safeuploads 1.0.0__tar.gz → 1.1.0__tar.gz

safeuploads-1.1.0/.forgejo/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,35 @@
+---
+name: 🐞 Bug report
+about: Report a bug
+title: "[BUG]: "
+labels: [bug]
+assignees: ''
+---
+
+## Checklist
+
+- [ ] I have searched **existing issues** to make sure this bug hasn't already been reported.
+- [ ] I have checked the **documentation** at [https://safeuploads.endurain.com](https://safeuploads.endurain.com) and didn't find a solution.
+
+## Description
+
+Describe the bug you encountered.
+
+## Steps to Reproduce
+
+1. Version
+2. Go to '...'
+3. Click on '...'
+4. See error
+
+## Expected Behavior
+
+What did you expect to happen?
+
+## Screenshots, logs or files
+
+If applicable, add screenshots, logs or files to help explain your problem. If you do not wish to upload sensitive information to the issue you can send that info to [joao@endurain.com](joao@endurain.com).
+
+## Additional Context
+
+Add any other context about the problem here.

safeuploads-1.1.0/.forgejo/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 📚 Documentation
+    url: https://safeuploads.endurain.com
+    about: Please check our documentation before creating an issue.

safeuploads-1.1.0/.forgejo/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,27 @@
+---
+name: 💡 Feature request
+about: Suggest an idea or enhancement for this project
+title: "[FEATURE]: "
+labels: [enhancement]
+assignees: ''
+---
+
+## Summary
+
+Briefly describe the feature you'd like to see.
+
+## Motivation
+
+Why is this feature important? What problem does it solve?
+
+## Proposed Solution
+
+How would this feature work? Describe any ideas you have.
+
+## Alternatives
+
+Have you considered any alternatives?
+
+## Additional Context
+
+Add screenshots, mockups, or examples if relevant.

safeuploads-1.1.0/.forgejo/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,33 @@
+## What does this PR do?
+ 
+A clear description of the change.
+ 
+## Related issue
+ 
+Required for anything beyond a small bug fix or typo.
+Don't forget to reference the issue so it auto-closes works, for example use `Closes #XYZ`
+ 
+## Type of change
+ 
+Check all that apply
+ 
+- [ ] Bug fix
+- [ ] New feature (exception during freeze; link prior discussion/acknowledgment)
+- [ ] Documentation
+- [ ] Refactor / code quality
+- [ ] Translation
+- [ ] Other (describe below)
+
+## Checklist
+ 
+- [ ] This PR is focused on a single concern
+- [ ] An issue was opened and acknowledged before writing this code (if not a small fix)
+- [ ] If this PR introduces a new feature during freeze, it was discussed and explicitly acknowledged first
+- [ ] The PR is under ~300 lines changed, excluding lock files, migrations, and generated code
+- [ ] Tests have been added or updated where applicable
+- [ ] Documentation has been updated where applicable
+- [ ] Commit messages follow Conventional Commits format
+
+## Notes for the reviewer
+ 
+Anything that would help review this. Tricky areas, alternative approaches considered, screenshots, etc.

