sourcelock 0.1.0__tar.gz

sourcelock-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,104 @@
+# Tests on every supported Python, then the wheel-install check that
+# pyproject.toml used to claim existed.
+#
+# The two jobs answer different questions. `tests` asks "does the code in this
+# checkout work". `wheel` asks "does the artifact we would publish work" -- it
+# builds the wheel, installs THAT wheel into a fresh venv outside the checkout,
+# and proves the installed copy carries every vendored data file, loads every
+# adapter, answers on every CLI command, and declares the dependencies
+# pyproject declares. Those are separable failures: the last wheel anyone built
+# from this repo passed the test suite and was still missing `cryptography` and
+# the manifest modules.
+name: ci
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: "ci-${{ github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  tests:
+    name: "pytest (py${{ matrix.python-version }})"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Floor comes from pyproject's requires-python (>=3.11); the ceiling is
+        # the newest release we have actually run the suite on.
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+        with:
+          python-version: "${{ matrix.python-version }}"
+      - name: "Install with dev extras"
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+      - name: "pytest"
+        # The suite is offline by contract (tests/conftest.py blocks sockets),
+        # so a network blip here is a real failure, not flake to be retried.
+        run: python -m pytest
+
+  wheel:
+    name: "wheel install (py${{ matrix.python-version }})"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+        with:
+          python-version: "${{ matrix.python-version }}"
+      - name: "Build the wheel, install it clean, and check it"
+        run: bash scripts/wheel_check.sh python
+
+  action:
+    name: "composite action, offline"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+        with:
+          python-version: "3.12"
+      - name: "run_doctor.py against a saved report"
+        # The action's annotation and exit-code logic, with no network and no
+        # CMS: a saved report in, workflow commands out. Live doctor belongs on
+        # a schedule (docs/ci.md), not on every push -- a CI job that fails when
+        # CMS has a bad afternoon is a job people learn to ignore.
+        run: |
+          python - <<'PY'
+          import json, subprocess, sys
+          report = {
+              "exit_code": 1,
+              "lockfile_present": True,
+              "summary": {"ok": 1, "drift": 1, "schema_changed": 0, "unreachable": 0,
+                          "unpinned": 0, "stale": 0, "error": 0, "fallback": 0},
+              "load_errors": [],
+              "results": [
+                  {"canary_id": "demo.fixture_release", "source_id": "demo", "status": "ok",
+                   "observed": "r1", "expected": "r1", "checked_at": "2026-01-01T00:00:00+00:00",
+                   "remediation": "", "warnings": [], "fallback_used": False},
+                  {"canary_id": "demo.fixture_hash", "source_id": "demo", "status": "drift",
+                   "observed": "b", "expected": "a", "checked_at": "2026-01-01T00:00:00+00:00",
+                   "remediation": "re-pin with `hc-source lock init`", "warnings": [],
+                   "fallback_used": False},
+              ],
+          }
+          open("report.json", "w").write(json.dumps(report))
+          proc = subprocess.run([sys.executable, "action/run_doctor.py", "--from-json", "report.json"],
+                                capture_output=True, text=True)
+          print(proc.stdout, proc.stderr)
+          assert proc.returncode == 1, proc.returncode
+          assert "::error title=demo.fixture_hash [drift]" in proc.stdout
+          PY

