repomatic 7.6.0__tar.gz → 7.8.0__tar.gz

{repomatic-7.6.0 → repomatic-7.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: repomatic
-Version: 7.6.0
+Version: 7.8.0
 Summary: 🏭 Automate repository maintenance, releases, and CI/CD workflows
 Keywords: changelog-formatter,dependabot-alternative,github-actions,github-labels,github-workflow,gitignore,mailmap,mypy,nuitka,python-automation,release-automation,repository-automation,repository-management,reusable-workflows,software-factory,sphinx-doc,typo,uv,workflow-reusable
 Author: Kevin Deldycke
@@ -59,7 +59,7 @@ Requires-Dist: wcmatch>=10
 Requires-Python: >=3.10
 Project-URL: Changelog, https://github.com/kdeldycke/repomatic/blob/main/changelog.md
 Project-URL: Documentation, https://kdeldycke.github.io/repomatic
-Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v7.6.0
+Project-URL: Download, https://github.com/kdeldycke/repomatic/releases/tag/v7.8.0
 Project-URL: Funding, https://github.com/sponsors/kdeldycke
 Project-URL: Homepage, https://github.com/kdeldycke/repomatic
 Project-URL: Issues, https://github.com/kdeldycke/repomatic/issues
@@ -67,14 +67,13 @@ Project-URL: Repository, https://github.com/kdeldycke/repomatic
 Description-Content-Type: text/markdown
 
 <p align="center">
-  <img src="docs/assets/logo-banner.svg" alt="repomatic">
+  <img src="https://raw.githubusercontent.com/kdeldycke/repomatic/main/docs/assets/logo-banner.svg" alt="repomatic">
 </p>
 
 [![Last release](https://img.shields.io/pypi/v/repomatic.svg)](https://pypi.org/project/repomatic/)
 [![Python versions](https://img.shields.io/pypi/pyversions/repomatic.svg)](https://pypi.org/project/repomatic/)
 [![Downloads](https://static.pepy.tech/badge/repomatic/month)](https://pepy.tech/projects/repomatic)
 [![Unittests status](https://img.shields.io/github/actions/workflow/status/kdeldycke/repomatic/tests.yaml?branch=main&label=%F0%9F%94%AC%20Tests)](https://github.com/kdeldycke/repomatic/actions/workflows/tests.yaml?query=branch%3Amain)
-[![Coverage status](https://codecov.io/gh/kdeldycke/repomatic/branch/main/graph/badge.svg)](https://app.codecov.io/gh/kdeldycke/repomatic)
 [![Documentation status](https://img.shields.io/github/actions/workflow/status/kdeldycke/repomatic/docs.yaml?branch=main&label=%F0%9F%93%9A%20Docs)](https://github.com/kdeldycke/repomatic/actions/workflows/docs.yaml?query=branch%3Amain)
 
 A Python CLI and `pyproject.toml` configuration that let you **release Python packages multiple times a day with only 2-clicks**. Designed for `uv`-based Python projects, but usable for other projects too. Every step is a CLI command: reusable GitHub Actions workflows are only the trigger, so the same automation runs on your machine.
@@ -160,8 +159,11 @@ Check these projects to get real-life examples of usage and inspiration:
 - ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/meta-package-manager?label=%E2%AD%90&style=flat-square) [Meta Package Manager](https://github.com/kdeldycke/meta-package-manager) - A unifying CLI for multiple package managers.
 - ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/mail-deduplicate?label=%E2%AD%90&style=flat-square) [Mail Deduplicate](https://github.com/kdeldycke/mail-deduplicate) - A CLI to deduplicate similar emails.
 - ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/dotfiles?label=%E2%AD%90&style=flat-square) [dotfiles](https://github.com/kdeldycke/dotfiles) - macOS dotfiles for Python developers.
-- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/click-extra?label=%E2%AD%90&style=flat-square) [Click Extra](https://github.com/kdeldycke/click-extra) - Extra colorization and configuration loading for Click.
+- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/click-extra?label=%E2%AD%90&style=flat-square) [Click Extra](https://github.com/kdeldycke/click-extra) - Drop-in replacement for Click to make user-friendly and colorful CLI.
 - ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/repomatic?label=%E2%AD%90&style=flat-square) [repomatic](https://github.com/kdeldycke/repomatic) - Itself. Eat your own dog-food.
-- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/extra-platforms?label=%E2%AD%90&style=flat-square) [Extra Platforms](https://github.com/kdeldycke/extra-platforms) - Detect platforms and group them by family.
+- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/plumage?label=%E2%AD%90&style=flat-square) [Plumage](https://github.com/kdeldycke/plumage) - Clean and tidy theme for Pelican, the static site generator.
+- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/kevin-deldycke-blog?label=%E2%AD%90&style=flat-square) [Kevin Deldycke's blog](https://github.com/kdeldycke/kevin-deldycke-blog) - My personal blog, based on Pelican.
+- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/extra-platforms?label=%E2%AD%90&style=flat-square) [Extra Platforms](https://github.com/kdeldycke/extra-platforms) - Detect architectures, platforms, shells, terminals, CI systems and agents, grouped by family.
+- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/kdeldycke?label=%E2%AD%90&style=flat-square) [GitHub profile](https://github.com/kdeldycke/kdeldycke) - My GitHub profile page and short bio.
 
