shkit 1.2.0__tar.gz → 1.2.1__tar.gz

{shkit-1.2.0 → shkit-1.2.1}/.github/workflows/build-wheel.yml

@@ -19,8 +19,8 @@ jobs:
       DATABRICKS_HOST: ${{ secrets.DATABRICKS_HOST }}
       DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 
@@ -49,7 +49,7 @@ jobs:
           python scripts/smoke_local.py "$WHEEL"
 
       - name: Upload wheel artifact (always)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: iic-wheel
           path: dist/*.whl

{shkit-1.2.0 → shkit-1.2.1}/.github/workflows/ci.yml

@@ -9,8 +9,8 @@ jobs:
   lint-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
       - name: Install package

{shkit-1.2.0 → shkit-1.2.1}/.github/workflows/deploy-prod.yml

@@ -12,9 +12,9 @@ jobs:
     if: github.event.inputs.confirm == 'deploy-prod'
     environment: production
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: databricks/setup-cli@main
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 

{shkit-1.2.0 → shkit-1.2.1}/.github/workflows/incident-dispatch.yml

@@ -16,9 +16,9 @@ jobs:
   investigate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 

{shkit-1.2.0 → shkit-1.2.1}/.github/workflows/publish-tenant.yml

@@ -30,16 +30,16 @@ jobs:
     # environment: production
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Checkout tenant config (Access-private)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: yogasathyandrun/Access-private
           path: _tenants
           token: ${{ secrets.CONFIG_REPO_TOKEN }}
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 

{shkit-1.2.0 → shkit-1.2.1}/.github/workflows/pull-antibodies.yml

@@ -31,16 +31,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Checkout tenant config (Access-private, write scope)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: yogasathyandrun/Access-private
           path: _tenants
           token: ${{ secrets.CONFIG_REPO_TOKEN }}
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 

{shkit-1.2.0 → shkit-1.2.1}/.github/workflows/push-antibodies.yml

@@ -26,7 +26,7 @@ name: "[DEPRECATED] Push antibodies to tenant"
 #     notify:
 #       runs-on: ubuntu-latest
 #       steps:
-#         - uses: actions/checkout@v4
+#         - uses: actions/checkout@v6
 #         - name: Fire push for each changed tenant
 #           env:
 #             GH_TOKEN: ${{ secrets.KIT_DISPATCH_TOKEN }}   # repo scope on Self-healing-kit
@@ -62,16 +62,16 @@ jobs:
         run: echo "tenant=${{ inputs.tenant || github.event.client_payload.tenant }}" >> "$GITHUB_OUTPUT"
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Checkout tenant config (Access-private)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: yogasathyandrun/Access-private
           path: _tenants
           token: ${{ secrets.CONFIG_REPO_TOKEN }}
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 

shkit-1.2.1/.github/workflows/release-pypi.yml

@@ -0,0 +1,125 @@
+name: Publish to PyPI
+
+# Two ways to cut a release — BOTH publish via Trusted Publishing (OIDC); no token stored.
+#
+#   • One-click (recommended): Actions → "Publish to PyPI" → Run workflow → type the new
+#     version (e.g. 1.2.1). It bumps pyproject.toml + iic.__version__, commits to main,
+#     tags v<version>, runs the gate, and publishes. No "forgot to bump" mistakes.
+#   • Manual: bump the version yourself, then `git tag vX.Y.Z && git push origin vX.Y.Z`.
+#
+# IMPORTANT: the FILENAME must stay `release-pypi.yml` — the PyPI Trusted Publisher is
+# bound to it. (The sidebar shows the display name above, "Publish to PyPI".)
+#
+# The one-click path commits the bump to `main`; if `main` has branch protection that
+# blocks the Actions bot, use the manual path (or allow the bot to push).
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "New version, e.g. 1.2.1 (bumps pyproject + __init__, commits to main, tags v<version>)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  prepare:
+    # Only the one-click path runs this; the manual `git tag` path skips straight to gate.
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # commit the version bump + push the tag
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: main
+      - name: Validate version, bump, commit, tag
+        run: |
+          set -e
+          V="${{ inputs.version }}"
+          echo "$V" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+([._-]?(a|b|rc|post|dev)[0-9]+)?$' \
+            || { echo "❌ '$V' is not a valid version (expected like 1.2.1)"; exit 1; }
+          if git rev-parse "v$V" >/dev/null 2>&1; then echo "❌ tag v$V already exists"; exit 1; fi
+          python - "$V" <<'PY'
+          import re, sys, pathlib
+          v = sys.argv[1]
+          for path, key in (("pyproject.toml", "version"), ("src/iic/__init__.py", "__version__")):
+              p = pathlib.Path(path)
+              pat = rf'(?m)^{re.escape(key)} = ".*"'
+              new = p.read_text()
+              if not re.search(pat, new):
+                  raise SystemExit(f"could not find {key} in {path}")
+              p.write_text(re.sub(pat, f'{key} = "{v}"', new, count=1))
+          print("bumped to", v)
+          PY
+          git config user.name "iic-release-bot"
+          git config user.email "iic-release-bot@users.noreply.github.com"
+          git commit -am "release v$V"
+          git tag "v$V"
+          git push origin HEAD:main
+          git push origin "v$V"
+          echo "✅ committed bump + pushed tag v$V"
+
+  gate:
+    needs: [prepare]
+    # Runs on a manual tag push, OR after prepare succeeds on the one-click path.
+    if: always() && (github.event_name == 'push' || needs.prepare.result == 'success')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('v{0}', inputs.version) || github.ref }}
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install + lint + unit tests
+        run: |
+          pip install -e ".[dev]"
+          ruff check src/ onboarding/ --ignore E501
+          pytest tests/unit/ -q
+
+      - name: Build sdist + wheel
+        run: |
+          pip install build
+          python -m build
+          ls -l dist/
+
+      - name: Gate — .pth at wheel root + arms on install
+        run: |
+          set -e
+          WHEEL=$(ls dist/*.whl | head -1)
+          python -m zipfile -l "$WHEEL" | awk '{print $1}' | grep -qxE 'iic_autoload\.pth' \
+            || { echo "FAIL: iic_autoload.pth not at wheel root"; exit 1; }
+          python -m venv /tmp/relvenv
+          /tmp/relvenv/bin/pip install --quiet "$WHEEL"
+          /tmp/relvenv/bin/python -c "import sys; assert 'iic.runtime.bootstrap' in sys.modules, 'bootstrap not auto-imported'; print('OK: tripwire armed at startup')"
+
+      - name: Gate — self-arming smoke (failure → one card)
+        run: |
+          WHEEL=$(ls dist/*.whl | head -1)
+          python scripts/smoke_local.py "$WHEEL"
+
+      - name: Upload dist
+        uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/*
+
+  publish:
+    needs: gate
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # OIDC for PyPI Trusted Publishing — no API token stored
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist
+      - name: Publish to PyPI (Trusted Publishing / OIDC)
+        uses: pypa/gh-action-pypi-publish@release/v1

