scitex-cards 0.14.0__tar.gz

scitex_cards-0.14.0/.djfinal.txt

@@ -0,0 +1,14 @@
+........................................................................ [  8%]
+........................................................................ [ 17%]
+........................................................................ [ 26%]
+........................................................................ [ 34%]
+........................................................................ [ 43%]
+........................................................................ [ 52%]
+........................................................................ [ 61%]
+........................................................................ [ 69%]
+........................................................................ [ 78%]
+........................................................................ [ 87%]
+........................................................................ [ 96%]
+................................                                         [100%]
+824 passed in 455.10s (0:07:35)
+DONE_RC=0

scitex_cards-0.14.0/.djs.txt

@@ -0,0 +1,39 @@
+........................................................................ [  8%]
+........................................................................ [ 17%]
+........................................................................ [ 26%]
+........................................................................ [ 34%]
+........................................................................ [ 43%]
+........................................................................ [ 52%]
+.......................................................F................ [ 61%]
+........................................................................ [ 69%]
+........................................................................ [ 78%]
+........................................................................ [ 87%]
+........................................................................ [ 96%]
+................................                                         [100%]
+=================================== FAILURES ===================================
+______________________ test_timeline_view_ungrouped_lane _______________________
+
+store_ungrouped = PosixPath('/uvwork/tmp/pytest-of-agent/pytest-58/test_timeline_view_ungrouped_l0/tasks.yaml')
+
+    def test_timeline_view_ungrouped_lane(store_ungrouped):
+        """A task without an agent or group lands in the ``"(ungrouped)"``
+        lane — operator-brief floor for tasks with no lane value."""
+        # Arrange
+        rf = RequestFactory()
+        req = rf.get("/timeline")
+        # Act
+        payload = json.loads(timeline_view(req).content)
+        # Assert
+>       assert payload["events"][0]["lane"] == "(ungrouped)"
+E       AssertionError: assert 'agent:test-suite' == '(ungrouped)'
+E         
+E         - (ungrouped)
+E         + agent:test-suite
+
+tests/scitex_todo/_django/handlers/test__timeline_view.py:253: AssertionError
+------------------------------ Captured log setup ------------------------------
+WARNING  scitex_todo._notify._dispatch:_dispatch.py:272 [scitex-todo._notify] card 't-naked' not loadable for 'created' event; skipping notify: "task id 't-naked' not found in /home/agent/.scitex/todo/tasks.yaml"
+=========================== short test summary info ============================
+FAILED tests/scitex_todo/_django/handlers/test__timeline_view.py::test_timeline_view_ungrouped_lane
+1 failed, 823 passed in 392.96s (0:06:32)
+DONE_RC=1

scitex_cards-0.14.0/.env.example

@@ -0,0 +1,14 @@
+# scitex-todo environment variables
+#
+# Copy this file to `.env` (gitignored) and edit values for your setup.
+# CLI flags always override env vars when both are given. Variables follow
+# the SciTeX ecosystem convention: SCITEX_<MODULE>_<NAME>.
+#
+# Local state (per the SciTeX local-state convention) is read from:
+#   ~/.scitex/todo/               user-global task store
+#   <proj-root>/.scitex/todo/     project-local task store (preferred)
+
+# Absolute path to the canonical tasks.yaml task store. When set, it wins
+# over the project/user/bundled fallback chain (but a `--tasks` CLI flag
+# still overrides it).
+# SCITEX_TODO_TASKS=/abs/path/to/tasks.yaml

scitex_cards-0.14.0/.envrc

@@ -0,0 +1,13 @@
+# Load the parent directory's .envrc first (direnv), so shared
+# repo-group env (e.g. ~/proj/.envrc) applies before these per-repo overrides.
+source_up
+
+# Claude Code Telegrammer
+export CCT_ALLOWED_USERS="8379369979"
+export CCT_AGENT_ID="scitex-todo"
+export CCT_BOT_TOKEN="$CCT_BOT_TOKEN_TODO"
+
+# SCITEX Todo
+export SCITEX_TODO_AGENT_ID="scitex-todo"
+export SCITEX_TODO_TASKS_YAML_SHARED="$HOME/.scitex/todo/tasks.yaml"
+

