reliabot 0.4.0__py3-none-any.whl

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# CODEOWNERS currently only enabled for metadata and checks configuration
+/.github/ @dupuy
+/.pre-commit-config.yaml @dupuy
+pyproject.toml @dupuy
+setup.cfg @dupuy
+# Pending original author's gree light to use.
+tidy-md-refs.py @drdrang

.github/ISSUE_TEMPLATE/enhancement.md

@@ -0,0 +1,30 @@
+---
+name: Enhancement
+about: Suggest an enhancement to Reliabot
+title: Enhancement to …
+labels: enhancement
+assignees: ''
+---
+
+> Before suggesting an enhancement, search for similar issues: \
+> https://github.com/dupuy/reliabot/issues?q=is%3Aissue+sort%3Acomments-desc
+
+> If you find one, please add a comment in that issue. For more help, see \
+> https://github.com/dupuy/reliabot/blob/main/CONTRIBUTING.md#suggesting-enhancements.
+
+## _If the enhancement is:_ Related to a problem
+
+_Explain the problem you're having, such as "it's frustrating when …" and how
+this enhancement would help._
+
+## Describe the solution you want to see
+
+_Explain how you want Reliabot to work, providing as many details as possible._
+
+## Outline alternatives you've considered
+
+_Summarize any alternatives, and explain why they aren't as good._
+
+## Provide a rationale
+
+_Explain why this enhancement would be useful to many reliabot users._

.github/ISSUE_TEMPLATE/problem.md

@@ -0,0 +1,49 @@
+---
+name: Problem
+about: Report a problem you have with Reliabot
+title: Problem with …
+labels: ''
+assignees: ''
+---
+
+> Before reporting a problem, search for similar issues: \
+> https://github.com/dupuy/reliabot/issues?q=is%3Aissue+sort%3Acomments-desc
+
+> If you find one, please add a comment in that issue. For more help, see \
+> https://github.com/dupuy/reliabot/blob/main/CONTRIBUTING.md#reporting-problems.
+
+> ⚠️**Don't report security related issues or vulnerabilities here**. See \
+> https://github.com/dupuy/reliabot/security/policy for secure reporting.
+
+## Describe the problem
+
+_Briefly describe the expected behavior and Reliabot's actual behavior._
+
+## How you can reproduce the problem
+
+_Outline the steps to show the problem you are having._
+
+1. Set `PYTHONWARNINGS=default` in your environment
+
+2. _Provide the Reliabot command line (or `pre-commit run -v reliabot`) output,
+   including all warnings, error messages, and stack traces._
+
+3. _Attach `.pre-commit-config.yml`, `dependabot.yml`, and `.gitignore` files._
+
+4. _Link to a public GitHub repository or provide `tree` or `ls -R` output._
+
+## Screenshots
+
+_If applicable, add screenshots to help explain your problem._
+
+## Context
+
+_Add any other context about the problem here._
+
+- Reliabot version
+
+- Python version
+
+- Operating system (distribution) version
+
+- Output from `reliabot.py --self-test` (if relevant)

.github/ISSUE_TEMPLATE/question.md

@@ -0,0 +1,24 @@
+---
+name: Question
+about: Ask a question about Reliabot
+title: Question about …
+labels: question
+assignees: ''
+---
+
+> Before asking a question, search for similar issues: \
+> https://github.com/dupuy/reliabot/issues?q=is%3Aissue+sort%3Acomments-desc
+
+> If you find one, but still need help, ask your question in that issue. A few
+> internet searches may turn up an answer. For help asking questions, see \
+> https://github.com/dupuy/reliabot/blob/main/CONTRIBUTING.md#asking-a-question.
+
+_Provide as much context as you can for your question._
+
+- Reliabot version
+
+- Whether you're running Reliabot with pre-commit or on the command line
+
+- Operating System (distribution) and Python versions
+
+_Explain what you're trying to do, and what you don't understand._

