repolore-mcp 0.2.0__tar.gz

repolore_mcp-0.2.0/.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

repolore_mcp-0.2.0/.githooks/pre-commit

@@ -0,0 +1,5 @@
+#!/bin/sh
+if [ "$(git symbolic-ref --short -q HEAD)" = "main" ]; then
+  echo "Direct commits to main are blocked: create a branch and open a PR." >&2
+  exit 1
+fi

repolore_mcp-0.2.0/.githooks/pre-push

@@ -0,0 +1,7 @@
+#!/bin/sh
+while read -r _ _ remote_ref _; do
+  if [ "$remote_ref" = "refs/heads/main" ]; then
+    echo "Direct pushes to main are blocked: push a branch and open a PR." >&2
+    exit 1
+  fi
+done

repolore_mcp-0.2.0/.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+
+# Weekly version bumps for both ecosystems. The workflow actions are pinned to a commit with the
+# version in a comment, and Dependabot moves both together.
+#
+# Cooldown holds a release for seven days before proposing it: a malicious or broken publish is
+# usually caught and pulled within the week. Security updates for vulnerable dependencies are
+# switched on in the repository settings and arrive on their own, not on this schedule.
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      # Alone, because CI can't run Metal: an mlx bump waits for `uv run pytest -m live` on a Mac.
+      mlx:
+        patterns: [mlx, mlx-cpu, mlx-metal]
+      uv-minor-and-patch:
+        update-types: [minor, patch]
+        exclude-patterns: [mlx, mlx-cpu, mlx-metal]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7

repolore_mcp-0.2.0/.github/rulesets/README.md

@@ -0,0 +1,20 @@
+# Branch protection ruleset
+
+`protect-main.json` is the "Protect main" ruleset, applied to this repository. It blocks deleting
+or force-pushing the default branch, requires every change to go through a pull request (no
+direct pushes, no bypass, admins included), and requires the `lint`, `typecheck`,
+`test (ubuntu-latest)`, `test (windows-latest)`, `test (macos-latest)`, `build`, `typos`, `zizmor` and `actionlint`
+checks from `.github/workflows/ci.yml` to pass before a PR can merge. `audit` runs on every PR
+but isn't required: a newly published advisory would otherwise block every PR, related or not. No
+required review count: solo repo, so that's just CI plus a PR.
+
+CodeQL (Python and Actions) runs from `.github/workflows/codeql.yml`. Its `analyze (python)` and
+`analyze (actions)` jobs are required checks, so a failed analysis shows as a failed check rather
+than as results that never arrive. A `code_scanning` rule gates the results themselves: a PR can't
+merge without them, or with an error-level alert or a high or critical security alert. GitHub's default setup is switched off,
+because it skips pull requests from forks, which would leave this rule waiting on them forever.
+
+The file is the source of truth, but GitHub doesn't read it. A change here, such as a renamed or
+added CI job, has to be applied by hand: **Settings → Rules → Rulesets → Protect main**, or
+through the API with `gh api -X PUT repos/ryckakas/repolore/rulesets/<id> --input
+.github/rulesets/protect-main.json` (`gh api repos/ryckakas/repolore/rulesets` lists the id).

repolore_mcp-0.2.0/.github/rulesets/protect-main.json

@@ -0,0 +1,61 @@
+{
+  "name": "Protect main",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "required_status_checks": [
+          { "context": "lint" },
+          { "context": "typecheck" },
+          { "context": "test (ubuntu-latest)" },
+          { "context": "test (windows-latest)" },
+          { "context": "test (macos-latest)" },
+          { "context": "build" },
+          { "context": "typos" },
+          { "context": "zizmor" },
+          { "context": "actionlint" },
+          { "context": "analyze (python)" },
+          { "context": "analyze (actions)" }
+        ],
+        "strict_required_status_checks_policy": false
+      }
+    },
+    {
+      "type": "code_scanning",
+      "parameters": {
+        "code_scanning_tools": [
+          {
+            "tool": "CodeQL",
+            "alerts_threshold": "errors",
+            "security_alerts_threshold": "high_or_higher"
+          }
+        ]
+      }
+    }
+  ],
+  "bypass_actors": []
+}