 Send a PR to add your project if you use repomatic.

{repomatic-7.6.0 → repomatic-7.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ requires = ["uv-build>=0.8"]
 
 [project]
 name = "repomatic"
-version = "7.6.0"
+version = "7.8.0"
 description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 readme = "readme.md"
 keywords = [
@@ -92,7 +92,7 @@ email = "kevin@deldycke.com"
 [project.urls]
 Changelog = "https://github.com/kdeldycke/repomatic/blob/main/changelog.md"
 Documentation = "https://kdeldycke.github.io/repomatic"
-Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.6.0"
+Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.8.0"
 Funding = "https://github.com/sponsors/kdeldycke"
 Homepage = "https://github.com/kdeldycke/repomatic"
 Issues = "https://github.com/kdeldycke/repomatic/issues"
@@ -146,7 +146,7 @@ module-root = ""
 [tool.nuitka]
 copyright = "Kevin Deldycke <kevin@deldycke.com> and contributors. Distributed under GPL-2.0-or-later license."
 file-description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
-file-version = "7.6.0"
+file-version = "7.8.0"
 include-data-dir = [
     "repomatic/data/awesome_template=repomatic/data/awesome_template",
     "repomatic/data/skills=repomatic/data/skills",
@@ -156,7 +156,7 @@ include-package-data = ["click_extra"]
 linux-icon = "docs/assets/icon.png"
 macos-app-icon = "docs/assets/icon.icns"
 product-name = "Repomatic"
-product-version = "7.6.0"
+product-version = "7.8.0"
 windows-icon-from-ico = "docs/assets/icon.ico"
 
 [tool.ruff]
@@ -208,6 +208,7 @@ astroid = "astroid"
 Contribuer = "Contribuer"
 oject = "oject"
 PNGs = "PNGs"
+quater = "quater"
 sur = "sur"
 
 [tool.mypy]
@@ -245,10 +246,11 @@ branch = true
 source = ["repomatic"]
 
 [tool.coverage.report]
+fail_under = 80
 precision = 2
 
 [tool.bumpversion]
-current_version = "7.6.0"
+current_version = "7.8.0"
 parse = '(?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(\.dev(?P<dev>\d+))?'
 serialize = [
     "{major}.{minor}.{patch}.dev{dev}",
@@ -333,10 +335,13 @@ pypi-package-history = [
     "gha-utils",
     "repokit",
 ]
-release-assets = ["repomatic-plugin.zip"]
+release-assets = ["repomatic-claude-plugin.zip"]
 
 [tool.repomatic.changelog]
 archive-location = "./docs/changelog-archive.md"
 
 [tool.repomatic.manpages]
 script = "repomatic.cli:repomatic"
+
+[tool.actionlint.paths."**/workflows/*"]
+ignore = ['property "job_workflow_sha" is not defined']

