pyopenapi-gen 0.8.7__tar.gz → 0.10.1__tar.gz

pyopenapi_gen-0.10.1/.bandit

@@ -0,0 +1,22 @@
+# Bandit configuration for pyopenapi-gen
+
+# Skip these specific checks that are acceptable for this project:
+# B101: assert_used - We use assertions for Design by Contract (DbC) as documented
+# B404: import_subprocess - We need subprocess for post-processing (ruff, mypy) 
+# B603: subprocess_without_shell_equals_true - We use controlled subprocess calls to trusted tools
+# B110: try_except_pass - Acceptable for telemetry error handling
+skips:
+  - B101
+  - B404
+  - B603
+  - B110
+
+# Only scan source code, not tests (tests may have different security requirements)
+exclude_dirs:
+  - tests/
+  - _process/
+  - venv/
+  - .venv/
+
+# Set confidence level to only report medium and high confidence issues
+confidence: MEDIUM

pyopenapi_gen-0.10.1/.github/workflows/ci.yml

@@ -0,0 +1,23 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main, develop, staging]
+    # Run on PRs to provide required "test" status check for branch protection
+    # Actual testing is handled by pr-checks.yml, this just satisfies the requirement
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Provide required test status check
+        run: |
+          echo "✅ This workflow satisfies the required 'test' status check"
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo "PR testing is handled by pr-checks.yml workflow"
+          else
+            echo "Main branch testing is handled by semantic-release.yml workflow"
+          fi
+          echo "This minimal workflow prevents branch protection conflicts"

{pyopenapi_gen-0.8.7 → pyopenapi_gen-0.10.1}/.github/workflows/claude-auto-approve.yml

@@ -1,20 +1,20 @@
 name: Claude Auto-Approve
 
 on:
-  pull_request_review:
-    types: [submitted]
+  workflow_run:
+    workflows: ["Claude Code"]
+    types: [completed]
   issue_comment:
     types: [created]
 
 jobs:
   auto-approve:
     if: |
-      (github.event_name == 'pull_request_review' && 
-       github.event.review.user.login == 'claude[bot]' && 
-       contains(github.event.review.body, 'APPROVE')) ||
+      (github.event_name == 'workflow_run' && 
+       github.event.workflow_run.conclusion == 'success') ||
       (github.event_name == 'issue_comment' && 
-       github.event.comment.user.login == 'claude[bot]' && 
-       contains(github.event.comment.body, 'APPROVED'))
+       contains(github.event.comment.body, '@claude') &&
+       contains(github.event.comment.body, 'approved'))
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -31,39 +31,78 @@ jobs:
       
       - name: Get PR number
         id: pr_number
-        run: |
-          if [[ "${{ github.event_name }}" == "pull_request_review" ]]; then
-            echo "pr_number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
-          elif [[ "${{ github.event_name }}" == "issue_comment" ]]; then
-            echo "pr_number=${{ github.event.issue.number }}" >> $GITHUB_OUTPUT
-          fi
+        uses: actions/github-script@v7
+        with:
+          script: |
+            let prNumber = null;
+            
+            if (context.eventName === 'workflow_run') {
+              // Get PR number from workflow run
+              const { data: workflowRun } = await github.rest.actions.getWorkflowRun({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: context.payload.workflow_run.id,
+              });
+              
+              if (workflowRun.pull_requests && workflowRun.pull_requests.length > 0) {
+                prNumber = workflowRun.pull_requests[0].number;
+              }
+            } else if (context.eventName === 'issue_comment') {
+              prNumber = context.payload.issue.number;
+            }
+            
+            console.log(`Found PR number: ${prNumber}`);
+            core.setOutput('pr_number', prNumber);
+            return prNumber;
       
       - name: Check if PR can be auto-approved
         id: check_approval
+        if: steps.pr_number.outputs.pr_number != ''
         run: |
           pr_number="${{ steps.pr_number.outputs.pr_number }}"
           
