strictcli 0.37.0__tar.gz → 0.38.0__tar.gz

{strictcli-0.37.0 → strictcli-0.38.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: strictcli
-Version: 0.37.0
+Version: 0.38.0
 Summary: A strict CLI framework for Python
 Project-URL: Homepage, https://github.com/smm-h/strictcli
 Project-URL: Repository, https://github.com/smm-h/strictcli

{strictcli-0.37.0 → strictcli-0.38.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "strictcli"
-version = "0.37.0"
+version = "0.38.0"
 description = "A strict CLI framework for Python"
 readme = "README.md"
 license = "MIT"

{strictcli-0.37.0 → strictcli-0.38.0}/strictcli/__init__.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-__version__ = "0.37.0"
+__version__ = "0.38.0"
 
 __all__ = [
     "App", "Flag", "Arg", "FlagSet", "MutexGroup", "CoRequired", "Requires",
@@ -44,7 +44,7 @@ from collections import deque
 from collections.abc import Sequence
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Callable, Protocol, TypeVar, get_args, get_origin, runtime_checkable
+from typing import Any, Callable, NamedTuple, Protocol, TypeVar, get_args, get_origin, runtime_checkable
 
 # TypeVar for decorator return types — preserves the decorated function's type
 F = TypeVar("F", bound=Callable[..., Any])
@@ -1423,13 +1423,30 @@ def _validate_grants(cmd_name: str, grants) -> tuple:
 # Closed lists, matched on the called attribute/function name: process starts,
 # filesystem mutations, and network calls. The analyser is stdlib `ast` -- a
 # regular dependency, no optional import and no soft degradation.
+#
+# Several leaves are RECEIVER-SCOPED: a name alone is not evidence of an
+# effect, and a finding a consumer cannot act on is worse than no finding.
+# `mapping.get(...)` is not a network call and `platform.system()` is not a
+# process start, so those leaves are banned only through a receiver the
+# module's own imports let the analyser resolve.
 # ---------------------------------------------------------------------------
 
 _BYPASS_PROCESS = frozenset({
     "run", "Popen", "call", "check_call", "check_output", "getoutput",
-    "getstatusoutput", "system", "popen", "execv", "execvp", "execve",
+    "getstatusoutput", "popen", "execv", "execvp", "execve",
     "spawnv", "spawnl", "fork",
 })
+# Process leaves that start a process only through `os`. `system` is the whole
+# set: `os.system` runs a shell, but `platform.system()` is a pure in-process
+# string read -- no process, no effect, and nothing the effects handle could
+# carry, since its closed method set has no in-process-observe method. Banning
+# the leaf on any receiver produced a finding whose own remediation ("route it
+# through ctx.effects") could not be followed, which is the one thing a lint
+# must never emit. An UNKNOWN receiver (`foo.system()`) is exempt for the same
+# reason the network leaves are receiver-scoped: without a resolvable binding
+# to `os` there is no evidence a process starts, and a name is not evidence.
+_BYPASS_PROCESS_OS_ONLY = frozenset({"system"})
+_BYPASS_OS_RECEIVERS = frozenset({"os"})
 _BYPASS_FILESYSTEM = frozenset({
     "remove", "unlink", "rmdir", "removedirs", "mkdir", "makedirs",
     "rename", "renames", "replace", "chmod", "chown", "symlink", "link",
@@ -1453,6 +1470,63 @@ _BYPASS_SKIP_DIRS = frozenset({
     "site-packages", "build", "dist", ".tox", ".mypy_cache", ".ruff_cache",
     ".pytest_cache", ".eggs",
 })
+# The modules whose imports bind a receiver the analyser trusts. Closed, like
+# every other list here: `import requests as rq` must resolve to `requests` and
+# `from os import system` to `os`, while `from mylib import get` must bind
+# NOTHING -- widening this to every module would re-create exactly the ordinary
+# `mapping.get(...)` noise the network receiver list exists to remove.
+_BYPASS_EFFECT_MODULES = frozenset({
+    "os", "os.path", "subprocess", "shutil", "pathlib", "socket", "tempfile",
+    "requests", "httpx", "urllib", "urllib.request", "http", "http.client",
+    "aiohttp", "urllib3",
+})
+
+
+class _BypassImports(NamedTuple):
+    """What a module's imports say about the names it calls.
+
+    ``receivers`` maps a bound module name to the effect module it denotes
+    (``import os as o`` -> ``{"o": "os"}``); ``calls`` maps a bound member name
+    to the ``(module, member)`` pair it came from (``from os import system as
+    sh`` -> ``{"sh": ("os", "system")}``). Both are used to normalize a call
+    before the ban lists see it, so the lists stay written in terms of real
+    module and member names rather than whatever the consumer spelled.
+    """
+
+    receivers: dict
+    calls: dict
+
+
+_BYPASS_NO_IMPORTS = _BypassImports({}, {})
+
+
+def _bypass_import_bindings(tree) -> _BypassImports:
+    """Names bound to effect modules and to their members, in one module.
+
+    Relative imports are skipped: ``from .os import system`` is the consumer's
+    own module, not the stdlib one, and the analyser cannot resolve it.
+    """
+    receivers: dict = {}
+    calls: dict = {}
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                if alias.name not in _BYPASS_EFFECT_MODULES:
+                    continue
+                if alias.asname is None:
+                    # `import os.path` binds `os`, and `os.system` still works.
+                    bound = module = alias.name.split(".")[0]
+                else:
+                    bound = alias.asname
+                    module = alias.name.rsplit(".", 1)[-1]
+                receivers[bound] = module
+        elif isinstance(node, ast.ImportFrom):
+            if node.level or node.module not in _BYPASS_EFFECT_MODULES:
+                continue
+            module = node.module.rsplit(".", 1)[-1]
+            for alias in node.names:
+                calls[alias.asname or alias.name] = (module, alias.name)
+    return _BypassImports(receivers, calls)
 
