scitex-dev 0.18.0__tar.gz → 0.18.2__tar.gz

{scitex_dev-0.18.0 → scitex_dev-0.18.2}/.github/workflows/auto-merge-to-develop.yaml

@@ -42,16 +42,7 @@ jobs:
                 | (.conclusion // .state // "")
                 | select(. != "SUCCESS" and . != "NEUTRAL" and . != "SKIPPED" and . != "") ] | length' 2>/dev/null || echo 1)
             if [ "$pending" = "0" ]; then
-              # --squash, NOT --merge: this repo forbids merge commits (linear
-              # history — only squash/rebase allowed). With --merge, every green
-              # develop PR silently "blocked" and never auto-merged, defeating
-              # the green->self-merge ring (feedback.pdf §3). Fail LOUD on a real
-              # merge failure so it never silently stalls again.
-              if gh pr merge "$pr" --repo "$REPO" --squash --admin --delete-branch; then
-                echo "MERGED #$pr -> develop (squash)"
-              else
-                echo "::warning::auto-merge of #$pr FAILED (green but not merged) — needs a human look"
-              fi
+              gh pr merge "$pr" --repo "$REPO" --merge --admin --delete-branch && echo "MERGED #$pr -> develop" || echo "blocked #$pr"
             else
               echo "PR #$pr not green ($pending) — skip"
             fi

{scitex_dev-0.18.0 → scitex_dev-0.18.2}/.github/workflows/cla.yml

@@ -63,7 +63,7 @@ jobs:
           path-to-signatures: "signatures/cla.json"
           path-to-document: "https://github.com/ywatanabe1989/scitex-dev/blob/main/CLA.md"
           branch: "cla-signatures"
-          allowlist: bot*,ywatanabe1989
+          allowlist: bot*,ywatanabe1989,LLEmacs
           custom-allsigned-prcomment: |
             Thank you for signing the SciTeX CLA. Your contribution can now be reviewed.
           custom-notsigned-prcomment: |

scitex_dev-0.18.2/.github/workflows/import-smoke-on-ubuntu-py3-12.yml

@@ -0,0 +1,34 @@
+name: import-smoke
+
+# Catches "wheel installs but `import scitex_dev` blows up at runtime"
+# — separate from the full pytest suite so a broken entry-point fails
+# fast without paying for the matrix. Companion to `tests` — confirms
+# the bare package (no extras) is `pip install -e .`-able and
+# `import scitex_dev` succeeds. Catches `[project] dependencies`
+# drift that the test matrix masks because it installs `[all,dev]`.
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    - cron: "0 17 * * *"  # nightly 17:00 UTC (~02:00 JST), off-peak
+  workflow_dispatch:
+
+jobs:
+  install-check:
+    name: import-smoke-on-ubuntu-py3-12
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install (no extras)
+        run: |
+          python -m venv .venv
+          .venv/bin/pip install --upgrade pip
+          .venv/bin/pip install -e .
+      - name: Import smoke
+        run: .venv/bin/python -c "import scitex_dev; print(scitex_dev.__version__)"

