stemtrace 0.3.5__tar.gz → 0.3.7__tar.gz

{stemtrace-0.3.5 → stemtrace-0.3.7}/.bumpversion.toml

@@ -1,5 +1,5 @@
 [tool.bumpversion]
-current_version = "0.3.5"
+current_version = "0.3.7"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]
 commit = true
@@ -24,6 +24,21 @@ filename = "src/stemtrace/server/ui/frontend/package.json"
 search = '"version": "{current_version}"'
 replace = '"version": "{new_version}"'
 
+# Frontend package-lock.json: root version and the root package entry
+[[tool.bumpversion.files]]
+filename = "src/stemtrace/server/ui/frontend/package-lock.json"
+search = """"name": "stemtrace-ui",
+  "version": "{current_version}\""""
+replace = """"name": "stemtrace-ui",
+  "version": "{new_version}\""""
+
+[[tool.bumpversion.files]]
+filename = "src/stemtrace/server/ui/frontend/package-lock.json"
+search = """"name": "stemtrace-ui",
+      "version": "{current_version}\""""
+replace = """"name": "stemtrace-ui",
+      "version": "{new_version}\""""
+
 # uv.lock - keep workspace lockfile in sync (uv stores the local project version)
 [[tool.bumpversion.files]]
 filename = "uv.lock"

{stemtrace-0.3.5 → stemtrace-0.3.7}/.dockerignore

@@ -2,9 +2,9 @@
 .git
 .gitignore
 
-# Python
-__pycache__
-*.py[cod]
+# Python (patterns without **/ only match at the context root)
+**/__pycache__
+**/*.py[cod]
 *$py.class
 *.so
 .Python
@@ -37,13 +37,23 @@ ENV/
 
 # Testing
 .pytest_cache/
+.mypy_cache/
+.ruff_cache/
 .coverage
 htmlcov/
 .tox/
 .nox/
 
 # Node (rebuilt in container)
-node_modules/
+**/node_modules/
+
+# Frontend build output and test artifacts (the UI is built in the
+# frontend stage; a local dist/ would be merged into the image's copy)
+src/stemtrace/server/ui/frontend/dist/
+src/stemtrace/server/ui/frontend/test-results/
+src/stemtrace/server/ui/frontend/playwright-report/
+src/stemtrace/server/ui/frontend/.tanstack/
+src/stemtrace/server/ui/frontend/tsconfig.tsbuildinfo
 
 # Documentation
 docs/_build/
@@ -53,9 +63,10 @@ docs/_build/
 .env.local
 *.log
 
-# Cursor/Editor
+# Cursor/Editor/agent tooling
 .cursor/
 .context/
+.claude/
 
 # Keep these (they're built in Dockerfile)
 !src/stemtrace/server/ui/frontend/package*.json

stemtrace-0.3.7/.github/dependabot.yml

@@ -0,0 +1,46 @@
+version: 2
+updates:
+  # Python dependencies: pyproject.toml + uv.lock (CI and images install from the lock)
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps)"
+    ignore:
+      # Dependabot's uv updater fails on the build backend; updated by the
+      # weekly maintenance routine
+      - dependency-name: "hatchling"
+
+  - package-ecosystem: npm
+    directory: /src/stemtrace/server/ui/frontend
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps)"
+    ignore:
+      # Pinned to ^22: types must match the Node 22 runtime used in CI and Docker
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps)"
+
+  # Base images in Dockerfile and Dockerfile.e2e (tags pinned by digest)
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps)"
+    ignore:
+      # The shipped Python runtime is deliberate: stay on 3.12.x patch updates
+      - dependency-name: "python"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
+      # UI is built with Node 22 LTS: allow minor/patch updates only
+      - dependency-name: "node"
+        update-types: ["version-update:semver-major"]