.github/dependabot.yml

@@ -0,0 +1,39 @@
+---
+# reliabot: mapping=2 offset=2 sequence=4
+# reliabot: keep=. # this is mostly for test coverage (as is ./ in next)
+# reliabot: ignore=./reliabot # already tracked in repository root
+# reliabot: ignore=testdir/
+version: 2
+updates:
+  - directory: /
+    package-ecosystem: pip
+    schedule:
+      interval: monthly
+    groups:
+      python-tools:
+        - ruff
+        - tox
+  - directory: /
+    package-ecosystem: github-actions
+    schedule:
+      interval: monthly
+    groups:
+      gh-actions-infrastructure:
+        patterns:
+          - actions/*
+          - github/*
+          - ossf/*
+          - step-security/*
+      gh-actions-releases:
+        patterns:
+          - ncipollo/release-action
+          - orhun/git-cliff-action
+          - pypa/*
+  - directory: /fuzz
+    package-ecosystem: docker
+    schedule:
+      interval: monthly
+  - directory: /fuzz
+    package-ecosystem: pip
+    schedule:
+      interval: monthly

.github/repository-rules/reliabot-default-branch-rules.json

@@ -0,0 +1,73 @@
+{
+  "id": 12895965,
+  "name": "reliabot-default-branch-rules",
+  "target": "branch",
+  "source_type": "Repository",
+  "source": "dupuy/reliabot",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "exclude": [],
+      "include": ["~DEFAULT_BRANCH"]
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 1,
+        "dismiss_stale_reviews_on_push": true,
+        "required_reviewers": [],
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "required_review_thread_resolution": false,
+        "allowed_merge_methods": ["squash", "rebase"]
+      }
+    },
+    {
+      "type": "required_linear_history"
+    },
+    {
+      "type": "code_scanning",
+      "parameters": {
+        "code_scanning_tools": [
+          {
+            "tool": "CodeQL",
+            "security_alerts_threshold": "high_or_higher",
+            "alerts_threshold": "errors"
+          }
+        ]
+      }
+    },
+    {
+      "type": "code_quality",
+      "parameters": {
+        "severity": "errors"
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          {
+            "context": "pre-commit.ci - pr",
+            "integration_id": 68672
+          },
+          {
+            "context": "Codacy Static Code Analysis",
+            "integration_id": 56611
+          }
+        ]
+      }
+    }
+  ],
+  "bypass_actors": []
+}

.github/workflows/assign-labels.yaml

@@ -0,0 +1,75 @@
+# This workflow assigns labels to PRs based on conventional commit titles.
+
+# It looks at the commits in a pull request, mapping their commit types
+# (and some scopes) into labels according to the mappings in this workflow file.
+#
+# You can adjust the specific behavior by modifying this file.
+# For more information, see:
+# https://github.com/dupuy/action-assign-labels?tab=readme-ov-file#computer-how-to-use-action-assign-labels
+
+name: 'Assign labels to PRs from conventional commit titles'
+
+on:
+  pull_request_target:
+    branches: ['main']
+    types:
+      - opened
+      - ready_for_review
+      - reopened
+      - synchronize
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
+jobs:
+  assign-labels:
+    runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: write
+    steps:
+      - name: 'Harden runner'
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+
+      - name: 'Assign labels'
+        uses: dupuy/action-assign-labels@671a4ca2da0f900464c58b8b5540a1e07133e915 # v1.5.1
+        with:
+          apply-changes: true
+          conventional-commits: |
+            conventional-commits:
+              - type: 'fix'
+                nouns: ['fix']
+                labels: ['bug']
+              - type: 'feature'
+                nouns: ['feat']
+                labels: ['enhancement']
+              - type: 'breaking_change'
+                nouns: ['BREAKING CHANGE', 'BREAKING', 'feat!', 'fix!']
+                labels: ['major']
+
+              - type: 'build'
+                nouns: ['build', 'build(deps)', 'build(dev-deps)', 'chore']
+                labels: ['deployment']
+              - type: 'integration'
+                nouns: ['ci', 'test']
+                labels: ['testing']
+              - type: 'documentation'
+                nouns: ['docs']
+                labels: ['documentation']
+              - type: 'performance'
+                nouns: ['perf']
+                labels: ['performance']
+              - type: 'refactor'
+                nouns: ['refactor']
+                labels: ['refactor']
+              - type: 'style'
+                nouns: ['style']
+                labels: ['style']
+
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          maintain-labels-not-matched: true