scitex_dev-0.18.2/.github/workflows/pypi-publish-and-github-release-on-tag.yml

@@ -0,0 +1,184 @@
+name: release
+
+# Tag-driven release pipeline. The intended operator flow is:
+#
+#     git tag vX.Y.Z && git push origin vX.Y.Z
+#
+# Everything else fires automatically:
+#
+#   1. test          — matrix pytest. Must pass or the pipeline halts;
+#                      nothing is published until tests are green on the
+#                      tagged commit.
+#   2. build         — wheel + sdist, uploaded as workflow artifact.
+#   3. publish       — PyPI via OIDC trusted publisher.
+#   4. release       — GitHub Release with CHANGELOG notes + artifacts.
+#   5. sync-main     — open a develop→main PR (admin-merge) so main
+#                      always equals the latest released commit. Skipped
+#                      if main already matches.
+#
+# Manual re-run: the workflow also accepts a `version` input via
+# workflow_dispatch so you can re-publish without re-tagging.
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Tag to publish (e.g. v0.18.1) — must already exist on the repo'
+        required: true
+        type: string
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - name: Resolve version
+        id: ver
+        run: |
+          if [ "${{ github.event_name }}" = "push" ]; then
+            v="${GITHUB_REF#refs/tags/}"
+          else
+            v="${{ inputs.version }}"
+          fi
+          echo "version=$v" >> "$GITHUB_OUTPUT"
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.ver.outputs.version }}
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install (best-effort fallback chain)
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[all,dev]" || pip install -e ".[dev]" || pip install -e .
+      - name: Run pytest
+        run: |
+          if [ -d tests ]; then
+            pytest tests/ -x
+          else
+            echo "no tests/ directory — skipping pytest"
+          fi
+
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.ver.outputs.version }}
+    steps:
+      - name: Resolve version
+        id: ver
+        run: |
+          if [ "${{ github.event_name }}" = "push" ]; then
+            v="${GITHUB_REF#refs/tags/}"
+          else
+            v="${{ inputs.version }}"
+          fi
+          echo "version=$v" >> "$GITHUB_OUTPUT"
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.ver.outputs.version }}
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install build tools
+        run: pip install build
+      - name: Build distribution
+        run: python -m build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/scitex-dev
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  release:
+    needs: [build, publish]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.build.outputs.version }}
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+      - name: Extract release notes from CHANGELOG.md
+        run: |
+          VERSION="${{ needs.build.outputs.version }}"
+          VERSION="${VERSION#v}"
+          awk -v v="$VERSION" '
+            $0 ~ "^## \\[" v "\\]" {p=1; next}
+            p && /^## \[/ {exit}
+            p
+          ' CHANGELOG.md > release-notes.md || true
+          if [ ! -s release-notes.md ]; then
+            echo "Release v${VERSION}. See CHANGELOG.md for details." > release-notes.md
+          fi
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ needs.build.outputs.version }}" \
+            --title "${{ needs.build.outputs.version }}" \
+            --notes-file release-notes.md \
+            dist/*
+
+  sync-main:
+    # Open develop→main PR so main always equals the latest released
+    # commit. Branch-protected mains require PR review; this job tries
+    # admin-merge but leaves the PR open if that isn't allowed.
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: develop
+      - name: Open develop→main PR if diverged
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -e
+          git fetch origin main
+          AHEAD=$(git rev-list --count origin/main..origin/develop)
+          if [ "$AHEAD" -eq 0 ]; then
+            echo "main already up-to-date with develop."
+            exit 0
+          fi
+          EXISTING=$(gh pr list --base main --head develop --state open --json number --jq '.[0].number // empty')
+          if [ -z "$EXISTING" ]; then
+            PR_URL=$(gh pr create --base main --head develop \
+              --title "release: sync main with develop" \
+              --body "Auto-opened by the release pipeline so main equals the latest released commit.")
+            EXISTING=$(echo "$PR_URL" | grep -oE '[0-9]+$')
+            echo "Created PR #${EXISTING}"
+          else
+            echo "Reusing existing PR #${EXISTING}"
+          fi
+          gh pr merge "$EXISTING" --merge --admin \
+            || echo "Admin merge unavailable; PR left open for manual merge."

