testisolation 0.0.0__tar.gz → 0.3.0__tar.gz

testisolation-0.3.0/.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+# Per-SHA group: re-runs of the same commit dedupe, but a new commit never
+# cancels an earlier commit's in-flight run (release CI conclusions stay intact).
+concurrency:
+  group: ${{ github.workflow_ref }}-${{ github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # requires-python: >= 3.11
+        python-version: ["3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v7
+      - run: uv python install ${{ matrix.python-version }}
+      - run: uv sync --locked
+      - run: uv run python -c "import testisolation"
+      - name: Install gitleaks
+        run: |
+          GITLEAKS_VERSION=8.24.3
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin gitleaks
+      - run: uv run pytest --rootdir .

testisolation-0.3.0/.github/workflows/publish.yml

@@ -0,0 +1,195 @@
+name: Publish
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to publish (e.g. v1.2.3). Overrides the ref for
+          retry dispatch.
+        required: false
+        type: string
+
+# One publish run per tag: a workflow_dispatch retry at the same tag
+# queues behind the in-flight run instead of racing it. A publish is never
+# cancelled mid-flight.
+concurrency:
+  group: publish-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+permissions:
+  contents: read
+  id-token: write
+jobs:
+  gate:
+    name: Gate on CI
+    runs-on: ubuntu-latest
+    permissions:
+      checks: read
+      contents: read
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+      GATE_TIMEOUT_MINUTES: '20'
+      GATE_GRACE_MINUTES: '5'
+      GATE_POLL_SECONDS: '15'
+      GATE_MARKER_ATTEMPTS: '5'
+      GATE_MARKER_RETRY_SECONDS: '5'
+      CI_CHECK_REGEX: ^(test)( \(.*\))?$
+    steps:
+      - name: Wait for CI to succeed on the release commit
+        run: |
+          set -euo pipefail
+
+          # Commit resolution -- explicit marker-first order (never reads the release
+          # event payload; dispatch retries have none, so this path is uniform for
+          # release events and dispatch retries alike):
+          #   (1) Marker: rlsbl writes the exact commit CI ran on into the GitHub
+          #       Release body as a machine-parseable line of the form
+          #           <!-- rlsbl-ci-sha: <40-hex> -->
+          #       Prefer it when present -- it pins the precise commit and is immune to
+          #       ref races. A just-created release can lag on a GitHub API read replica
+          #       (the marker is written at release creation but may not be visible on
+          #       the first read), so RETRY the read GATE_MARKER_ATTEMPTS times,
+          #       GATE_MARKER_RETRY_SECONDS apart, before concluding it is absent. The
+          #       tag is inputs.tag (TAG_INPUT) when dispatched with an explicit
+          #       override, else GITHUB_REF_NAME (matches the router resolver).
+          #   (2) Fallback: older releases predate the marker, so fall back to
+          #       $GITHUB_SHA, the tag's commit for both release and dispatch-at-tag.
+          extract_ci_sha() {
+            # Emit the first rlsbl-ci-sha marker SHA found on stdin, if any.
+            sed -n 's/.*<!-- rlsbl-ci-sha: \([0-9a-f]\{40\}\) -->.*/\1/p' | head -n1
+          }
+          tag="${TAG_INPUT:-$GITHUB_REF_NAME}"
+          marker_attempts="${GATE_MARKER_ATTEMPTS:-5}"
+          marker_retry_seconds="${GATE_MARKER_RETRY_SECONDS:-5}"
+          sha=""
+          attempt=1
+          while [ "$attempt" -le "$marker_attempts" ]; do
+            if body="$(gh release view "$tag" --json body --jq .body 2>/dev/null)"; then
+              sha="$(printf '%s\n' "$body" | extract_ci_sha)"
+            fi
+            if [ -n "$sha" ]; then
+              break
+            fi
+            if [ "$attempt" -lt "$marker_attempts" ]; then
+              echo "Publish gate: rlsbl-ci-sha marker not yet visible in the '$tag' release body (attempt $attempt/$marker_attempts); retrying in ${marker_retry_seconds}s..."
+              sleep "$marker_retry_seconds"
+            fi
+            attempt=$(( attempt + 1 ))
+          done
+          if [ -n "$sha" ]; then
+            echo "Publish gate: resolved release commit from rlsbl-ci-sha marker in the '$tag' release body."
+          else
+            sha="$GITHUB_SHA"
+            echo "Publish gate: no rlsbl-ci-sha marker after $marker_attempts attempt(s) on the '$tag' release body; falling back to \$GITHUB_SHA."
+          fi
+          echo "Publish gate: waiting for CI on $GITHUB_REF_NAME (commit $sha)"
+          echo "Check-run name filter: $CI_CHECK_REGEX"
+          # Timeout, grace window, and poll interval come from the job env above;
+          # edit them there if this repository's CI needs different limits.
+