scitex_cards-0.14.0/.gitattributes

@@ -0,0 +1,2 @@
+# Sphinx-generated docs bundle — exclude from GitHub language stats.
+src/*/_sphinx_html/** linguist-generated

scitex_cards-0.14.0/.githooks/_lib.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# -*- coding: utf-8 -*-
+# Shared helpers for the scitex-todo git->card hooks (post-commit, pre-push).
+#
+# Phase P3 of the task-driven-feedback epic (card tcfb-p3-git-to-card).
+# These helpers capture a local git mutation onto the matching board
+# card's ROUTE by emitting a canonical "push" event to
+#   scitex-todo hook push --payload -
+#
+# SOFT linking: a card is annotated only when a card id is present in the
+# branch name (or a `Card: <id>` commit-message trailer). Ad-hoc commits
+# with no card id are NOT an error -- the hooks emit nothing and exit 0.
+#
+# BEST EFFORT: every step is guarded so a hook NEVER blocks the
+# commit/push, even if python, the package, or the consumer is missing.
+#
+# This file is sourced, not executed; it defines functions only.
+
+# Resolve a python interpreter that can import scitex_cards. Preference:
+#   1. repo-local venv (.venv/bin/python) -- CI-parity dev setup
+#   2. `scitex-todo` console-script's interpreter (best proxy on PATH)
+#   3. plain python3
+# Echoes the interpreter path; callers test importability separately.
+sttc_python() {
+    local repo_root="$1"
+    if [ -x "${repo_root}/.venv/bin/python" ]; then
+        echo "${repo_root}/.venv/bin/python"
+        return 0
+    fi
+    if command -v python3 >/dev/null 2>&1; then
+        echo "python3"
+        return 0
+    fi
+    echo "python"
+}
+
+# Derive an "owner/repo" slug from the origin remote URL. Handles both
+# SSH (git@github.com:owner/repo.git) and HTTPS
+# (https://github.com/owner/repo.git) forms. Echoes "" if undeterminable.
+sttc_repo_slug() {
+    local repo_root="$1"
+    local url
+    url="$(git -C "${repo_root}" remote get-url origin 2>/dev/null)" || return 0
+    [ -n "${url}" ] || return 0
+    # Strip a trailing .git, then take the last two path segments.
+    url="${url%.git}"
+    # Normalise scp-like "host:owner/repo" to ".../owner/repo".
+    url="${url/://}"
+    # Echo the trailing owner/repo (last two slash-separated segments).
+    echo "${url}" | awk -F/ '{ if (NF>=2) printf "%s/%s", $(NF-1), $NF }'
+}
+
+# Emit + dispatch a push event for one commit, best-effort.
+# Args: repo_root branch commit_sha [commit_msg_file] [trigger]
+# - trigger (commit|push, default push) tells the consumer whether this
+#   came from post-commit (commit) or pre-push (push) so it emits the
+#   matching canonical card-event type (committed vs pushed).
+# - Resolves the card id (branch, then Card: trailer in the msg file).
+# - If a card id resolves, builds the event JSON in python and pipes it
+#   to `scitex-todo hook push --payload -`.
+# - No card id  -> silent exit 0 (SOFT).
+# - Any failure -> swallowed (|| true); the hook never blocks git.
+sttc_emit_push() {
+    local repo_root="$1" branch="$2" sha="$3" msg_file="${4:-}" trigger="${5:-push}"
+    [ -n "${branch}" ] || return 0
+    [ -n "${sha}" ] || return 0
+
+    local py slug author event
+    py="$(sttc_python "${repo_root}")"
+
+    # If the interpreter can't import scitex_cards, give up softly.
+    "${py}" -c "import scitex_cards._git_link" >/dev/null 2>&1 || return 0
+
+    slug="$(sttc_repo_slug "${repo_root}")"
+    author="$(git -C "${repo_root}" log -1 --format='%an' "${sha}" 2>/dev/null)"
+
+    local -a msg_args=()
+    if [ -n "${msg_file}" ] && [ -f "${msg_file}" ]; then
+        msg_args=(--message-file "${msg_file}")
+    fi
+
+    # Build the canonical push-event JSON in python (safe quoting of the
+    # commit message). Empty stdout == no card id == SOFT skip.
+    event="$("${py}" -m scitex_cards._git_link emit-event \
+        --repo "${slug}" \
+        --branch "${branch}" \
+        --sha "${sha}" \
+        --author "${author}" \
+        --trigger "${trigger}" \
+        "${msg_args[@]}" 2>/dev/null)" || return 0
+    [ -n "${event}" ] || return 0
+
+    # Pipe to the consumer. Prefer the repo-venv console script; fall back
+    # to `scitex-todo` on PATH, then to `python -m scitex_cards`.
+    if [ -x "${repo_root}/.venv/bin/scitex-todo" ]; then
+        printf '%s\n' "${event}" |
+            "${repo_root}/.venv/bin/scitex-todo" hook push --payload - \
+                >/dev/null 2>&1 || true
+    elif command -v scitex-todo >/dev/null 2>&1; then
+        printf '%s\n' "${event}" |
+            scitex-todo hook push --payload - >/dev/null 2>&1 || true
+    else
+        printf '%s\n' "${event}" |
+            "${py}" -m scitex_cards hook push --payload - \
+                >/dev/null 2>&1 || true
+    fi
+    return 0
+}
+
+# EOF

