pypiron 0.0.2__tar.gz

pypiron-0.0.2/.dockerignore

@@ -0,0 +1,28 @@
+# Keep the build context tiny: only Rust sources feed `cargo build`.
+# Everything here is either rebuilt, irrelevant to the binary, or bulky.
+target/
+.git/
+.github/
+docs/
+tests/
+bench/
+fuzz/
+data/
+dist/
+downloaded/
+pypiron-data/
+.venv/
+.test-venv/
+.pytest_cache/
+.ruff_cache/
+.claude/
+.cargo/
+*.whl
+*.tar.gz
+**/__pycache__/
+*.pyc
+.DS_Store
+pyproject.toml
+uv.lock
+README.md
+RELEASE.md

pypiron-0.0.2/.github/stamp-version.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Stamp a release-tag version (vX.Y.Z) into Cargo.toml and Cargo.lock.
+# The repo permanently carries version 0.0.0; CI runs this before building wheels.
+set -euo pipefail
+
+TAG="${1:?usage: stamp-version.sh vX.Y.Z}"
+[[ "$TAG" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)$ ]] || {
+    echo "release tag must be vX.Y.Z, got: $TAG" >&2
+    exit 1
+}
+V="${BASH_REMATCH[1]}"
+
+# No trailing $ anchors: tolerate CRLF checkouts on Windows runners.
+sed -i.bak "s/^version = \"0.0.0\"/version = \"$V\"/" Cargo.toml
+# Cargo.lock pins pypiron's own version; stamp it too so --locked builds (e.g. from sdist) work.
+sed -i.bak -e '/^name = "pypiron"/{' -e n -e "s/^version = \"0.0.0\"/version = \"$V\"/" -e '}' Cargo.lock
+rm -f Cargo.toml.bak Cargo.lock.bak
+
+grep -q "^version = \"$V\"" Cargo.toml || { echo "failed to stamp Cargo.toml" >&2; exit 1; }
+grep -A1 '^name = "pypiron"' Cargo.lock | grep -q "^version = \"$V\"" || { echo "failed to stamp Cargo.lock" >&2; exit 1; }
+echo "stamped version $V"

