safereach 0.1.0__tar.gz

safereach-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  push: { branches: [main] }
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv python install ${{ matrix.python }}
+      - run: uv venv --python ${{ matrix.python }}
+      - run: uv pip install -e ".[dev]"
+      # The spec linter runs first: it fails the build if the allowlist ever permits a
+      # mutating verb, which is cheaper to learn before the rest of the suite runs.
+      - run: uv run pytest tests/test_spec_lint.py -q
+      - run: uv run pytest -q
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run python shim/build.py
+
+  # A single stable check name to require in branch protection.
+  #
+  # The matrix above produces `test (3.11)`, `test (3.12)`, `test (3.13)` — three names
+  # that change whenever the matrix does, and a required check that no longer exists
+  # silently stops gating anything. This job is one name that never changes.
+  #
+  # `if: always()` matters: without it, a skipped or failed matrix leg would leave this
+  # job skipped, and GitHub treats a skipped required check as passing.
+  ci-ok:
+    needs: test
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: All matrix legs must have succeeded
+        run: |
+          echo "test result: ${{ needs.test.result }}"
+          [ "${{ needs.test.result }}" = "success" ] || exit 1

safereach-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,125 @@
+name: Publish
+
+# Trusted Publishing (OIDC) — no API token is stored anywhere. GitHub mints a
+# short-lived identity token for this workflow, and PyPI accepts it only for the exact
+# repository, workflow filename and environment configured on the PyPI side.
+#
+# That is why the `environment:` key below matters: PyPI checks it. If it does not match
+# the "Environment name" on the trusted publisher, the upload is rejected — which is the
+# point. It means a workflow added to some other branch cannot publish.
+
+# Publishing is a deliberate act, run from `main`.
+#
+# The environment's deployment-branch rule is evaluated against the ref that triggered
+# the run. A GitHub Release runs on the TAG ref, not on `main` — so an environment
+# restricted to `main` would block every release with a fairly opaque message. Triggering
+# from workflow_dispatch on `main` keeps the trigger and the rule in agreement.
+#
+# Cut the GitHub Release afterwards for the changelog; it no longer drives publishing.
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: "Where to publish"
+        required: true
+        default: pypi
+        type: choice
+        options: [pypi, testpypi]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+
+      # The tag and pyproject version must agree. Tagging v0.2.0 while pyproject still
+      # says 0.1.0 otherwise builds and uploads 0.1.0 under a 0.2.0 release — or fails
+      # much later with "file already exists", which reads like an infrastructure problem
+      # rather than the version bump you forgot.
+      - name: Must be publishing from main
+        run: |
+          [ "$GITHUB_REF_NAME" = "main" ] || {
+            echo "::error::publish only from main (got $GITHUB_REF_NAME)"
+            exit 1
+          }
+
+      # PyPI versions are immutable: a published 0.1.0 can never be replaced, only
+      # yanked. Failing here is far cheaper than burning a version number.
+      - name: Version must not already be on PyPI
+        if: inputs.target == 'pypi'
+        run: |
+          PKG=$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' "https://pypi.org/pypi/safereach/$PKG/json")
+          [ "$CODE" = "404" ] || {
+            echo "::error::safereach $PKG is already published — bump the version"
+            exit 1
+          }
+
+      - run: uv python install 3.11
+      - run: uv venv --python 3.11
+      - run: uv pip install -e ".[dev]"
+
+      # Never ship a release that fails its own tests. The spec linter runs first: it
+      # fails the build if the allowlist ever permits a mutating verb.
+      - name: Spec linter
+        run: uv run pytest tests/test_spec_lint.py -q
+      - name: Full suite
+        run: uv run pytest -q
+      - name: Lint
+        run: uv run ruff check .
+
+      - name: Build sdist and wheel
+        run: uv build
+
+      # PyPI rejects a malformed long_description at upload time; catching it here is
+      # the one gap that skipping TestPyPI would otherwise leave.
+      - name: README must render on PyPI
+        run: uv run --with twine twine check dist/*
+
+      # A wheel that imports but cannot find its packaged commands.yaml is useless, and
+      # that failure only shows up outside the source tree.
+      - name: Smoke-test the built wheel in a clean environment
+        run: |
+          uv venv /tmp/verify
+          uv pip install --python /tmp/verify/bin/python dist/*.whl
+          /tmp/verify/bin/safereach --help
+          /tmp/verify/bin/safereach validate "journalctl -u nginx -n 5"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish-testpypi:
+    needs: build
+    if: inputs.target == 'testpypi'
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/safereach
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: dist, path: dist }
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  publish-pypi:
+    needs: build
+    if: inputs.target == 'pypi'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/safereach
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: dist, path: dist }
+      - uses: pypa/gh-action-pypi-publish@release/v1

safereach-0.1.0/.gitignore

@@ -0,0 +1,14 @@
+*.bak-*
+build/
+.coverage
+dist/
+docs/
+*.egg-info/
+hosts.yaml
+htmlcov/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+shim/dist/
+.venv/

safereach-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 imtiaz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.