 
 def _call_target_name(node) -> tuple:
@@ -1613,10 +1687,45 @@ def _bypass_reachable_functions(tree) -> set:
     return reachable
 
 
-def _bypass_call_is_banned(node, target: str, receiver) -> bool:
+def _bypass_resolve_call(leaf: str, receiver,
+                         imports: _BypassImports) -> tuple:
+    """The ``(leaf, receiver)`` a call really goes through, per its imports.
+
+    A bare name imported from an effect module answers with that module and the
+    member's REAL name (``from os import system as sh`` -> ``("system",
+    "os")``), and an aliased module receiver answers with the module it denotes
+    (``import os as o`` -> ``os``). Anything else is returned untouched, so an
+    unresolvable receiver stays unresolvable rather than being guessed at.
+    """
+    if receiver is None:
+        bound = imports.calls.get(leaf)
+        if bound is None:
+            return leaf, None
+        module, member = bound
+        return member, module
+    return leaf, imports.receivers.get(receiver, receiver)
+
+
+def _bypass_call_is_banned(node, target: str, receiver,
+                           imports: _BypassImports = _BYPASS_NO_IMPORTS) -> bool:
+    """True when one call is a direct effect the handle should have carried.
+
+    Two leaves are deliberately narrower than the rest: builtin ``open`` is a
+    finding only in a writing mode, and ``system`` only through ``os`` --
+    ``platform.system()`` observes this process and starts nothing, and the
+    effects handle has no method that could carry it.
+
+    Builtin ``open`` is answered BEFORE import resolution, because it is the
+    one leaf whose meaning comes from being unqualified. Everything after it is
+    resolved through the module's imports (see :func:`_bypass_resolve_call`),
+    so the lists below are written in terms of real module and member names.
+    """
     leaf = target.rsplit(".", 1)[-1]
     if leaf == "open" and receiver is None:
         return _open_is_write_mode(node)
+    leaf, receiver = _bypass_resolve_call(leaf, receiver, imports)
+    if leaf in _BYPASS_PROCESS_OS_ONLY:
+        return receiver in _BYPASS_OS_RECEIVERS
     return (
         (leaf in _BYPASS_PROCESS and receiver is not None)
         or leaf in _BYPASS_FILESYSTEM
@@ -1625,7 +1734,7 @@ def _bypass_call_is_banned(node, target: str, receiver) -> bool:
 
 
 def _bypass_walk(node, stack: list, reachable: set, findings: list, rel: str,
-                 aliases: frozenset) -> None:
+                 aliases: frozenset, imports: _BypassImports) -> None:
     """Walk one subtree, carrying the enclosing-function stack.
 
