shacl2code 1.1.0__tar.gz → 1.3.2__tar.gz

shacl2code-1.3.2/.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

shacl2code-1.3.2/.github/workflows/bandit.yaml

@@ -0,0 +1,30 @@
+---
+name: Bandit
+
+on:
+  push:
+    # Only run when shacl2code's own Python source could be affected
+    paths: &trigger-paths
+      - "src/shacl2code/**"
+      - "pyproject.toml"
+      - ".github/workflows/bandit.yaml"
+  pull_request:
+    paths: *trigger-paths
+
+permissions:
+  contents: read
+
+jobs:
+  bandit:
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload results to the code scanning dashboard
+      security-events: write
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Run Bandit
+        uses: PyCQA/bandit-action@67a458d90fa11fb1463e91e7f4c8f068b5863c7f # v1.0.1
+        with:
+          targets: src/shacl2code

{shacl2code-1.1.0 → shacl2code-1.3.2}/.github/workflows/coverage-generate.yaml

@@ -7,6 +7,10 @@ on:
     branches:
       - "main"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
@@ -23,31 +27,46 @@ jobs:
       # comments (to avoid publishing multiple comments in the same PR)
       contents: write
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - name: Setup Python ${{ matrix.python-version }}
-        uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: "pyproject.toml"
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
       - name: Install dependencies
         run: |
-          sudo apt install -y build-essential doxygen graphviz
+          sudo apt install -y build-essential cppcheck doxygen graphviz
+          npm install -g jsonld-cli
+          npm --prefix scripts ci
+      - name: Install Go static analysis tools
+        run: |
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+          go install honnef.co/go/tools/cmd/staticcheck@latest
+      - name: Install Rust static analysis tools
+        run: |
+          rustup component add clippy
       - name: Install package
         run: |
+          pip install --upgrade pip
           pip install -e .[dev]
       - name: Generate coverage report
         run: |
           pytest -v
       - name: Coverage comment
         id: coverage_comment
-        uses: py-cov-action/python-coverage-comment-action@2b84cfb222691291ba358a586c13606f0a9c172c # v3
+        uses: py-cov-action/python-coverage-comment-action@a05be3d2e8a6272d3ef5fb2840ab20368bb2eb71 # v4.3
         with:
           GITHUB_TOKEN: ${{ github.token }}
       - name: Store Pull Request comment to be posted
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: steps.coverage_comment.outputs.COMMENT_FILE_WRITTEN == 'true'
         with:
           # If you use a different name, update COMMENT_ARTIFACT_NAME accordingly
           name: python-coverage-comment-action
           # If you use a different name, update COMMENT_FILENAME accordingly
           path: python-coverage-comment-action.txt
-

{shacl2code-1.1.0 → shacl2code-1.3.2}/.github/workflows/coverage-report.yaml

@@ -30,7 +30,7 @@ jobs:
       # DO NOT run actions/checkout here, for security reasons
       # For details, refer to https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
       - name: Post comment
-        uses: py-cov-action/python-coverage-comment-action@2b84cfb222691291ba358a586c13606f0a9c172c # v3
+        uses: py-cov-action/python-coverage-comment-action@a05be3d2e8a6272d3ef5fb2840ab20368bb2eb71 # v4.3
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_PR_RUN_ID: ${{ github.event.workflow_run.id }}

shacl2code-1.3.2/.github/workflows/publish.yaml

@@ -0,0 +1,71 @@
+---
+name: Upload Python Package
+on:
+  release:
+    types:
+      - published
+
+jobs:
+  test:
+    uses: ./.github/workflows/test.yaml
+
+  deploy:
+    needs:
+      - test
+
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.x'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install build spdx3-validate
+
+      - name: Build package
+        run: python -m build
+
+      - name: Embed SBOM into the wheel
+        id: pitloom
+        uses: bact/pitloom@68b02e2052902012716c6b888addbaf95d5e1bf5 # v0.17.0
+        with:
+          embed-wheel: "dist/*.whl"
+          extras: "content-type"
+          content-type: "true"
+          artifact-name: "sbom"
+
+      - name: Extract and validate embedded SBOM
+        env:
+          SBOM_PATH: ${{ steps.pitloom.outputs.sbom-path }}
+        run: |
+          set -euo pipefail
+          whl=$(ls dist/*.whl)
+          sbom_basename=$(basename "${SBOM_PATH}")
+
+          entry=""
+          while IFS= read -r line; do
+            case "${line}" in
+              *".dist-info/sboms/${sbom_basename}") entry="${line}"; break ;;
+            esac
+          done < <(unzip -Z1 "${whl}")
+
+          if [ -z "${entry}" ]; then
+            echo "::error::${sbom_basename} not found under */.dist-info/sboms/ in ${whl}"
+            exit 1
+          fi
+          echo "Found: ${entry}"
+
+          mkdir -p extracted-sbom
+          unzip -p "${whl}" "${entry}" > "extracted-sbom/${sbom_basename}"
+          spdx3-validate --json "extracted-sbom/${sbom_basename}"
+
+      - name: Publish distribution to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