safeuploads-1.1.0/.forgejo/scripts/check_conventional_commits.py

@@ -0,0 +1,165 @@
+#!/usr/bin/env python3
+"""Validate that messages follow the Conventional Commits 1.0.0 specification.
+
+Reads one or more messages (either from CLI arguments or, when ``--stdin`` is
+passed, one message per line from standard input) and exits non-zero if any of
+them is invalid.
+
+Spec reference: https://www.conventionalcommits.org/en/v1.0.0/
+
+Usage::
+
+    check_conventional_commits.py "feat(api): add endpoint"
+    git log --format=%s base..head | check_conventional_commits.py --stdin
+
+Designed to run with the Python interpreter already available on the Forgejo
+runner image. Uses only the standard library so there is no third-party
+supply-chain surface.
+"""
+
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from collections.abc import Iterable
+
+# Allowed types. This whitelist is a *project policy* layered on top of the
+# Conventional Commits 1.0.0 spec (the spec recommends but does not mandate a
+# fixed set of types). Keep this list in sync with the project's commit
+# conventions documented in ``.github/copilot-instructions.md``.
+#
+# Per the spec, types are matched case-insensitively.
+ALLOWED_TYPES: tuple[str, ...] = (
+    "build",
+    "chore",
+    "ci",
+    "docs",
+    "feat",
+    "fix",
+    "perf",
+    "refactor",
+    "revert",
+    "style",
+    "test",
+)
+
+# Subject pattern: ``type(scope)!: description``. Scope and ``!`` are optional.
+# Per CC 1.0.0:
+#   - the type is a noun (matched case-insensitively against ALLOWED_TYPES);
+#   - the scope is any noun describing a section of the codebase, enclosed in
+#     parentheses, so we accept any non-empty string that is not a closing
+#     parenthesis;
+#   - the description is free-form text.
+_HEADER_RE = re.compile(
+    r"""
+    ^
+    (?P<type>[A-Za-z]+)
+    (?:\((?P<scope>[^)]+)\))?
+    (?P<breaking>!)?
+    :\x20
+    (?P<description>.+?)
+    \s*$
+    """,
+    re.VERBOSE,
+)
+
+
+def _validate_message(message: str) -> list[str]:
+    """Return a list of validation errors for ``message`` (empty if valid)."""
+    errors: list[str] = []
+
+    # Conventional Commits only constrains the first line (the header).
+    header = message.splitlines()[0] if message else ""
+
+    if not header.strip():
+        return ["message is empty"]
+
+    match = _HEADER_RE.match(header)
+    if match is None:
+        errors.append(
+            "header does not match '<type>(<scope>)!: <description>' "
+            "(see https://www.conventionalcommits.org/en/v1.0.0/)"
+        )
+        return errors
+
+    commit_type = match.group("type")
+
+    # Project policy: restrict to a known set of types. Types are matched
+    # case-insensitively per the Conventional Commits spec.
+    if commit_type.lower() not in ALLOWED_TYPES:
+        errors.append(
+            f"type '{commit_type}' is not allowed; "
+            f"use one of: {', '.join(ALLOWED_TYPES)}"
+        )
+
+    return errors
+
+
+def _safe_log_value(value: str) -> str:
+    """Return ``value`` escaped for safe CI log output."""
+    return value.encode("unicode_escape").decode("ascii")
+
+
+def _iter_messages(args: argparse.Namespace) -> Iterable[str]:
+    """Yield messages from stdin or CLI arguments."""
+    if args.stdin:
+        for line in sys.stdin:
+            stripped = line.rstrip("\n")
+            if stripped:
+                yield stripped
+    else:
+        yield from args.messages
+
+
+def main(argv: list[str] | None = None) -> int:
+    """Validate all messages and return a process exit code."""
+    parser = argparse.ArgumentParser(
+        description="Validate Conventional Commits headers.",
+    )
+    parser.add_argument(
+        "messages",
+        nargs="*",
+        help="One or more commit messages (or PR titles) to validate.",
+    )
+    parser.add_argument(
+        "--stdin",
+        action="store_true",
+        help="Read messages from standard input, one per line.",
+    )
+    args = parser.parse_args(argv)
+
+    if not args.stdin and not args.messages:
+        parser.error("provide at least one message or use --stdin")
+
+    failures = 0
+    checked = 0
+    for message in _iter_messages(args):
+        checked += 1
+        errors = _validate_message(message)
+        safe_message = _safe_log_value(message)
+        if errors:
+            failures += 1
+            print(f"INVALID: {safe_message}", file=sys.stderr)
+            for err in errors:
+                print(f"  - {err}", file=sys.stderr)
+        else:
+            print(f"OK: {safe_message}")
+
+    if checked == 0:
+        print("No messages to validate.", file=sys.stderr)
+        return 1
+
+    if failures:
+        print(
+            f"\n{failures} of {checked} message(s) failed "
+            "Conventional Commits validation.",
+            file=sys.stderr,
+        )
+        return 1
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

safeuploads-1.1.0/.forgejo/workflows/conventional-commits.yml

@@ -0,0 +1,40 @@
+name: Conventional Commits
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+concurrency:
+  group: ${{ forgejo.workflow }}-${{ forgejo.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: local-runner
+
+    steps:
+      - name: Checkout code
+        uses: https://data.forgejo.org/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Validate PR title
+        # The PR title is passed through an environment variable to prevent
+        # shell injection via crafted titles (see security-and-owasp guidelines).
+        env:
+          PR_TITLE: ${{ forgejo.event.pull_request.title }}
+        run: |
+          python3 .forgejo/scripts/check_conventional_commits.py "$PR_TITLE"
+
+      - name: Validate commits in PR
+        # Validates every commit subject between the PR base and head. Use the
+        # base/head SHAs from the event payload so we don't depend on the local
+        # checkout ref layout.
+        env:
+          BASE_SHA: ${{ forgejo.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ forgejo.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin "$BASE_SHA" "$HEAD_SHA"
+          git log --no-merges --format=%s "$BASE_SHA".."$HEAD_SHA" \
+            | python3 .forgejo/scripts/check_conventional_commits.py --stdin

