tariffkit 0.2.0__tar.gz → 0.2.2__tar.gz

{tariffkit-0.2.0 → tariffkit-0.2.2}/CHANGELOG.md

@@ -5,6 +5,59 @@ All notable changes to this project are documented here. This project follows
 
 ## [Unreleased]
 
+## [0.2.2] - 2026-08-16
+
+### Added
+- Project documentation now uses a TariffKit banner built from the integration's
+  existing icon and a provider-neutral electricity rate curve.
+- Public contribution and support guidance now provides privacy-safe issue
+  forms, private security routing, review ownership, a pull request checklist,
+  community conduct expectations, and exact development checks. The guidance
+  also makes the generated-data and repository-only audit boundaries explicit
+  so public collaboration does not expose utility-account material or alter
+  distribution guarantees.
+- Pull requests now run GitHub's dependency review action with read-only
+  permissions so vulnerable or disallowed dependency changes fail before merge.
+
+### Changed
+- **Python 3.14.2 and Home Assistant 2026.3.0 are now the supported floors.**
+  The lockfile no longer carries the obsolete Home Assistant 2026.2 fallback,
+  and CI audits the complete locked dependency graph with a pinned `pip-audit`
+  release while retaining raw reports as failure artifacts. The Linux secrets
+  extra and Home Assistant tests both inherit the same exact cryptography pin;
+  an expiring policy requires each audit to report exactly its three known,
+  unreachable advisories and rejects any additional finding.
+- The README now explains that default HACS approval may take months and gives
+  complete custom-repository installation steps for use during the review.
+- Workflow actions are pinned to reviewed immutable commits, checkout credentials
+  are not persisted, superseded runs are bounded by concurrency controls, and
+  repository write access is isolated to the jobs that publish results.
+- MQTT now rejects credentials over plaintext unless the operator explicitly
+  allows insecure authentication for an isolated trusted network. Passwords
+  also require a username, while anonymous plaintext publishing remains valid.
+
+### Fixed
+- Rate-sheet regeneration now scans trailing table cells with a linear parser,
+  avoiding pathological regular-expression backtracking on malformed publisher
+  text while preserving accepted dollar, decimal, negative, and change-marker
+  forms.
+
+## [0.2.1] - 2026-08-16
+
+### Added
+- **HACS releases now include a deterministic `tariffkit.zip` integration
+  artifact.** HACS installs only the tracked component files, rooted directly
+  in the integration directory, while the release pipeline validates the ZIP
+  against its source, checksums it with the Python distributions, and attaches
+  all artifacts before immutable publication. Dedicated HACS and hassfest
+  checks also gate integration changes and prepare TariffKit for default-store
+  submission.
+
+### Fixed
+- Home Assistant action descriptions now follow hassfest's current service
+  schema: icons live in `icons.json`, target metadata is explicit, and the
+  config-entry-only YAML schema is declared.
+
 ## [0.2.0] - 2026-08-16
 
 ### Added
@@ -168,5 +221,7 @@ Initial release.
 - Holiday calendars are extracted per vintage from the source data rather than
   recomputed, because the vintage files disagree in far-future years.
 
-[Unreleased]: https://github.com/eman/tariffkit/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/eman/tariffkit/compare/v0.2.2...HEAD
+[0.2.2]: https://github.com/eman/tariffkit/releases/tag/v0.2.2
+[0.2.1]: https://github.com/eman/tariffkit/releases/tag/v0.2.1
 [0.2.0]: https://github.com/eman/tariffkit/releases/tag/v0.2.0

{tariffkit-0.2.0 → tariffkit-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tariffkit
-Version: 0.2.0
+Version: 0.2.2
 Summary: Offline electricity tariff pricing, billing, and integration tools
 Project-URL: Homepage, https://github.com/eman/tariffkit
 Project-URL: Documentation, https://github.com/eman/tariffkit#documentation
@@ -17,7 +17,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Home Automation
 Classifier: Typing :: Typed
-Requires-Python: >=3.14
+Requires-Python: >=3.14.2
 Provides-Extra: all
 Requires-Dist: fastapi>=0.110; extra == 'all'
 Requires-Dist: httpx>=0.27; extra == 'all'
@@ -43,8 +43,17 @@ Requires-Dist: fastapi>=0.110; extra == 'web'
 Requires-Dist: uvicorn[standard]>=0.29; extra == 'web'
 Description-Content-Type: text/markdown
 
+<p align="center">
+  <img src="images/banner.svg" alt="TariffKit — electricity pricing, billing, and energy integrations" width="100%">
+</p>
+
 # TariffKit
 