{repomatic-7.6.0 → repomatic-7.8.0}/pyproject.toml.orig

@@ -12,7 +12,7 @@ requires = [ "uv-build>=0.8" ]
 [project]
 # Docs: https://packaging.python.org/en/latest/guides/writing-pyproject-toml/
 name = "repomatic"
-version = "7.6.0"
+version = "7.8.0"
 description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 readme = "readme.md"
 keywords = [
@@ -145,7 +145,7 @@ dependencies = [
 ]
 urls.Changelog = "https://github.com/kdeldycke/repomatic/blob/main/changelog.md"
 urls.Documentation = "https://kdeldycke.github.io/repomatic"
-urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.6.0"
+urls.Download = "https://github.com/kdeldycke/repomatic/releases/tag/v7.8.0"
 urls.Funding = "https://github.com/sponsors/kdeldycke"
 urls.Homepage = "https://github.com/kdeldycke/repomatic"
 urls.Issues = "https://github.com/kdeldycke/repomatic/issues"
@@ -250,7 +250,7 @@ copyright = "Kevin Deldycke <kevin@deldycke.com> and contributors. Distributed u
 file-description = "🏭 Automate repository maintenance, releases, and CI/CD workflows"
 # Numeric only: Nuitka rejects PEP 440 .devN suffixes. Kept in sync with the
 # package version by the dedicated [tool.bumpversion] rule that strips the suffix.
-file-version = "7.6.0"
+file-version = "7.8.0"
 include-data-dir = [
   "repomatic/data/awesome_template=repomatic/data/awesome_template",
   "repomatic/data/skills=repomatic/data/skills",
@@ -269,7 +269,7 @@ include-package-data = [ "click_extra" ]
 linux-icon = "docs/assets/icon.png"
 macos-app-icon = "docs/assets/icon.icns"
 product-name = "Repomatic"
-product-version = "7.6.0"
+product-version = "7.8.0"
 windows-icon-from-ico = "docs/assets/icon.ico"
 
 [tool.ruff]
@@ -310,8 +310,11 @@ output-prefer-rule-codes = true
 [tool.typos]
 default.extend-identifiers = { Github = "GitHub", IOS = "iOS", Javascript = "JavaScript", MacOS = "macOS", PNGs = "PNGs", PyPi = "PyPI", Typescript = "TypeScript" }
 # False positives. "Contribuer" is the French for "Contributing", part of the
-# translated-readme fixture in tests/test_awesome_toc.py.
-default.extend-words = { astroid = "astroid", Contribuer = "Contribuer", oject = "oject", PNGs = "PNGs", sur = "sur" }
+# translated-readme fixture in tests/test_awesome_toc.py. "quater" is the fourth
+# term of the Latin ordinal series numbering the repo-lint checks (bis, ter,
+# quater), not a misspelling of "quarter": the unattended fix-typos job rewrote
+# it once already and had to be reverted by hand.
+default.extend-words = { astroid = "astroid", Contribuer = "Contribuer", oject = "oject", PNGs = "PNGs", quater = "quater", sur = "sur" }
 # Skip content between <!-- typos:off --> and <!-- typos:on --> markers.
 default.extend-ignore-re = [
   "(?s)<!-- typos:off -->.*?<!-- typos:on -->",
@@ -392,10 +395,19 @@ xfail_strict = true
 # https://coverage.readthedocs.io/en/latest/config.html
 run.branch = true
 run.source = [ "repomatic" ]
+# Coverage ratchet: the suite fails below this. The matrix floor sits near
+# 81.6%, since the only cell-dependent tests (tests/test_sphinx_crossrefs.py)
+# run on Linux + Python 3.14 alone and push that cell *up*; the package holds
+# four platform-conditional lines total, so the OS spread is noise. ~1.6 points
+# of margin absorbs that without waving a real regression through.
+#
+# The `once-tests` workflow job overrides this to 0, covering ~22% on its own
+# by design. A focused local run trips it too, so pair those with `--no-cov`.
+report.fail_under = 80
 report.precision = 2
 
 [tool.bumpversion]
-current_version = "7.6.0"
+current_version = "7.8.0"
 # Parse versions with an optional .devN suffix (PEP 440).
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)(\\.dev(?P<dev>\\d+))?"
 serialize = [
@@ -522,4 +534,21 @@ pypi-package-history = [ "gha-utils", "repokit" ]
 # attached to every GitHub release by the engine's extra-assets job. The
 # marketplace at .claude-plugin/marketplace.json installs the plugin straight
 # from this asset, so a release missing it breaks `/plugin install`.
-release-assets = [ "repomatic-plugin.zip" ]
+release-assets = [ "repomatic-claude-plugin.zip" ]
+
+[tool.actionlint]
+# actionlint reads no pyproject section of its own: repomatic serializes this one
+# to a temporary YAML config and passes it via `--config-file`. `paths` keys are
+# globs relative to the repository root, and each `ignore` entry is a regular
+# expression matched against the error message.
+#
+# `github.job_workflow_sha` is a real context property, holding the commit SHA of
+# the reusable workflow file itself, which the tool-cache keys read so they do not
+# rotate on every caller commit. GitHub documents it only as an OIDC token claim,
+# never on the `github` context reference page, so actionlint's schema lacks it.
+# Drop this entry once rhysd/actionlint#671 ships in a release.
+#
+# The glob carries no dot on purpose: click-extra expands every dotted key of
+# `pyproject.toml`, and one starting with a dot makes it warn on each repomatic
+# invocation. `**` matches dot-directories, so `.github/workflows/` is covered.
+paths."**/workflows/*".ignore = [ 'property "job_workflow_sha" is not defined' ]

