sendermap 0.1.0__tar.gz

sendermap-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,96 @@
+# Publish a release to PyPI when a tag v* is pushed, then make the GitHub release.
+#
+# PYPI_READY: publishing is held until the repository variable PYPI_READY is true. It is set
+# under Settings, Secrets and variables, Actions, Variables, once the PyPI trusted publisher
+# exists. Until then a v* tag still builds the sdist and wheel and uploads them as the workflow
+# artifact "dist", and the publish and release jobs are skipped, not failed.
+#
+# build: the sdist and wheel with python -m build, from a full clone so hatch-vcs reads the tag,
+#   checked to carry the tag's version; the tag's section of CHANGELOG.md becomes the release
+#   notes, and a tag without one fails here, before anything is published.
+# publish: uploads to PyPI by trusted publishing (no token: the pypi environment and the
+#   id-token permission), with attestations.
+# release: the GitHub release for the tag, with the notes and the built files.
+
+name: Publish
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0  # hatch-vcs takes the version from the tag
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - name: Build
+        run: |
+          python -m pip install build
+          python -m build
+      - name: Check the version is the tag's
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          ls dist
+          test -f "dist/sendermap-${version}.tar.gz"
+          test -f "dist/sendermap-${version}-py3-none-any.whl"
+      - name: Release notes from CHANGELOG.md
+        run: python tools/release_notes.py "$GITHUB_REF_NAME" > release-notes.md
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-notes
+          path: release-notes.md
+
+  publish:
+    needs: build
+    if: vars.PYPI_READY == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: pypi
+      url: https://pypi.org/p/sendermap
+    permissions:
+      id-token: write  # trusted publishing
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true
+
+  release:
+    needs: publish
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write  # create the release
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: actions/download-artifact@v4
+        with:
+          name: release-notes
+      - name: Create the GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: >
+          gh release create "$GITHUB_REF_NAME" dist/*
+          --repo "$GITHUB_REPOSITORY"
+          --title "Sendermap ${GITHUB_REF_NAME#v}"
+          --notes-file release-notes.md

sendermap-0.1.0/.github/workflows/recheck-corpus.yml

@@ -0,0 +1,49 @@
+# Map every case in tests/corpus live again, weekly (an hour after the proofs job) and by hand,
+# and report how each live map differs from its expected.json, leaving out checked_at and the
+# two run fields. Drift is reported in the job summary and fails nothing: the world changing is
+# not a bug, and a drifted case is re-recorded by hand after reading the diff. The fresh
+# recordings are uploaded for 30 days; nothing is committed. The job fails only when a live map
+# could not be built at all.
+
+name: Recheck corpus
+
+on:
+  schedule:
+    - cron: "0 10 * * 1"  # Monday 10:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  recheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.12"
+      - name: Install
+        run: uv sync --locked --no-dev
+      - name: Map each case live and compare
+        run: |
+          failed=()
+          for case in tests/corpus/*/case.json; do
+            domain=$(basename "$(dirname "$case")")
+            if ! uv run --no-sync python tools/record_corpus.py "$domain" --recheck recheck >>"$GITHUB_STEP_SUMMARY"; then
+              failed+=("$domain")
+              printf '### %s\n\nThe live map could not be built.\n\n' "$domain" >>"$GITHUB_STEP_SUMMARY"
+            fi
+          done
+          if (( ${#failed[@]} )); then
+            echo "::error::no live map for: ${failed[*]}"
+            exit 1
+          fi
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: corpus-recheck-${{ github.run_id }}
+          path: recheck/
+          retention-days: 30
+          if-no-files-found: ignore

sendermap-0.1.0/.github/workflows/test.yml

@@ -0,0 +1,40 @@
+# Run the suite on every push to main, on every pull request and by hand: ruff check, ruff
+# format --check, mypy and pytest, on each supported Python, installed from uv.lock exactly.
+# pytest takes its addopts from pyproject.toml, so the network is blocked here the same way it
+# is locally. Any of the four failing fails the job.
+
+name: Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+      - name: Install
+        run: uv sync --locked --extra web --extra mcp  # mypy and the tests read fastapi and fastmcp
+      - name: ruff check
+        run: uv run --no-sync ruff check
+      - name: ruff format --check
+        run: uv run --no-sync ruff format --check
+      - name: mypy
+        run: uv run --no-sync mypy
+      - name: pytest
+        run: uv run --no-sync pytest

sendermap-0.1.0/.github/workflows/verify-proofs.yml

@@ -0,0 +1,62 @@
+# Recheck every proof in vendors.json against live DNS and the web: on any pull request that
+# touches the file or the checker, weekly, and by hand. A proof not found fails the job, which
+# blocks a pull request; on the weekly run it also opens an issue, or comments on the open one. A
+# proof that could not be checked (timeout, lookup failure, a page that refuses the request) is
+# listed in the output and fails nothing.
+
+name: Verify proofs
+
+on:
+  pull_request:
+    paths:
+      - sendermap/data/vendors.json
+      - tools/verify_proofs.py
+  schedule:
+    - cron: "0 9 * * 1"  # Monday 09:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+defaults:
+  run:
+    shell: bash  # -eo pipefail, so the checker's exit code survives the tee
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.12"
+      - name: Install
+        run: uv sync --locked --no-dev
+      - name: Check every proof
+        id: verify
+        run: uv run --no-sync python tools/verify_proofs.py --json | tee results.jsonl
+      - name: Open or update an issue per failing proof
+        if: failure() && steps.verify.outcome == 'failure' && github.event_name == 'schedule'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          today=$(date -u +%F)
+          open=$(gh issue list --state open --limit 1000 --json number,title)
+          jq -c 'select(.status == "not found")' results.jsonl | while read -r row; do
+            title=$(jq -r '"Proof failed: \(.vendor) \(.field) \(.pattern)"' <<<"$row")
+            body=$(jq -r --arg today "$today" '[
+              "Proof domain: \(.domain)",
+              "Record expected: \(.record), a \(.expected)",
+              "Published now: \(.observed)",
+              "Checked: \($today)"
+            ] | join("\n\n")' <<<"$row")
+            number=$(jq -r --arg title "$title" \
+              'first(.[] | select(.title == $title) | .number) // empty' <<<"$open")
+            if [[ -n $number ]]; then
+              gh issue comment "$number" --body "$body" </dev/null
+            else
+              gh issue create --title "$title" --body "$body" </dev/null
+            fi
+          done

sendermap-0.1.0/.gitignore

@@ -0,0 +1,5 @@
+node_modules/
+_site/
+.DS_Store
+*.log
+__pycache__/