settfex 0.2.1__tar.gz → 0.3.1__tar.gz

{settfex-0.2.1 → settfex-0.3.1}/.github/workflows/release.yml

@@ -141,7 +141,6 @@ jobs:
           path: dist/
 
       - name: Extract changelog section
-        id: changelog
         run: |
           VERSION="${{ needs.validate.outputs.version }}"
           python3 - "$VERSION" <<'PYEOF'
@@ -152,19 +151,14 @@ jobs:
           match = re.search(pattern, content, re.DOTALL)
           notes = match.group(1).strip() if match else f"Release v{version}"
           with open("release_notes.txt", "w") as f:
-              f.write(notes)
+              f.write(notes + "\n")
           PYEOF
-          {
-            echo 'notes<<CHANGELOG_EOF'
-            cat release_notes.txt
-            echo 'CHANGELOG_EOF'
-          } >> "$GITHUB_OUTPUT"
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           name: "settfex v${{ needs.validate.outputs.version }}"
-          body: ${{ steps.changelog.outputs.notes }}
+          body_path: release_notes.txt
           prerelease: ${{ needs.validate.outputs.is_prerelease }}
           files: dist/*
           make_latest: ${{ needs.validate.outputs.is_prerelease == 'false' }}

{settfex-0.2.1 → settfex-0.3.1}/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.1] - 2026-11-02
+
+Security backport for the 0.3 line: the same fix as 0.26.1, with nothing else changed.
+
+### Security
+
+- **The session cache no longer unpickles anything, and `diskcache` is no longer a dependency**
+  (`settfex.utils.session_cache`). `diskcache` reads cached values back with pickle
+  (PYSEC-2026-2447 / CVE-2025-69872 / GHSA-w8v5-vhqr-4h9v). It has no fixed release, so anyone
+  able to write into the cache directory could execute code in the process that read it.
+  - The store is now stdlib `sqlite3` holding JSON text (`sessions.sqlite3`, created `0600`
+    inside a `0700` directory). A row that is not a JSON object is a cache miss, never code.
+  - The old `cache.db` is never opened, so a session warms up once after the upgrade.
+  - `SessionCache`'s API is unchanged.
+
+## [0.3.0] - 2026-06-17
+
+### Added
+
+- **TFEX underlying-price service** (`get_underlying_price`, `TFEXUnderlyingPriceService`,
+  `UnderlyingPrice`): fetches the underlying instrument price for a TFEX series via
+  `GET /api/set/tfex/series/{symbol}/underlying-price`. For SET50 index options/futures the underlying
+  is the **SET50 index spot** — exposes last/prior/high/low, change, total volume/value, and P/E + P/BV.
+  Mirrors the existing TFEX service pattern (SessionManager/Incapsula bypass, NaN-rejecting hardened
+  parsing, `get_*` convenience function + `*_raw` variant); 100% module test coverage. Adds the
+  `verify_underlying_price.py` script and the `examples/tfex/03_underlying_price.ipynb` notebook.
+
 ## [0.2.1] - 2026-06-17
 
 Robustness and concurrency hardening release. No public API changes — function

{settfex-0.2.1 → settfex-0.3.1}/CONTRIBUTING.md

@@ -61,6 +61,12 @@ Detailed engineering guidelines live in [`.github/instructions/`](.github/instru
 4. Ensure the quality gate passes.
 5. Open a PR using the template and link any related issue.
 