scitex_cards-0.14.0/.githooks/post-commit

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# -*- coding: utf-8 -*-
+# scitex-todo git->card hook: record each local commit on the matching
+# board card's ROUTE (Phase P3, card tcfb-p3-git-to-card).
+#
+# SOFT linking: only fires when a card id is present in the branch name
+# (or a `Card: <id>` commit-message trailer). Ad-hoc commits are skipped
+# silently. BEST EFFORT: never blocks the commit -- the hook always
+# exits 0, even on any internal failure.
+
+set -u
+
+HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+. "${HOOK_DIR}/_lib.sh" 2>/dev/null || exit 0
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
+[ -n "${REPO_ROOT}" ] || exit 0
+
+BRANCH="$(git -C "${REPO_ROOT}" symbolic-ref --quiet --short HEAD 2>/dev/null)" || exit 0
+[ -n "${BRANCH}" ] || exit 0  # detached HEAD -> nothing to link.
+
+SHA="$(git -C "${REPO_ROOT}" rev-parse HEAD 2>/dev/null)" || exit 0
+
+# The commit message of the just-created commit, for the `Card:` trailer
+# fallback. Write it to a temp file so the helper reads it verbatim.
+MSG_FILE="$(mktemp 2>/dev/null)" || MSG_FILE=""
+if [ -n "${MSG_FILE}" ]; then
+    git -C "${REPO_ROOT}" log -1 --format='%B' HEAD >"${MSG_FILE}" 2>/dev/null || true
+fi
+
+sttc_emit_push "${REPO_ROOT}" "${BRANCH}" "${SHA}" "${MSG_FILE}" "commit" || true
+
+[ -n "${MSG_FILE}" ] && rm -f "${MSG_FILE}" 2>/dev/null
+
+exit 0
+# EOF

