installed wheel
+        run: |
+          wheel=$(find dist -maxdepth 1 -name '*.whl' -print -quit)
+          uv run --no-project --with "$wheel" -- \
+            python -c 'import pyinfra_incus; from importlib.metadata import version; print(version("pyinfra-incus"))'
+
+      - name: Rehearse registry upload
+        run: uv publish --dry-run dist/*

pyinfra_incus-0.1.0/.github/workflows/release-please.yml

@@ -0,0 +1,36 @@
+# Required release app settings:
+# - vars.MEIGMA_RELEASE_APP_ID
+# - secrets.MEIGMA_RELEASE_APP_PRIVATE_KEY
+
+name: Release Please
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  release-please:
+    name: Release Please
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Create release app token
+        id: release-app
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.MEIGMA_RELEASE_APP_ID }}
+          private-key: ${{ secrets.MEIGMA_RELEASE_APP_PRIVATE_KEY }}
+
+      - name: Run Release Please
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          token: ${{ steps.release-app.outputs.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

pyinfra_incus-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,113 @@
+# Release Please creates the tag and a draft GitHub release. This workflow
+# independently rebuilds the tagged source and publishes it to PyPI through
+# Trusted Publishing. The GitHub release remains a draft for human inspection.
+
+name: Release
+
+on:
+  push:
+    tags:
+      - v*
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Tag to publish
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  resolve-release:
+    name: Resolve Release
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    outputs:
+      tag: ${{ steps.release-tag.outputs.tag }}
+      version: ${{ steps.release-tag.outputs.version }}
+    steps:
+      - name: Resolve release tag
+        id: release-tag
+        env:
+          DISPATCH_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+
+          if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
+            tag="$DISPATCH_TAG"
+          else
+            tag="$GITHUB_REF_NAME"
+          fi
+
+          if [[ ! "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z][0-9A-Za-z.-]*)?$ ]]; then
+            echo "Release tag must match vX.Y.Z or vX.Y.Z-prerelease: $tag" >&2
+            exit 1
+          fi
+
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Wait for draft release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.release-tag.outputs.tag }}
+        run: |
+          for attempt in $(seq 1 30); do
+            if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --json isDraft --jq '.isDraft' 2>/dev/null | grep -qx true; then
+              exit 0
+            fi
+            echo "Draft release $RELEASE_TAG is not ready yet; retrying..."
+            sleep 10
+          done
+
+          echo "Draft release $RELEASE_TAG was not found or is not a draft." >&2
+          exit 1
+
+  publish-pypi:
+    name: Publish to PyPI
+    needs:
+      - resolve-release
+    runs-on: ubuntu-24.04
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Check out requested tag
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          RELEASE_TAG: ${{ needs.resolve-release.outputs.tag }}
+        run: git checkout --detach "$RELEASE_TAG"
+
+      - name: Setup mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        with:
+          version: 2026.6.14
+          cache: false
+
+      - name: Run release quality gates
+        run: moon run root:check --summary minimal
+
+      - name: Build publishable distributions
+        run: uv build --no-sources --clear
+
+      - name: Validate distribution metadata
+        env:
+          RELEASE_VERSION: ${{ needs.resolve-release.outputs.version }}
+        run: python3 .github/scripts/validate-release.py "$RELEASE_VERSION"
+
+      - name: Smoke test installed wheel
+        run: |
+          wheel=$(find dist -maxdepth 1 -name '*.whl' -print -quit)
+          uv run --no-project --with "$wheel" -- \
+            python -c 'import pyinfra_incus; from importlib.metadata import version; print(version("pyinfra-incus"))'
+
+      - name: Publish distributions
+        run: uv publish --trusted-publishing always dist/*

pyinfra_incus-0.1.0/.gitignore

@@ -0,0 +1,17 @@
+.agents/
+.claude/
+.journal/
+.wt/
+
+.moon/cache/
+.moon/docker/
+
+.venv/
+__pycache__/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+*.py[cod]
+build/
+dist/
+*.egg-info/

pyinfra_incus-0.1.0/.moon/toolchains.yml

@@ -0,0 +1,2 @@
+# Tool versions are managed by mise.toml and mise.lock. Tasks use the system
+# toolchain so Moon never installs a second Python or uv runtime.

pyinfra_incus-0.1.0/.moon/workspace.yml

@@ -0,0 +1,12 @@
+projects:
+  root: '.'
+
+defaultProject: 'root'
+
+vcs:
+  defaultBranch: 'master'
+  provider: 'github'
+
+# uv commands synchronize the locked environment explicitly inside each task.
+pipeline:
+  installDependencies: false

pyinfra_incus-0.1.0/.python-version

@@ -0,0 +1 @@
+3.11.14

pyinfra_incus-0.1.0/.release-please-manifest.json

@@ -0,0 +1 @@
+{".":"0.1.0"}