pyproject-api 1.12.3__tar.gz → 1.12.5__tar.gz

pyproject_api-1.12.5/.github/workflows/check.yaml

@@ -0,0 +1,67 @@
+name: 🧪 check
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+    tags-ignore: ["**"]
+  pull_request:
+    types: [opened, synchronize, reopened]
+  schedule:
+    - cron: "43 7 * * *"
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+permissions:
+  contents: read
+jobs:
+  test:
+    name: 🧪 Test
+    uses: tox-dev/github-workflows/.github/workflows/check.yaml@13381289334b15375958be7f7438f3c3d860e575 # 6.5.5
+    permissions:
+      contents: read
+    with:
+      include: |
+        [
+          {"env": "3.15"},
+          {"env": "3.15t", "python": "3.15t"},
+          {"env": "3.14", "python": "3.14"},
+          {"env": "3.13", "python": "3.13"},
+          {"env": "3.12", "python": "3.12"},
+          {"env": "3.11", "python": "3.11"},
+          {"env": "type"},
+          {"env": "dev"},
+          {"env": "pkg_meta"},
+          {"env": "3.15", "os": "windows-2025-vs2026"},
+          {"env": "3.15t", "python": "3.15t", "os": "windows-2025-vs2026"},
+          {"env": "3.14", "python": "3.14", "os": "windows-2025-vs2026"},
+          {"env": "3.13", "python": "3.13", "os": "windows-2025-vs2026"},
+          {"env": "3.12", "python": "3.12", "os": "windows-2025-vs2026"},
+          {"env": "3.11", "python": "3.11", "os": "windows-2025-vs2026"},
+          {"env": "type", "os": "windows-2025-vs2026"},
+          {"env": "dev", "os": "windows-2025-vs2026"},
+          {"env": "pkg_meta", "os": "windows-2025-vs2026"},
+          {"env": "3.15", "os": "macos-26"}
+        ]
+  release:
+    name: 🏷️ Release dry run
+    uses: $/.github/workflows/prepare-release.yaml
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      dry-run: true
+  hooks:
+    name: 🧹 Hooks under the cooldown
+    uses: tox-dev/github-workflows/.github/workflows/cooled-hooks.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+    permissions:
+      contents: read
+  gate:
+    name: 🚦 ${{ github.event_name == 'pull_request' && 'Required checks pass' || 'Non-PR checks pass' }}
+    if: ${{ !cancelled() }} # codespell:ignore cancelled
+    needs: [test, release, hooks]
+    runs-on: ubuntu-26.04
+    steps:
+      - name: 🚦 Require all needed jobs to pass
+        uses: tox-dev/github-workflows/required-checks@13381289334b15375958be7f7438f3c3d860e575 # 6.5.5
+        with:
+          needs: ${{ toJSON(needs) }}

pyproject_api-1.12.5/.github/workflows/codeql.yaml

@@ -0,0 +1,22 @@
+name: 🛡️ CodeQL
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+  pull_request:
+  schedule:
+    - cron: "0 9 * * 2"
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+jobs:
+  analyze:
+    name: 🛡️ Analyze
+    uses: tox-dev/github-workflows/.github/workflows/codeql.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      languages: '["actions","python"]'
+      paths-ignore: '["tests"]'

{pyproject_api-1.12.3 → pyproject_api-1.12.5}/.github/workflows/news.yaml

@@ -2,9 +2,6 @@ name: 📝 Changelog
 on:
   pull_request:
     types: [opened, reopened, synchronize, labeled, unlabeled]
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
 permissions:
   contents: read
   pull-requests: read
@@ -19,15 +16,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: 🐍 Install uv
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           version: latest-known
           python-version: "3.15"
           enable-cache: false
       - name: 📦 Install locked release tools
-        uses: tox-dev/github-workflows/install-locked-tools@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+        uses: tox-dev/github-workflows/install-locked-tools@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
         with:
           groups: release-news
           venv: ${{ runner.temp }}/release-tools
       - name: 🔍 Validate news fragments
-        uses: tox-dev/github-workflows/validate-news@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+        uses: tox-dev/github-workflows/validate-news@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0

{pyproject_api-1.12.3 → pyproject_api-1.12.5}/.github/workflows/prepare-release.yaml