scitex_cards-0.14.0/.githooks/pre-push

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# -*- coding: utf-8 -*-
+# scitex-todo git->card hook: record pushed commits on the matching board
+# card's ROUTE (Phase P3, card tcfb-p3-git-to-card).
+#
+# git invokes pre-push with `<remote-name> <remote-url>` as argv and feeds
+# one line per pushed ref on stdin:
+#     <local_ref> SP <local_sha> SP <remote_ref> SP <remote_sha> LF
+# For each updated branch we record its tip commit (local_sha) against the
+# card id parsed from the branch (or a `Card:` trailer).
+#
+# SOFT linking: only fires when a card id is present. Ad-hoc pushes are
+# skipped silently. BEST EFFORT: never blocks the push -- always exits 0.
+
+set -u
+
+HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+. "${HOOK_DIR}/_lib.sh" 2>/dev/null || exit 0
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
+[ -n "${REPO_ROOT}" ] || exit 0
+
+# Sentinel git uses for "no such object" (deletes / fresh refs).
+ZERO="0000000000000000000000000000000000000000"
+
+while read -r local_ref local_sha remote_ref remote_sha; do
+    # Branch deletion (local side is the zero sha) -> nothing to record.
+    [ -n "${local_ref}" ] || continue
+    [ "${local_sha}" = "${ZERO}" ] && continue
+    [ -n "${local_sha}" ] || continue
+
+    # Only annotate branch pushes; ignore tags and other ref namespaces.
+    case "${local_ref}" in
+    refs/heads/*) branch="${local_ref#refs/heads/}" ;;
+    *) continue ;;
+    esac
+    [ -n "${branch}" ] || continue
+
+    MSG_FILE="$(mktemp 2>/dev/null)" || MSG_FILE=""
+    if [ -n "${MSG_FILE}" ]; then
+        git -C "${REPO_ROOT}" log -1 --format='%B' "${local_sha}" \
+            >"${MSG_FILE}" 2>/dev/null || true
+    fi
+
+    sttc_emit_push "${REPO_ROOT}" "${branch}" "${local_sha}" "${MSG_FILE}" "push" || true
+
+    [ -n "${MSG_FILE}" ] && rm -f "${MSG_FILE}" 2>/dev/null
+done
+
+exit 0
+# EOF

scitex_cards-0.14.0/.github/ci/build-in-sif.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Runs INSIDE the reused scitex-ci SIF (apptainer exec — invoked via
+# exec-in-sif.sh). Builds scitex-todo's wheel + sdist into ./dist/.
+#
+# WHY build in the SIF: the self-hosted Spartan runner has no Python on the
+# bare node (the whole reason the old `actions/setup-python@v5` step failed:
+# "version 3.x not found for this OS"). The SIF bakes python 3.11/3.12/3.13 +
+# pip + uv at /opt/venv-<ver>, exactly like the working pytest-matrix CI.
+#
+# `python -m build` needs the `build` frontend, which is NOT baked in the SIF
+# (only scitex-dev[all,dev] deps are). Mirror run-in-sif.sh: install `build`
+# into a writable --target on node-local /tmp and put it on PYTHONPATH. The
+# SIF's /opt/venv-* are root-owned + RO and the compute-node HOME is RO inside
+# the container, so a normal install fails Permission denied — a --target on
+# writable scratch sidesteps both.
+#
+# Fail-loud (operator directive): a missing interpreter or a failed build is a
+# HARD error, never a silent fallback.
+set -euo pipefail
+
+V="${1:-3.12}"
+VENV="/opt/venv-$V"
+PY="$VENV/bin/python"
+test -x "$PY" || {
+    echo "::error::baked python missing in $VENV — rebuild the SIF: scitex-container apptainer build ci-cpu"
+    exit 1
+}
+
+export LC_ALL=C.UTF-8 LANG=C.UTF-8
+
+# Writable scratch (the runner's TMPDIR=~/.cache/tmp is a host path that does
+# NOT resolve inside the container). Node-local /tmp is writable + ephemeral.
+TMPDIR="/tmp/build-scitex_cards-${GITHUB_RUN_ID:-0}-${GITHUB_RUN_ATTEMPT:-0}-$V"
+export TMPDIR
+rm -rf "$TMPDIR"
+mkdir -p "$TMPDIR/site" "$TMPDIR/uv-cache"
+
+# The compute-node $HOME is RO inside the container — point every cache the
+# installer might touch at the writable scratch (else uv/pip die creating
+# ~/.cache).
+export UV_CACHE_DIR="$TMPDIR/uv-cache"
+export XDG_CACHE_HOME="$TMPDIR"
+export PIP_CACHE_DIR="$TMPDIR/pip-cache"
+
+# A VIRTUAL_ENV leaked from the runner profile (~/.env-3.11) is a broken
+# symlink in here; unset it so no tool follows it.
+unset VIRTUAL_ENV || true
+
+export PATH="$VENV/bin:$PATH"
+echo "build: py=$("$PY" -V) target=$TMPDIR/site"
+
+# Install the PEP 517 build frontend into the writable target (uv fast path,
+# pip safety net), then build with it. Clean dist/ first so only the freshly
+# built artifacts are uploaded.
+uv pip install --python "$PY" --target="$TMPDIR/site" build ||
+    "$PY" -m pip install --target="$TMPDIR/site" build
+
+export PYTHONPATH="$TMPDIR/site${PYTHONPATH:+:$PYTHONPATH}"
+
+rm -rf dist
+"$PY" -m build --outdir dist
+
+echo "=== built artifacts ==="
+ls -l dist
+# fail-loud: refuse to continue the pipeline with an empty dist/.
+test -n "$(ls -A dist 2>/dev/null)" || {
+    echo "::error::python -m build produced no artifacts in dist/"
+    exit 1
+}