+          if [[ -z "$pr_number" || "$pr_number" == "null" ]]; then
+            echo "No PR number found, skipping auto-approval"
+            echo "auto_approve=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          
           # Get PR details
-          pr_data=$(gh pr view $pr_number --json author,title,baseRefName,mergeable,reviewDecision)
+          pr_data=$(gh pr view $pr_number --json author,title,baseRefName,mergeable,reviewDecision,headRefName)
           pr_author=$(echo "$pr_data" | jq -r '.author.login')
           pr_title=$(echo "$pr_data" | jq -r '.title')
           pr_base=$(echo "$pr_data" | jq -r '.baseRefName')
+          pr_head=$(echo "$pr_data" | jq -r '.headRefName')
           pr_mergeable=$(echo "$pr_data" | jq -r '.mergeable')
           review_decision=$(echo "$pr_data" | jq -r '.reviewDecision')
           
-          echo "PR Author: $pr_author"
-          echo "PR Title: $pr_title" 
-          echo "PR Base: $pr_base"
-          echo "PR Mergeable: $pr_mergeable"
-          echo "Review Decision: $review_decision"
+          echo "PR #$pr_number Analysis:"
+          echo "  Author: $pr_author"
+          echo "  Title: $pr_title" 
+          echo "  Base: $pr_base"
+          echo "  Head: $pr_head"
+          echo "  Mergeable: $pr_mergeable"
+          echo "  Review Decision: $review_decision"
           
           # Check if this is an eligible PR for auto-approval
           auto_approve=false
           
-          if [[ "$pr_author" == "devops-mindhive" ]] && \
-             [[ "$pr_title" =~ ^(fix|chore|release): ]] && \
-             [[ "$pr_mergeable" == "MERGEABLE" ]]; then
-            auto_approve=true
+          # Auto-approve conditions:
+          # 1. Hotfix branches (fix critical issues)
+          # 2. DevOps bot PRs with fix/chore/release prefixes
+          # 3. Dependabot PRs
+          if [[ "$pr_head" =~ ^hotfix/ ]] || \
+             [[ "$pr_author" == "dependabot[bot]" ]] || \
+             ([[ "$pr_author" == "devops-mindhive" ]] && [[ "$pr_title" =~ ^(fix|chore|release): ]]); then
+            
+            if [[ "$pr_mergeable" == "MERGEABLE" ]]; then
+              auto_approve=true
+              echo "✅ PR eligible for auto-approval"
+            else
+              echo "❌ PR not mergeable, skipping auto-approval"
+            fi
+          else
+            echo "❌ PR does not meet auto-approval criteria"
           fi
           
           echo "auto_approve=$auto_approve" >> $GITHUB_OUTPUT

{pyopenapi_gen-0.8.7 → pyopenapi_gen-0.10.1}/.github/workflows/claude.yml

@@ -42,11 +42,19 @@ jobs:
         uses: anthropics/claude-code-action@beta
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          # Enable formal PR reviews instead of just comments
-          create_review: true
-          auto_approve: true
-          allowed_tools: |
-            mcp__github__create_pull_request
-            mcp__github__create_review
-            mcp__github__approve_pull_request
+          direct_prompt: |
+            Review this PR for code quality, security, and compatibility:
+            
+            **For hotfixes and minor fixes:**
+            1. If code quality is good and tests pass, fix any minor issues directly
+            2. Provide detailed analysis in comments
+            3. Note if manual approval is recommended
+            
+            **For larger changes:**
+            1. Provide comprehensive review feedback
+            2. Create issues for complex problems
+            3. Suggest improvements and alternatives
+            
+            Focus on: syntax errors, security issues, type safety, and compatibility.
+          timeout_minutes: 60
 