sourcelock-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,210 @@
+# Tag -> release. One push, and the artifact people install exists.
+#
+#   git tag v0.1.0 && git push origin v0.1.0
+#
+# What happens: the full test suite runs across the same Python matrix ci.yml
+# uses, the tag is checked against pyproject's version, the sdist and wheel are
+# built once, the wheel is installed clean and checked (scripts/check_wheel.py
+# -- the same check CI runs), SHA256SUMS is generated, and a GitHub Release is
+# created carrying all three. Publishing to PyPI is a separate job gated the
+# same way, using Trusted Publishing (OIDC) so there is no long-lived token to
+# leak. See RELEASING.md.
+#
+# Nothing downstream of `tests` can start until every matrix leg is green: a
+# tag that fails on 3.11 must not produce a release just because 3.13 passed.
+# The build happens ONCE and every downstream job consumes that artifact. A
+# second `python -m build` would produce a second wheel, and then the checksums
+# in the release would describe bytes nobody verified.
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing tag to build (workflow_dispatch only)."
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    name: "pytest (py${{ matrix.python-version }})"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Same floor/ceiling as ci.yml's `tests` job. A release built from a
+        # tag that only passed on one Python is not "tested" in any sense
+        # RELEASING.md's promises rely on -- mirror the matrix, don't shrink it.
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: "${{ github.event.inputs.tag || github.ref }}"
+
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+        with:
+          python-version: "${{ matrix.python-version }}"
+
+      - name: "Install with dev extras"
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+
+      - name: "pytest"
+        # Offline by contract (tests/conftest.py blocks sockets): a network
+        # blip here is a real failure, not flake to retry past.
+        run: python -m pytest
+
+  build:
+    name: "build + verify"
+    needs: tests
+    runs-on: ubuntu-latest
+    outputs:
+      version: "${{ steps.version.outputs.version }}"
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: "${{ github.event.inputs.tag || github.ref }}"
+
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+        with:
+          python-version: "3.12"
+
+      - name: "The tag and pyproject must agree"
+        env:
+          RAW_TAG: "${{ github.event.inputs.tag || github.ref_name }}"
+        run: |
+          set -euo pipefail
+          python - <<'PY'
+          import os, re, sys, tomllib
+          raw = os.environ["RAW_TAG"]
+          if not re.fullmatch(r"v[0-9A-Za-z.+_-]{1,60}", raw):
+              sys.exit(f"refusing to build from tag {raw!r}: expected vMAJOR.MINOR.PATCH")
+          tag = raw[1:]
+          declared = tomllib.load(open("pyproject.toml", "rb"))["project"]["version"]
+          if tag != declared:
+              sys.exit(
+                  f"tag {raw} does not match pyproject version {declared}. Bump "
+                  "pyproject.toml and re-tag; a release whose filename disagrees with its "
+                  "metadata is the supply-chain problem this product exists to catch."
+              )
+          with open(os.environ["GITHUB_OUTPUT"], "a") as fh:
+              fh.write(f"version={tag}\n")
+          print(f"tag {raw} matches pyproject version {declared}")
+          PY
+        id: version
+
+      - name: "Build sdist + wheel"
+        run: |
+          set -euo pipefail
+          python -m pip install --upgrade pip build
+          python -m build --outdir dist .
+          ls -l dist
+
+      - name: "Install the built wheel clean and check it"
+        run: |
+          set -euo pipefail
+          python -m venv /tmp/relcheck
+          /tmp/relcheck/bin/python -m pip install --quiet --upgrade pip
+          /tmp/relcheck/bin/python -m pip install --quiet dist/*.whl
+          cd /tmp   # never import hc_source from the checkout
+          /tmp/relcheck/bin/python "${GITHUB_WORKSPACE}/scripts/check_wheel.py" \
+            --source-root "${GITHUB_WORKSPACE}"
+
+      - name: "SHA256SUMS"
+        run: |
+          set -euo pipefail
+          cd dist
+          sha256sum -- *.whl *.tar.gz > SHA256SUMS
+          cat SHA256SUMS
+
+      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  github-release:
+    name: "GitHub Release"
+    needs: [tests, build]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # creating a release is the only write this workflow needs
+    steps:
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: dist
+          path: dist
+      - name: "Create the release"
+        env:
+          GH_TOKEN: "${{ github.token }}"
+          TAG: "${{ github.event.inputs.tag || github.ref_name }}"
+          VERSION: "${{ needs.build.outputs.version }}"
+          REPO: "${{ github.repository }}"
+        run: |
+          set -euo pipefail
+          {
+            echo "SourceLock ${VERSION}."
+            echo
+            echo '```'
+            cat dist/SHA256SUMS
+            echo '```'
+            echo
+            echo "Verify before you install:"
+            echo
+            echo '```'
+            echo "sha256sum -c SHA256SUMS"
+            echo "pipx install ./sourcelock-${VERSION}-py3-none-any.whl"
+            echo '```'
+            echo
+            echo "The wheel in this release was installed into a clean virtualenv and"
+            echo "checked by scripts/check_wheel.py before the release was created:"
+            echo "every vendored data file present, every adapter loading, every CLI"
+            echo "command answering, and metadata matching pyproject.toml. The full"
+            echo "test suite passed on Python 3.11, 3.12, and 3.13 before this build"
+            echo "ran."
+          } > notes.md
+          gh release create "${TAG}" dist/* \
+            --repo "${REPO}" \
+            --title "SourceLock ${VERSION}" \
+            --notes-file notes.md
+
+  pypi:
+    name: "PyPI (Trusted Publishing)"
+    needs: [tests, build]
+    runs-on: ubuntu-latest
+    environment:
+      # A GitHub Environment, not just a name: configure it (Settings ->
+      # Environments -> pypi) with "Deployment branches and tags" restricted to
+      # `v*` so a token-less OIDC exchange can still only fire from a real
+      # release tag. Required by PyPI Trusted Publishing's publisher config,
+      # which is registered against this exact repo/workflow/environment
+      # triple -- see RELEASING.md.
+      name: pypi
+      url: https://pypi.org/project/sourcelock/
+    permissions:
+      id-token: write   # the OIDC token Trusted Publishing exchanges for an upload credential
+    steps:
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: dist
+          path: dist
+
+      - name: "Drop the checksum manifest -- it is a release asset, not a distribution"
+        run: rm -f dist/SHA256SUMS
+
+      - name: "Publish"
+        # No password/token input: Trusted Publishing mints a short-lived PyPI
+        # API token from this job's OIDC identity (the `id-token: write`
+        # permission above) inside the action itself. There is no
+        # PYPI_API_TOKEN secret sitting in this job's environment while
+        # anything gets pip-installed from the network -- that was the finding
+        # this replaces. If the trusted publisher is not yet registered on
+        # PyPI's side, this step fails with a clear error; the GitHub Release
+        # above already succeeded independently, so a first release still
+        # produces installable artifacts even before PyPI is wired up.
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

sourcelock-0.1.0/.gitignore

@@ -0,0 +1,20 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.venv/
+venv/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+*.log
+.DS_Store
+
+# ops material (runbooks, signing keys) lives in ~/sourcelock-ops, never here
+sourcelock-ops/
+keys/
+*.key
+sourcelock-manifest.json