skcomms 0.2.6__tar.gz → 0.2.8__tar.gz

{skcomms-0.2.6 → skcomms-0.2.8}/.github/workflows/publish.yml

@@ -150,6 +150,15 @@ jobs:
 
   pypi-publish:
     needs: build
+    # Same always() guard the build job needs, one level further down.
+    # GitHub propagates a skip THROUGH a job: `tag` is skipped on the tag-push
+    # path, `build` survives it with always(), but a bare `needs: build` here
+    # still evaluates to skipped, because an ANCESTOR was skipped. The publish
+    # step could then never run on a tag push: the build is green, the run
+    # reports success, and NOTHING is uploaded. skharness lost v0.3.13 to this
+    # exact bug. Ported from skcoord PR #6.
+    if: >-
+      always() && !cancelled() && needs.build.result == 'success'
     runs-on: ubuntu-latest
     environment: pypi
     permissions:

skcomms-0.2.8/.github/workflows/secret-scan.yml

@@ -0,0 +1,61 @@
+name: secret-scan
+
+# Secret-scan gate: keeps the repo's clean secrets hygiene true over time.
+#
+# Runs gitleaks (the fleet default, via its official GitHub Action) on every
+# push and every pull request. The build FAILS if gitleaks finds anything not
+# covered by the baseline allowlist in .gitleaks.toml at the repo root.
+#
+# The allowlist documents known non-secret placeholder tokens; see that file
+# for how to add an entry when a real placeholder trips the scanner. If the
+# scanner flags a REAL secret, rotate it and purge it from history, do NOT
+# add it to the allowlist.
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Full history so a push scans every new commit, not just the tip.
+          fetch-depth: 0
+      # Run the gitleaks BINARY, not gitleaks-action.
+      #
+      # The action requires a paid license for ORGANIZATION-owned repos, and
+      # this repo is owned by the smilinTux org, so every run died with
+      # "missing gitleaks license" BEFORE scanning anything. That is worse than
+      # having no gate: the check sat red on main for months, so it read as
+      # known-broken and got ignored, while the repo had no secret scanning at
+      # all. It also hid a real (benign) finding, see .gitleaks.toml.
+      #
+      # gitleaks itself is MIT-licensed and free. Only the ACTION wrapper is
+      # licensed, so invoking the binary directly restores real scanning at no
+      # cost and with no org secret to provision. Pinned to an exact version so
+      # a new upstream rule cannot turn CI red without a deliberate bump.
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: 8.28.0
+        run: |
+          set -euo pipefail
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+      - name: Run gitleaks
+        # --redact so a genuine finding never echoes the secret into public CI
+        # logs. --exit-code 1 makes a finding fail the build.
+        run: |
+          gitleaks detect \
+            --source . \
+            --config .gitleaks.toml \
+            --redact \
+            --no-banner \
+            --exit-code 1

{skcomms-0.2.6 → skcomms-0.2.8}/.gitleaks.toml

@@ -33,3 +33,15 @@ docs/superpowers/specs/2026-06-13-ble-mesh-proximity-transport-design.md:178.
 """
 paths = ['''docs/superpowers/specs/2026-06-13-ble-mesh-proximity-transport-design\.md''']
 regexes = ['''Ed25519-signed''']
+
+# Fake PGP key blocks in the identity-trust backup test. The private-key rule
+# matches the "-----BEGIN PGP PRIVATE KEY BLOCK-----" armor header, but the body
+# is the literal string "fake-private" (and "fake-public"): a fixture that
+# exercises the backup/restore path without any real key material. Confirmed
+# non-secret on 2026-08-14 by reading tests/test_identity_trust_backup.py:42-43.
+#
+# This is the finding that had been sitting undetected: the CI gate has never
+# actually scanned anything (see secret-scan.yml), so nothing ever reported it.
+[[allowlists]]
+description = "Fake PGP armor fixtures in tests/test_identity_trust_backup.py"
+paths = ['''tests/test_identity_trust_backup\.py''']

{skcomms-0.2.6/src/skcomms.egg-info → skcomms-0.2.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: skcomms
-Version: 0.2.6
+Version: 0.2.8
 Summary: Sovereign communications for AI agents — multi-channel transport + FQID realm addressing
 Author-email: smilinTux <chefboyrdave2.1@gmail.com>
 License: GPL-3.0-or-later

{skcomms-0.2.6 → skcomms-0.2.8/src/skcomms.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: skcomms
-Version: 0.2.6
+Version: 0.2.8
 Summary: Sovereign communications for AI agents — multi-channel transport + FQID realm addressing
 Author-email: smilinTux <chefboyrdave2.1@gmail.com>
 License: GPL-3.0-or-later

skcomms-0.2.6/.github/workflows/secret-scan.yml

@@ -1,48 +0,0 @@
-name: secret-scan
-
-# Secret-scan gate: keeps the repo's clean secrets hygiene true over time.
-#
-# Runs gitleaks (the fleet default, via its official GitHub Action) on every
-# push and every pull request. The build FAILS if gitleaks finds anything not
-# covered by the baseline allowlist in .gitleaks.toml at the repo root.
-#
-# The allowlist documents known non-secret placeholder tokens; see that file
-# for how to add an entry when a real placeholder trips the scanner. If the
-# scanner flags a REAL secret, rotate it and purge it from history, do NOT
-# add it to the allowlist.
-
-on:
-  push:
-    branches: ["main"]
-  pull_request:
-    branches: ["main"]
-
-permissions:
-  contents: read
-
-jobs:
-  gitleaks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          # Full history so a push scans every new commit, not just the tip.
-          fetch-depth: 0
-      - name: Run gitleaks
-        uses: gitleaks/gitleaks-action@v2
-        env:
-          # Use the baseline/allowlist committed at the repo root.
-          GITLEAKS_CONFIG: ${{ github.workspace }}/.gitleaks.toml
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # gitleaks-action requires a license for ORGANIZATION-owned repos.
-          # The note here used to say this repo ran on an individual account;
-          # it does not, it is owned by the smilinTux org, which is why every
-          # run fails with "missing gitleaks license" before scanning anything.
-          # Licensing keys on org-vs-personal, not public-vs-private, so being
-          # a public repo does not exempt it.
-          #
-          # Free key for open source at https://gitleaks.io; add it as an
-          # organization secret named GITLEAKS_LICENSE so every smilinTux repo
-          # can use the same one. Until it exists this reference is harmless:
-          # an unset secret expands to empty, exactly as today.
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}