scitex_dev-0.18.2/.github/workflows/pytest-matrix-on-ubuntu-py3-11-3-12-3-13.yml

@@ -0,0 +1,51 @@
+name: tests
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    - cron: "0 17 * * *"  # nightly 17:00 UTC (~02:00 JST), off-peak
+  workflow_dispatch:
+
+jobs:
+  test:
+    # Job name is a REQUIRED status check (branch protection):
+    # pytest-matrix-on-ubuntu-py3.11 / 3.12 / 3.13 — keep verbatim.
+    name: pytest-matrix-on-ubuntu-py${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          # Fallback chain: prefer [all,dev] so optional-dep code paths
+          # (yaml, fastmcp, textual) get exercised. Falls back to [dev] then
+          # plain editable so a packaging hiccup doesn't strand CI.
+          pip install -e ".[all,dev]" || pip install -e ".[dev]" || pip install -e .
+      - name: Run tests
+        run: |
+          pytest tests/ --cov=src/scitex_dev --cov-report=xml --cov-report=term
+      - name: Upload coverage to Codecov
+        if: always() && matrix.python-version == '3.12'
+        uses: codecov/codecov-action@v5
+        env:
+          # Per-job isolated HOME so parallel matrix jobs don't race on the
+          # codecov uploader's state under $HOME, and so the uploader's
+          # internal `git` calls don't trip "dubious ownership" on the
+          # shared checkout. Paired with disable_safe_directory below.
+          HOME: ${{ runner.temp }}/codecov-home-${{ matrix.python-version }}
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./coverage.xml
+          fail_ci_if_error: false
+          disable_safe_directory: true

{scitex_dev-0.18.0 → scitex_dev-0.18.2}/.github/workflows/rtd-sphinx-build-on-ubuntu-latest.yml

@@ -28,8 +28,13 @@ jobs:
       - name: Install package + docs deps
         run: pip install -e ".[docs]"
 
-      - name: Build Sphinx HTML (warnings-as-errors everywhere)
-        run: sphinx-build -W --keep-going -b html docs/sphinx docs/sphinx/_build/html
+      - name: Build Sphinx HTML (warnings fail PRs only)
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            sphinx-build -W -b html docs/sphinx docs/sphinx/_build/html
+          else
+            sphinx-build -b html docs/sphinx docs/sphinx/_build/html
+          fi
 
       - name: Refresh src/scitex_dev/_sphinx_html/ (develop push only)
         # main is PR-only — its _sphinx_html/ bundle arrives via the
@@ -39,7 +44,6 @@ jobs:
         run: |
           rm -rf src/scitex_dev/_sphinx_html
           cp -rf docs/sphinx/_build/html src/scitex_dev/_sphinx_html
-          rm -rf src/scitex_dev/_sphinx_html/.doctrees
           touch src/scitex_dev/_sphinx_html/.nojekyll
 
       - name: Commit refreshed HTML if it changed (develop push only)

scitex_dev-0.18.2/.github/workflows/scitex-dev-quality-audit-on-ubuntu-latest.yml

@@ -0,0 +1,60 @@
+name: quality
+
+# Single-package quality gate -- runs `scitex-dev ecosystem audit-all`
+# against THIS package (audit-cli / audit-mcp-tools / audit-skills /
+# audit-python-apis / audit-project). Mirrors the canonical audit that
+# `tests/develop/test_audit.py` runs inside the test suite, but as a
+# standalone gate so an audit regression is visible even when the matrix
+# is skipped.
+#
+# scitex-dev IS the audit tool: it audits ITSELF using its OWN editable
+# checkout, NOT a separately-pinned published scitex-dev. That way the
+# gate exercises the auditor code on this very PR/commit -- a fix to the
+# auditor is validated against itself before it ever ships.
+
+on:
+  schedule:
+    - cron: "0 18 * * *"  # 18:00 UTC (~03:00 JST), after Test
+  workflow_dispatch:
+  push:
+    branches: [develop]
+    paths:
+      - "src/**"
+      - "tests/**"
+      - "pyproject.toml"
+      - ".github/workflows/scitex-dev-quality-audit-on-ubuntu-latest.yml"
+  pull_request:
+    branches: [main, develop]
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install fd (Rust file finder; audit file discovery requires it)
+        run: sudo apt-get update && sudo apt-get install -y fd-find && sudo ln -sf "$(command -v fdfind)" /usr/local/bin/fd
+
+      - name: Fetch develop into a remote-tracking ref for --new-only baseline
+        # Fetch into refs/remotes/origin/develop (NOT the local develop
+        # branch): on the push:[develop] trigger HEAD already IS develop, so
+        # `git fetch origin develop:develop` dies with "refusing to fetch
+        # into branch ... checked out". The remote-tracking ref is always
+        # writable and `--since origin/develop` resolves it for the
+        # worktree-staged diff on both push and pull_request events.
+        run: git fetch origin develop
+
+      - name: Install package + audit tooling (own editable checkout)
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Run scitex-dev ecosystem audit-all (self-audit, own code)
+        run: scitex-dev ecosystem audit-all scitex-dev --new-only --since origin/develop --no-version-check