     A banned call is reported once, at the INNERMOST enclosing function, when
@@ -1638,10 +1747,11 @@ def _bypass_walk(node, stack: list, reachable: set, findings: list, rel: str,
         if stack and any(id(fn) in reachable for fn in stack):
             if not _reaches_effects_handle(node.func, aliases):
                 target, receiver = _call_target_name(node.func)
-                if target is not None and _bypass_call_is_banned(node, target, receiver):
+                if target is not None and _bypass_call_is_banned(
+                        node, target, receiver, imports):
                     findings.append((rel, node.lineno, stack[-1].name, target))
     for child in ast.iter_child_nodes(node):
-        _bypass_walk(child, stack, reachable, findings, rel, aliases)
+        _bypass_walk(child, stack, reachable, findings, rel, aliases, imports)
 
 
 def _open_is_write_mode(node) -> bool:
@@ -1685,7 +1795,8 @@ def _scan_effects_bypasses(root: Path) -> list[tuple]:
             if not reachable:
                 continue
             _bypass_walk(tree, [], reachable, findings, rel,
-                         _bypass_effects_aliases(tree))
+                         _bypass_effects_aliases(tree),
+                         _bypass_import_bindings(tree))
     return findings
 
 
@@ -4846,7 +4957,11 @@ class App:
 
         - ``effects-bypass`` (error) fails on any direct process,
           filesystem-mutation or network call REACHABLE FROM A REGISTERED
-          COMMAND HANDLER;
+          COMMAND HANDLER. Its remediation is always "route it through
+          ctx.effects", so a leaf the handle could not carry must never be a
+          finding: the handle's closed method set has no in-process-observe
+          method, which is why ``platform.system()`` is exempt while
+          ``os.system(...)`` is not (see :data:`_BYPASS_PROCESS_OS_ONLY`);
         - ``observe-allowlist-breadth`` (warn) surfaces short
           ``proc_observe_allowlist`` prefixes, which authorize real execution
           under ``--dry-run``;