{shacl2code-1.1.0 → shacl2code-1.3.2}/.github/workflows/scorecard.yml

@@ -32,12 +32,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif

shacl2code-1.3.2/.github/workflows/test-sbom.yaml

@@ -0,0 +1,73 @@
+---
+# Tests that the SBOM generation and embedding step works correctly on every PR.
+name: Test SBOM generation
+
+on:
+  push:
+    paths-ignore: &ignore-paths
+      - "docs/**"
+      - "**/*.md"
+      - "LICENSE*"
+  pull_request:
+    paths-ignore: *ignore-paths
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test-sbom:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.x"
+          cache: pip
+
+      - name: Install build tooling
+        run: |
+          python -m pip install --upgrade pip
+          pip install build spdx3-validate
+
+      - name: Build wheel
+        run: python -m build --wheel
+
+      - name: Embed SBOM into the wheel
+        id: pitloom
+        uses: bact/pitloom@68b02e2052902012716c6b888addbaf95d5e1bf5 # v0.17.0
+        with:
+          embed-wheel: "dist/*.whl"
+          extras: "content-type"
+          content-type: "true"
+          artifact-name: "sbom"
+
+      - name: Extract and validate embedded SBOM
+        env:
+          SBOM_PATH: ${{ steps.pitloom.outputs.sbom-path }}
+        run: |
+          set -euo pipefail
+          whl=$(ls dist/*.whl)
+          sbom_basename=$(basename "${SBOM_PATH}")
+
+          entry=""
+          while IFS= read -r line; do
+            case "${line}" in
+              *".dist-info/sboms/${sbom_basename}") entry="${line}"; break ;;
+            esac
+          done < <(unzip -Z1 "${whl}")
+
+          if [ -z "${entry}" ]; then
+            echo "::error::${sbom_basename} not found under */.dist-info/sboms/ in ${whl}"
+            exit 1
+          fi
+          echo "Found: ${entry}"
+
+          mkdir -p extracted-sbom
+          unzip -p "${whl}" "${entry}" > "extracted-sbom/${sbom_basename}"
+          spdx3-validate --json "extracted-sbom/${sbom_basename}"

shacl2code-1.3.2/.github/workflows/test.yaml

@@ -0,0 +1,102 @@
+---
+name: Test shacl2code
+on:
+  push:
+    # Skip changes in docs and other workflows
+    paths: &trigger-paths
+      - "**"
+      - "!**/*.md"
+      - "!LICENSE"
+      - "!.github/ISSUE_TEMPLATE/**"
+      - "!.github/workflows/**"
+      - ".github/workflows/test.yaml"
+  pull_request:
+    paths: *trigger-paths
+  workflow_call:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
+        include:
+          - os: macos-latest
+            python-version: "3.10"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Setup Python ${{ matrix.python-version }}
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: scripts/package-lock.json
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install build
+          npm install -g jsonld-cli
+          npm --prefix scripts ci
+      - name: Install Linux packages
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt update
+          sudo apt install -y build-essential cppcheck doxygen graphviz ccache
+      - name: Install macOS packages
+        if: runner.os == 'macOS'
+        run: |
+          brew update
+          brew install cppcheck doxygen gcc go graphviz ccache
+      - name: Install Go static analysis tools
+        run: |
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+          go install honnef.co/go/tools/cmd/staticcheck@latest
+      - name: Install Rust static analysis tools
+        run: |
+          rustup component add clippy
+      - name: Configure ccache
+        uses: hendrikmuhs/ccache-action@v1.2
+        with:
+          key: ${{ github.job }}-${{ matrix.os }}-${{ matrix.python-version }}
+      - name: Build package
+        run: |
+          python -m build
+      - name: Install package
+        run: |
+          pip install -e .[dev]
+      - name: Run tests
+        run: |
+          pytest -v
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          # Black in this Python version must support all target-versions listed in pyproject.toml
+          python-version: "3.14"
+          cache: pip
+      - uses: psf/black@87928e6d6761a4a6d22250e1fee5601b3998086e # 26.5.1
+      - uses: py-actions/flake8@84ec6726560b6d5bd68f2a5bed83d62b52bb50ba # v2.3.0
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install clang-format
+      - name: Check code formatting
+        run: |
+          ./scripts/format.sh
+          git diff --exit-code