scitex_cards-0.14.0/.github/ci/exec-in-sif.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Outer apptainer-exec wrapper for scitex-tex's self-hosted (Spartan) CI.
+#
+# Runs ON THE RUNNER (outside the SIF). Resolves the apptainer shim + SIF image
+# from the repo Actions Variables, then `apptainer exec`s the SIF and hands off
+# to an INNER script (run inside the container). Keeps every workflow job's YAML
+# down to one line — `bash .github/ci/exec-in-sif.sh <inner-script> [args...]` —
+# and concentrates all the HPC/SIF plumbing (shim PATH, ~-expansion, scratch,
+# binds) in one version-controlled place.
+#
+# Required env (set by the workflow from repo Actions Variables):
+#   SCITEX_CI_APPTAINER   path to the apptainer shim   (e.g. ~/.env-3.11/bin/apptainer)
+#   SCITEX_CI_SIF         path to the CI SIF image     (e.g. ~/.scitex/dev/containers/ci-cpu.sif)
+#
+# Usage:
+#   bash .github/ci/exec-in-sif.sh run-in-sif.sh 3.12
+#
+# Fail-loud (operator directive): a missing shim or SIF is a HARD error — never
+# a silent fallback to a bare-runner install.
+set -euo pipefail
+
+INNER="${1:?inner script name required (relative to .github/ci/)}"
+shift || true
+
+# The runner's job shell is --noprofile --norc (no Lmod), so the apptainer shim
+# must be put on PATH explicitly; it execs the real Apptainer binary directly.
+# ~-expand the Actions-Variable paths: a quoted "~/…" is NOT tilde-expanded by
+# the shell, so substitute a leading ~ with $HOME ourselves.
+APPTAINER="${SCITEX_CI_APPTAINER:?SCITEX_CI_APPTAINER not set (repo Actions Variable)}"
+SIF="${SCITEX_CI_SIF:?SCITEX_CI_SIF not set (repo Actions Variable)}"
+APPTAINER="${APPTAINER/#\~/$HOME}"
+SIF="${SIF/#\~/$HOME}"
+export PATH="$HOME/.env-3.11/bin:$PATH"
+
+[ -x "$APPTAINER" ] || {
+    echo "::error::apptainer shim not executable at $APPTAINER"
+    exit 1
+}
+[ -f "$SIF" ] || {
+    echo "::error::CI SIF missing at $SIF — rebuild it: scitex-container apptainer build ci-cpu"
+    exit 1
+}
+
+# apptainer scratch on the shared FS — keeps HOME clean.
+export APPTAINER_TMPDIR="/data/gpfs/projects/punim0264/ywatanabe/ci/apptainer-tmp"
+mkdir -p "$APPTAINER_TMPDIR"
+
+# --bind punim0264: $HOME/.scitex is a symlink into punim0264; bind it so the
+# symlink resolves inside the container. --pwd "$PWD" keeps the checkout as cwd.
+exec "$APPTAINER" exec --pwd "$PWD" --bind /data/gpfs/projects/punim0264 \
+    "$SIF" bash ".github/ci/$INNER" "$@"