{strictcli-0.37.0 → strictcli-0.38.0}/tests/test_effects_bypass_check.py

@@ -326,6 +326,153 @@ async def deploy(ctx):
         assert r.exit_code == 1
 
 
+class TestSystemIsBannedOnlyThroughOs:
+    """`system` starts a shell only as `os.system`.
+
+    `platform.system()` is a pure in-process string read: no process, no
+    effect, and NOTHING the effects handle could carry it -- the handle's
+    closed method set has no in-process-observe method. A finding on it is
+    unfixable by its own remediation ("route it through ctx.effects"), which
+    is the one thing a lint must never emit. So the leaf is receiver-scoped,
+    exactly as the network leaves already are.
+    """
+
+    def _run(self, tmp_path, source):
+        app, root = _app(tmp_path)
+        (root / "handlers.py").write_text(source)
+        return app.test(["check", "--name", "effects-bypass"])
+
+    def test_platform_system_is_not_a_finding(self, tmp_path):
+        r = self._run(tmp_path, '''
+import platform
+
+def deploy(ctx):
+    ctx.effects.run(["true"])
+    return platform.system()
+''')
+        assert r.exit_code == 0, r.stdout
+        assert "no direct effect calls bypass ctx.effects" in r.stdout
+
+    def test_system_imported_from_platform_is_not_a_finding(self, tmp_path):
+        r = self._run(tmp_path, '''
+from platform import system
+
+def deploy(ctx):
+    ctx.effects.run(["true"])
+    return system()
+''')
+        assert r.exit_code == 0, r.stdout
+
+    def test_an_unknown_receiver_named_system_is_not_a_finding(self, tmp_path):
+        """No resolvable binding to `os` is no evidence a process starts.
+
+        `foo.system()` is some object's method. Receiver-awareness means the
+        lint reports what it can show, and an unknown receiver shows nothing.
+        """
+        r = self._run(tmp_path, '''
+def deploy(ctx, foo):
+    ctx.effects.run(["true"])
+    return foo.system()
+''')
+        assert r.exit_code == 0, r.stdout
+
+    def test_os_system_is_still_a_finding(self, tmp_path):
+        r = self._run(tmp_path, '''
+import os
+
+def deploy(ctx):
+    ctx.effects.run(["true"])
+    os.system("rm -rf /")
+''')
+        assert r.exit_code == 1
+        assert "deploy calls os.system directly" in r.stdout
+
+    def test_system_imported_from_os_is_a_finding(self, tmp_path):
+        r = self._run(tmp_path, '''
+from os import system
+
+def deploy(ctx):
+    ctx.effects.run(["true"])
+    system("rm -rf /")
+''')
+        assert r.exit_code == 1, r.stdout
+        assert "deploy calls system directly" in r.stdout
+
+    def test_system_imported_from_os_under_an_alias_is_a_finding(self, tmp_path):
+        r = self._run(tmp_path, '''
+from os import system as shell_out
+
+def deploy(ctx):
+    ctx.effects.run(["true"])
+    shell_out("rm -rf /")
+''')
+        assert r.exit_code == 1, r.stdout
+        assert "deploy calls shell_out directly" in r.stdout
+
+    def test_an_aliased_os_module_receiver_is_a_finding(self, tmp_path):
+        r = self._run(tmp_path, '''
+import os as o
+
+def deploy(ctx):
+    ctx.effects.run(["true"])
+    o.system("rm -rf /")
+''')
+        assert r.exit_code == 1, r.stdout
+        assert "deploy calls o.system directly" in r.stdout
+
+
+class TestImportBindingsResolveReceivers:
+    """An effect-module import is a receiver the analyser can resolve.
+
+    The same binding table that keeps `platform.system` clean also closes two
+    escapes it would otherwise open: an aliased effect module and a bare name
+    imported from one.
+    """
+
+    def _run(self, tmp_path, source):
+        app, root = _app(tmp_path)
+        (root / "handlers.py").write_text(source)
+        return app.test(["check", "--name", "effects-bypass"])
+
+    def test_an_aliased_requests_module_is_a_network_finding(self, tmp_path):
+        r = self._run(tmp_path, '''
+import requests as rq
+
+def deploy(ctx):
+    ctx.effects.run(["true"])
+    rq.post("https://x.test")
+''')
+        assert r.exit_code == 1, r.stdout
+        assert "deploy calls rq.post directly" in r.stdout
+
+    def test_a_bare_name_imported_from_subprocess_is_a_finding(self, tmp_path):
+        r = self._run(tmp_path, '''
+from subprocess import run
+
+def deploy(ctx):
+    ctx.effects.run(["true"])
+    run(["git", "push"])
+''')
+        assert r.exit_code == 1, r.stdout
+        assert "deploy calls run directly" in r.stdout
+
+    def test_a_bare_name_from_an_unrelated_module_is_not_a_finding(self, tmp_path):
+        """Only the closed list of effect modules binds a receiver.
+
+        `from mylib import get` must stay silent -- widening the binding table
+        to every module would re-create the `mapping.get(...)` noise the
+        network receiver list exists to remove.
+        """
+        r = self._run(tmp_path, '''
+from mylib import get
+
+def deploy(ctx):
+    ctx.effects.run(["true"])
+    return get("k")
+''')
+        assert r.exit_code == 0, r.stdout
+
+
 class TestObserveAllowlistBreadth:
     """§6.2's hazard, surfaced as a WARNING and never as an error.
 