{shacl2code-1.1.0 → shacl2code-1.3.2}/.gitignore

@@ -1,3 +1,8 @@
+# Node
+node_modules/
+package.json
+package-lock.json
+
 # Byte-compiled / optimized / DLL files
 __pycache__/
 *.py[cod]

{shacl2code-1.1.0 → shacl2code-1.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: shacl2code
-Version: 1.1.0
+Version: 1.3.2
 Summary: Convert SHACL model file to code bindings
 Project-URL: Homepage, https://github.com/JPEWdev/shacl2code
 Project-URL: Repository, https://github.com/JPEWdev/shacl2code.git
@@ -10,33 +10,41 @@ License-Expression: MIT
 License-File: LICENSE
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: C++
+Classifier: Programming Language :: Go
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Rust
+Classifier: Topic :: File Formats :: JSON :: JSON Schema
 Classifier: Topic :: Software Development :: Build Tools
-Requires-Python: >=3.8
+Classifier: Topic :: Software Development :: Code Generators
+Requires-Python: >=3.9
 Requires-Dist: jinja2>=3.1.2
 Requires-Dist: rdflib>=7.0.0
 Provides-Extra: dev
+Requires-Dist: bandit<1.10.0,>=1.8.6; extra == 'dev'
+Requires-Dist: black>=25.11.0; extra == 'dev'
 Requires-Dist: flake8-import-order>=0.19.2; extra == 'dev'
 Requires-Dist: flake8>=7.0.0; extra == 'dev'
-Requires-Dist: jsonschema>=4.23.0; extra == 'dev'
-Requires-Dist: mypy>=1.14.1; extra == 'dev'
+Requires-Dist: jsonschema>=4.25.1; extra == 'dev'
+Requires-Dist: mypy>=1.19.1; extra == 'dev'
 Requires-Dist: pyrefly>=0.55.0; extra == 'dev'
 Requires-Dist: pyright>=1.1.403; extra == 'dev'
-Requires-Dist: pyshacl>=0.25.0; extra == 'dev'
+Requires-Dist: pyshacl!=0.40.0,>=0.25.0; extra == 'dev'
 Requires-Dist: pytest-cov>=4.1; extra == 'dev'
+Requires-Dist: pytest-xdist>=3.5; extra == 'dev'
 Requires-Dist: pytest>=7.4; extra == 'dev'
-Requires-Dist: types-jsonschema>=4.23.0; extra == 'dev'
+Requires-Dist: types-jsonschema>=4.25.1; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # Convert SHACL Model to code bindings
 