{repomatic-7.6.0 → repomatic-7.8.0}/readme.md

@@ -1,12 +1,11 @@
 <p align="center">
-  <img src="docs/assets/logo-banner.svg" alt="repomatic">
+  <img src="https://raw.githubusercontent.com/kdeldycke/repomatic/main/docs/assets/logo-banner.svg" alt="repomatic">
 </p>
 
 [![Last release](https://img.shields.io/pypi/v/repomatic.svg)](https://pypi.org/project/repomatic/)
 [![Python versions](https://img.shields.io/pypi/pyversions/repomatic.svg)](https://pypi.org/project/repomatic/)
 [![Downloads](https://static.pepy.tech/badge/repomatic/month)](https://pepy.tech/projects/repomatic)
 [![Unittests status](https://img.shields.io/github/actions/workflow/status/kdeldycke/repomatic/tests.yaml?branch=main&label=%F0%9F%94%AC%20Tests)](https://github.com/kdeldycke/repomatic/actions/workflows/tests.yaml?query=branch%3Amain)
-[![Coverage status](https://codecov.io/gh/kdeldycke/repomatic/branch/main/graph/badge.svg)](https://app.codecov.io/gh/kdeldycke/repomatic)
 [![Documentation status](https://img.shields.io/github/actions/workflow/status/kdeldycke/repomatic/docs.yaml?branch=main&label=%F0%9F%93%9A%20Docs)](https://github.com/kdeldycke/repomatic/actions/workflows/docs.yaml?query=branch%3Amain)
 
 A Python CLI and `pyproject.toml` configuration that let you **release Python packages multiple times a day with only 2-clicks**. Designed for `uv`-based Python projects, but usable for other projects too. Every step is a CLI command: reusable GitHub Actions workflows are only the trigger, so the same automation runs on your machine.
@@ -92,8 +91,11 @@ Check these projects to get real-life examples of usage and inspiration:
 - ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/meta-package-manager?label=%E2%AD%90&style=flat-square) [Meta Package Manager](https://github.com/kdeldycke/meta-package-manager) - A unifying CLI for multiple package managers.
 - ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/mail-deduplicate?label=%E2%AD%90&style=flat-square) [Mail Deduplicate](https://github.com/kdeldycke/mail-deduplicate) - A CLI to deduplicate similar emails.
 - ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/dotfiles?label=%E2%AD%90&style=flat-square) [dotfiles](https://github.com/kdeldycke/dotfiles) - macOS dotfiles for Python developers.
-- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/click-extra?label=%E2%AD%90&style=flat-square) [Click Extra](https://github.com/kdeldycke/click-extra) - Extra colorization and configuration loading for Click.
+- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/click-extra?label=%E2%AD%90&style=flat-square) [Click Extra](https://github.com/kdeldycke/click-extra) - Drop-in replacement for Click to make user-friendly and colorful CLI.
 - ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/repomatic?label=%E2%AD%90&style=flat-square) [repomatic](https://github.com/kdeldycke/repomatic) - Itself. Eat your own dog-food.
-- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/extra-platforms?label=%E2%AD%90&style=flat-square) [Extra Platforms](https://github.com/kdeldycke/extra-platforms) - Detect platforms and group them by family.
+- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/plumage?label=%E2%AD%90&style=flat-square) [Plumage](https://github.com/kdeldycke/plumage) - Clean and tidy theme for Pelican, the static site generator.
+- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/kevin-deldycke-blog?label=%E2%AD%90&style=flat-square) [Kevin Deldycke's blog](https://github.com/kdeldycke/kevin-deldycke-blog) - My personal blog, based on Pelican.
+- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/extra-platforms?label=%E2%AD%90&style=flat-square) [Extra Platforms](https://github.com/kdeldycke/extra-platforms) - Detect architectures, platforms, shells, terminals, CI systems and agents, grouped by family.
+- ![GitHub stars](https://img.shields.io/github/stars/kdeldycke/kdeldycke?label=%E2%AD%90&style=flat-square) [GitHub profile](https://github.com/kdeldycke/kdeldycke) - My GitHub profile page and short bio.
 
