safeuploads 0.1.2__tar.gz → 1.0.1__tar.gz

safeuploads-1.0.1/.forgejo/scripts/check_conventional_commits.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""Validate that messages follow the Conventional Commits 1.0.0 specification.
+
+Reads one or more messages (either from CLI arguments or, when ``--stdin`` is
+passed, one message per line from standard input) and exits non-zero if any of
+them is invalid.
+
+Spec reference: https://www.conventionalcommits.org/en/v1.0.0/
+
+Usage::
+
+    check_conventional_commits.py "feat(api): add endpoint"
+    git log --format=%s base..head | check_conventional_commits.py --stdin
+
+Designed to run with the Python interpreter already available on the Forgejo
+runner image. Uses only the standard library so there is no third-party
+supply-chain surface.
+"""
+
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from collections.abc import Iterable
+
+# Allowed types. This whitelist is a *project policy* layered on top of the
+# Conventional Commits 1.0.0 spec (the spec recommends but does not mandate a
+# fixed set of types). Keep this list in sync with the project's commit
+# conventions documented in ``.github/copilot-instructions.md``.
+#
+# Per the spec, types are matched case-insensitively.
+ALLOWED_TYPES: tuple[str, ...] = (
+    "build",
+    "chore",
+    "ci",
+    "docs",
+    "feat",
+    "fix",
+    "perf",
+    "refactor",
+    "revert",
+    "style",
+    "test",
+)
+
+# Subject pattern: ``type(scope)!: description``. Scope and ``!`` are optional.
+# Per CC 1.0.0:
+#   - the type is a noun (matched case-insensitively against ALLOWED_TYPES);
+#   - the scope is any noun describing a section of the codebase, enclosed in
+#     parentheses, so we accept any non-empty string that is not a closing
+#     parenthesis;
+#   - the description is free-form text.
+_HEADER_RE = re.compile(
+    r"""
+    ^
+    (?P<type>[A-Za-z]+)
+    (?:\((?P<scope>[^)]+)\))?
+    (?P<breaking>!)?
+    :\ 
+    (?P<description>.+?)
+    \s*$
+    """,
+    re.VERBOSE,
+)
+
+
+def _validate_message(message: str) -> list[str]:
+    """Return a list of validation errors for ``message`` (empty if valid)."""
+    errors: list[str] = []
+
+    # Conventional Commits only constrains the first line (the header).
+    header = message.splitlines()[0] if message else ""
+
+    if not header.strip():
+        return ["message is empty"]
+
+    match = _HEADER_RE.match(header)
+    if match is None:
+        errors.append(
+            "header does not match '<type>(<scope>)!: <description>' "
+            "(see https://www.conventionalcommits.org/en/v1.0.0/)"
+        )
+        return errors
+
+    commit_type = match.group("type")
+
+    # Project policy: restrict to a known set of types. Types are matched
+    # case-insensitively per the Conventional Commits spec.
+    if commit_type.lower() not in ALLOWED_TYPES:
+        errors.append(
+            f"type '{commit_type}' is not allowed; "
+            f"use one of: {', '.join(ALLOWED_TYPES)}"
+        )
+
+    return errors
+
+
+def _safe_log_value(value: str) -> str:
+    """Return ``value`` escaped for safe CI log output."""
+    return value.encode("unicode_escape").decode("ascii")
+
+
+def _iter_messages(args: argparse.Namespace) -> Iterable[str]:
+    if args.stdin:
+        for line in sys.stdin:
+            stripped = line.rstrip("\n")
+            if stripped:
+                yield stripped
+    else:
+        yield from args.messages
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        description="Validate Conventional Commits headers.",
+    )
+    parser.add_argument(
+        "messages",
+        nargs="*",
+        help="One or more commit messages (or PR titles) to validate.",
+    )
+    parser.add_argument(
+        "--stdin",
+        action="store_true",
+        help="Read messages from standard input, one per line.",
+    )
+    args = parser.parse_args(argv)
+
+    if not args.stdin and not args.messages:
+        parser.error("provide at least one message or use --stdin")
+
+    failures = 0
+    checked = 0
+    for message in _iter_messages(args):
+        checked += 1
+        errors = _validate_message(message)
+        safe_message = _safe_log_value(message)
+        if errors:
+            failures += 1
+            print(f"INVALID: {safe_message}", file=sys.stderr)
+            for err in errors:
+                print(f"  - {err}", file=sys.stderr)
+        else:
+            print(f"OK: {safe_message}")
+
+    if checked == 0:
+        print("No messages to validate.", file=sys.stderr)
+        return 1
+
+    if failures:
+        print(
+            f"\n{failures} of {checked} message(s) failed Conventional Commits "
+            "validation.",
+            file=sys.stderr,
+        )
+        return 1
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

