python-devkit 0.1.0__tar.gz → 0.1.1__tar.gz

{python_devkit-0.1.0 → python_devkit-0.1.1}/.github/workflows/release.yml

@@ -22,4 +22,4 @@ jobs:
       - uses: astral-sh/setup-uv@v7
 
       - name: Publish
-        run: uvx --from release-devkit==0.1.0 publish-packages --config publish-config.json
+        run: uvx --from release-devkit==0.1.1 publish-packages --config publish-config.json

python_devkit-0.1.1/AGENTS.md

@@ -0,0 +1,30 @@
+# python-devkit
+
+The python repo-lifecycle devkit — workspace locking (`lock-python`), the preflight check runner, and the canonical ruff configuration with its sync verb and drift gate, per the tooling-consolidation program. Purely python-domain by charter: the CI runner floor (step wrapper, runner provisioning, git tags, OCI cache) lives in [`ci-devkit`](https://github.com/outernet-foundation/ci-devkit), which this package depends on (`ci-devkit>=0.1.0`).
+
+The package is `python_devkit` (src-layout under `src/python_devkit/`); all dependencies resolve from PyPI (`bashrun`, `ci-devkit`, `pydantic`, `typer`; git-source pins only in scratch branches testing unreleased changes).
+
+## Shape
+
+Entry point (`[project.scripts]`): `lock-python` → `lock_python.py:app`. The command function doubles as the library API — consumer preflights import `lock_python` and call `lock_python(check=True)` directly.
+
+`lock_python.py` regenerates a uv workspace's `uv.lock` plus per-service `pylock.toml` exports. Discovery: members of `[tool.uv.workspace]` in the root `pyproject.toml` that carry a `Dockerfile`; each gets `pylock.toml` (`--no-default-groups`) and one `pylock.<group>.toml` (`--only-group`) per non-`dev` dependency group. Redirect: a group matching a key of `[tool.python-devkit.lock-python] group-export-dirs` (glob → repo-relative directory) exports into that directory instead of the member's, once, deduplicated across members — the generalization of placeframe's neural-networks accelerator groups, which several members declare identically but only a non-member base image consumes. `--check` compares normalized exports against committed files and exits non-zero on any staleness.
+
+`preflight_runner.py` is the labeled-check runner consumer preflights thin into: `run_checks(checks)` executes a declarative list of `CommandCheck` (label + shell command under a `ci_step` group) and `GeneratedCheck` (label + generate command + pathspec + fix command — runs the generator, then fails on any `git status --porcelain` dirt under the paths, showing the diff and the fix command). Fail-fast; each check's duration lands in the Actions step summary via `ci_step`.
+
+## Constraints
+
+- **The module surface is cross-repo Python API.** `python_devkit.lock_python.lock_python(check, root)` and `python_devkit.preflight_runner.run_checks(checks)` are contract: placeframe's preflight calls both in-process, the lock-python entry point is on CI's path, and the `[tool.python-devkit.lock-python]` table in consumer root pyprojects is its declarative config surface.
+- **`group-export-dirs` is devkit-owned and `extra="forbid"`.** A typo'd key in that table fails validation loudly rather than silently dropping the redirect (the failure mode is per-group pylocks appearing in member directories).
+- **The redirect contract assumes identical group declarations.** Dedup is first-member-wins; members declaring the same redirected group differently get whichever member enumerates first, silently.
+- **Export commands are byte-stability load-bearing.** The exact `uv export` flag order must not churn — committed pylocks are compared byte-for-byte (after newline normalization), so a cosmetic flag change ripples into every consumer's diff.
+- **uv invocations run with `cwd=root`.** `--root` (default: current directory) exists so the verb and the library call work from anywhere; the uv commands themselves must execute inside the workspace root.
+
+## Release flow
+
+`release.yml` (workflow_run-gated on CI) publishes via release-devkit uvx-isolated under OIDC trusted publishing (publisher bound to `release.yml`, no environment); the first release is 0.1.0 on the fresh `python-devkit-v*` tag ledger. The committed `pyproject.toml` version is permanently the `0.0.0.dev0` sentinel; the tags are the version ledger. API-breaking changes ship with a manually bumped version — patch-auto assumes additive changes.
+
+## See also
+
+- `README.md` — human-facing overview.
+- [tooling-consolidation.md](https://github.com/outernet-foundation/placeframe/blob/dev/design/tooling-consolidation.md) — the program this repo belongs to.