 Send a PR to add your project if you use repomatic.

{repomatic-7.6.0 → repomatic-7.8.0}/repomatic/__init__.py

@@ -17,5 +17,5 @@
 
 from __future__ import annotations
 
-__version__ = "7.6.0"
-__git_tag_sha__ = "07e3ef8ae5685c7dfc4af43001b6fc67501396b1"
+__version__ = "7.8.0"
+__git_tag_sha__ = "ab43527b67361553b1c8539e8f3d9e6e2013b98c"

{repomatic-7.6.0 → repomatic-7.8.0}/repomatic/__main__.py

@@ -35,21 +35,22 @@ from repomatic.cli import repomatic
 
 
 def main():
-    """Execute the CLI but force its name to not let Click defaults to:
+    """Execute the CLI under its canonical name, whatever the entry point.
+
+    Without `prog_name`, Click derives the displayed name from the invocation:
 
     ```{code-block} shell-session
     $ python -m repomatic --version
     python -m repomatic, version 4.0.0
     ```
 
-    Indirection via this `main()` method was [required to reconcile](https://github.com/python-poetry/poetry/issues/5981):
-
-        - plain inline package call: `python -m repomatic`,
-        - Poetry's script entry point: `repomatic = 'repomatic.__main__:main`,
-        - Nuitka's main module invocation requirement:
-          `python -m nuitka (...) repomatic/__main__.py`
+    The `main()` indirection lets three invocation styles share one entry
+    point rendering the same name:
 
-    That way we can deduce all three cases from the entry point.
+    - the plain module call: `python -m repomatic`,
+    - the `[project.scripts]` console script: `repomatic = "repomatic.__main__:main"`,
+    - Nuitka's main-module compilation requirement:
+      `python -m nuitka (...) repomatic/__main__.py`.
     """
     repomatic(prog_name=repomatic.name)
 