+[![PyPI - Version](https://img.shields.io/pypi/v/shacl2code)](https://pypi.org/project/shacl2code/)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/9999/badge)](https://www.bestpractices.dev/projects/9999)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/JPEWdev/shacl2code/badge)](https://scorecard.dev/viewer/?uri=github.com/JPEWdev/shacl2code)
 [![Coverage Report](https://raw.githubusercontent.com/JPEWdev/shacl2code/python-coverage-comment-action-data/badge.svg)](https://htmlpreview.github.io/?https://github.com/JPEWdev/shacl2code/blob/python-coverage-comment-action-data/htmlcov/index.html)
@@ -83,6 +91,59 @@ The available language bindings can be viewed by running:
 shacl2code list
 ```
 
+### Using JSON-LD contexts
+
+When using JSON-LD contexts, the context document shall align with the model.
+
+During model development, there may be cases where the context URL is known
+but not yet live or resolvable. In these situations, you can use the
+`--context-url` option to map your local context file to its future public home.
+
+The `--context-url` option accepts two arguments:
+
+1. `CONTEXT_LOCATION`: The actual path to the local or temporary file
+   containing the context.
+2. `CONTEXT_URL`: The official public URL. While temporarily unresolvable
+   during development, this is the URL that production JSON-LD processors will
+   eventually rely on, so it must be recorded inside the generated JSON Schema.
+
+### Generating the JSON Schema file
+
+`shacl2code` can generate a JSON Schema directly from a model.
+
+To view all options specific to JSON Schema generation, run:
+
+```shell
+shacl2code generate jsonschema -h
+```
+
+#### Example 1: Generating from publicly available URLs
+
+To generate a schema using remote, publicly accessible assets
+(such as SPDX 3.0.1):
+
+```shell
+shacl2code generate \
+    --input https://spdx.org/rdf/3.0.1/spdx-model.ttl \
+    --input https://spdx.org/rdf/3.0.1/spdx-json-serialize-annotations.ttl \
+    --context https://spdx.org/rdf/3.0.1/spdx-context.jsonld \
+    jsonschema \
+    --output spdx-json-schema.json
+```
+
+#### Example 2: Generating with a local context document
+
+To generate a schema using a local context file while embedding its future
+public URL:
+
+```shell
+shacl2code generate \
+    --input model-draft.ttl \
+    --context-url context-draft.jsonld https://example.com/context.jsonld \
+    jsonschema \
+   --output schema.json
+```
+
 ## Developing
 
 Developing on `shacl2code` is best done using a virtual environment. You can
@@ -250,5 +311,66 @@ classes are automatically concrete unless they indicate otherwise.
 It is also possible to define a class as abstract by declaring it to be of
 type: `http://spdx.invalid./AbstractClass`, but this is not preferred.
 
+### Pre-Release models
+
+`shacl2code` can detect if an ontology is a "pre-release" version (still
+subject to breaking changes). For language bindings that support it (such as
+Python), importing a pre-release ontology binding will emit a warning
+(e.g. `FutureWarning`).
+
+Pre-release status can be specified explicitly via command-line options,
+or inferred automatically from various ontology annotations. For example,
+
+```ttl
+<http://example.org/my-ontology> a ow:Ontology ;
+   sh-to-code:isPreRelease true
+   .
+```
+
+Note that the IRI of the ontology must be the prefix of all IRIs that belong to
+that ontology.
+
+In the event of conflicting annotations, `shacl2code` evaluates pre-release
+status using the following order of precedence (1 = the highest priority):
+
+1. **`--pre-release` or `--no-pre-release` command-line options**:
+   Explicitly marks the generated bindings as pre-release or stable,
+   overriding any annotations in the input ontology.
+2. **`sh-to-code:isPreRelease`**:
+   The `shacl2code` custom boolean annotation
+   (`sh-to-code:isPreRelease true` or `false`).
+3. **`adms:status` (EU SEMIC Vocabulary)**:
+   If the status is
+   `<http://publications.europa.eu/resource/authority/dataset-status/DEVELOP>`,
+   it is considered a pre-release.
+   Other values in the dataset-status vocabulary space (e.g. `COMPLETED`)
+   indicate a stable release.
+4. **`adms:status` (Original ADMS Vocabulary)**:
+   If the status is `<http://purl.org/adms/status/UnderDevelopment>`,
+   it is considered a pre-release.
+   Other values in the ADMS status namespace (e.g. `Completed`)
+   indicate a stable release.
+5. **`bibo:status` (Bibliographic Ontology)**:
+   If set to `<http://purl.org/ontology/bibo/status/draft>`, it is
+   considered a pre-release.
+   Other values in the BIBO status namespace (e.g. `published`, `legal`)
+   indicate a stable release.
+6. **`schema:creativeWorkStatus`**:
+   If set to `"Draft"` or `"Incomplete"`, it is considered a pre-release.
+   Other values (e.g. `"Published"`) indicate a stable release.
+7. **`vs:term_status`**:
+   If set to `"unstable"` or `"testing"`, it is considered a pre-release.
+   Other values (e.g. `"stable"`) indicate a stable release.
+8. **`owl:versionInfo` (pre-release extension)**:
+   If the version string contains a pre-release extension suffix
+   (e.g., `-alpha`, `-beta`, `-dev`, `-rc`, `-SNAPSHOT`, `.alpha`, etc.).
+9. **`owl:versionInfo` (major version zero)**:
+   If the version string corresponds to a major version zero in
+   [Semantic Versioning][semver] (e.g., `0.7.1`).
+10. **Default Fallback**:
+    If none of the above are present, the ontology is assumed to be a stable
+    release.
+
 [pytest]: https://www.pytest.org
 [pytest-cov]: https://pytest-cov.readthedocs.io/en/latest/
+[semver]: https://semver.org/