{scitex_dev-0.18.0 → scitex_dev-0.18.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scitex-dev
-Version: 0.18.0
+Version: 0.18.2
 Summary: Shared developer utilities for the SciTeX ecosystem
 Author-email: Yusuke Watanabe <ywatanabe@scitex.ai>
 License-Expression: AGPL-3.0-only

{scitex_dev-0.18.0 → scitex_dev-0.18.2}/pyproject.toml

@@ -144,6 +144,7 @@ scitex_dev = [
     "_cli/audit/_summary/data/*",
     "_sphinx_html/**/*",
     "_sphinx_html/**/.[!.]*",
+    "_ecosystem/ci_template/templates/*.tmpl",
 ]
 
 [tool.hatch.build.targets.wheel.force-include]
@@ -173,3 +174,15 @@ markers = [
 parallel = true
 source = ["scitex_dev"]
 concurrency = ["multiprocessing", "thread"]
+
+[tool.scitex_dev.audit]
+# PS-168 — Per-package secret + env-var prefix in GitHub Actions workflows.
+# `GH_PERSONAL_ACCESS_TOKEN` is the ecosystem-wide cross-cutting PAT used
+# by the contributor-assistant CLA action. The natural GITHUB_* namespace
+# is reserved by GitHub Actions on the secret-name surface (HTTP 422 on
+# every `gh secret set`), so the GH_ shorthand is the canonical
+# substitute and is registered ecosystem-wide via PR #122 on scitex-dev
+# (EXCEPTION_SECRETS_DEFAULT). This per-package entry pins the same
+# exception inline so the audit passes on every scitex-dev version,
+# independent of release timing.
+ps168_secret_exceptions = ["GH_PERSONAL_ACCESS_TOKEN"]

{scitex_dev-0.18.0 → scitex_dev-0.18.2}/src/scitex_dev/_cli/audit/_project/_check_umbrella_dep_and_integration.py

@@ -18,6 +18,7 @@ from __future__ import annotations
 
 import ast
 import re
+import subprocess
 from pathlib import Path
 
 try:
@@ -30,18 +31,72 @@ _UMBRELLA_DEP_RE = re.compile(r"^\s*scitex(\[[^\]]*\])?\s*([<>=!~,].*)?$")
 
 
 def _own_import_name(repo: Path) -> str:
-    """`scitex-foo` → `scitex_foo`."""
+    """Canonical import name for the package at repo (scitex-foo -> scitex_foo).
+
+    Prefer the distribution name declared in [project].name over the
+    checkout directory name. Agents and the operator routinely audit from
+    git-worktree checkouts whose dir is <pkg>-<suffix> (e.g.
+    scitex-dev-rel); deriving the own-name from the dir there yields
+    scitex_dev_rel, so the package own scitex_dev.* imports stop
+    matching the own-name filter in _collect_cross_package_imports and
+    fire as bogus PS-140 missing-from-gate cross-package violations.
+    [project].name is worktree-path-independent and fixes this.
+    """
+    dist = _pyproject_distribution_name(repo)
+    if dist:
+        return dist.replace("-", "_")
     return repo.name.replace("-", "_")
 
 
-def _is_umbrella(repo: Path) -> bool:
-    """True if `repo` is the SciTeX umbrella package (distribution `scitex`).
+def _main_worktree_root(repo: Path) -> Path | None:
+    """Return the *main* working-tree root if `repo` is a git worktree.
 