scitex_cards-0.14.0/.github/ci/publish-in-sif.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# Runs INSIDE the reused scitex-ci SIF (apptainer exec — invoked via
+# exec-in-sif.sh). Publishes ./dist/* to PyPI via MANUAL OIDC Trusted
+# Publishing, then twine upload.
+#
+# WHY manual OIDC (not pypa/gh-action-pypi-publish): that action is a Docker
+# container action. Self-hosted Spartan compute nodes have NO Docker, so the
+# action cannot run there. PyPI Trusted Publishing is just an OIDC token
+# exchange over plain HTTPS, so we do it by hand:
+#
+#   1. Ask the GitHub Actions OIDC provider for a JWT with audience=pypi,
+#      using the per-job ACTIONS_ID_TOKEN_REQUEST_{TOKEN,URL} env vars (present
+#      because the publish job declares `permissions: id-token: write`).
+#      apptainer exec (no --cleanenv) passes those host env vars into the SIF.
+#   2. Exchange that JWT at PyPI's mint-token endpoint for a short-lived,
+#      scope-limited PyPI API token.
+#   3. twine upload dist/* with TWINE_USERNAME=__token__ and that minted token.
+#
+# This requires a Trusted Publisher to be configured on PyPI for
+# (project=scitex-todo, owner=ywatanabe1989, repo=scitex-todo,
+#  workflow=pypi-publish-and-github-release-on-tag.yml). It already is — the
+# previous releases published via the Docker action under the same trusted
+# publisher; only the *client* changes here, not PyPI's trust config.
+#
+# curl, python and (after a --target install) twine all live in the SIF.
+#
+# Fail-loud (operator directive): every step asserts non-empty output and
+# `set -euo pipefail`; any failure is a HARD error with the exact cause, never
+# a silent skip.
+set -euo pipefail
+
+V="${1:-3.12}"
+VENV="/opt/venv-$V"
+PY="$VENV/bin/python"
+test -x "$PY" || {
+    echo "::error::baked python missing in $VENV — rebuild the SIF: scitex-container apptainer build ci-cpu"
+    exit 1
+}
+
+export LC_ALL=C.UTF-8 LANG=C.UTF-8
+
+# dist/ must already hold the artifacts (downloaded by the publish job before
+# this script runs). Fail loud if empty.
+if [ ! -d dist ] || [ -z "$(ls -A dist 2>/dev/null)" ]; then
+    echo "::error::dist/ is empty — nothing to publish (download the build artifact first)"
+    exit 1
+fi
+echo "=== dist to publish ==="
+ls -l dist
+
+# --- writable scratch (compute-node HOME is RO inside the container) ---
+TMPDIR="/tmp/publish-scitex_cards-${GITHUB_RUN_ID:-0}-${GITHUB_RUN_ATTEMPT:-0}-$V"
+export TMPDIR
+rm -rf "$TMPDIR"
+mkdir -p "$TMPDIR/site" "$TMPDIR/uv-cache"
+export UV_CACHE_DIR="$TMPDIR/uv-cache"