pyopenapi_gen-0.10.1/.github/workflows/semantic-release.yml

@@ -0,0 +1,304 @@
+name: Semantic Release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      reason:
+        description: 'Reason for manual release'
+        required: false
+        default: 'Manual release'
+
+permissions:
+  contents: write
+  packages: write
+  pull-requests: write
+  issues: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: production
+    concurrency:
+      group: semantic-release
+      cancel-in-progress: false
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+        token: ${{ secrets.SEMANTIC_RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
+
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.12'
+
+    - name: Install Poetry
+      uses: snok/install-poetry@v1
+      with:
+        version: latest
+        virtualenvs-create: true
+        virtualenvs-in-project: true
+        virtualenvs-path: .venv
+
+    - name: Install dependencies
+      run: |
+        poetry install --with dev
+
+    - name: Run comprehensive quality checks
+      run: |
+        poetry run black --check src/ tests/
+        poetry run ruff check src/ tests/
+        poetry run mypy src/ --strict --no-warn-no-return
+        poetry run bandit -r src/ -f txt -c .bandit
+
+    - name: Run full test suite
+      run: |
+        poetry run pytest -n 2 --timeout=120 --cov=src --cov-report=term-missing --cov-report=xml --cov-fail-under=85
+
+    - name: Check for release-worthy changes
+      id: check_changes
+      run: |
+        # Check if there are any commits since the last tag that would trigger a release
+        LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+        if [ -n "$LAST_TAG" ]; then
+          COMMITS_SINCE_TAG=$(git log --oneline $LAST_TAG..HEAD | wc -l)
+          RELEASE_WORTHY=$(git log $LAST_TAG..HEAD --grep="^feat" --grep="^fix" --grep="^perf" --grep="BREAKING CHANGE" --oneline | wc -l)
+        else
+          COMMITS_SINCE_TAG=1
+          RELEASE_WORTHY=1
+        fi
+        
+        echo "commits_since_tag=$COMMITS_SINCE_TAG" >> $GITHUB_OUTPUT
+        echo "release_worthy=$RELEASE_WORTHY" >> $GITHUB_OUTPUT
+        echo "last_tag=$LAST_TAG" >> $GITHUB_OUTPUT
+        
+        if [ "$RELEASE_WORTHY" -gt 0 ]; then
+          echo "Found release-worthy changes since $LAST_TAG"
+        else
+          echo "No release-worthy changes found since $LAST_TAG"
+        fi
+
+    - name: Run semantic-release version
+      if: steps.check_changes.outputs.release_worthy > 0 || github.event_name == 'workflow_dispatch'
+      env:
+        GH_TOKEN: ${{ secrets.SEMANTIC_RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
+      run: |
+        git config user.name "github-actions[bot]"
+        git config user.email "github-actions[bot]@users.noreply.github.com"
+        poetry run semantic-release version --skip-build
+
+    - name: Build packages after version bump
+      if: steps.check_changes.outputs.release_worthy > 0 || github.event_name == 'workflow_dispatch'
+      run: |
+        echo "🧹 Cleaning old packages..."
+        rm -rf dist/
+        echo "📦 Building packages with updated version..."
+        poetry run python -m build
+        echo "📋 Package contents:"
+        ls -la dist/
+
+    - name: Check if packages exist after semantic-release
+      if: steps.check_changes.outputs.release_worthy > 0 || github.event_name == 'workflow_dispatch'
+      run: |
+        if [ -d "dist" ] && [ "$(ls -A dist/)" ]; then
+          echo "✅ Packages exist in dist/"
+          ls -la dist/
+          
+          # Extract version from package filename
+          PACKAGE_VERSION=$(ls dist/*.whl | sed 's/.*-\([0-9]\+\.[0-9]\+\.[0-9]\+\).*/\1/' | head -1)
+          echo "📦 Built package version: $PACKAGE_VERSION"
+          echo "package_version=$PACKAGE_VERSION" >> $GITHUB_ENV
+          
+          # Check if version already exists on PyPI
+          PYPI_LATEST=$(curl -s "https://pypi.org/pypi/pyopenapi-gen/json" | python3 -c "import sys, json; data=json.load(sys.stdin); print(data['info']['version'])" 2>/dev/null || echo "unknown")
+          echo "📚 PyPI latest version: $PYPI_LATEST"
+          
+          if [ "$PACKAGE_VERSION" = "$PYPI_LATEST" ]; then
+            echo "⚠️ Version $PACKAGE_VERSION already exists on PyPI"
+            echo "This indicates either:"
+            echo "  - No release-worthy changes since last version"
+            echo "  - Semantic-release didn't detect conventional commits"