pypiron-0.0.2/.github/workflows/ci.yml

@@ -0,0 +1,373 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - master
+      - main
+    tags:
+      - 'v*'
+  pull_request:
+    branches:
+      - master
+      - main
+  workflow_dispatch:
+
+env:
+  CARGO_TERM_COLOR: always
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fmt:
+    name: rustfmt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+  clippy:
+    name: clippy (lint)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - name: Clippy (fail on warnings)
+        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+
+  test:
+    name: tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - name: Unit tests
+        run: cargo test --workspace --all-features --locked
+
+  integration:
+    name: blackbox integration
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - name: Sync dev dependencies
+        run: uv sync
+      # The product's center of gravity is the blackbox suite (docs/TESTING.md):
+      # the real binary driven over HTTP by real uv/pip clients. S3/MinIO tests
+      # skip without Docker; the multi-client compat matrix (poetry/pdm/flit/
+      # hatch via uvx) stays a local `make compat` concern, not a merge gate.
+      - name: Blackbox suite (disk mode)
+        run: uv run -- pytest tests -m "not perf and not stress and not compat"
+
+  fuzz-build:
+    name: fuzz build (smoke)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2.82.0
+        with:
+          tool: cargo-fuzz
+      # Keep the fuzz targets compiling. Coverage-guided runs stay manual
+      # (`make fuzz`); this only guards against bitrot in the harness.
+      - name: Compile all fuzz targets
+        # Pin the gnu host target: recent cargo-fuzz defaults to musl even on a
+        # gnu host, and musl's static libc is incompatible with ASan.
+        # https://github.com/rust-fuzz/cargo-fuzz/issues/398
+        run: cargo fuzz build --target x86_64-unknown-linux-gnu
+
+  build-release:
+    # Build release binaries on pushes to master/main (not on PRs)
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
+    name: build release (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    needs: [fmt, clippy, test]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ ubuntu-latest, macos-latest, windows-latest ]
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+
+      - name: Build (release)
+        run: cargo build --release --locked
+
+      # Upload the built binary as an artifact per-OS.
+      - name: Upload artifact (Linux/macOS)
+        if: runner.os != 'Windows'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: pypiron-${{ runner.os }}-${{ github.sha }}
+          path: target/release/pypiron
+          retention-days: 14
+
+      - name: Upload artifact (Windows)
+        if: runner.os == 'Windows'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: pypiron-${{ runner.os }}-${{ github.sha }}
+          path: target\release\pypiron.exe
+          retention-days: 14
+
+  # Wheel builds run only for release tags (and manual dispatch for testing the
+  # pipeline). The version is stamped from the tag; the repo itself stays at 0.0.0.
+  linux:
+    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          - runner: ubuntu-22.04
+            target: x86_64
+          - runner: ubuntu-22.04
+            target: x86
+          - runner: ubuntu-22.04
+            target: aarch64
+          - runner: ubuntu-22.04
+            target: armv7
+          - runner: ubuntu-22.04
+            target: s390x
+          - runner: ubuntu-22.04
+            target: ppc64le
+          - runner: ubuntu-22.04
+            target: riscv64
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - name: Stamp version from tag
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        run: ./.github/stamp-version.sh "$GITHUB_REF_NAME"
+      # Make the README baked into the wheel/sdist metadata render on PyPI:
+      # rewrite its repo-relative links/logo to absolute URLs (pinned to the
+      # stamped tag). The committed file stays GitHub-relative.
+      - name: Rewrite README links to absolute URLs for PyPI
+        shell: bash
+        run: command -v python3 >/dev/null 2>&1 && python3 scripts/transform_readme.py --target pypi || python scripts/transform_readme.py --target pypi
+      - name: Build wheels
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          target: ${{ matrix.platform.target }}
+          args: --release --locked --out dist
+          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+          manylinux: auto
+        env:
+          CFLAGS_aarch64_unknown_linux_gnu: "-D__ARM_ARCH=8"
+      - name: Upload wheels
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: wheels-linux-${{ matrix.platform.target }}
+          path: dist
+
+  musllinux:
+    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          - runner: ubuntu-22.04
+            target: x86_64
+          - runner: ubuntu-22.04
+            target: x86
+          - runner: ubuntu-22.04
+            target: aarch64
+          - runner: ubuntu-22.04
+            target: armv7
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - name: Stamp version from tag
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        run: ./.github/stamp-version.sh "$GITHUB_REF_NAME"
+      # Make the README baked into the wheel/sdist metadata render on PyPI:
+      # rewrite its repo-relative links/logo to absolute URLs (pinned to the
+      # stamped tag). The committed file stays GitHub-relative.
+      - name: Rewrite README links to absolute URLs for PyPI
+        shell: bash
+        run: command -v python3 >/dev/null 2>&1 && python3 scripts/transform_readme.py --target pypi || python scripts/transform_readme.py --target pypi
+      - name: Build wheels
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          target: ${{ matrix.platform.target }}
+          args: --release --locked --out dist
+          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+          manylinux: musllinux_1_2
+        env:
+          CFLAGS_aarch64_unknown_linux_gnu: "-D__ARM_ARCH=8"
+      - name: Upload wheels
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: wheels-musllinux-${{ matrix.platform.target }}
+          path: dist
+
+  windows:
+    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          - runner: windows-latest
+            target: x64
+          - runner: windows-latest
+            target: x86
+          - runner: windows-latest
+            target: aarch64
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - name: Stamp version from tag
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        run: ./.github/stamp-version.sh "$GITHUB_REF_NAME"
+      # Make the README baked into the wheel/sdist metadata render on PyPI:
+      # rewrite its repo-relative links/logo to absolute URLs (pinned to the
+      # stamped tag). The committed file stays GitHub-relative.
+      - name: Rewrite README links to absolute URLs for PyPI
+        shell: bash
+        run: command -v python3 >/dev/null 2>&1 && python3 scripts/transform_readme.py --target pypi || python scripts/transform_readme.py --target pypi
+      - name: Build wheels
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          target: ${{ matrix.platform.target }}
+          args: --release --locked --out dist
+          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+      - name: Upload wheels
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: wheels-windows-${{ matrix.platform.target }}
+          path: dist
+
+  macos:
+    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          # GitHub retired the macos-13 (Intel) image on 2025-12-04; macos-15-intel
+          # is its standard x86_64 replacement (last Intel image, supported to ~2027-08).
+          - runner: macos-15-intel
+            target: x86_64
+          - runner: macos-14
+            target: aarch64
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - name: Stamp version from tag
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        run: ./.github/stamp-version.sh "$GITHUB_REF_NAME"
+      # Make the README baked into the wheel/sdist metadata render on PyPI:
+      # rewrite its repo-relative links/logo to absolute URLs (pinned to the
+      # stamped tag). The committed file stays GitHub-relative.
+      - name: Rewrite README links to absolute URLs for PyPI
+        shell: bash
+        run: command -v python3 >/dev/null 2>&1 && python3 scripts/transform_readme.py --target pypi || python scripts/transform_readme.py --target pypi
+      - name: Build wheels
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          target: ${{ matrix.platform.target }}
+          args: --release --locked --out dist
+          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+      - name: Upload wheels
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: wheels-macos-${{ matrix.platform.target }}
+          path: dist
+
+  sdist:
+    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - name: Stamp version from tag
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        run: ./.github/stamp-version.sh "$GITHUB_REF_NAME"
+      # Make the README baked into the wheel/sdist metadata render on PyPI:
+      # rewrite its repo-relative links/logo to absolute URLs (pinned to the
+      # stamped tag). The committed file stays GitHub-relative.
+      - name: Rewrite README links to absolute URLs for PyPI
+        shell: bash
+        run: command -v python3 >/dev/null 2>&1 && python3 scripts/transform_readme.py --target pypi || python scripts/transform_readme.py --target pypi
+      - name: Build sdist
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          command: sdist
+          args: --out dist
+      - name: Upload sdist
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: wheels-sdist
+          path: dist
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [fmt, clippy, test, linux, musllinux, windows, macos, sdist]
+    permissions:
+      # Used for PyPI trusted publishing and to sign the release artifacts
+      id-token: write
+      # Used to upload release artifacts
+      contents: write
+      # Used to generate artifact attestation
+      attestations: write
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          pattern: wheels-*
+          merge-multiple: true
+          path: dist
+      # Build-provenance attestation is a public-repo-only feature; skip it while
+      # the repo is private (it reactivates automatically once the repo is public).
+      - name: Generate artifact attestation
+        if: ${{ !github.event.repository.private }}
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+        with:
+          subject-path: 'dist/*'
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        with:
+          skip-existing: true