+export XDG_CACHE_HOME="$TMPDIR"
+export PIP_CACHE_DIR="$TMPDIR/pip-cache"
+unset VIRTUAL_ENV || true
+export PATH="$VENV/bin:$PATH"
+
+# --- step 1: request the OIDC JWT (audience=pypi) from GitHub ---
+: "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:?ACTIONS_ID_TOKEN_REQUEST_TOKEN not set — the publish job needs 'permissions: id-token: write'}"
+: "${ACTIONS_ID_TOKEN_REQUEST_URL:?ACTIONS_ID_TOKEN_REQUEST_URL not set — the publish job needs 'permissions: id-token: write'}"
+
+echo "=== minting OIDC JWT (audience=pypi) ==="
+JWT="$(curl -fsS \
+    -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
+    "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=pypi" |
+    "$PY" -c 'import sys,json; print(json.load(sys.stdin)["value"])')"
+test -n "$JWT" || {
+    echo "::error::OIDC JWT request returned an empty token"
+    exit 1
+}
+echo "OIDC JWT obtained (length=${#JWT})"
+
+# --- step 2: exchange the JWT for a short-lived PyPI API token ---
+echo "=== exchanging JWT at PyPI mint-token endpoint ==="
+MINT_RESP="$(curl -sS -X POST https://pypi.org/_/oidc/mint-token \
+    -d "{\"token\":\"${JWT}\"}")"
+MINTED="$(printf '%s' "$MINT_RESP" |
+    "$PY" -c 'import sys,json; d=json.load(sys.stdin); print(d.get("token",""))')"
+if [ -z "$MINTED" ]; then
+    # Surface PyPI's error body VERBATIM (the JWT is NOT echoed) so a trust
+    # misconfiguration is diagnosable — this is the decisive failure mode for
+    # the fleet. Print the raw response unconditionally (most reliable on an
+    # error path); pretty-print is best-effort on top.
+    echo "::error::PyPI mint-token returned no token."
+    echo "--- PyPI mint-token response body (raw) ---"
+    printf '%s\n' "$MINT_RESP"
+    echo "--- (pretty, best-effort) ---"
+    printf '%s' "$MINT_RESP" |
+        "$PY" -c 'import sys,json; print(json.dumps(json.load(sys.stdin), indent=2))' \
+            2>/dev/null || true
+    exit 1
+fi
+echo "PyPI token minted (length=${#MINTED})"
+
+# --- step 3: install twine into the writable target, then upload ---
+echo "=== installing twine (--target) ==="
+uv pip install --python "$PY" --target="$TMPDIR/site" twine ||
+    "$PY" -m pip install --target="$TMPDIR/site" twine
+export PYTHONPATH="$TMPDIR/site${PYTHONPATH:+:$PYTHONPATH}"
+
+echo "=== twine upload dist/* ==="
+TWINE_USERNAME="__token__" TWINE_PASSWORD="$MINTED" \
+    "$PY" -m twine upload --non-interactive --disable-progress-bar dist/*
+
+echo "PUBLISH-OK: scitex-todo dist/* uploaded to PyPI via manual OIDC trusted publishing"