repolore_mcp-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,145 @@
+name: CI
+
+# Every job's name below becomes a GitHub status check, and the "Protect main" ruleset
+# (.github/rulesets/protect-main.json) requires each one by that exact name before a PR can merge,
+# so a job renamed here needs the ruleset updated to match.
+#
+# Workflows are audited like code (see the zizmor job): every action is pinned to a full commit
+# with its version in a comment, and Dependabot moves both. A tag can be moved to other code; a
+# commit cannot.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+# A new push to a pull request supersedes the run already going; main keeps every run so each
+# merge has its own result.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - run: uv sync --locked
+      - run: uv run ruff check --output-format=github
+      - run: uv run ruff format --check
+      - run: uv run bonsai-lint --format github
+
+  typecheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      # The extra brings sentence-transformers, so reranking.py is checked against its real types.
+      - run: uv sync --locked --extra rerank
+      - run: uv run pyright
+
+  # Windows is load-bearing rather than ceremony: it is the development machine and where installed
+  # users run the CLI, and its default cp1252 codec is a known way to break on GitHub content.
+  test:
+    name: test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - run: uv sync --locked
+      - run: uv run pytest --cov
+
+  # Installs the built wheel in an isolated environment and runs the entry point, which catches a
+  # packaging break (missing module, wrong script target) that tests against the source tree can't.
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - run: uv build
+      - run: uv run --isolated --no-project --with dist/*.whl repolore version
+
+  typos:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # An exact release, since each one adds corrections; Dependabot proposes the next one.
+      - uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
+
+  # Workflow security: pinned actions, least-privilege tokens, no credentials left behind, no
+  # template injection.
+  zizmor:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # An exact release: new audits arrive with a deliberate bump, not with an unrelated pull
+      # request.
+      - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
+        with:
+          tool: zizmor@1.31.1
+      # The token lets zizmor check that every pinned commit belongs to its action's repository.
+      - run: zizmor --format github .github
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+  # Workflow correctness, where zizmor covers security, plus shellcheck over every `run:` block
+  # and the git hooks, which have no .sh extension for a glob to find.
+  actionlint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # actionlint skips the `run:` blocks without a word when shellcheck is missing, so it is
+      # installed first, at an exact release.
+      - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
+        with:
+          tool: shellcheck@0.11.0
+      # The release binary, checked against its published SHA-256. Dependabot doesn't see this
+      # pin; bump the version and the hash together.
+      - name: Install actionlint
+        run: |
+          curl -sSfL -o "$RUNNER_TEMP/actionlint.tar.gz" \
+            https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
+          echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  $RUNNER_TEMP/actionlint.tar.gz" | sha256sum -c -
+          tar -xzf "$RUNNER_TEMP/actionlint.tar.gz" -C "$RUNNER_TEMP" actionlint
+      - run: '"$RUNNER_TEMP/actionlint"'
+      - run: shellcheck .githooks/*
+
+  # Known advisories in uv.lock. Not a required check: an advisory published overnight would
+  # otherwise block every pull request, related or not. `uv audit` is still a preview feature.
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - run: uv audit --locked --preview-features audit-command

repolore_mcp-0.2.0/.github/workflows/codeql.yml

@@ -0,0 +1,45 @@
+name: CodeQL
+
+# Advanced setup rather than GitHub's default setup, because default setup skips pull requests from
+# forks, and the "Protect main" ruleset's code_scanning rule then waits on them forever. The
+# categories match the ones default setup used, so alerts carry over. The ruleset also requires each
+# analyze job by name, so renaming one needs the ruleset updated to match.
+#
+# No weekly schedule: the pinned action fixes the CodeQL version, so rescanning an unchanged main
+# would run the same queries. New queries arrive with a Dependabot bump, which is scanned on its pull
+# request and again on main.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  analyze:
+    name: analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, actions]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          category: /language:${{ matrix.language }}