repomatic-7.8.0/repomatic/attestation.py

@@ -0,0 +1,189 @@
+# Copyright Kevin Deldycke <kevin@deldycke.com> and contributors.
+#
+# This program is Free Software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+
+"""Naming and packing of the sigstore bundles attached to a release.
+
+`actions/attest` writes every bundle to the same `attestation.json` basename,
+whatever it signed, so each release job has to rename its own before the files
+land in one directory. Three of them did, three different ways: the compiled
+binaries appended the suffix to the full filename, the man-page tarball dropped
+its `.tar.gz` first, and the consumer-declared extra assets were named after the
+*job* rather than any file. A release page therefore carried
+`repomatic-manpages.attestation.json` next to `repomatic-manpages.tar.gz`, and
+`repomatic-extra-assets.attestation.json` next to `repomatic-claude-plugin.zip`.
+
+This module holds the one rule instead: a bundle is named after the artifact it
+attests. The subject list is read back out of the bundle rather than passed in,
+so the name is derived from what was actually signed and no caller can spell it
+differently. See {func}`bundle_filename` for the multi-subject case.
+
+```{note}
+The signing itself stays in `actions/attest`: it needs the job's OIDC token, so
+it cannot move here. This module runs immediately after it, in the same job.
+```
+"""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import json
+import shutil
+from pathlib import Path
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Sequence
+    from typing import Final
+
+ATTESTATION_SUFFIX: Final[str] = ".attestation.json"
+"""Extension carried by every attestation bundle attached to a release.
+
+Not `.sigstore.json` (the ecosystem's own convention) because these files have
+been published under this name since the first attested release, and a release
+asset name is part of the surface users script against.
+"""
+
+
+def bundle_subjects(bundle_path: Path) -> tuple[str, ...]:
+    """Filenames of the artifacts a sigstore bundle attests.
+
+    A bundle wraps a DSSE envelope whose base64 payload is an in-toto
+    Statement, and that statement's `subject` array names every file signed in
+    the same call. One entry for a single `subject-path`, several when
+    `actions/attest` was handed a glob: "If multiple subjects are being attested
+    at the same time, a single attestation will be created with references to
+    each of the supplied subjects."
+
+    :param bundle_path: The bundle `actions/attest` wrote.
+    :return: Subject filenames, in the order the statement lists them.
+    :raises ValueError: If the file is not a bundle carrying a readable
+        in-toto statement, or names a subject that is not a bare filename.
+    """
+    try:
+        bundle = json.loads(bundle_path.read_text(encoding="UTF-8"))
+    except json.JSONDecodeError as exc:
+        raise ValueError(f"{bundle_path} is not valid JSON: {exc}") from exc
+
+    payload = (bundle.get("dsseEnvelope") or {}).get("payload")
+    if not payload:
+        raise ValueError(
+            f"{bundle_path} carries no DSSE envelope payload: not an "
+            "attestation bundle."
+        )
+    # A payload that is not a base64 string lands in the same basket as one
+    # that is unreadable, so callers only ever catch ValueError here.
+    try:
+        statement = json.loads(base64.b64decode(payload, validate=True))
+    except (
+        TypeError,
+        binascii.Error,
+        UnicodeDecodeError,
+        json.JSONDecodeError,
+    ) as exc:
+        raise ValueError(f"{bundle_path} has an unreadable payload: {exc}") from exc
+
+    subjects = statement.get("subject")
+    if not isinstance(subjects, list) or not subjects:
+        raise ValueError(f"{bundle_path} attests no subject.")
+
+    names = []
+    for subject in subjects:
+        name = subject.get("name") if isinstance(subject, dict) else None
+        if not isinstance(name, str) or not name:
+            raise ValueError(f"{bundle_path} has a subject with no name.")
+        # A subject name is a bare filename everywhere the release lane
+        # produces one. Reject a path so the join in pack_attestation below
+        # cannot be walked out of the asset directory.
+        if Path(name).name != name:
+            raise ValueError(
+                f"{bundle_path} names subject {name!r}, which is not a bare filename."
+            )
+        names.append(name)
+    return tuple(names)
+
+
+def bundle_filename(subjects: Sequence[str], set_name: str | None = None) -> str:
+    """Name a bundle after the artifact it attests.
+
+    A single subject gives the bundle its own name, suffix appended to the
+    whole filename so the two sort together on a release page listing assets
+    alphabetically (`papaya.tar.gz`, then `papaya.tar.gz.attestation.json`).
+
+    Several subjects have no such name to borrow, since one bundle covers them
+    all, so *set_name* is required and should describe the set rather than any
+    member of it. That case only arises when a job hands `actions/attest` a
+    glob.
+
+    :param subjects: Subject filenames, from {func}`bundle_subjects`.
+    :param set_name: Stem to use when *subjects* holds more than one entry.
+    :return: The bundle's filename.
+    :raises ValueError: If *subjects* is empty, or holds several entries with
+        no *set_name* to fall back on.
+    """
+    if not subjects:
+        raise ValueError("Cannot name a bundle that attests no subject.")
+    if len(subjects) == 1:
+        return f"{subjects[0]}{ATTESTATION_SUFFIX}"
+    if not set_name:
+        raise ValueError(
+            f"Bundle attests {len(subjects)} subjects "
+            f"({', '.join(sorted(subjects))}), so it cannot be named after any "
+            "one of them: pass --name to name the set."
+        )
+    return f"{set_name}{ATTESTATION_SUFFIX}"
+
+
+def pack_attestation(
+    bundle_path: Path,
+    asset_dir: Path,
+    set_name: str | None = None,
+) -> list[Path]:
+    """Name a bundle after its subject and print what to upload with it.
+
+    Copies *bundle_path* into *asset_dir* under the name
+    {func}`bundle_filename` derives, then returns that bundle alongside every
+    artifact it attests, which is exactly the file list the release upload step
+    has to attach for the provenance to be verifiable offline.
+
+    Every subject must already sit in *asset_dir*: a bundle naming a file that
+    is not there means the job attested a different tree than the one it is
+    about to upload, which would publish an asset whose sidecar covers
+    something else. Immutable releases make that unfixable after the fact, so
+    it fails here instead.
+
+    Idempotent: re-running copies the same bytes over the same name.
+
+    :param bundle_path: The bundle `actions/attest` wrote.
+    :param asset_dir: Directory holding the attested artifacts.
+    :param set_name: Stem for the multi-subject case, see
+        {func}`bundle_filename`.
+    :return: Sorted paths to upload, the renamed bundle included.
+    :raises ValueError: If a subject is missing from *asset_dir*.
+    """
+    subjects = bundle_subjects(bundle_path)
+    assets = [asset_dir / name for name in subjects]
+
+    missing = [path.name for path in assets if not path.is_file()]
+    if missing:
+        raise ValueError(
+            f"{bundle_path} attests {', '.join(sorted(missing))}, missing from "
+            f"{asset_dir}."
+        )
+
+    target = asset_dir / bundle_filename(subjects, set_name)
+    shutil.copy2(bundle_path, target)
+    return sorted({*assets, target})