@@ -12,15 +12,22 @@ on:
           - minor
           - patch
         default: auto
+  workflow_call:
+    inputs:
+      dry-run:
+        description: Assemble the release without pushing, for the pull request gate
+        type: boolean
+        required: true
 permissions: {}
 jobs:
   prepare:
     name: 🏷️ Prepare Towncrier release
-    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
     permissions:
       contents: read
       pull-requests: read
     secrets:
       RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
     with:
-      bump: ${{ inputs.bump }}
+      bump: ${{ inputs.bump || 'auto' }}
+      dry-run: ${{ inputs.dry-run == true }}

pyproject_api-1.12.5/.github/workflows/release.yaml

@@ -0,0 +1,56 @@
+name: 🚀 Release to PyPI
+on:
+  push:
+    tags: ["*"]
+permissions:
+  contents: read
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  build:
+    name: 🏗️ Build
+    uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+  github-notes:
+    name: 📝 Render GitHub Release notes
+    uses: tox-dev/github-workflows/.github/workflows/release-notes.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+    with:
+      tag: ${{ github.ref_name }}
+      changelog: docs/changelog.rst
+      artifact-url: https://pypi.org/project/pyproject-api/${{ github.ref_name }}/
+  release:
+    name: 🚀 Publish to PyPI
+    needs: [build, github-notes]
+    runs-on: ubuntu-26.04
+    environment:
+      name: release
+      url: https://pypi.org/project/pyproject-api/${{ github.ref_name }}
+    permissions:
+      id-token: write
+    steps:
+      - name: 📩 Download distributions
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          artifact-ids: ${{ needs.build.outputs.distributions-artifact-id }}
+          path: dist/
+      - name: 🚀 Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        with:
+          packages-dir: dist
+          attestations: true
+  github-release:
+    name: 🚀 Publish GitHub Release
+    needs: [build, release, github-notes]
+    uses: tox-dev/github-workflows/.github/workflows/github-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: write
+    with:
+      project: pyproject-api
+      version: ${{ github.ref_name }}
+      tag: ${{ github.ref_name }}
+      artifact-pattern: python-package-distributions
+      notes-artifact-id: ${{ needs.github-notes.outputs.artifact-id }}

pyproject_api-1.12.5/.github/workflows/scorecard.yaml

@@ -0,0 +1,26 @@
+name: 🛡️ scorecard
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "30 7 * * 2"
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+jobs:
+  analysis:
+    name: 🛡️ Scorecard analysis
+    if: github.repository == 'tox-dev/pyproject-api'
+    permissions:
+      actions: read # read workflow runs for the Packaging check
+      checks: read # read check runs for the CI-Tests and SAST checks
+      contents: read # check out and scan the repository
+      id-token: write # authenticate the results published to the scorecard API
+      issues: read # read issue activity for the Maintained check
+      pull-requests: read # read reviews for the Code-Review check
+      security-events: write # upload the SARIF results to code scanning
+      statuses: read # read commit statuses for the CI-Tests check
+    uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0

{pyproject_api-1.12.3 → pyproject_api-1.12.5}/.github/workflows/upgrade-release-tools.yaml

@@ -10,7 +10,7 @@ concurrency:
 jobs:
   upgrade:
     name: 🔀 Upgrade release tools
-    uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+    uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
     secrets:

{pyproject_api-1.12.3 → pyproject_api-1.12.5}/.pre-commit-config.yaml

@@ -9,7 +9,7 @@ repos:
       - id: end-of-file-fixer
       - id: trailing-whitespace
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0494aa7fa1314e98913a41227d8f0a515b2c1049 # frozen: 0.38.2
+    rev: a76b92851fc9eede9f9bc4073eb55202f34eb0df # frozen: 0.39.0
     hooks:
       - id: check-github-workflows
         args: ["--verbose"]
@@ -30,7 +30,7 @@ repos:
     hooks:
       - id: pyproject-fmt
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: "38bfb07c0c64c304f47eb52090f8288150c77730" # frozen: v0.17.1
+    rev: "25bcf95026b96e2dd3c0aec3090c3d6ef6ca2e6c" # frozen: v0.17.3
     hooks:
       - id: ruff-format
       - id: ruff
@@ -44,7 +44,7 @@ repos:
           ^docs/changelog[.]rst$  # Only the generated release history.
         args: ["-l", "120", "--preserve-adornments"]
         additional_dependencies:
-          - "sphinx==9.1.1"
+          - "sphinx==9.2.0"
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
     rev: c92afdf2c6ca336aaa8f39e2bd8d48f62dbd8e1f # frozen: v1.31.1
     hooks:

{pyproject_api-1.12.3 → pyproject_api-1.12.5}/CONTRIBUTING.md

@@ -2,3 +2,7 @@
 
 See the [contributing guide](https://pyproject-api.readthedocs.io/en/latest/contributing.html) for release note rules
 and local checks.
+
+## Tests
+
+Add a test for every new feature and bug fix. A change without a test needs a reason in the pull request description.