{strictcli-0.37.0 → strictcli-0.38.0}/uv.lock

@@ -232,7 +232,7 @@ wheels = [
 
 [[package]]
 name = "strictcli"
-version = "0.37.0"
+version = "0.38.0"
 source = { editable = "." }
 dependencies = [
     { name = "tomlkit" },

strictcli-0.37.0/.rlsbl/bases/.github/workflows/ci.yml

@@ -1,33 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-# Per-SHA group: re-runs of the same commit dedupe, but a new commit never
-# cancels an earlier commit's in-flight run (release CI conclusions stay intact).
-concurrency:
-  group: ${{ github.workflow_ref }}-${{ github.sha }}
-  cancel-in-progress: true
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        # requires-python: >= 3.11
-        python-version: ["3.12", "3.13", "3.14"]
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
-      - run: uv python install ${{ matrix.python-version }}
-      - run: uv sync --locked
-      - run: uv run python -c "import strictcli"
-      - name: Install gitleaks
-        run: |
-          GITLEAKS_VERSION=8.24.3
-          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin gitleaks
-      - run: uv run pytest --rootdir .

strictcli-0.37.0/.rlsbl/bases/.github/workflows/publish.yml

@@ -1,195 +0,0 @@
-name: Publish
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: Release tag to publish (e.g. v1.2.3). Overrides the ref for
-          retry dispatch.
-        required: false
-        type: string
-
-# One publish run per tag: a workflow_dispatch retry at the same tag
-# queues behind the in-flight run instead of racing it. A publish is never
-# cancelled mid-flight.
-concurrency:
-  group: publish-${{ inputs.tag || github.ref_name }}
-  cancel-in-progress: false
-permissions:
-  contents: read
-  id-token: write
-jobs:
-  gate:
-    name: Gate on CI
-    runs-on: ubuntu-latest
-    permissions:
-      checks: read
-      contents: read
-    env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      GH_REPO: ${{ github.repository }}
-      GATE_TIMEOUT_MINUTES: '20'
-      GATE_GRACE_MINUTES: '5'
-      GATE_POLL_SECONDS: '15'
-      GATE_MARKER_ATTEMPTS: '5'
-      GATE_MARKER_RETRY_SECONDS: '5'
-      CI_CHECK_REGEX: ^(test)( \(.*\))?$
-    steps:
-      - name: Wait for CI to succeed on the release commit
-        run: |
-          set -euo pipefail
-
-          # Commit resolution -- explicit marker-first order (never reads the release
-          # event payload; dispatch retries have none, so this path is uniform for
-          # release events and dispatch retries alike):
-          #   (1) Marker: rlsbl writes the exact commit CI ran on into the GitHub
-          #       Release body as a machine-parseable line of the form
-          #           <!-- rlsbl-ci-sha: <40-hex> -->
-          #       Prefer it when present -- it pins the precise commit and is immune to
-          #       ref races. A just-created release can lag on a GitHub API read replica
-          #       (the marker is written at release creation but may not be visible on
-          #       the first read), so RETRY the read GATE_MARKER_ATTEMPTS times,
-          #       GATE_MARKER_RETRY_SECONDS apart, before concluding it is absent. The
-          #       tag is inputs.tag (TAG_INPUT) when dispatched with an explicit
-          #       override, else GITHUB_REF_NAME (matches the router resolver).
-          #   (2) Fallback: older releases predate the marker, so fall back to
-          #       $GITHUB_SHA, the tag's commit for both release and dispatch-at-tag.
-          extract_ci_sha() {
-            # Emit the first rlsbl-ci-sha marker SHA found on stdin, if any.
-            sed -n 's/.*<!-- rlsbl-ci-sha: \([0-9a-f]\{40\}\) -->.*/\1/p' | head -n1
-          }
-          tag="${TAG_INPUT:-$GITHUB_REF_NAME}"
-          marker_attempts="${GATE_MARKER_ATTEMPTS:-5}"
-          marker_retry_seconds="${GATE_MARKER_RETRY_SECONDS:-5}"
-          sha=""
-          attempt=1
-          while [ "$attempt" -le "$marker_attempts" ]; do
-            if body="$(gh release view "$tag" --json body --jq .body 2>/dev/null)"; then
-              sha="$(printf '%s\n' "$body" | extract_ci_sha)"
-            fi