repolore_mcp-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,135 @@
+name: Release
+
+# PyPI and TestPyPI trust this file. A vX.Y.Z tag publishes that version to PyPI and creates its GitHub Release.
+# Dispatched by hand, it rehearses on TestPyPI with a .dev<run number> version, or reruns a failed PyPI publish when
+# started at a release tag. A version on PyPI is permanent, so nothing is ever replaced there.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      target:
+        description: "Index to upload to"
+        type: choice
+        options: [testpypi, pypi]
+        default: testpypi
+
+permissions: {}
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    outputs:
+      target: ${{ steps.request.outputs.target }}
+      version: ${{ steps.request.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # hatch-vcs needs the history and tags to count the commits since the last release.
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          # A release must not restore what another workflow wrote.
+          enable-cache: false
+      - name: Check the request
+        id: request
+        env:
+          TARGET: ${{ inputs.target || 'pypi' }}
+        run: |
+          if [ "$TARGET" = pypi ]; then
+            if [[ ! "$GITHUB_REF" =~ ^refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              echo "::error::PyPI takes only a release tag vX.Y.Z, not $GITHUB_REF; prereleases are not published"
+              exit 1
+            fi
+            if ! git merge-base --is-ancestor HEAD origin/main; then
+              echo "::error::$GITHUB_REF_NAME is not on main"
+              exit 1
+            fi
+            version="${GITHUB_REF_NAME#v}"
+          else
+            # TestPyPI rejects the local +g<sha> part, and a rerun needs a version it hasn't seen.
+            scm=$(uv run --no-project --python 3.12 --with 'hatch-vcs>=0.5.0,<0.6' python -c \
+              'from setuptools_scm import get_version; print(get_version(local_scheme="no-local-version"))')
+            version="${scm%%.dev*}.dev$GITHUB_RUN_NUMBER"
+          fi
+          echo "Publishing repolore-mcp $version to $TARGET"
+          {
+            echo "target=$TARGET"
+            echo "version=$version"
+          } >> "$GITHUB_OUTPUT"
+      - name: Build
+        env:
+          TARGET: ${{ steps.request.outputs.target }}
+          VERSION: ${{ steps.request.outputs.version }}
+        run: |
+          # A release builds the version hatch-vcs reads from its tag, which the next step checks.
+          if [ "$TARGET" = testpypi ]; then
+            export SETUPTOOLS_SCM_PRETEND_VERSION="$VERSION"
+          fi
+          uv build --no-sources
+      - name: Check the wheel
+        env:
+          VERSION: ${{ steps.request.outputs.version }}
+        run: |
+          wheel="dist/repolore_mcp-$VERSION-py3-none-any.whl"
+          if [ ! -f "$wheel" ]; then
+            echo "::error::expected $wheel, built: $(ls dist)"
+            exit 1
+          fi
+          uv run --isolated --no-project --python 3.12 --with "$wheel" repolore version | tee version.txt
+          grep -qx "repolore $VERSION" version.txt
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+          retention-days: 7
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment:
+      name: ${{ needs.build.outputs.target }}
+      url: ${{ needs.build.outputs.target == 'pypi' && 'https://pypi.org/p/repolore-mcp' || 'https://test.pypi.org/p/repolore-mcp' }}
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        with:
+          repository-url: ${{ needs.build.outputs.target == 'pypi' && 'https://upload.pypi.org/legacy/' || 'https://test.pypi.org/legacy/' }}
+
+  github-release:
+    needs: [build, publish]
+    if: needs.build.outputs.target == 'pypi'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist/
+      - name: Create the GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # A rerun of this job, or a release made by hand, finds it already there.
+          if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "$GITHUB_REF_NAME already has a GitHub Release"
+            exit 0
+          fi
+          gh release create "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY" --generate-notes --verify-tag

repolore_mcp-0.2.0/.gitignore

@@ -0,0 +1,11 @@
+.plans/
+tmp/
+.env
+*.db
+.venv/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+dist/
+.coverage

repolore_mcp-0.2.0/.python-version

@@ -0,0 +1 @@
+3.12