+            echo "  - Last commit was already a release commit"
+            echo "packages_exist=false" >> $GITHUB_ENV
+            echo "version_conflict=true" >> $GITHUB_ENV
+          else
+            echo "✅ New version $PACKAGE_VERSION ready for publishing (current: $PYPI_LATEST → new: $PACKAGE_VERSION)"
+            echo "packages_exist=true" >> $GITHUB_ENV
+            echo "version_conflict=false" >> $GITHUB_ENV
+          fi
+        else
+          echo "❌ No packages found, semantic-release may not have triggered a release"
+          echo "packages_exist=false" >> $GITHUB_ENV
+        fi
+
+    - name: Validate PyPI token availability
+      if: (steps.check_changes.outputs.release_worthy > 0 || github.event_name == 'workflow_dispatch') && env.packages_exist == 'true'
+      env:
+        PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+      run: |
+        echo "🔐 Validating PYPI_API_TOKEN secret..."
+        if [ -z "$PYPI_TOKEN" ]; then
+          echo "❌ PYPI_API_TOKEN secret is not configured in GitHub repository"
+          echo ""
+          echo "To fix this:"
+          echo "  1. Go to: https://github.com/mindhiveoy/pyopenapi_gen/settings/secrets/actions"
+          echo "  2. Click 'New repository secret'"
+          echo "  3. Name: PYPI_API_TOKEN"
+          echo "  4. Value: your PyPI token (starts with pypi-)"
+          echo ""
+          echo "Your PyPI token should be the same one that works locally."
+          exit 1
+        fi
+        
+        # Validate token format
+        if [[ ! "$PYPI_TOKEN" =~ ^pypi- ]]; then
+          echo "⚠️ Token doesn't start with 'pypi-' - this may be incorrect"
+          echo "Token length: ${#PYPI_TOKEN} characters"
+        else
+          echo "✅ Token format looks correct (pypi-...)"
+          echo "✅ Token length: ${#PYPI_TOKEN} characters"
+        fi
+
+    - name: Publish to PyPI with twine
+      if: (steps.check_changes.outputs.release_worthy > 0 || github.event_name == 'workflow_dispatch') && env.packages_exist == 'true'
+      timeout-minutes: 10
+      env:
+        TWINE_USERNAME: __token__
+        TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+      run: |
+        echo "🚀 Publishing to PyPI with twine..."
+        
+        echo "✅ Token configured (length: ${#TWINE_PASSWORD})"
+        echo "📦 Checking packages..."
+        poetry run twine check dist/*
+        
+        echo "🔗 Testing PyPI connectivity..."
+        curl -I https://upload.pypi.org/legacy/ || {
+          echo "⚠️ PyPI upload endpoint not reachable"
+          exit 1
+        }
+        
+        echo "📤 Uploading to PyPI with timeout protection..."
+        timeout 300 poetry run twine upload \
+          --username "$TWINE_USERNAME" \
+          --password "$TWINE_PASSWORD" \
+          --verbose \
+          --disable-progress-bar \
+          dist/* || {
+          echo "❌ Upload failed or timed out after 5 minutes"
+          echo "This could be due to:"
+          echo "  - Network connectivity issues"
+          echo "  - PyPI rate limiting"
+          echo "  - Invalid token permissions"
+          echo "  - Package already exists (version conflict)"
+          exit 1
+        }
+
+    - name: Run semantic-release publish (GitHub release only)
+      if: steps.check_changes.outputs.release_worthy > 0 || github.event_name == 'workflow_dispatch'
+      env:
+        GH_TOKEN: ${{ secrets.SEMANTIC_RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
+      run: |
+        echo "📝 Creating GitHub release with semantic-release..."
+        poetry run semantic-release publish
+
+    - name: Get release version
+      if: success() && (steps.check_changes.outputs.release_worthy > 0 || github.event_name == 'workflow_dispatch')
+      id: get_version
+      run: |
+        # Get the latest tag as the released version
+        LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+        echo "released_version=$LATEST_TAG" >> $GITHUB_OUTPUT
+        echo "Released version: $LATEST_TAG"
+
+    - name: Sync version to staging branch
+      if: success() && steps.get_version.outputs.released_version != ''
+      env:
+        GH_TOKEN: ${{ secrets.SEMANTIC_RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
+      run: |
+        echo "🔄 Syncing main to staging branch..."
+        
+        # Fetch all branches
+        git fetch origin staging:staging || echo "Staging branch doesn't exist, skipping"
+        
+        if git show-ref --verify --quiet refs/heads/staging; then