-            if [ -n "$sha" ]; then
-              break
-            fi
-            if [ "$attempt" -lt "$marker_attempts" ]; then
-              echo "Publish gate: rlsbl-ci-sha marker not yet visible in the '$tag' release body (attempt $attempt/$marker_attempts); retrying in ${marker_retry_seconds}s..."
-              sleep "$marker_retry_seconds"
-            fi
-            attempt=$(( attempt + 1 ))
-          done
-          if [ -n "$sha" ]; then
-            echo "Publish gate: resolved release commit from rlsbl-ci-sha marker in the '$tag' release body."
-          else
-            sha="$GITHUB_SHA"
-            echo "Publish gate: no rlsbl-ci-sha marker after $marker_attempts attempt(s) on the '$tag' release body; falling back to \$GITHUB_SHA."
-          fi
-          echo "Publish gate: waiting for CI on $GITHUB_REF_NAME (commit $sha)"
-          echo "Check-run name filter: $CI_CHECK_REGEX"
-          # Timeout, grace window, and poll interval come from the job env above;
-          # edit them there if this repository's CI needs different limits.
-
-          now() { date +%s; }
-          start="$(now)"
-          deadline=$(( start + GATE_TIMEOUT_MINUTES * 60 ))
-          grace_deadline=$(( start + GATE_GRACE_MINUTES * 60 ))
-
-          while :; do
-            if ! resp="$(gh api --paginate "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs?per_page=100")"; then
-              echo "Checks API request failed; retrying in ${GATE_POLL_SECONDS}s..."
-              sleep "$GATE_POLL_SECONDS"
-              continue
-            fi
-            # Match this project's CI check runs by name; exclude check runs that
-            # belong to THIS workflow run (the gate itself and the queued publish
-            # jobs would otherwise deadlock the poll loop).
-            # A retried CI run creates a BRAND-NEW check-run with the same name as the
-            # old one, so a stale failure would block the gate forever. Project id and
-            # started_at, then reduce to the latest check-run per name (max started_at,
-            # numeric id as tiebreak for retries within the same second) BEFORE the
-            # pending / not-success logic runs. This way the newest run decides: still
-            # running -> wait; genuinely red -> hard fail.
-            runs="$(jq -s --arg re "$CI_CHECK_REGEX" --arg run_id "$GITHUB_RUN_ID" '
-              [ .[].check_runs[]
-                | select(.name | test($re))
-                | select((.details_url // "") | contains("/actions/runs/" + $run_id + "/") | not)
-                | {name, status, conclusion, id, started_at} ]
-              | group_by(.name)
-              | map(sort_by(.started_at, .id) | last)' <<< "$resp")"
-            total="$(jq 'length' <<< "$runs")"
-
-            if [ "$total" -eq 0 ]; then
-              if [ "$(now)" -ge "$grace_deadline" ]; then
-                echo "::error::Publish gate: no CI check runs matching $CI_CHECK_REGEX appeared on $sha within $GATE_GRACE_MINUTES minutes."
-                echo "A scaffolded repository always has a CI workflow, and rlsbl verifies CI on this exact commit BEFORE tagging it, so check runs must exist here."
-                echo "Their absence means the check runs were deleted, the commit resolution is wrong, or this tag was created outside rlsbl."
-                echo "If CI jobs were renamed, update CI_CHECK_REGEX in this workflow's gate job to match the new names."
-                exit 1
-              fi
-              echo "No matching CI check runs yet; retrying in ${GATE_POLL_SECONDS}s..."
-              sleep "$GATE_POLL_SECONDS"
-              continue
-            fi
-
-            pending="$(jq '[ .[] | select(.status != "completed") ] | length' <<< "$runs")"
-            if [ "$pending" -gt 0 ]; then
-              if [ "$(now)" -ge "$deadline" ]; then
-                echo "::error::Publish gate: timed out after $GATE_TIMEOUT_MINUTES minutes waiting for CI to complete on $sha."
-                jq -r '.[] | "  \(.name): status=\(.status) conclusion=\(.conclusion // "none")"' <<< "$runs"
-                exit 1
-              fi