safeuploads-1.0.1/.forgejo/workflows/conventional-commits.yml

@@ -0,0 +1,44 @@
+name: Conventional Commits
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ forgejo.workflow }}-${{ forgejo.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: codeberg-small
+
+    steps:
+      - name: Checkout code
+        uses: https://data.forgejo.org/actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Validate PR title
+        # The PR title is passed through an environment variable to prevent
+        # shell injection via crafted titles (see security-and-owasp guidelines).
+        env:
+          PR_TITLE: ${{ forgejo.event.pull_request.title }}
+        run: |
+          python3 .forgejo/scripts/check_conventional_commits.py "$PR_TITLE"
+
+      - name: Validate commits in PR
+        # Validates every commit subject between the PR base and head. Use the
+        # base/head SHAs from the event payload so we don't depend on the local
+        # checkout ref layout.
+        env:
+          BASE_SHA: ${{ forgejo.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ forgejo.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin "$BASE_SHA" "$HEAD_SHA"
+          git log --format=%s "$BASE_SHA".."$HEAD_SHA" \
+            | python3 .forgejo/scripts/check_conventional_commits.py --stdin

safeuploads-1.0.1/.forgejo/workflows/docs.yml

@@ -0,0 +1,51 @@
+name: Deploy documentation
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+      - master
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'safeuploads/**/*.py'
+      - '.forgejo/workflows/docs.yml'
+
+permissions:
+  contents: write
+
+concurrency:
+  group: ${{ forgejo.workflow }}-${{ forgejo.ref }}
+  cancel-in-progress: true
+
+jobs:
+
+  deploy:
+
+    runs-on: codeberg-small
+
+    steps:
+      - name: Checkout code
+        uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: https://data.forgejo.org/actions/setup-python@v5
+        with:
+          python-version: '3.13'
+          cache: pip
+
+      - name: Install documentation dependencies
+        run: pip install mkdocs-material mkdocstrings[python]
+
+      - name: Build documentation
+        run: mkdocs build --site-dir site
+
+      - name: Deploy documentation to Codeberg Pages
+        uses: https://codeberg.org/git-pages/action@v2
+        with:
+          site: https://${{ forge.repository_owner }}.codeberg.page/${{ forge.event.repository.name }}/
+          token: ${{ forge.token }}
+          source: site/

safeuploads-1.0.1/.forgejo/workflows/fuzz.yml

@@ -0,0 +1,44 @@
+name: Scheduled Fuzz
+
+on:
+  schedule:
+    # Every Sunday at 03:00 UTC
+    - cron: "0 3 * * 0"
+  workflow_dispatch:
+
+# Cancel in-progress runs for the same branch to avoid wasted
+# runner minutes.
+concurrency:
+  group: ${{ forge.workflow }}-${{ forge.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    name: Fuzz
+    runs-on: codeberg-medium-lazy
+
+    steps:
+      - name: Checkout repository
+        uses: https://data.forgejo.org/actions/checkout@v4
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libmagic1
+
+      - name: Set up Python 3.13
+        uses: https://data.forgejo.org/actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install uv
+        run: pip install uv
+
+      - name: Install dependencies
+        run: uv sync --frozen --dev
+
+      - name: Run fuzz tests
+        run: >
+          uv run pytest -m fuzz
+          --hypothesis-seed=0
+          -x
+          --tb=short
+          -q