{pyproject_api-1.12.3 → pyproject_api-1.12.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyproject-api
-Version: 1.12.3
+Version: 1.12.5
 Import-Name: pyproject_api
 Summary: API to interact with the python pyproject.toml based projects
 Project-URL: Changelog, https://github.com/tox-dev/pyproject-api/blob/main/docs/changelog.rst
@@ -29,13 +29,14 @@ Requires-Python: >=3.11
 Requires-Dist: packaging>=26.3
 Description-Content-Type: text/markdown
 
-# [`pyproject-api`][RTD]
+# [`pyproject-api`][rtd]
 
 [![PyPI](https://img.shields.io/pypi/v/pyproject-api?style=flat-square)](https://pypi.org/project/pyproject-api/)
-[![Supported Python
-versions](https://img.shields.io/pypi/pyversions/pyproject-api.svg)](https://pypi.org/project/pyproject-api/)
+[![Supported Python versions](https://img.shields.io/pypi/pyversions/pyproject-api.svg)](https://pypi.org/project/pyproject-api/)
 [![Downloads](https://static.pepy.tech/badge/pyproject-api/month)](https://pepy.tech/project/pyproject-api)
 [![check](https://github.com/tox-dev/pyproject-api/actions/workflows/check.yaml/badge.svg)](https://github.com/tox-dev/pyproject-api/actions/workflows/check.yaml)
-[![Documentation Status](https://readthedocs.org/projects/pyproject-api/badge/?version=latest)][RTD]
+[![Documentation Status](https://readthedocs.org/projects/pyproject-api/badge/?version=latest)][rtd]
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/tox-dev/pyproject-api/badge)](https://scorecard.dev/viewer/?uri=github.com/tox-dev/pyproject-api)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/16251/badge)](https://www.bestpractices.dev/projects/16251)
 
-[RTD]: https://pyproject-api.rtfd.io
+[rtd]: https://pyproject-api.rtfd.io

pyproject_api-1.12.5/README.md

@@ -0,0 +1,11 @@
+# [`pyproject-api`][rtd]
+
+[![PyPI](https://img.shields.io/pypi/v/pyproject-api?style=flat-square)](https://pypi.org/project/pyproject-api/)
+[![Supported Python versions](https://img.shields.io/pypi/pyversions/pyproject-api.svg)](https://pypi.org/project/pyproject-api/)
+[![Downloads](https://static.pepy.tech/badge/pyproject-api/month)](https://pepy.tech/project/pyproject-api)
+[![check](https://github.com/tox-dev/pyproject-api/actions/workflows/check.yaml/badge.svg)](https://github.com/tox-dev/pyproject-api/actions/workflows/check.yaml)
+[![Documentation Status](https://readthedocs.org/projects/pyproject-api/badge/?version=latest)][rtd]
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/tox-dev/pyproject-api/badge)](https://scorecard.dev/viewer/?uri=github.com/tox-dev/pyproject-api)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/16251/badge)](https://www.bestpractices.dev/projects/16251)
+
+[rtd]: https://pyproject-api.rtfd.io

{pyproject_api-1.12.3 → pyproject_api-1.12.5}/docs/api.rst

@@ -16,6 +16,14 @@ backend runs from the project directory. Result paths retain the spelling of the
 directory argument. Configuration settings and generic command arguments are
 passed through unchanged.
 
+Metadata preparation replaces a symlink used as the output directory with a real directory, leaving the link target
+untouched. Dangling links are replaced too. Paths resolving to the project root or one of its ancestors are still
+rejected before cleanup.
+
+Metadata preparation clears the output directory before calling the metadata hook. If cleanup fails, the filesystem
+error propagates and the hook is not called. When extracting metadata from a built wheel, cleanup errors stop extraction
+after the wheel has been built.
+
 .. autoclass:: OptionalHooks
 
 Exceptions

{pyproject_api-1.12.3 → pyproject_api-1.12.5}/docs/changelog.rst

@@ -5,6 +5,27 @@ Release History
 
 .. towncrier release notes start
 
+.. _release-1-12-5:
+
+v1.12.5 (2026-11-07)
+--------------------
+
+.. _release-1-12-5-fixed:
+
+Fixed
+^^^^^
+
+- Propagate filesystem errors when clearing nested metadata directories (:pr:`357`) by :user:`Quinnod345` and
+  :user:`gaborbernat`.
+- Replace a symlink passed to ``ensure_empty_dir`` instead of following it, so a dangling link no longer raises
+  ``FileExistsError`` and a link to a directory no longer has its target emptied (:pr:`354`) by :user:`abhishekcpp007`
+  and :user:`gaborbernat`.
+
+.. _release-1-12-4:
+
+v1.12.4 (2026-11-04)
+--------------------
+
 .. _release-1-12-3:
 
 v1.12.3 (2026-11-02)