.github/workflows/codacy-coverage-reporter.yaml

@@ -0,0 +1,58 @@
+# Source repository: https://github.com/codacy/codacy-coverage-reporter-action/blob/master/README.md#uploading-coverage-to-codacy
+
+name: 'Codacy Coverage Reporter'
+on:
+  - pull_request_target
+  - push
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
+jobs:
+  codacy-coverage-reporter:
+    runs-on: ubuntu-24.04
+    name: codacy-coverage-reporter
+    # Only run on primary fork, since this requires a Codacy project token
+    if: github.repository == 'dupuy/reliabot'
+    steps:
+      - name: 'Harden runner'
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.codacy.com:443
+            artifacts.codacy.com:443
+            files.pythonhosted.org:443
+            github.com:443
+            pypi.org:443
+            raw.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
+
+      - name: 'Checkout repository'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'Install Poetry'
+        run: 'pipx install poetry'
+
+      - name: 'Set up Python'
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.12'
+          cache: 'poetry'
+
+      - name: 'Install dependencies with extras'
+        run: 'poetry install --extras re2 --with testing'
+
+      - name: 'Run tests with coverage'
+        run: 'poetry run tox -e py'
+
+      - name: 'Run codacy-coverage-reporter'
+        uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1.3.0
+        with:
+          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
+          language: Python
+          coverage-reports: 'cobertura.xml'

.github/workflows/codeql.yaml

@@ -0,0 +1,71 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+name: 'CodeQL'
+
+on:
+  push:
+    branches: ['main']
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ['main']
+  schedule:
+    - cron: '47 2 * * 1'
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: 'Analyze'
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['python']
+
+    steps:
+      - name: 'Harden runner'
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            objects.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
+            uploads.github.com:443
+
+      - name: 'Checkout repository'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      # Initializes the CodeQL tools for scanning.
+      - name: 'Initialize CodeQL'
+        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      # [This is commented out since there are no compiled languages]
+      # - name: Autobuild
+      #   uses: github/codeql-action/autobuild@v3
+
+      - name: 'Perform CodeQL analysis'
+        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        with:
+          category: '/language:${{matrix.language}}'

.github/workflows/dependency-review.yaml

@@ -0,0 +1,37 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+
+name: 'Dependency review'
+on: [pull_request]
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: 'Harden runner'
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.deps.dev:443
+            api.github.com:443
+            github.com:443
+
+      - name: 'Checkout repository'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'Dependency review'
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0

.github/workflows/ossf-scorecard.yaml

@@ -0,0 +1,74 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: 'Scorecard supply-chain security'
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule: null # Run whenever a branch protection check occurs
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '36 23 * * 1'
+  push:
+    branches: ['main']
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: 'Scorecard analysis'
+    runs-on: ubuntu-24.04
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+
+    steps:
+      - name: 'Harden runner'
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.deps.dev:443
+            api.github.com:443
+            api.osv.dev:443
+            api.scorecard.dev:443
+            api.securityscorecards.dev:443
+            fulcio.sigstore.dev:443
+            github.com:443
+            oss-fuzz-build-logs.storage.googleapis.com:443
+            rekor.sigstore.dev:443
+            tuf-repo-cdn.sigstore.dev:443
+            www.bestpractices.dev:443
+
+      - name: 'Checkout repository'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'Run analysis'
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: 'Upload artifact'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: 'Upload to code-scanning'
+        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        with:
+          sarif_file: results.sarif