pypiron-0.0.2/.github/workflows/docker.yml

@@ -0,0 +1,166 @@
+name: Docker
+
+# Publishes multi-arch images to GHCR:
+#   ghcr.io/<owner>/pypiron:<branch>   on pushes to master/main
+#   ghcr.io/<owner>/pypiron:X.Y.Z + :X.Y + :latest   on vX.Y.Z tags
+#   plus a :sha-<short> tag on every push.
+# Pull requests build (both arches) but never push, so the Dockerfile stays
+# green without leaking images.
+#
+# Multi-arch is built one arch per native runner (amd64 + arm64), then stitched
+# into a single manifest list with `imagetools create` — no QEMU, which would
+# crawl for a from-scratch Rust release build. This is Docker's documented
+# split-runner pattern: https://docs.docker.com/build/ci/github-actions/multi-platform/
+
+on:
+  push:
+    branches: [master, main]
+    tags: ['v*']
+  pull_request:
+    branches: [master, main]
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+concurrency:
+  group: docker-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: build (${{ matrix.platform.arch }})
+    runs-on: ${{ matrix.platform.runner }}
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - arch: amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      # Tagged builds stamp the version so the binary's --version is correct.
+      - name: Stamp version from tag
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        run: ./.github/stamp-version.sh "$GITHUB_REF_NAME"
+
+      - name: Docker metadata (labels)
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+      - name: Log in to ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: .
+          platforms: linux/${{ matrix.platform.arch }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=docker-${{ matrix.platform.arch }}
+          cache-to: type=gha,scope=docker-${{ matrix.platform.arch }},mode=max
+          # On PRs build only (push=false); the merge job is skipped there.
+          # Provenance off so each arch is a clean single manifest — the merge
+          # job re-attests the final manifest list.
+          provenance: false
+          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
+
+      - name: Export digest
+        if: github.event_name != 'pull_request'
+        run: |
+          mkdir -p "${{ runner.temp }}/digests"
+          digest="${{ steps.build.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: digest-${{ matrix.platform.arch }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  # merge:
+  #   name: merge manifest & push tags
+  #   if: github.event_name != 'pull_request'
+  #   needs: build
+  #   runs-on: ubuntu-latest
+  #   permissions:
+  #     contents: read
+  #     packages: write
+  #     id-token: write       # provenance attestation
+  #     attestations: write
+  #   steps:
+  #     - name: Download digests
+  #       uses: actions/download-artifact@v4
+  #       with:
+  #         path: ${{ runner.temp }}/digests
+  #         pattern: digest-*
+  #         merge-multiple: true
+
+  #     - uses: docker/setup-buildx-action@v3
+
+  #     - name: Docker metadata (tags)
+  #       id: meta
+  #       uses: docker/metadata-action@v5
+  #       with:
+  #         images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+  #         tags: |
+  #           type=semver,pattern={{version}}
+  #           type=semver,pattern={{major}}.{{minor}}
+  #           type=ref,event=branch
+  #           type=sha,prefix=sha-
+  #         flavor: |
+  #           latest=auto
+
+  #     - name: Log in to ${{ env.REGISTRY }}
+  #       uses: docker/login-action@v3
+  #       with:
+  #         registry: ${{ env.REGISTRY }}
+  #         username: ${{ github.actor }}
+  #         password: ${{ secrets.GITHUB_TOKEN }}
+
+  #     - name: Create manifest list and push
+  #       id: manifest
+  #       working-directory: ${{ runner.temp }}/digests
+  #       run: |
+  #         docker buildx imagetools create \
+  #           $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+  #           $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
+  #         digest=$(docker buildx imagetools inspect \
+  #           "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}" \
+  #           --format '{{json .Manifest.Digest}}' | tr -d '"')
+  #         echo "digest=$digest" >> "$GITHUB_OUTPUT"
+
+  #     - name: Inspect image
+  #       run: |
+  #         docker buildx imagetools inspect \
+  #           "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}"
+
+  #     - name: Attest provenance
+  #       uses: actions/attest-build-provenance@v2
+  #       with:
+  #         subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+  #         subject-digest: ${{ steps.manifest.outputs.digest }}
+  #         push-to-registry: true