+[![CI](https://github.com/eman/tariffkit/actions/workflows/ci.yml/badge.svg)](https://github.com/eman/tariffkit/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/tariffkit)](https://pypi.org/project/tariffkit/)
+[![Python 3.14.2](https://img.shields.io/badge/python-3.14.2-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
+
 An offline electricity tariff engine for pricing, billing, and energy-system
 integrations. The first data provider supports PG&E residential rate plans under
 **NEM 3.0 / the Net Billing Tariff (NBT)**; the package identity is deliberately
@@ -134,6 +143,23 @@ pip install 'tariffkit[statements]' # + reading local PG&E statement PDFs
 pip install 'tariffkit[all]'
 ```
 
+The Home Assistant integration has been
+[submitted to the default HACS store](https://github.com/hacs/default/pull/10019),
+but approval queues can take months. Until it is approved, install TariffKit as
+a custom repository:
+
+[![Open your Home Assistant instance and add the TariffKit repository to HACS](https://my.home-assistant.io/badges/hacs_repository.svg)](https://my.home-assistant.io/redirect/hacs_repository/?owner=eman&repository=tariffkit&category=integration)
+
+Or add it manually:
+
+1. Open **HACS** in Home Assistant.
+2. Select the **three-dot menu → Custom repositories**.
+3. Enter `https://github.com/eman/tariffkit`, choose **Integration**, and select
+   **Add**.
+4. Search HACS for **TariffKit**, open it, and select **Download**.
+5. Restart Home Assistant, then add TariffKit from
+   **Settings → Devices & services → Add integration**.
+
 ## CLI
 
 ```bash

{tariffkit-0.2.0 → tariffkit-0.2.2}/README.md

@@ -1,5 +1,14 @@
+<p align="center">
+  <img src="images/banner.svg" alt="TariffKit — electricity pricing, billing, and energy integrations" width="100%">
+</p>
+
 # TariffKit
 
+[![CI](https://github.com/eman/tariffkit/actions/workflows/ci.yml/badge.svg)](https://github.com/eman/tariffkit/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/tariffkit)](https://pypi.org/project/tariffkit/)
+[![Python 3.14.2](https://img.shields.io/badge/python-3.14.2-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
+
 An offline electricity tariff engine for pricing, billing, and energy-system
 integrations. The first data provider supports PG&E residential rate plans under
 **NEM 3.0 / the Net Billing Tariff (NBT)**; the package identity is deliberately
@@ -89,6 +98,23 @@ pip install 'tariffkit[statements]' # + reading local PG&E statement PDFs
 pip install 'tariffkit[all]'
 ```
 
+The Home Assistant integration has been
+[submitted to the default HACS store](https://github.com/hacs/default/pull/10019),
+but approval queues can take months. Until it is approved, install TariffKit as
+a custom repository:
+
+[![Open your Home Assistant instance and add the TariffKit repository to HACS](https://my.home-assistant.io/badges/hacs_repository.svg)](https://my.home-assistant.io/redirect/hacs_repository/?owner=eman&repository=tariffkit&category=integration)
+
+Or add it manually:
+
+1. Open **HACS** in Home Assistant.
+2. Select the **three-dot menu → Custom repositories**.
+3. Enter `https://github.com/eman/tariffkit`, choose **Integration**, and select
+   **Add**.
+4. Search HACS for **TariffKit**, open it, and select **Download**.
+5. Restart Home Assistant, then add TariffKit from
+   **Settings → Devices & services → Add integration**.
+
 ## CLI
 
 ```bash

{tariffkit-0.2.0 → tariffkit-0.2.2}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "hatchling.build"
 
 [project]
 name = "tariffkit"
-version = "0.2.0"
+version = "0.2.2"
 description = "Offline electricity tariff pricing, billing, and integration tools"
 readme = "README.md"
 license = "MIT"
 license-files = ["LICENSE"]
-requires-python = ">=3.14"
+requires-python = ">=3.14.2"
 keywords = ["pge", "nem3", "net-billing-tariff", "solar", "battery", "home-assistant", "energy", "tariff"]
 classifiers = [
     "Development Status :: 3 - Alpha",
@@ -61,11 +61,15 @@ release = [
     "packaging>=25",
     "twine>=6.2",
 ]
+security = [
+    "pip-audit==2.10.1",
+]
 dev = [
     { include-group = "test" },
     { include-group = "quality" },
     { include-group = "regen" },
     { include-group = "release" },
+    { include-group = "security" },
     "fastapi>=0.110",
     "paho-mqtt>=2.0",
     "pytest-homeassistant-custom-component>=0.13.316",