-    Cannot rely on the directory basename alone — the umbrella's local
-    clone is `~/proj/scitex-python/`, so `repo.name` is `scitex-python`
-    not `scitex`. Resolve the canonical distribution name from the
-    ECOSYSTEM registry by matching `local_path` resolved.
+    The umbrella's canonical clone is `~/proj/scitex-python`; agents and
+    the operator routinely audit from sibling `git worktree add` checkouts
+    living at `<repo>/.worktrees/<name>` (or `<repo>/.claude/worktrees/...`).
+    Those carry a different `repo.resolve()` path, so an exact-path match
+    against the ECOSYSTEM `local_path` misses — the umbrella exemption then
+    silently breaks and PS-139/PS-140 fire ~77 false positives on the
+    umbrella's recursive `scitex[<extra>]` self-references.
+
+    `git worktree list --porcelain` reports the main working tree first;
+    its path is the registry-canonical one. Returns `None` when `repo` is
+    not inside a git checkout (callers fall back to the plain path).
     """
+    try:
+        proc = subprocess.run(
+            ["git", "-C", str(repo), "worktree", "list", "--porcelain"],
+            capture_output=True,
+            text=True,
+            timeout=10,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if proc.returncode != 0:
+        return None
+    for line in proc.stdout.splitlines():
+        # The first "worktree <path>" line is always the main working tree.
+        if line.startswith("worktree "):
+            return Path(line[len("worktree ") :].strip())
+    return None
+
+
+def _pyproject_distribution_name(repo: Path) -> str | None:
+    """Return `[project].name` from `repo/pyproject.toml`, or `None`."""
+    pyproject = repo / "pyproject.toml"
+    if not pyproject.exists():
+        return None
+    try:
+        data = tomllib.loads(pyproject.read_text(encoding="utf-8"))
+    except (OSError, tomllib.TOMLDecodeError):
+        return None
+    name = data.get("project", {}).get("name")
+    return name if isinstance(name, str) else None
+
+
+def _matches_umbrella_registry(repo: Path) -> bool:
+    """True iff `repo`'s resolved path equals the umbrella's `local_path`."""
     try:
         from scitex_dev._ecosystem._core import ECOSYSTEM
     except ImportError:
@@ -53,6 +108,36 @@ def _is_umbrella(repo: Path) -> bool:
             continue
         if Path(local).expanduser().resolve() == repo_resolved:
             return info.get("category") == "umbrella" or dist == "scitex"
+    return False
+
+
+def _is_umbrella(repo: Path) -> bool:
+    """True if `repo` is the SciTeX umbrella package (distribution `scitex`).
+
+    Cannot rely on the directory basename alone — the umbrella's local
+    clone is `~/proj/scitex-python/`, so `repo.name` is `scitex-python`
+    not `scitex`. Resolve the canonical distribution name from the
+    ECOSYSTEM registry by matching `local_path` resolved.
+
+    Three signals, any of which identifies the umbrella:
+
+      1. `repo` itself matches the registry `local_path` (canonical clone).
+      2. `repo` is a *git worktree* whose **main** working tree matches the
+         registry (`.worktrees/<name>` and `.claude/worktrees/...` checkouts
+         resolve to a different path than the registered clone — without
+         this the exemption breaks for every worktree-based audit).
+      3. The repo's own `pyproject.toml` declares `[project].name == "scitex"`
+         — a path-independent backstop so the exemption survives clones at
+         non-registered locations (CI checkouts, fresh `gh repo clone`, …).
+    """
+    if _matches_umbrella_registry(repo):
+        return True
+    main_wt = _main_worktree_root(repo)
+    if main_wt is not None and main_wt.resolve() != repo.resolve():
+        if _matches_umbrella_registry(main_wt):
+            return True
+    if _pyproject_distribution_name(repo) == "scitex":
+        return True
     # Fallback: import name `scitex` (rare — would mean repo basename
     # matches the umbrella distribution name).
     return repo.name == "scitex"