-              echo "$pending of $total matching CI check runs still running; retrying in ${GATE_POLL_SECONDS}s..."
-              sleep "$GATE_POLL_SECONDS"
-              continue
-            fi
-
-            not_success="$(jq '[ .[] | select(.conclusion != "success") ]' <<< "$runs")"
-            if [ "$(jq 'length' <<< "$not_success")" -gt 0 ]; then
-              echo "::error::Publish gate: CI did not pass on $sha -- refusing to publish."
-              jq -r '.[] | "  \(.name): \(.conclusion)"' <<< "$not_success"
-              while IFS= read -r conclusion; do
-                case "$conclusion" in
-                  failure|timed_out)
-                    echo "CI concluded '$conclusion' on the release commit."
-                    echo "rlsbl tags and releases a commit only AFTER its CI has gone green, so reaching this branch means one of: CI was re-run on an already-released commit and regressed, a required check was added after the release, or this tag/Release was created outside rlsbl."
-                    echo "Do NOT re-dispatch this publish workflow expecting a different answer -- a failure baked into the code at this commit fails identically every time, and there is no way to make this tag green."
-                    echo "Remedy: fix forward on the release branch and cut a NEW release with 'rlsbl release run' (its own CI gate must go green before it is tagged), then mark this one with 'rlsbl release deprecate <version>'."
-                    ;;
-                  cancelled)
-                    echo "A CI check run was CANCELLED. A cancelled run proves nothing about the commit, so the gate treats it as a hard failure instead of waiting for a conclusion that will never come."
-                    echo "Remedy: re-run the cancelled CI workflow on this exact commit (gh run rerun <run-id>). If it concludes success, re-dispatch this publish workflow at the tag ref: gh workflow run <publish workflow> --ref $GITHUB_REF_NAME"
-                    ;;
-                  skipped)
-                    echo "A CI check run matching the filter was SKIPPED. The gate cannot treat a skipped check as passing: this project must actually run its own CI on the release commit."
-                    echo "Remedy: check paths filters and job conditions so CI runs for this project, re-run CI on this commit, then re-dispatch this publish workflow at the tag ref."
-                    ;;
-                  *)
-                    echo "CI check concluded '$conclusion' (not success). The gate only proceeds when every matching check concluded success."
-                    ;;
-                esac
-              done <<< "$(jq -r '.[].conclusion' <<< "$not_success" | sort -u)"
-              exit 1
-            fi
-
-            echo "Publish gate: all $total matching CI check runs succeeded."
-            jq -r '.[] | "  \(.name): \(.conclusion)"' <<< "$runs"
-            exit 0
-          done
-  pypi:
-    needs: gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.tag || github.event.release.tag_name }}
-      - uses: astral-sh/setup-uv@v7
-      - name: Install gitleaks
-        run: |
-          GITLEAKS_VERSION=8.24.3
-          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin gitleaks
-      - run: uv build --out-dir dist
-      - name: Scan artifacts for secrets
-        run: |
-          gitleaks dir dist/
-      - uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          skip-existing: true

strictcli-0.37.0/.rlsbl/bases/.gitignore

@@ -1,18 +0,0 @@
-node_modules/
-__pycache__/
-*.pyc
-*.log
-.DS_Store
-coverage/
-build/
-dist/
-target/
-*.egg-info/
-.rlsbl-notes-*.tmp
-.rlsbl/lock
-.rlsbl-monorepo/lock
-.credentials.json
-.*-cache.json
-.env
-.env.local
-*.local-only

strictcli-0.37.0/.rlsbl/lint/python.toml

@@ -1,25 +0,0 @@
-[forbidden-imports]
-modules = [
-    "argparse",
-    "click",
-    "typer",
-    "flask",
-    "fastapi",
-    "django",
-    "uvicorn",
-    "granian",
-    "starlette",
-    "tornado",
-    "bottle",
-]
-
-[stdout]
-enabled = true
-ignore = []
-
-[entry-point]
-enabled = true
-ignore = []
-
-[files]
-exclude = []

strictcli-0.37.0/.rlsbl/version

@@ -1 +0,0 @@
-0.110.2