techrevati-runtime 0.1.0__tar.gz → 0.3.0.dev1__tar.gz

{techrevati_runtime-0.1.0 → techrevati_runtime-0.3.0.dev1}/.github/ISSUE_TEMPLATE/feature.md

@@ -20,6 +20,6 @@ labels: enhancement
 <!-- What would you do today as a workaround? Why doesn't it scale? -->
 
 **Industry priors**
-<!-- Has another agent SDK (OpenAI Agents SDK, LangGraph, Anthropic
-     Claude Agent SDK, etc.) shipped something similar? Link it. We
-     prefer landing primitives that match industry conventions. -->
+<!-- Has another agent SDK (OpenAI Agents SDK, LangGraph, etc.)
+     shipped something similar? Link it. We prefer landing
+     primitives that match industry conventions. -->

techrevati_runtime-0.3.0.dev1/.github/workflows/ci.yml

@@ -0,0 +1,124 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Test on Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ['3.11', '3.12', '3.13']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install package + dev dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Lint with ruff
+        run: ruff check src/ tests/
+
+      - name: Format check with ruff
+        run: ruff format --check src/ tests/
+
+      - name: Type check with mypy
+        run: mypy src/ --strict
+
+      - name: Run tests
+        run: pytest tests/ -v --cov=src/techrevati --cov-report=term-missing --cov-report=xml
+
+      - name: Per-module coverage floor (>= 85%)
+        run: python scripts/check_module_coverage.py --threshold 85
+
+      - name: Upload coverage
+        uses: codecov/codecov-action@v4
+        with:
+          files: ./coverage.xml
+          fail_ci_if_error: false
+
+  build:
+    name: Build on Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    needs: test
+    strategy:
+      matrix:
+        python-version: ['3.11', '3.12', '3.13']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build distribution
+        run: python -m build
+
+      - name: Check wheel
+        run: |
+          pip install dist/*.whl
+          python -c "from techrevati import runtime; print(f'techrevati-runtime {runtime.__version__}')"
+
+  zero-deps-smoke:
+    name: Zero-deps smoke on Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    needs: build
+    strategy:
+      matrix:
+        python-version: ['3.11', '3.12', '3.13']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Build distribution
+        run: |
+          pip install build
+          python -m build
+
+      - name: Install in an empty venv (no [dev], no [otel])
+        # Spin a fresh venv to verify the zero-runtime-dependency
+        # promise: the wheel must import with only stdlib + the wheel
+        # itself, no optional extras pulled in.
+        run: |
+          python -m venv smoke-venv
+          smoke-venv/bin/pip install --upgrade pip
+          smoke-venv/bin/pip install dist/*.whl
+          smoke-venv/bin/python -c "
+          import techrevati.runtime as r
+          assert r.__version__, '__version__ missing'
+          # Touch the public exports to make sure every module imports
+          # without optional deps installed.
+          from techrevati.runtime import (
+              AgentSession, OrchestrationSession, AsyncOrchestrationSession,
+              CircuitBreaker, AsyncCircuitBreaker,
+              TokenBucket, AsyncTokenBucket, RateLimiter,
+              StaticProviderRouter, RoundRobinProviderRouter,
+              InMemorySaver, SqliteSaver,
+              SqliteEventSink, SqliteUsageSink,
+              UsageLimits, ManualClock, SystemClock,
+          )
+          print(f'zero-deps smoke OK on techrevati-runtime {r.__version__}')
+          "

techrevati_runtime-0.3.0.dev1/.github/workflows/codeql.yml

@@ -0,0 +1,42 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly scan on Mondays — catches dependency-driven advisories
+    # that land after a PR has already been merged.
+    - cron: '0 6 * * 1'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

{techrevati_runtime-0.1.0 → techrevati_runtime-0.3.0.dev1}/.github/workflows/docs.yml

@@ -26,7 +26,10 @@ jobs:
           pip install mkdocs mkdocs-material mkdocstrings[python]
 
       - name: Build documentation
-        run: mkdocs build
+        # --strict turns broken refs and unresolved nav entries into
+        # hard failures so a doc regression cannot silently degrade
+        # the published site.
+        run: mkdocs build --strict
 
       - name: Deploy to GitHub Pages
         uses: peaceiris/actions-gh-pages@v3

techrevati_runtime-0.3.0.dev1/.github/workflows/release.yml

@@ -0,0 +1,108 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  # contents: write so softprops/action-gh-release can create the
+  # GitHub Release; id-token: write for PyPI trusted publishing.
+  contents: write
+  id-token: write
+
+jobs:
+  # Gate the release behind the same lint/type/test checks CI enforces
+  # on `main`. Without this, a tag push could publish a broken wheel to
+  # PyPI even if CI was red on the underlying commit. Matrix mirrors
+  # ci.yml so the gate has the same shape.
+  verify:
+    name: Verify on Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ['3.11', '3.12', '3.13']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install package + dev dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Lint with ruff
+        run: ruff check src/ tests/
+
+      - name: Format check with ruff
+        run: ruff format --check src/ tests/
+
+      - name: Type check with mypy
+        run: mypy src/ --strict
+
+      - name: Run tests
+        run: pytest tests/ -v --cov=src/techrevati --cov-report=term-missing
+
+      - name: Per-module coverage floor (>= 85%)
+        run: python scripts/check_module_coverage.py --threshold 85
+
+  release:
+    name: Release to PyPI
+    runs-on: ubuntu-latest
+    needs: verify
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install build tools
+        # cyclonedx-py is dev-only here — it generates the SBOM
+        # artifact and never touches the runtime install.
+        run: pip install build cyclonedx-bom
+
+      - name: Build distribution
+        run: python -m build
+
+      - name: Stage artifacts for PyPI
+        # Keep PyPI uploads strictly to wheel + sdist. The SBOM lives
+        # alongside the wheel on the GitHub Release but never lands on
+        # the index.
+        run: |
+          mkdir -p pypi-dist
+          cp dist/*.whl dist/*.tar.gz pypi-dist/
+
+      - name: Generate CycloneDX SBOM
+        # SBOM describes the build's dependency graph at publish time.
+        # PyPI's trusted-publishing attestations + this SBOM together
+        # give downstream consumers everything they need to verify
+        # provenance (see SECURITY.md for the verify command).
+        run: |
+          pip install dist/*.whl
+          cyclonedx-py environment --output-format json --output-file dist/sbom.cyclonedx.json
+          cyclonedx-py environment --output-format xml  --output-file dist/sbom.cyclonedx.xml
+
+      - name: Publish to PyPI (Trusted Publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: pypi-dist
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v1
+        with:
+          generate_release_notes: true
+          files: |
+            dist/*.whl
+            dist/*.tar.gz
+            dist/sbom.cyclonedx.json
+            dist/sbom.cyclonedx.xml