python_devkit-0.1.1/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.5
+Name: python-devkit
+Version: 0.1.1
+Summary: Python repo-lifecycle tooling: workspace locking, preflight checks, canonical ruff configuration
+License-File: LICENSE
+License-File: NOTICE
+Requires-Python: >=3.13
+Requires-Dist: bashrun>=0.1.0
+Requires-Dist: ci-devkit>=0.1.0
+Requires-Dist: pydantic>=2.11.7
+Requires-Dist: typer>=0.17.4

python_devkit-0.1.1/README.md

@@ -0,0 +1,50 @@
+# python-devkit
+
+Python repo-lifecycle tooling shared across outernet-foundation repos: workspace locking (`lock-python`), the preflight check runner, and the canonical ruff configuration with its sync verb and drift gate. Sibling of `ci-devkit` (the CI runner floor it will depend on), `unity-devkit`, `docker-devkit`, and `release-devkit`.
+
+## lock-python
+
+Regenerates a uv workspace's `uv.lock` and the per-service `pylock.toml` exports consumed by service Dockerfiles:
+
+```bash
+uv run lock-python           # write: uv lock + every export
+uv run lock-python --check   # validate; exit 1 on any stale lock
+```
+
+For every workspace member that carries a `Dockerfile`, it exports `pylock.toml` (no default groups) plus one `pylock.<group>.toml` per non-`dev` dependency group. Dependency groups whose names match a pattern in the root `pyproject.toml`'s `[tool.python-devkit.lock-python] group-export-dirs` map export into the mapped directory instead, once, deduplicated across members — e.g. placeframe's accelerator groups:
+
+```toml
+[tool.python-devkit.lock-python]
+group-export-dirs = { "neural-networks-*" = "docker/neural-networks-base" }
+```
+
+## preflight runner
+
+Consumer preflights thin into a declarative check list over `run_checks`:
+
+```python
+from python_devkit.preflight_runner import CommandCheck, GeneratedCheck, run_checks
+
+run_checks([
+    CommandCheck(label="Lint", command="uv run ruff check ."),
+    GeneratedCheck(
+        label="Check client codegen",
+        generate_command="uv run generate-clients",
+        paths=[Path("packages/generated/")],
+        fix_command="uv run generate-clients",
+    ),
+])
+```
+
+`CommandCheck` wraps a shell command in a labeled CI step group; `GeneratedCheck` additionally guards the checked-in generator output with a git-status staleness check (diff shown, fix command named). Checks run fail-fast with per-step durations in the Actions step summary.
+
+## Development
+
+Requires Python 3.13+ and [uv](https://docs.astral.sh/uv/).
+
+```bash
+uv sync
+uv run ruff check .
+uv run ruff format --check .
+uv run basedpyright
+```

{python_devkit-0.1.0 → python_devkit-0.1.1}/pyproject.toml

@@ -1,14 +1,18 @@
 [project]
 name = "python-devkit"
-version = "0.1.0"
-description = "Python repo-lifecycle tooling: CI step wrapper, runner provisioning, workspace locking, preflight checks"
+version = "0.1.1"
+description = "Python repo-lifecycle tooling: workspace locking, preflight checks, canonical ruff configuration"
 requires-python = ">=3.13"
 dependencies = [
     "bashrun>=0.1.0",
+    "ci-devkit>=0.1.0",
     "pydantic>=2.11.7",
-    "pydantic-settings>=2.9.1",
+    "typer>=0.17.4",
 ]
 
+[project.scripts]
+lock-python = "python_devkit.lock_python:app"
+
 [dependency-groups]
 dev = ["basedpyright>=1.39.10", "ruff>=0.14.11"]
 
@@ -18,7 +22,7 @@ build-backend = "hatchling.build"
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/python_devkit"]
-include = ["src/python_devkit/py.typed", "src/python_devkit/third-party/**"]
+include = ["src/python_devkit/py.typed"]
 
 [tool.uv.sources]
 