pypiron-0.0.2/.gitignore

@@ -0,0 +1,35 @@
+# Rust
+/target
+.cargo/
+
+# Python
+/downloaded
+/dist
+.test-venv
+*.pyc
+__pycache__/
+*.egg-info/
+.eggs/
+*.whl
+*.tar.gz
+
+# Build artifacts
+build/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# macOS
+.DS_Store
+pypiron-data/
+# Bench harness local state
+bench/.keys/
+bench/.server-env
+bench/.rig.env
+bench/results/
+/data/
+# Bulk PyPI corpus downloads (95MB+, see src/corpus_check.rs)
+bench/corpus/

pypiron-0.0.2/AGENTS.md

@@ -0,0 +1,44 @@
+# Working in this repo
+
+pypiron is a single-crate Rust PyPI server (index, upload, mirror, on-demand
+proxy). Truth is files on disk/S3; indexes are regenerable views. One binary, no
+database. The guiding bias is against complexity: the best code is no code.
+
+## Before you finish
+- Run `make check` (format, `cargo check`, clippy `-D warnings`, Rust unit tests)
+  and fix everything it reports. A change isn't done until it passes.
+- Run `make test` for the full suite (Rust unit + Python blackbox) when you touch
+  HTTP, storage, the worker, sync, or the proxy. `make help` lists every target.
+
+## Testing (see [docs/TESTING.md](docs/TESTING.md))
+- Blackbox-first: the real binary, driven over HTTP by real `uv`/`pip`/`twine`.
+  Add a blackbox test (`tests/*.py`) for any changed user-visible behavior.
+- Rust unit tests (`#[cfg(test)]`) are for pure functions only — parsing,
+  rendering, normalization. Anything touching I/O is tested blackbox.
+- Prefer real clients and real packages over mocks; don't add a mock layer.
+- S3 tests need Docker/MinIO and skip cleanly without it; the poetry/pdm/flit/
+  hatch compat matrix runs via `make compat`, not on every change.
+
+## Conventions
+- Architecture and the storage-layout contract: [docs/DESIGN.md](docs/DESIGN.md)
+  ([docs/VISION.md](docs/VISION.md) is the one-pager). Don't invent storage-tree
+  or sidecar variants.
+- Standards support is behavior verified against real clients, not spec-shaped
+  output: [docs/STANDARDS.md](docs/STANDARDS.md).
+- Every `--flag` is also a `PYPIRON_FLAG` env var; document new knobs in
+  [docs/CONFIGURATION.md](docs/CONFIGURATION.md).
+- Check [docs/ROADMAP.md](docs/ROADMAP.md) before adding features — respect the
+  "rejected" list; don't re-litigate it.
+- No `unwrap`/`expect`/`panic!` on a request or worker path; return errors with
+  `anyhow` context. Catch specific errors, never a blanket match.
+- Security is fail-closed: a half-configured credential refuses startup, secrets
+  compare in constant time, private names never fall through to upstream.
+- Storage mutations are write-to-tmp-then-rename on the same filesystem; keep
+  them crash-safe.
+- Don't add a dependency to avoid a few lines of code.
+
+## Commits & releases
+- Conventional commits; spell out `feature` (not `feat`). Bug-fix messages state
+  the root cause and how it was addressed.
+- The repo version stays `0.0.0`; real versions come from `vX.Y.Z` git tags and
+  are stamped by CI. See [RELEASE.md](RELEASE.md).

pypiron-0.0.2/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md