safeuploads-1.1.0/.forgejo/workflows/docs.yml

@@ -0,0 +1,59 @@
+name: Deploy documentation
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: Build docs but do not deploy
+        required: false
+        default: false
+        type: boolean
+  push:
+    branches:
+      - main
+      - master
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'safeuploads/**/*.py'
+      - '.forgejo/workflows/docs.yml'
+
+concurrency:
+  group: ${{ forgejo.workflow }}-${{ forgejo.ref }}
+  cancel-in-progress: true
+
+jobs:
+
+  deploy:
+
+    runs-on: local-runner
+
+    steps:
+      - name: Checkout code
+        uses: https://data.forgejo.org/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: https://data.forgejo.org/astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          working-directory: .
+
+      - name: Sync documentation dependencies
+        working-directory: .
+        run: uv sync --frozen --only-group docs
+      - name: Build documentation
+        run: uv run --no-sync --project safeuploads mkdocs build --site-dir site
+
+      - name: Set dry-run mode
+        if: ${{ inputs.dry-run == true }}
+        run: echo "DOCS_DRY_RUN=true" >> "$FORGEJO_ENV"
+
+      - name: Deploy documentation to Codeberg Pages
+        if: env.DOCS_DRY_RUN != 'true'
+        uses: https://data.forgejo.org/actions/git-pages@5978530ffb9bbe196ad9fdc0c48fdaf1483de4cf # v2.1.0
+        with:
+          site: https://safeuploads.endurain.com/
+          server: codeberg.page
+          token: ${{ forge.token }}
+          source: site/

{safeuploads-1.0.0/.github → safeuploads-1.1.0/.forgejo}/workflows/fuzz.yml

@@ -9,35 +9,25 @@ on:
 # Cancel in-progress runs for the same branch to avoid wasted
 # runner minutes.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ forge.workflow }}-${{ forge.ref }}
   cancel-in-progress: true
 
-# Principle of least privilege: only read access by default.
-permissions:
-  contents: read
-
 jobs:
   fuzz:
     name: Fuzz
-    runs-on: ubuntu-latest
+    runs-on: local-runner
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: https://data.forgejo.org/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y libmagic1
-
-      - name: Set up Python 3.13
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.13"
+        run: apt-get update && apt-get install -y libmagic1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: https://data.forgejo.org/astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
-          enable-cache: true
-          cache-dependency-glob: "uv.lock"
+          working-directory: .
 
       - name: Install dependencies
         run: uv sync --frozen --dev

safeuploads-1.0.0/.github/workflows/lint&test.yml → safeuploads-1.1.0/.forgejo/workflows/lint-and-test.yml

@@ -9,13 +9,9 @@ on:
 # Cancel in-progress runs for the same branch/PR to avoid wasted
 # runner minutes and race conditions on shared resources.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ forge.workflow }}-${{ forge.ref }}
   cancel-in-progress: true
 
-# Principle of least privilege: only read access by default.
-permissions:
-  contents: read
-
 jobs:
   # ----------------------------------------------------------------
   # Lint
@@ -24,22 +20,18 @@ jobs:
   # ----------------------------------------------------------------
   lint:
     name: Lint
-    runs-on: ubuntu-latest
+    runs-on: codeberg-tiny
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up Python 3.13
-        uses: actions/setup-python@v6
+      - name: Checkout code
+        uses: https://data.forgejo.org/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          python-version: "3.13"
+          fetch-depth: 1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: https://data.forgejo.org/astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
-          enable-cache: true
-          cache-dependency-glob: "uv.lock"
+          working-directory: .
 
       - name: Install dependencies
         run: uv sync --frozen --dev
@@ -50,6 +42,9 @@ jobs:
       - name: Check formatting with ruff
         run: uv run ruff format --check safeuploads tests examples
 
+      - name: Type check with mypy
+        run: uv run mypy
+
   # ----------------------------------------------------------------
   # Test
   # Runs the full pytest suite with coverage. Only runs after lint
@@ -57,40 +52,34 @@ jobs:
   # ----------------------------------------------------------------
   test:
     name: Test
-    runs-on: ubuntu-latest
+    runs-on: local-runner
     needs: lint
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: https://data.forgejo.org/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y libmagic1
-
-      - name: Set up Python 3.13
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.13"
+        run: apt-get update && apt-get install -y libmagic1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: https://data.forgejo.org/astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
-          enable-cache: true
-          cache-dependency-glob: "uv.lock"
+          working-directory: .
 