{tariffkit-0.2.0 → tariffkit-0.2.2}/src/tariffkit/cli.py

@@ -215,6 +215,12 @@ def build_parser() -> argparse.ArgumentParser:
     mqtt.add_argument("--topic-prefix")
     mqtt.add_argument("--forecast-hours", type=int)
     mqtt.add_argument("--tls", action="store_true", default=None)
+    mqtt.add_argument(
+        "--allow-insecure-auth",
+        action="store_true",
+        default=None,
+        help="allow MQTT credentials without TLS on an isolated trusted network",
+    )
     mqtt.add_argument(
         "--no-discovery",
         dest="discovery",
@@ -601,6 +607,7 @@ def _mqtt_settings(args: Any, *, config: Config | None, profile_name: str | None
         discovery=args.discovery,
         forecast_hours=args.forecast_hours,
         tls=args.tls,
+        allow_insecure_auth=args.allow_insecure_auth,
         profile=profile_name,
     )
     if config is not None and settings.profile is not None:

{tariffkit-0.2.0 → tariffkit-0.2.2}/src/tariffkit/mqtt/publisher.py

@@ -49,10 +49,26 @@ class MqttSettings:
     forecast_hours: int = 48
     client_id: str = "tariffkit"
     tls: bool = False
+    allow_insecure_auth: bool = False
     profile: str | None = None
     account: str | None = None
 
     def __post_init__(self) -> None:
+        if not isinstance(self.tls, bool):
+            raise ConfigError("MQTT tls must be a boolean")
+        if not isinstance(self.allow_insecure_auth, bool):
+            raise ConfigError("MQTT allow_insecure_auth must be a boolean")
+        if self.password is not None and not self.username:
+            raise ConfigError("MQTT password requires a username")
+        if (
+            (self.username is not None or self.password is not None)
+            and not self.tls
+            and not self.allow_insecure_auth
+        ):
+            raise ConfigError(
+                "MQTT credentials require TLS; enable tls or explicitly set "
+                "allow_insecure_auth for an isolated trusted network"
+            )
         if self.profile is not None and self.account is not None and self.profile != self.account:
             raise ConfigError("profile and account selections disagree")
         if self.profile is None:
@@ -79,6 +95,7 @@ class MqttSettings:
                 "forecast_hours",
                 "client_id",
                 "tls",
+                "allow_insecure_auth",
                 "profile",
                 "account",
             ):
@@ -101,6 +118,17 @@ class MqttSettings:
         ):
             if value := env.get(name):
                 values[key] = value
+        if value := env.get("TARIFFKIT_MQTT_ALLOW_INSECURE_AUTH"):
+            normalized = value.casefold()
+            if normalized in {"1", "true", "yes", "on"}:
+                values["allow_insecure_auth"] = True
+            elif normalized in {"0", "false", "no", "off"}:
+                values["allow_insecure_auth"] = False
+            else:
+                raise ConfigError(
+                    "TARIFFKIT_MQTT_ALLOW_INSECURE_AUTH must be a boolean "
+                    "(true/false, yes/no, on/off, or 1/0)"
+                )
         for name in ("TARIFFKIT_ACCOUNT", "TARIFFKIT_PROFILE"):
             if value := env.get(name):
                 values["profile"] = value
@@ -177,7 +205,7 @@ class MqttPublisher:
         Kept separate from construction to allow dependency injection of the client
         while still exercising this logic.
         """
-        if self.settings.username:
+        if self.settings.username is not None:
             client.username_pw_set(self.settings.username, self.settings.password)
         if self.settings.tls:
             client.tls_set()

{tariffkit-0.2.0 → tariffkit-0.2.2}/tests/test_account_cli.py

@@ -21,7 +21,7 @@ from tariffkit.account import (
 )
 from tariffkit.account.cli import migrate_existing, sync_profile
 from tariffkit.billing import BillingPeriod, IntervalReading
-from tariffkit.cli import _mqtt_settings, _pricing_context, main
+from tariffkit.cli import _mqtt_settings, _pricing_context, build_parser, main
 from tariffkit.config import Config
 from tariffkit.errors import ConfigError
 from tariffkit.models import Supplier
@@ -412,6 +412,7 @@ def test_explicit_config_stops_mqtt_from_reverting_to_a_default_profile(
         discovery=None,
         forecast_hours=None,
         tls=None,
+        allow_insecure_auth=None,
     )
     _engine, config, profile_name, _repository = _pricing_context(args)
 
@@ -420,3 +421,13 @@ def test_explicit_config_stops_mqtt_from_reverting_to_a_default_profile(
     settings = _mqtt_settings(args, config=config, profile_name=profile_name)
 
     assert settings.profile is None
+
+
+def test_mqtt_cli_accepts_insecure_auth_escape_hatch() -> None:
+    args = build_parser().parse_args(
+        ["mqtt", "--broker", "broker.local", "--username", "user", "--allow-insecure-auth"]
+    )
+
+    settings = _mqtt_settings(args, config=None, profile_name=None)
+
+    assert settings.allow_insecure_auth is True