+          # Switch to staging and merge main
+          git checkout staging
+          git merge main --no-edit || {
+            echo "⚠️ Merge conflict detected, creating PR instead"
+            git merge --abort
+            gh pr create \
+              --title "chore: sync version ${{ steps.get_version.outputs.released_version }} from main to staging" \
+              --body "Automated sync of semantic release version ${{ steps.get_version.outputs.released_version }} from main branch" \
+              --base staging \
+              --head main \
+              --label "automated,version-sync" || echo "PR may already exist"
+          } && {
+            echo "✅ Successfully merged main into staging"
+            git push origin staging || echo "Failed to push to staging"
+          }
+        else
+          echo "ℹ️ Staging branch doesn't exist, skipping sync"
+        fi
+
+    - name: Sync version to develop branch  
+      if: success() && steps.get_version.outputs.released_version != ''
+      env:
+        GH_TOKEN: ${{ secrets.SEMANTIC_RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
+      run: |
+        echo "🔄 Syncing main to develop branch..."
+        
+        # Fetch all branches
+        git fetch origin develop:develop || echo "Develop branch doesn't exist, skipping"
+        
+        if git show-ref --verify --quiet refs/heads/develop; then
+          # Switch to develop and merge main
+          git checkout develop
+          git merge main --no-edit || {
+            echo "⚠️ Merge conflict detected, creating PR instead"
+            git merge --abort
+            gh pr create \
+              --title "chore: sync version ${{ steps.get_version.outputs.released_version }} from main to develop" \
+              --body "Automated sync of semantic release version ${{ steps.get_version.outputs.released_version }} from main branch" \
+              --base develop \
+              --head main \
+              --label "automated,version-sync" || echo "PR may already exist"
+          } && {
+            echo "✅ Successfully merged main into develop"
+            git push origin develop || echo "Failed to push to develop"
+          }
+        else
+          echo "ℹ️ Develop branch doesn't exist, skipping sync"
+        fi
+
+    - name: Create release summary
+      if: success()
+      run: |
+        echo "## 🚀 Release Published" >> $GITHUB_STEP_SUMMARY
+        echo "- **Version**: ${{ steps.get_version.outputs.released_version }}" >> $GITHUB_STEP_SUMMARY
+        echo "- **PyPI**: [pyopenapi-gen ${{ steps.get_version.outputs.released_version }}](https://pypi.org/project/pyopenapi-gen/${{ steps.get_version.outputs.released_version }})" >> $GITHUB_STEP_SUMMARY
+        echo "- **GitHub Release**: [Release Notes](https://github.com/mindhiveoy/pyopenapi_gen/releases/tag/${{ steps.get_version.outputs.released_version }})" >> $GITHUB_STEP_SUMMARY
+        
+        if [ -n "${{ steps.get_version.outputs.released_version }}" ]; then
+          echo "- **Branch Sync**: Version synced to staging and develop branches" >> $GITHUB_STEP_SUMMARY
+        fi
+
+  notify-completion:
+    needs: release
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+    - name: Report success
+      if: needs.release.result == 'success'
+      run: |
+        echo "✅ Semantic release completed successfully"
+        
+    - name: Report failure
+      if: needs.release.result == 'failure'
+      run: |
+        echo "❌ Semantic release failed"
+        exit 1 

{pyopenapi_gen-0.8.7 → pyopenapi_gen-0.10.1}/.github/workflows/staging-publish.yml

@@ -1,4 +1,6 @@
 name: Staging Release (TestPyPI)
+# This workflow handles development releases to TestPyPI
+# Production releases are handled by semantic-release.yml
 
 on:
   push:

{pyopenapi_gen-0.8.7 → pyopenapi_gen-0.10.1}/.github/workflows/testpypi-publish.yml

@@ -1,8 +1,12 @@
-name: Publish to TestPyPI (pre-release)
+name: Publish to TestPyPI (manual)
 
 on:
-  push:
-    branches: [main]
+  workflow_dispatch:
+    inputs:
+      reason:
+        description: 'Reason for manual TestPyPI publish'
+        required: false
+        default: 'Manual testing'
 
 jobs:
   build-and-testpypi:

{pyopenapi_gen-0.8.7 → pyopenapi_gen-0.10.1}/.gitignore

@@ -186,4 +186,7 @@ output_*
 **/.claude/settings.local.json
 out
 test_outputs
-temp_test
+temp_test_process/
+.deps-installed
+
+_process/

pyopenapi_gen-0.10.1/.python-version

@@ -0,0 +1 @@
+3.12