       - name: Install dependencies
-        run: uv sync --frozen --dev
+        run: uv sync --frozen --dev --extra fastapi
 
       - name: Audit Python dependencies
-        run: uvx pip-audit --require-hashes --disable-pip -r <(uv export --frozen --no-header --no-emit-project)
+        run: uvx pip-audit --require-hashes --disable-pip -r <(uv export --frozen --no-header --no-emit-project --no-dev)
 
       - name: Run tests with coverage
         run: uv run pytest --cov-fail-under=90
 
       - name: Upload coverage report
-        uses: actions/upload-artifact@v7
+        uses: https://data.forgejo.org/forgejo/upload-artifact@v4
         if: always()
         with:
           name: safeuploads-coverage
           path: .coverage
-          retention-days: 7
+          retention-days: 7

{safeuploads-1.0.0/.github → safeuploads-1.1.0/.forgejo}/workflows/publish.yml

@@ -13,25 +13,22 @@ concurrency:
   group: publish
   cancel-in-progress: false
 
-permissions:
-  contents: read
-  id-token: write  # Required for trusted publishing (OIDC)
-
 jobs:
   publish:
     name: Build & Publish
-    runs-on: ubuntu-latest
-    environment: pypi
+    runs-on: local-runner
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: https://data.forgejo.org/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Verify version matches input
         run: |
           PKG_VERSION=$(python3 -c "
           import tomllib, pathlib
-          data = tomllib.loads(pathlib.Path('pyproject.toml').read_text())
+          data = tomllib.loads(
+              pathlib.Path('pyproject.toml').read_text()
+          )
           print(data['project']['version'])
           ")
           if [ "$PKG_VERSION" != "${{ inputs.confirm }}" ]; then
@@ -41,18 +38,12 @@ jobs:
           echo "Publishing version $PKG_VERSION"
 
       - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y libmagic1
-
-      - name: Set up Python 3.13
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.13"
+        run: apt-get update && apt-get install -y libmagic1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: https://data.forgejo.org/astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
-          enable-cache: true
-          cache-dependency-glob: "uv.lock"
+          working-directory: .
 
       - name: Install dependencies
         run: uv sync --frozen --dev
@@ -64,4 +55,6 @@ jobs:
         run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        env:
+          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+        run: uv publish

safeuploads-1.1.0/.forgejo/workflows/renovate.yml

@@ -0,0 +1,32 @@
+name: Dependency updates
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 4 * * 0'
+
+concurrency:
+  group: ${{ forgejo.workflow }}-${{ forgejo.ref }}
+  cancel-in-progress: false
+
+jobs:
+
+  renovate:
+
+    runs-on: local-runner
+
+    steps:
+      - name: Checkout code
+        uses: https://data.forgejo.org/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+
+      - name: Run Renovate
+        uses: docker://ghcr.io/renovatebot/renovate@sha256:38aac6e29e09288bc3fb3b95ba9445962508a1081013144d5b6ec5a6735707b9 # 43.168.5
+        env:
+          LOG_LEVEL: info
+          RENOVATE_CONFIG_FILE: renovate.json
+          RENOVATE_ENDPOINT: https://codeberg.org/api/v1/
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_REPOSITORIES: ${{ forgejo.repository }}
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}

{safeuploads-1.0.0 → safeuploads-1.1.0}/.github/copilot-instructions.md

@@ -70,3 +70,24 @@ class MyClass:
 ## Documentation & Examples
 - Update docstrings and README examples when public APIs change (e.g., `FileValidator`, utility helpers).
 - Demonstrate usage snippets with async FastAPI context where applicable.
+
+## Commits logic
+
+Committing should use clear messages following [Conventional Commits](https://www.conventionalcommits.org/) format:
+
+**Format:** `<type>(<scope>)!: <description>` — `(<scope>)` and the breaking-change `!` are optional.
+
+The following rules are enforced automatically on every PR (against the PR title and every commit subject) by `.forgejo/workflows/conventional-commits.yml`. Validation follows the [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) spec, with a single project-policy addition (the allowed-type whitelist). Generated commit messages must comply:
+
+- **Header format:** `<type>(<scope>)!: <description>` — the `(<scope>)` and breaking-change `!` are optional, and a space is required after the colon.
+- **Allowed types (project policy):** `build`, `chore`, `ci`, `docs`, `feat`, `fix`, `perf`, `refactor`, `revert`, `style`, `test`. Types are matched case-insensitively per the spec.
+- **Scope** (optional) is any non-empty string (no parentheses), per the spec.
+- **Description** is free-form text, per the spec (no lowercase requirement, no trailing-period restriction, no length limit).
+- **Breaking changes** are marked with `!` after the type/scope (e.g. `feat(api)!: ...`) or a `BREAKING CHANGE:` footer in the commit body.
+
+Examples:
+- `feat: add GPX max speed parsing`
+- `fix(garmin): handle multi-segment GPX distance correctly`
+- `docs: update development instructions`
+- `test(activities): add regression test for GPX segment handling`
+- `refactor(api)!: rename Activity.distance to total_distance`