+## Releasing
+
+Releases go through a single path: bump the version, update `CHANGELOG.md`, merge to `main`,
+then push a `vX.Y.Z` git tag. The tag triggers CI to publish to PyPI (via OIDC) and create the
+GitHub Release. See [`RELEASING.md`](RELEASING.md) for the exact steps and the one-time setup.
+
 ## Reporting security issues
 
 Please do **not** open public issues for vulnerabilities — see

{settfex-0.2.1 → settfex-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: settfex
-Version: 0.2.1
+Version: 0.3.1
 Summary: Async Python library for fetching real-time and historical data from the Stock Exchange of Thailand (SET) and Thailand Futures Exchange (TFEX)
 Project-URL: Homepage, https://github.com/lumduan/settfex
 Project-URL: Documentation, https://github.com/lumduan/settfex#readme
@@ -27,7 +27,6 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Requires-Dist: curl-cffi>=0.6.0
-Requires-Dist: diskcache>=5.6.0
 Requires-Dist: loguru>=0.7.0
 Requires-Dist: pydantic>=2.0.0
 Provides-Extra: examples

settfex-0.3.1/RELEASING.md

@@ -0,0 +1,73 @@
+# Releasing settfex
+
+settfex publishes to PyPI through **one canonical path: pushing a `vX.Y.Z` git tag.**
+
+The tag triggers [`.github/workflows/release.yml`](.github/workflows/release.yml), which:
+
+1. validates the tag matches `pyproject.toml`,
+2. runs the full CI gate (ruff, format, mypy, pytest),
+3. builds the sdist + wheel,
+4. publishes to PyPI via an **OIDC Trusted Publisher** (no API token), and
+5. creates the GitHub Release with the changelog body + built artifacts.
+
+There is intentionally **no second PyPI upload path in the repo** — the workflow is the only
+thing that runs `twine`. Its publish step uses `skip-existing: true`, so re-tagging (or a one-off
+manual rescue) never hard-fails on an already-published file.
+
+## Cut a release
+
+1. Bump the version in **both** `pyproject.toml` and `settfex/__init__.py` (keep them in sync).
+2. Add a `## [X.Y.Z] - YYYY-MM-DD` section to `CHANGELOG.md`.
+3. Commit, open a PR, and merge to `main`.
+4. From an up-to-date `main`, tag and push:
+
+   ```bash
+   git checkout main && git pull --ff-only
+   git tag -a vX.Y.Z -m "settfex X.Y.Z"
+   git push origin vX.Y.Z
+   ```
+
+   CI does the rest — watch:
+   <https://github.com/lumduan/settfex/actions/workflows/release.yml>
+
+> **Maintainer convenience.** A local, gitignored `scripts/publish.sh` performs the same tag
+> push behind pre-flight checks (version sync between `pyproject.toml` and `settfex/__init__.py`,
+> a clean/synced `main`, the CHANGELOG section, and tag uniqueness). It never runs `twine`; it
+> only tags. It is not shipped in the repo because the tag push above is the real interface.
+
+## One-time setup: PyPI Trusted Publisher (required for the OIDC publish)
+
+This must be done once on pypi.org or the publish step will fail. On
+<https://pypi.org/manage/project/settfex/settings/publishing/>, add a **GitHub Actions**
+publisher:
+
+| Field | Value |
+|---|---|
+| Owner | `lumduan` |
+| Repository | `settfex` |
+| Workflow name | `release.yml` |
+| Environment | `pypi` |
+
+Then create the `pypi` environment under **GitHub → Settings → Environments** (it can be empty;
+the workflow references `environment: pypi`).
+
+## Break-glass: manual publish (fallback only)
+
+Use **only** if the tag/CI path is unavailable (e.g. an Actions outage). Requires a
+project-scoped token in a gitignored `.env` (`PYPI_TOKEN=pypi-…`):
+
+```bash
+rm -rf dist
+uv run python -m build
+uv run twine check dist/*
+uv run twine upload dist/* --username __token__ --password "$PYPI_TOKEN"
+```
+
+Prefer the tag-driven path. Because CI uses `skip-existing: true`, a later tag for the same
+version still succeeds and just backfills the GitHub Release.
+
+## Recommended follow-up
+
+Single-source the version (e.g. Hatchling `[tool.hatch.version] path = "settfex/__init__.py"`
+with `dynamic = ["version"]`) so `pyproject.toml` and the package can never drift again. The
+release workflow's validate step reads `project.version`, so adjust it if you switch.