pyselfupdate 0.3.0__tar.gz → 0.3.2__tar.gz

{pyselfupdate-0.3.0 → pyselfupdate-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: pyselfupdate
-Version: 0.3.0
+Version: 0.3.2
 Summary: Self-update and update notification for Python CLIs installed with uv tool
 Keywords: uv,cli,self-update,update-notifier,release
 Author: Chris Birch

{pyselfupdate-0.3.0 → pyselfupdate-0.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyselfupdate"
-version = "0.3.0"
+version = "0.3.2"
 description = "Self-update and update notification for Python CLIs installed with uv tool"
 readme = "README.md"
 keywords = [

{pyselfupdate-0.3.0 → pyselfupdate-0.3.2}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "pyselfupdate"
-version = "0.3.0"
+version = "0.3.2"
 description = "Self-update and update notification for Python CLIs installed with uv tool"
 authors = [{ name = "Chris Birch", email = "datapointchris@gmail.com" }]
 license = { text = "MIT" }

{pyselfupdate-0.3.0 → pyselfupdate-0.3.2}/src/pyselfupdate/github.py

@@ -29,9 +29,11 @@ API = 'https://api.github.com'
 DEFAULT_TIMEOUT = 10.0
 
 
-TOKEN_COMMAND_ENV = 'GITHUB_TOKEN_COMMAND'
+# B105 reads any name carrying "token" as a credential. Both hold the name of a
+# variable and the text of a command; neither ever holds a secret.
+TOKEN_COMMAND_ENV = 'GITHUB_TOKEN_COMMAND'  # nosec B105
 
-DEFAULT_TOKEN_COMMAND = 'gh auth token'
+DEFAULT_TOKEN_COMMAND = 'gh auth token'  # nosec B105
 """What runs when nothing overrides it.
 
 Authenticating is the default because the alternative is not "no credential" but

{pyselfupdate-0.3.0 → pyselfupdate-0.3.2}/src/pyselfupdate/notifier.py

@@ -45,6 +45,7 @@ class Skip(Enum):
     NOT_A_TTY = 'not-a-tty'
     CI = 'ci'
     INTERVAL = 'interval'
+    HELP = 'help'
     FAILED = 'failed'
 
 
@@ -102,6 +103,8 @@ def enabled(config: Config, *, interactive: bool | None = None) -> tuple[bool, S
     """
     if _disabled_by_env(config.tool):
         return False, Skip.DISABLED
+    if _asking_for_help():
+        return False, Skip.HELP
     if not (_is_interactive() if interactive is None else interactive):
         return False, Skip.NOT_A_TTY
     if _in_ci():
@@ -111,6 +114,30 @@ def enabled(config: Config, *, interactive: bool | None = None) -> tuple[bool, S
     return True, None
 
 
+def _asking_for_help() -> bool:
+    """Whether the command line asks for help rather than for work.
+
+    Click and Typer run a group's callback before answering a subcommand's
+    `--help`, so a notice called from that callback fires while printing a help
+    screen. Nothing a notice is for happens on a help screen, and the check
+    costs a releases-API call and a state write every time.
+
+    It lands hardest on a reader that walks a tool's help. Measured 2026-08-22:
+    reading doit's twenty commands meant twenty-one invocations, each one
+    reaching this.
+
+    A `--` ends the scan, because everything after it is the command's own
+    argument. Skipping when it should not have costs a missed notice, which is
+    the cheap direction to be wrong in.
+    """
+    for arg in sys.argv[1:]:
+        if arg == '--':
+            return False
+        if arg in {'--help', '-h'}:
+            return True
+    return False
+
+
 def _notify(
     config: Config,
     *,