stemtrace-0.3.7/.github/workflows/ci.yml

@@ -0,0 +1,230 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON: "3.12"
+      STEMTRACE_SKIP_UI_BUILD: "1"
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --locked --no-build --all-extras
+
+      - name: Lint with ruff
+        run: uv run --locked --no-build ruff check src/ tests/
+
+      - name: Check formatting
+        run: uv run --locked --no-build ruff format --check src/ tests/
+
+  type-check:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON: "3.12"
+      STEMTRACE_SKIP_UI_BUILD: "1"
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --locked --no-build --all-extras
+
+      - name: Type check with mypy
+        run: uv run --locked --no-build mypy src/ --strict
+
+  test:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
+      STEMTRACE_SKIP_UI_BUILD: "1"
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --locked --no-build --all-extras
+
+      - name: Run tests
+        run: uv run --locked --no-build pytest --cov=stemtrace --cov-branch --cov-report=xml --cov-fail-under=95
+
+      - name: Upload coverage
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        if: matrix.python-version == '3.12'
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./coverage.xml
+          fail_ci_if_error: false
+
+  audit:
+    name: Audit runtime dependencies
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON: "3.12"
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          enable-cache: true
+
+      - name: Export locked runtime dependencies
+        run: uv export --frozen --no-emit-project --no-dev --output-file requirements-audit.txt
+
+      - name: Audit for known vulnerabilities
+        run: uvx --no-build pip-audit==2.10.1 --strict --require-hashes --disable-pip -r requirements-audit.txt
+
+  frontend:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: src/stemtrace/server/ui/frontend
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: src/stemtrace/server/ui/frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Lint with Biome
+        run: npm run check
+
+      - name: Type check with TypeScript
+        run: npm run typecheck
+
+  build:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON: "3.12"
+    needs: [lint, type-check, test, frontend]
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          enable-cache: true
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: src/stemtrace/server/ui/frontend/package-lock.json
+
+      - name: Install frontend dependencies
+        run: npm ci --ignore-scripts
+        working-directory: src/stemtrace/server/ui/frontend
+
+      - name: Install build tools
+        run: uv sync --locked --no-build --all-extras --no-install-project
+
+      - name: Build package
+        run: uv run --locked --no-build --no-sync pyproject-build --no-isolation
+
+      - name: Verify package
+        run: uv run --locked --no-build --no-sync twine check dist/*
+
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: dist/
+
+  coverage-main:
+    # Keep PR checks as the main gate, but ensure Codecov gets updated for the
+    # actual default-branch commit after merges (or direct pushes / releases).
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON: "3.12"
+      STEMTRACE_SKIP_UI_BUILD: "1"
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --locked --no-build --all-extras
+
+      - name: Run tests (coverage only)
+        run: uv run --locked --no-build pytest --cov=stemtrace --cov-branch --cov-report=xml --cov-fail-under=95
+
+      - name: Upload coverage (main)
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./coverage.xml
+          fail_ci_if_error: false

{stemtrace-0.3.5 → stemtrace-0.3.7}/.github/workflows/e2e.yml

@@ -12,6 +12,10 @@ jobs:
   api-e2e:
     name: API E2E Tests
     runs-on: ubuntu-latest
+    env:
+      UV_PYTHON: "3.12"
+      # The Docker images build their own UI; skip the host-side build.
+      STEMTRACE_SKIP_UI_BUILD: "1"
     timeout-minutes: 15
     strategy:
       fail-fast: false
@@ -21,10 +25,10 @@ jobs:
           - rabbitmq
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Select compose file and Celery env
         run: |
@@ -51,20 +55,20 @@ jobs:
           echo "Services ready!"
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
       - name: Install dependencies
-        run: uv sync --all-extras
+        run: uv sync --locked --no-build --all-extras
 
       - name: Run API E2E tests
-        run: uv run pytest tests/e2e/ -m e2e -v --tb=short
+        run: uv run --locked --no-build pytest tests/e2e/ -m e2e -v --tb=short
 