{repomatic-7.6.0 → repomatic-7.8.0}/repomatic/awesome_toc.py

@@ -235,7 +235,7 @@ def fix_awesome_toc(root: Path | None = None) -> dict[Path, list[str]]:
     reference = root / REFERENCE_README
     reference_headings: list[str] | None = None
     if reference.is_file():
-        reference_headings = headings(reference.read_text(encoding="utf-8"))
+        reference_headings = headings(reference.read_text(encoding="UTF-8"))
     else:
         logging.warning(
             f"No {REFERENCE_README} in {root}: translations can only be matched "
@@ -244,13 +244,13 @@ def fix_awesome_toc(root: Path | None = None) -> dict[Path, list[str]]:
 
     report: dict[Path, list[str]] = {}
     for readme in _readmes(root):
-        content = readme.read_text(encoding="utf-8")
+        content = readme.read_text(encoding="UTF-8")
         forbidden = forbidden_headings_for(content, reference_headings)
         updated, removed = strip_toc_entries(content, forbidden)
         if not removed:
             logging.debug(f"No forbidden ToC entry in {readme}.")
             continue
-        readme.write_text(updated, encoding="utf-8")
+        readme.write_text(updated, encoding="UTF-8")
         logging.info(f"Removed {len(removed)} ToC entries from {readme}.")
         report[readme] = removed
     return report

{repomatic-7.6.0 → repomatic-7.8.0}/repomatic/binaries_page.py

@@ -57,7 +57,8 @@ from pathlib import Path
 
 from click_extra.blocks import replace_region
 
-from .binary import NUITKA_BUILD_TARGETS
+from .binary import BINARY_ASSET_SUFFIXES, NUITKA_BUILD_TARGETS
+from .bundle import get_data_content
 from .github.releases import parse_release_version
 from .virustotal import VIRUSTOTAL_GUI_URL
 
@@ -68,11 +69,21 @@ if TYPE_CHECKING:
     from .github.releases import ReleaseAsset, ReleaseWithAssets
     from .virustotal import ScanRecord
 
-BINARY_ASSET_SUFFIXES = (".bin", ".exe")
-"""File extensions identifying compiled binaries among release assets.
+CHART_JS_URL = "https://cdn.jsdelivr.net/npm/chart.js@4.5.0/dist/chart.umd.min.js"
+"""Pinned CDN artifact drawing the detections trend chart.
 
-Same set the `scan-virustotal` command uploads and the release workflow
-downloads (`--pattern` flags in `_release-engine.yaml`).
+The one external artifact this module publishes into every downstream
+repository's docs, so it carries a checksum beside the pin: bump the version
+by hand together with {data}`CHART_JS_SRI`.
+"""
+
+CHART_JS_SRI = "sha384-XcdcwHqIPULERb2yDEM4R0XaQKU3YnDsrTmjACBZyfdVVqjh6xQ4/DCMd7XLcA6Y"
+"""Subresource Integrity digest of {data}`CHART_JS_URL`.
+
+The browser refuses the script if the CDN bytes stop matching. Recompute on
+every version bump as the sha384 of the exact artifact, verified against the
+same file inside the npm registry tarball before trusting the CDN copy:
+`hashlib.sha384(artifact_bytes)` then base64.
 """
 
 CSV_HEADERS = (
@@ -186,13 +197,14 @@ def _binary_assets(release: ReleaseWithAssets) -> list[ReleaseAsset]:
     """Return the release's compiled binaries, sorted by filename.
 