scitex_cards-0.14.0/.github/ci/publish-with-uv.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# Publishes ./dist/* to PyPI via MANUAL OIDC Trusted Publishing + twine,
+# using a uv-provisioned Python on the bare self-hosted runner.
+#
+# Successor to publish-in-sif.sh (2026-07-11): the shared ci-cpu.sif vanished
+# from the Spartan runners (incident-ci-sif-vanished-release-blocked-20260711)
+# and the SIF's original rationale — "no Python on the bare node" — is
+# obsolete: the org-level pytest-matrix reusable workflow already provisions
+# Python on these same runners with astral-sh/setup-uv, green for weeks.
+# The OIDC exchange below is UNCHANGED from publish-in-sif.sh; only where
+# Python comes from differs. PyPI's trusted-publisher config keys on
+# (owner, repo, workflow file name), none of which change here.
+#
+# WHY manual OIDC (not pypa/gh-action-pypi-publish): that action is a Docker
+# container action and the Spartan compute nodes have no Docker. Trusted
+# Publishing is just an OIDC token exchange over HTTPS:
+#   1. JWT (audience=pypi) from the Actions OIDC provider, via the per-job
+#      ACTIONS_ID_TOKEN_REQUEST_{TOKEN,URL} env vars (present because the
+#      publish job declares `permissions: id-token: write`).
+#   2. Exchange the JWT at PyPI's mint-token endpoint for a short-lived token.
+#   3. twine upload dist/* with TWINE_USERNAME=__token__.
+#
+# Fail-loud (operator directive): set -euo pipefail; every step asserts
+# non-empty output; failures carry the exact cause, never a silent skip.
+set -euo pipefail
+
+command -v uv >/dev/null || {
+    echo "::error::uv not on PATH — the workflow must run astral-sh/setup-uv before this script"
+    exit 1
+}
+
+# Provision the interpreter (downloads a standalone CPython if the runner has
+# none — the whole point of retiring the SIF).
+uv venv --python 3.12 .venv-publish
+PY=".venv-publish/bin/python"
+test -x "$PY" || {
+    echo "::error::uv venv did not produce $PY"
+    exit 1
+}
+
+export LC_ALL=C.UTF-8 LANG=C.UTF-8
+
+if [ ! -d dist ] || [ -z "$(ls -A dist 2>/dev/null)" ]; then
+    echo "::error::dist/ is empty — nothing to publish (download the build artifact first)"
+    exit 1
+fi
+echo "=== dist to publish ==="
+ls -la dist/
+
+# --- step 1: request the OIDC JWT (audience=pypi) from GitHub ---
+: "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:?not set — the publish job needs 'permissions: id-token: write'}"
+: "${ACTIONS_ID_TOKEN_REQUEST_URL:?not set — the publish job needs 'permissions: id-token: write'}"
+
+echo "=== minting OIDC JWT (audience=pypi) ==="
+JWT="$(curl -fsS \
+    -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
+    "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=pypi" |
+    "$PY" -c 'import sys,json; print(json.load(sys.stdin)["value"])')"
+test -n "$JWT" || {
+    echo "::error::OIDC JWT request returned an empty token"
+    exit 1
+}
+echo "OIDC JWT obtained (length=${#JWT})"
+
+# --- step 2: exchange the JWT for a short-lived PyPI API token ---
+echo "=== exchanging JWT at PyPI mint-token endpoint ==="
+MINT_RESP="$(curl -sS -X POST https://pypi.org/_/oidc/mint-token \
+    -d "{\"token\":\"${JWT}\"}")"
+MINTED="$(printf '%s' "$MINT_RESP" |
+    "$PY" -c 'import sys,json; d=json.load(sys.stdin); print(d.get("token",""))')"
+if [ -z "$MINTED" ]; then
+    # Surface PyPI's error body VERBATIM (the JWT is NOT echoed) so a trust
+    # misconfiguration is diagnosable.
+    echo "::error::PyPI mint-token returned no token."
+    echo "--- PyPI mint-token response body (raw) ---"
+    printf '%s\n' "$MINT_RESP"
+    echo "--- (pretty, best-effort) ---"
+    printf '%s' "$MINT_RESP" |
+        "$PY" -c 'import sys,json; print(json.dumps(json.load(sys.stdin), indent=2))' \
+            2>/dev/null || true
+    exit 1
+fi
+echo "PyPI token minted (length=${#MINTED})"
+
+# --- step 3: twine upload ---
+echo "=== installing twine into the publish venv ==="
+uv pip install --python "$PY" twine
+
+echo "=== twine upload dist/* ==="
+TWINE_USERNAME="__token__" TWINE_PASSWORD="$MINTED" \
+    "$PY" -m twine upload --non-interactive --disable-progress-bar dist/*
+
+echo "PUBLISH-OK: dist/* uploaded to PyPI via manual OIDC trusted publishing (uv-provisioned python)"