python_devkit-0.1.1/src/python_devkit/lock_python.py

@@ -0,0 +1,130 @@
+from __future__ import annotations
+
+from fnmatch import fnmatch
+from pathlib import Path
+from tomllib import load
+from typing import Annotated, Any
+
+import typer
+from bashrun import bash, bash_check, bash_output
+from pydantic import BaseModel, ConfigDict, Field
+
+app = typer.Typer(add_completion=False, pretty_exceptions_show_locals=False)
+
+
+class LockPythonConfig(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    group_export_dirs: dict[str, Path] = Field(default_factory=dict, alias="group-export-dirs")
+
+
+class WorkspaceConfig(BaseModel):
+    members: list[str] = Field(default_factory=list)
+
+
+class ProjectConfig(BaseModel):
+    name: str
+
+
+class PackageConfig(BaseModel):
+    project: ProjectConfig
+    dependency_groups: dict[str, Any] = Field(default_factory=dict, alias="dependency-groups")
+
+
+@app.command()
+def lock_python(
+    check: Annotated[
+        bool, typer.Option("--check", help="Validate lock files without writing; exit non-zero if stale.")
+    ] = False,
+    root: Annotated[Path, typer.Option(help="uv workspace root; defaults to the current directory.")] = Path(),
+) -> None:
+    root = root.resolve()
+    stale = False
+
+    if check:
+        print("Checking uv.lock...")
+        if not bash_check("uv lock --check", cwd=root):
+            print("  STALE: uv.lock is out of date. Run 'uv run lock-python' to update.")
+            stale = True
+        else:
+            print("  OK")
+    else:
+        bash("uv lock", cwd=root)
+
+    with (root / "pyproject.toml").open("rb") as file:
+        workspace_toml = load(file)
+
+    tool = workspace_toml.get("tool", {})
+    workspace = WorkspaceConfig.model_validate(tool.get("uv", {}).get("workspace", {}))
+    config = LockPythonConfig.model_validate(tool.get("python-devkit", {}).get("lock-python", {}))
+
+    seen_redirected: set[str] = set()
+
+    for member in workspace.members:
+        member_dir = root / member
+
+        if not (member_dir / "Dockerfile").exists():
+            continue
+
+        with (member_dir / "pyproject.toml").open("rb") as file:
+            package = PackageConfig.model_validate(load(file))
+
+        stale |= _export_pylock(check, root, member_dir, package.project.name, group=None)
+
+        for group in package.dependency_groups:
+            if group == "dev":
+                continue
+            redirect = _redirect_dir(group, config, root)
+            if redirect is None:
+                stale |= _export_pylock(check, root, member_dir, package.project.name, group=group)
+                continue
+            if group in seen_redirected:
+                continue
+            seen_redirected.add(group)
+            stale |= _export_pylock(check, root, redirect, package.project.name, group=group)
+
+    if check and stale:
+        raise SystemExit(1)
+
+    if check:
+        print("\nAll Python lock files are up to date.")
+
+
+def _export_pylock(check: bool, root: Path, export_dir: Path, package_name: str, group: str | None) -> bool:
+    if group:
+        pylock = export_dir / f"pylock.{group}.toml"
+        group_flags = f"--only-group {group} "
+    else:
+        pylock = export_dir / "pylock.toml"
+        group_flags = "--no-default-groups "
+
+    export_command = (
+        f"uv export --format pylock.toml --no-header --package {package_name} {group_flags}--no-emit-local --frozen "
+    )
+
+    if check:
+        print(f"Checking {pylock}...")
+        exported = _normalize_line_endings(bash_output(export_command, cwd=root))
+        committed = _normalize_line_endings(pylock.read_text(encoding="utf-8")) if pylock.exists() else ""
+        if exported != committed:
+            print(f"  STALE: {pylock} is out of date.")
+            return True
+        print("  OK")
+        return False
+
+    bash(export_command + f"--output-file {pylock} ", cwd=root)
+    text = pylock.read_text(encoding="utf-8")
+    with pylock.open("w", encoding="utf-8", newline="\n") as file:
+        file.write(text)
+    return False
+
+
+def _normalize_line_endings(text: str) -> str:
+    return text.replace("\r\n", "\n").replace("\r", "\n")
+
+
+def _redirect_dir(group: str, config: LockPythonConfig, root: Path) -> Path | None:
+    for pattern, directory in config.group_export_dirs.items():
+        if fnmatch(group, pattern):
+            return root / directory
+    return None

python_devkit-0.1.1/src/python_devkit/preflight_runner.py

@@ -0,0 +1,43 @@
+from __future__ import annotations
+
+from collections.abc import Sequence
+from pathlib import Path
+
+from bashrun import bash, bash_output
+from ci_devkit.ci_step import ci_step
+from pydantic import BaseModel
+
+
+class CommandCheck(BaseModel):
+    label: str
+    command: str
+
+
+class GeneratedCheck(BaseModel):
+    label: str
+    generate_command: str
+    paths: list[Path]
+    fix_command: str
+
+
+def run_checks(checks: Sequence[CommandCheck | GeneratedCheck], *, cwd: Path | None = None) -> None:
+    for check in checks:
+        if isinstance(check, CommandCheck):
+            _run_command_check(check, cwd)
+        else:
+            _run_generated_check(check, cwd)
+
+
+def _run_command_check(check: CommandCheck, cwd: Path | None) -> None:
+    with ci_step(check.label):
+        bash(check.command, cwd=cwd)
+
+
+def _run_generated_check(check: GeneratedCheck, cwd: Path | None) -> None:
+    with ci_step(check.label):
+        bash(check.generate_command, cwd=cwd)
+        pathspec = " ".join(str(path) for path in check.paths)
+        staleness_output = bash_output(f"git status --porcelain -- {pathspec}", cwd=cwd)
+        if staleness_output.strip():
+            bash(f"git diff -- {pathspec}", cwd=cwd)
+            raise SystemExit(f"{check.label} output is stale. Run '{check.fix_command}' locally and commit the result.")