       - name: Show logs on failure
         if: failure()
@@ -79,6 +83,10 @@ jobs:
   playwright:
     name: Playwright E2E Tests
     runs-on: ubuntu-latest
+    env:
+      UV_PYTHON: "3.12"
+      # The Docker images build their own UI; skip the host-side build.
+      STEMTRACE_SKIP_UI_BUILD: "1"
     timeout-minutes: 20
     strategy:
       fail-fast: false
@@ -88,10 +96,10 @@ jobs:
           - rabbitmq
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Select compose file and Celery env
         run: |
@@ -117,22 +125,22 @@ jobs:
           echo "Services ready!"
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
       - name: Install Python dependencies
-        run: uv sync --all-extras
+        run: uv sync --locked --no-build --all-extras
 
       - name: Submit test tasks
         run: |
           # Submit some tasks to populate the UI for testing
-          uv run python -c "
+          uv run --locked --no-build python -c "
           from tests.e2e.tasks import add, create_workflow, always_fails
           # Submit a few tasks
           add.delay(1, 2)
@@ -145,19 +153,19 @@ jobs:
           sleep 5
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
           cache-dependency-path: src/stemtrace/server/ui/frontend/package-lock.json
 
       - name: Install frontend dependencies
         working-directory: src/stemtrace/server/ui/frontend
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Install Playwright browsers
         working-directory: src/stemtrace/server/ui/frontend
-        run: npx playwright install chromium --with-deps
+        run: ./node_modules/.bin/playwright install chromium --with-deps
 
       - name: Run Playwright tests
         working-directory: src/stemtrace/server/ui/frontend
@@ -167,7 +175,7 @@ jobs:
           PLAYWRIGHT_BASE_URL: http://localhost:8000
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: playwright-report-${{ matrix.broker }}
@@ -175,7 +183,7 @@ jobs:
           retention-days: 7
 
       - name: Upload test results
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: failure()
         with:
           name: playwright-test-results-${{ matrix.broker }}

{stemtrace-0.3.5 → stemtrace-0.3.7}/.github/workflows/release.yml

@@ -18,11 +18,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
+    env:
+      UV_PYTHON: "3.12"
     outputs:
       version: ${{ steps.version.outputs.version }}
       tag: ${{ steps.version.outputs.tag }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Determine version
         id: version
@@ -49,32 +51,37 @@ jobs:
           echo "✅ Version $PYPROJECT_VERSION matches"
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
           cache-dependency-path: src/stemtrace/server/ui/frontend/package-lock.json
 
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          enable-cache: false
+
       - name: Install frontend dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
         working-directory: src/stemtrace/server/ui/frontend
 
       - name: Install build tools
-        run: pip install build twine
+        run: uv sync --locked --no-build --all-extras --no-install-project
 
       - name: Build package
-        run: python -m build
+        run: uv run --locked --no-build --no-sync pyproject-build --no-isolation
 
       - name: Verify package
-        run: twine check dist/*
+        run: uv run --locked --no-build --no-sync twine check dist/*
 
       - name: Upload dist artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dist
           path: dist/
@@ -87,13 +94,13 @@ jobs:
       id-token: write
     steps:
       - name: Download dist artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist
           path: dist/
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
 
   docker:
     needs: build
@@ -102,16 +109,16 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -119,7 +126,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
@@ -127,7 +134,7 @@ jobs:
             type=raw,value=latest
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           push: true
@@ -143,10 +150,10 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Download dist artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist
           path: dist/
@@ -160,7 +167,7 @@ jobs:
           git push origin "${{ needs.build.outputs.tag }}"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           tag_name: ${{ needs.build.outputs.tag }}
           generate_release_notes: true

{stemtrace-0.3.5 → stemtrace-0.3.7}/.pre-commit-config.yaml

@@ -11,13 +11,15 @@ repos:
       - id: debug-statements
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.0
+    rev: v0.16.10
     hooks:
       # Linter (auto-fix enabled)
-      - id: ruff
+      - id: ruff-check
         args: [--fix]
-      # Formatter
+      # Formatter (Python only: the hook also formats Markdown code blocks,
+      # which would undo the hand-aligned comments in the README examples)
       - id: ruff-format
+        types_or: [python, pyi]
 
   # Local hooks use project environment (uv) for proper dependency access
   - repo: local