     Releases also carry versionless alias copies of each binary, backing the
-    stable ``releases/latest/download`` URLs (see the upload step in
-    ``_release-engine.yaml``). An alias shares its digest with its versioned
-    sibling: collapse each digest group onto its longest name (the versioned
-    one, since the alias is that same name minus the version segment) so the
-    catalog lists each binary once. Assets without a recorded digest
-    (uploaded before GitHub started recording them, mid-2025) predate the
-    aliases and are kept as-is.
+    stable ``releases/latest/download`` URLs (created by
+    {func}`~repomatic.binary.pack_binary_assets`, which
+    `release-assets` runs in the release engine). An alias shares its digest
+    with its versioned sibling: collapse each digest group onto its longest
+    name (the versioned one, since {func}`~repomatic.binary.versionless_alias`
+    only ever strips the version segment) so the catalog lists each binary
+    once. Assets without a recorded digest (uploaded before GitHub started
+    recording them, mid-2025) predate the aliases and are kept as-is.
     """
     binaries = [a for a in release.assets if a.name.endswith(BINARY_ASSET_SUFFIXES)]
     digest_groups: dict[str, list[ReleaseAsset]] = {}
@@ -275,6 +287,15 @@ def render_chart_section(records: Sequence[ScanRecord]) -> str:
         ],
         sort_keys=True,
     )
+    # The chart script ships as a bundled data file so it reads (and lints) as
+    # JavaScript instead of sixty quoted Python strings. Placeholder tokens are
+    # substituted with str.replace, never str.format: the script is full of
+    # literal braces.
+    script = (
+        get_data_content("vt-trend-chart.js")
+        .replace("__VT_TREND_PAYLOAD__", payload)
+        .replace("__VT_DANGER_PCT__", str(FLAGGED_DANGER_PCT))
+    )
     return (
         "## VirusTotal detections\n\n"
         "Share of antivirus engine verdicts flagging the binaries of each "
@@ -283,62 +304,9 @@ def render_chart_section(records: Sequence[ScanRecord]) -> str:
         "there up.\n\n"
         "```{raw} html\n"
         '<div style="height: 320px;"><canvas id="vt-trend"></canvas></div>\n'
-        '<script src="https://cdn.jsdelivr.net/npm/chart.js@4.5.0/dist/'
-        'chart.umd.min.js"></script>\n'
-        "<script>\n"
-        f"const VT_TREND = {payload};\n"
-        f"const VT_DANGER_PCT = {FLAGGED_DANGER_PCT};\n"
-        "const vtCss = getComputedStyle(document.documentElement);\n"
-        "const vtColor = (name, fallback) =>\n"
-        "    vtCss.getPropertyValue(name).trim() || fallback;\n"
-        "const vtTint = (p) => {\n"
-        '    if (p.pct === 0) { return vtColor("--sd-color-success", "#28a745"); }\n'
-        "    return p.pct >= VT_DANGER_PCT\n"
-        '        ? vtColor("--sd-color-danger", "#dc3545")\n'
-        '        : vtColor("--sd-color-warning", "#f0b37e");\n'
-        "};\n"
-        'new Chart(document.getElementById("vt-trend"), {\n'
-        '    type: "line",\n'
-        "    data: {\n"
-        "        datasets: [{\n"
-        "            data: VT_TREND.map((p) => ({x: Date.parse(p.date), y: p.pct})),\n"
-        '            borderColor: "#88888866",\n'
-        "            pointBackgroundColor: VT_TREND.map(vtTint),\n"
-        "            pointBorderColor: VT_TREND.map(vtTint),\n"
-        "            pointRadius: 4,\n"
-        "            tension: 0.2,\n"
-        "        }],\n"
-        "    },\n"
-        "    options: {\n"
-        "        maintainAspectRatio: false,\n"
-        "        plugins: {\n"
-        "            legend: {display: false},\n"
-        "            tooltip: {callbacks: {\n"
-        "                title: (items) => VT_TREND[items[0].dataIndex].tag,\n"
-        "                label: (item) => {\n"
-        "                    const p = VT_TREND[item.dataIndex];\n"
-        '                    return p.flagged + " / " + p.total\n'
-        '                        + " verdicts flagged (" + p.pct + "%)";\n'
-        "                },\n"
-        "            }},\n"
-        "        },\n"
-        "        scales: {\n"
-        "            x: {\n"
-        '                type: "linear",\n'
-        "                ticks: {\n"
-        "                    maxTicksLimit: 8,\n"
-        "                    callback: (value) =>\n"
-        "                        new Date(value).toISOString().slice(0, 10),\n"
-        "                },\n"
-        "            },\n"
-        "            y: {\n"
-        "                beginAtZero: true,\n"
-        '                title: {display: true, text: "Flagged verdicts (%)"},\n'
-        "            },\n"
-        "        },\n"
-        "    },\n"
-        "});\n"
-        "</script>\n"
+        f'<script src="{CHART_JS_URL}" integrity="{CHART_JS_SRI}" '
+        'crossorigin="anonymous"></script>\n'
+        f"<script>\n{script}</script>\n"
         "```"
     )