safeuploads-1.0.1/.forgejo/workflows/lint-and-test.yml

@@ -0,0 +1,86 @@
+name: Lint & Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Cancel in-progress runs for the same branch/PR to avoid wasted
+# runner minutes and race conditions on shared resources.
+concurrency:
+  group: ${{ forge.workflow }}-${{ forge.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ----------------------------------------------------------------
+  # Lint
+  # Runs ruff on all Python sources. Fails fast so test job is only
+  # triggered when the code is clean.
+  # ----------------------------------------------------------------
+  lint:
+    name: Lint
+    runs-on: codeberg-tiny
+
+    steps:
+      - name: Checkout repository
+        uses: https://data.forgejo.org/actions/checkout@v4
+
+      - name: Set up Python 3.13
+        uses: https://data.forgejo.org/actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install uv
+        run: pip install uv
+
+      - name: Install dependencies
+        run: uv sync --frozen --dev
+
+      - name: Lint with ruff
+        run: uv run ruff check safeuploads tests examples
+
+      - name: Check formatting with ruff
+        run: uv run ruff format --check safeuploads tests examples
+
+  # ----------------------------------------------------------------
+  # Test
+  # Runs the full pytest suite with coverage. Only runs after lint
+  # passes so we don't waste runner minutes on broken code.
+  # ----------------------------------------------------------------
+  test:
+    name: Test
+    runs-on: codeberg-medium
+    needs: lint
+
+    steps:
+      - name: Checkout repository
+        uses: https://data.forgejo.org/actions/checkout@v4
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libmagic1
+
+      - name: Set up Python 3.13
+        uses: https://data.forgejo.org/actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install uv
+        run: pip install uv
+
+      - name: Install dependencies
+        run: uv sync --frozen --dev
+
+      - name: Audit Python dependencies
+        run: uvx pip-audit --require-hashes --disable-pip -r <(uv export --frozen --no-header --no-emit-project --no-dev)
+
+      - name: Run tests with coverage
+        run: uv run pytest --cov-fail-under=90
+
+      - name: Upload coverage report
+        uses: https://data.forgejo.org/forgejo/upload-artifact@v4
+        if: always()
+        with:
+          name: safeuploads-coverage
+          path: .coverage
+          retention-days: 7

safeuploads-1.0.1/.forgejo/workflows/publish.yml

@@ -0,0 +1,63 @@
+name: Publish to PyPI
+
+on:
+  workflow_dispatch:
+    inputs:
+      confirm:
+        description: "Type the package version to confirm publish"
+        required: true
+        type: string
+
+# Only one publish at a time.
+concurrency:
+  group: publish
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Build & Publish
+    runs-on: codeberg-medium
+
+    steps:
+      - name: Checkout repository
+        uses: https://data.forgejo.org/actions/checkout@v4
+
+      - name: Verify version matches input
+        run: |
+          PKG_VERSION=$(python3 -c "
+          import tomllib, pathlib
+          data = tomllib.loads(
+              pathlib.Path('pyproject.toml').read_text()
+          )
+          print(data['project']['version'])
+          ")
+          if [ "$PKG_VERSION" != "${{ inputs.confirm }}" ]; then
+            echo "::error::Input version ${{ inputs.confirm }} does not match pyproject.toml version $PKG_VERSION"
+            exit 1
+          fi
+          echo "Publishing version $PKG_VERSION"
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libmagic1
+
+      - name: Set up Python 3.13
+        uses: https://data.forgejo.org/actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install uv
+        run: pip install uv
+
+      - name: Install dependencies
+        run: uv sync --frozen --dev
+
+      - name: Run tests before publish
+        run: uv run pytest --cov-fail-under=90
+
+      - name: Build package
+        run: uv build
+
+      - name: Publish to PyPI
+        env:
+          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+        run: uv publish

safeuploads-1.0.1/.forgejo/workflows/renovate.yml

@@ -0,0 +1,37 @@
+name: Dependency updates
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 4 * * 0'
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+concurrency:
+  group: ${{ forgejo.workflow }}-${{ forgejo.ref }}
+  cancel-in-progress: false
+
+jobs:
+
+  renovate:
+
+    runs-on: codeberg-small
+
+    steps:
+      - name: Checkout code
+        uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Renovate
+        uses: docker://ghcr.io/renovatebot/renovate:latest
+        env:
+          LOG_LEVEL: info
+          RENOVATE_CONFIG_FILE: renovate.json
+          RENOVATE_ENDPOINT: https://codeberg.org/api/v1/
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_REPOSITORIES: ${{ forgejo.repository }}
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}