{tariffkit-0.2.0 → tariffkit-0.2.2}/tests/test_mqtt_publisher.py

@@ -23,9 +23,17 @@ class FakeClient:
         self.published: list[tuple[str, str, bool]] = []
         self.will: tuple[str, str, bool] | None = None
         self.connected: tuple[str, int] | None = None
+        self.auth: tuple[str, str | None] | None = None
+        self.tls = False
         self.loop_running = False
         self.disconnected = False
 
+    def username_pw_set(self, username: str, password: str | None = None) -> None:
+        self.auth = (username, password)
+
+    def tls_set(self) -> None:
+        self.tls = True
+
     def will_set(self, topic: str, payload: str, retain: bool = False) -> None:
         self.will = (topic, payload, retain)
 
@@ -82,6 +90,48 @@ def test_discovery_can_be_disabled() -> None:
     assert not any(t.startswith("homeassistant/") for t in client_of(publisher).topics())
 
 
+def test_anonymous_plaintext_connection_is_allowed() -> None:
+    publisher = make_publisher()
+
+    assert client_of(publisher).auth is None
+    assert client_of(publisher).tls is False
+
+
+def test_authenticated_plaintext_connection_is_rejected() -> None:
+    with pytest.raises(ConfigError, match="credentials require TLS"):
+        make_publisher(username="user")
+
+
+def test_password_without_username_is_rejected_even_with_tls() -> None:
+    with pytest.raises(ConfigError, match="password requires a username"):
+        make_publisher(password="secret", tls=True)
+
+
+def test_insecure_auth_escape_hatch_must_be_boolean() -> None:
+    with pytest.raises(ConfigError, match="allow_insecure_auth must be a boolean"):
+        make_publisher(username="user", allow_insecure_auth="false")
+
+
+def test_authenticated_tls_connection_configures_auth_and_tls() -> None:
+    publisher = make_publisher(username="user", password="secret", tls=True, port=8883)
+
+    client = client_of(publisher)
+    assert client.auth == ("user", "secret")
+    assert client.tls is True
+
+
+def test_explicit_insecure_auth_allows_credentials_without_tls() -> None:
+    publisher = make_publisher(
+        username="user",
+        password="secret",
+        allow_insecure_auth=True,
+    )
+
+    client = client_of(publisher)
+    assert client.auth == ("user", "secret")
+    assert client.tls is False
+
+
 def test_publishes_known_values_retained(publisher: MqttPublisher) -> None:
     publisher.publish_now(datetime(2026, 9, 15, 19, tzinfo=PACIFIC))
     topics = client_of(publisher).topics()
@@ -204,6 +254,48 @@ def test_mqtt_settings_read_default_profile_from_shared_config(tmp_path: Path) -
     assert settings.profile == "home"
 
 
+def test_mqtt_settings_loads_insecure_auth_escape_hatch_from_toml(tmp_path: Path) -> None:
+    config = tmp_path / "config.toml"
+    config.write_text(
+        '[mqtt]\nbroker = "broker.local"\nallow_insecure_auth = true\n',
+        encoding="utf-8",
+    )
+
+    settings = MqttSettings.load(
+        config,
+        tmp_path / "absent",
+        username="user",
+        password="secret",
+    )
+
+    assert settings.allow_insecure_auth is True
+
+
+def test_mqtt_settings_loads_insecure_auth_escape_hatch_from_environment(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("TARIFFKIT_MQTT_BROKER", "broker.local")
+    monkeypatch.setenv("TARIFFKIT_MQTT_USERNAME", "user")
+    monkeypatch.setenv("TARIFFKIT_MQTT_ALLOW_INSECURE_AUTH", "true")
+
+    settings = MqttSettings.load(tmp_path / "absent", tmp_path / "absent-dotenv")
+
+    assert settings.allow_insecure_auth is True
+
+
+def test_mqtt_settings_rejects_invalid_insecure_auth_environment_value(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("TARIFFKIT_MQTT_ALLOW_INSECURE_AUTH", "sometimes")
+
+    with pytest.raises(ConfigError, match="must be a boolean"):
+        MqttSettings.load(
+            tmp_path / "absent",
+            tmp_path / "absent-dotenv",
+            broker="broker.local",
+        )
+
+
 def test_mqtt_environment_profile_overrides_config_alias(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:

{tariffkit-0.2.0 → tariffkit-0.2.2}/tests/test_private_config.py

@@ -101,7 +101,10 @@ def test_mqtt_settings_resolve_config_environment_and_keyring(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
     config = tmp_path / "config.toml"
-    config.write_text('[mqtt]\nbroker = "config-broker"\nport = 1884\n', encoding="utf-8")
+    config.write_text(
+        '[mqtt]\nbroker = "config-broker"\nport = 1884\ntls = true\n',
+        encoding="utf-8",
+    )
     monkeypatch.setenv("TARIFFKIT_MQTT_BROKER", "env-broker")
     monkeypatch.setattr(
         "tariffkit.mqtt.publisher.get_secret",