{shkit-1.2.0 → shkit-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: shkit
-Version: 1.2.0
+Version: 1.2.1
 Summary: Deterministic + AI hybrid engine that converts Databricks pipeline failures into prioritized, explainable incident intelligence
 Author-email: Sathya <yogasathyandrun.rajesh@zeb.co>
 License: MIT

{shkit-1.2.0 → shkit-1.2.1}/pyproject.toml

@@ -8,7 +8,7 @@ build-backend = "hatchling.build"
 # `pip install shkit` but still `import iic`. This MUST match the PyPI Trusted
 # Publisher's project name (see .github/workflows/release-pypi.yml + docs/INSTALL.md).
 name = "shkit"
-version = "1.2.0"
+version = "1.2.1"
 description = "Deterministic + AI hybrid engine that converts Databricks pipeline failures into prioritized, explainable incident intelligence"
 readme = "README.md"
 requires-python = ">=3.11"

{shkit-1.2.0 → shkit-1.2.1}/src/iic/__init__.py

@@ -17,7 +17,7 @@ The 11-stage pipeline lives in :mod:`iic.runtime.incident_engine`.
 
 from __future__ import annotations
 
-__version__ = "1.2.0"
+__version__ = "1.2.1"
 
 # NOTE: `import iic` is intentionally lightweight and does NOT arm anything.
 # The self-arming tripwire is installed by `iic_autoload.pth` at interpreter

shkit-1.2.0/.github/workflows/release-pypi.yml

@@ -1,75 +0,0 @@
-name: Release to PyPI
-
-# On a version tag (v*): build sdist+wheel, run the FULL gate (lint + unit tests +
-# the .pth-at-wheel-root assertion + the fresh-venv arms-on-install + the
-# self-arming smoke), then publish to PyPI via TRUSTED PUBLISHING (OIDC). No PyPI
-# API token is stored anywhere.
-#
-# ONE-TIME MAINTAINER SETUP (on PyPI, before the first release):
-#   1. Claim the distribution name in pyproject.toml [project].name. `iic` may be
-#      taken — if so, change [project].name (the ONLY place the dist name lives;
-#      the import name stays `iic`) and re-run the grep check in docs/INSTALL.md.
-#   2. Add a PyPI "Trusted Publisher": this repo, workflow `release-pypi.yml`,
-#      environment `pypi`. See https://docs.pypi.org/trusted-publishers/.
-on:
-  push:
-    tags: ["v*"]
-
-permissions:
-  contents: read
-
-jobs:
-  gate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install + lint + unit tests
-        run: |
-          pip install -e ".[dev]"
-          ruff check src/ onboarding/ --ignore E501
-          pytest tests/unit/ -q
-
-      - name: Build sdist + wheel
-        run: |
-          pip install build
-          python -m build
-          ls -l dist/
-
-      - name: Gate — .pth at wheel root + arms on install
-        run: |
-          set -e
-          WHEEL=$(ls dist/*.whl | head -1)
-          python -m zipfile -l "$WHEEL" | awk '{print $1}' | grep -qxE 'iic_autoload\.pth' \
-            || { echo "FAIL: iic_autoload.pth not at wheel root"; exit 1; }
-          python -m venv /tmp/relvenv
-          /tmp/relvenv/bin/pip install --quiet "$WHEEL" 2>/dev/null || /tmp/relvenv/bin/pip install --quiet "$WHEEL"
-          /tmp/relvenv/bin/python -c "import sys; assert 'iic.runtime.bootstrap' in sys.modules, 'bootstrap not auto-imported'; print('OK: tripwire armed at startup')"
-
-      - name: Gate — self-arming smoke (failure → one card)
-        run: |
-          WHEEL=$(ls dist/*.whl | head -1)
-          python scripts/smoke_local.py "$WHEEL"
-
-      - name: Upload dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist
-          path: dist/*
-
-  publish:
-    needs: gate
-    runs-on: ubuntu-latest
-    environment: pypi
-    permissions:
-      id-token: write   # OIDC for PyPI Trusted Publishing — no API token stored
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          name: dist
-          path: dist
-      - name: Publish to PyPI (Trusted Publishing / OIDC)
-        uses: pypa/gh-action-pypi-publish@release/v1