+          now() { date +%s; }
+          start="$(now)"
+          deadline=$(( start + GATE_TIMEOUT_MINUTES * 60 ))
+          grace_deadline=$(( start + GATE_GRACE_MINUTES * 60 ))
+
+          while :; do
+            if ! resp="$(gh api --paginate "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs?per_page=100")"; then
+              echo "Checks API request failed; retrying in ${GATE_POLL_SECONDS}s..."
+              sleep "$GATE_POLL_SECONDS"
+              continue
+            fi
+            # Match this project's CI check runs by name; exclude check runs that
+            # belong to THIS workflow run (the gate itself and the queued publish
+            # jobs would otherwise deadlock the poll loop).
+            # A retried CI run creates a BRAND-NEW check-run with the same name as the
+            # old one, so a stale failure would block the gate forever. Project id and
+            # started_at, then reduce to the latest check-run per name (max started_at,
+            # numeric id as tiebreak for retries within the same second) BEFORE the
+            # pending / not-success logic runs. This way the newest run decides: still
+            # running -> wait; genuinely red -> hard fail.
+            runs="$(jq -s --arg re "$CI_CHECK_REGEX" --arg run_id "$GITHUB_RUN_ID" '
+              [ .[].check_runs[]
+                | select(.name | test($re))
+                | select((.details_url // "") | contains("/actions/runs/" + $run_id + "/") | not)
+                | {name, status, conclusion, id, started_at} ]
+              | group_by(.name)
+              | map(sort_by(.started_at, .id) | last)' <<< "$resp")"
+            total="$(jq 'length' <<< "$runs")"
+
+            if [ "$total" -eq 0 ]; then
+              if [ "$(now)" -ge "$grace_deadline" ]; then
+                echo "::error::Publish gate: no CI check runs matching $CI_CHECK_REGEX appeared on $sha within $GATE_GRACE_MINUTES minutes."
+                echo "A scaffolded repository always has a CI workflow, and rlsbl verifies CI on this exact commit BEFORE tagging it, so check runs must exist here."
+                echo "Their absence means the check runs were deleted, the commit resolution is wrong, or this tag was created outside rlsbl."
+                echo "If CI jobs were renamed, update CI_CHECK_REGEX in this workflow's gate job to match the new names."
+                exit 1
+              fi
+              echo "No matching CI check runs yet; retrying in ${GATE_POLL_SECONDS}s..."
+              sleep "$GATE_POLL_SECONDS"
+              continue
+            fi
+
+            pending="$(jq '[ .[] | select(.status != "completed") ] | length' <<< "$runs")"
+            if [ "$pending" -gt 0 ]; then
+              if [ "$(now)" -ge "$deadline" ]; then
+                echo "::error::Publish gate: timed out after $GATE_TIMEOUT_MINUTES minutes waiting for CI to complete on $sha."
+                jq -r '.[] | "  \(.name): status=\(.status) conclusion=\(.conclusion // "none")"' <<< "$runs"
+                exit 1
+              fi
+              echo "$pending of $total matching CI check runs still running; retrying in ${GATE_POLL_SECONDS}s..."
+              sleep "$GATE_POLL_SECONDS"
+              continue
+            fi
+
+            not_success="$(jq '[ .[] | select(.conclusion != "success") ]' <<< "$runs")"
+            if [ "$(jq 'length' <<< "$not_success")" -gt 0 ]; then
+              echo "::error::Publish gate: CI did not pass on $sha -- refusing to publish."
+              jq -r '.[] | "  \(.name): \(.conclusion)"' <<< "$not_success"
+              while IFS= read -r conclusion; do
+                case "$conclusion" in
+                  failure|timed_out)
+                    echo "CI concluded '$conclusion' on the release commit."
+                    echo "rlsbl tags and releases a commit only AFTER its CI has gone green, so reaching this branch means one of: CI was re-run on an already-released commit and regressed, a required check was added after the release, or this tag/Release was created outside rlsbl."
+                    echo "Do NOT re-dispatch this publish workflow expecting a different answer -- a failure baked into the code at this commit fails identically every time, and there is no way to make this tag green."
+                    echo "Remedy: fix forward on the release branch and cut a NEW release with 'rlsbl release run' (its own CI gate must go green before it is tagged), then mark this one with 'rlsbl release deprecate <version>'."
+                    ;;
+                  cancelled)
+                    echo "A CI check run was CANCELLED. A cancelled run proves nothing about the commit, so the gate treats it as a hard failure instead of waiting for a conclusion that will never come."
+                    echo "Remedy: re-run the cancelled CI workflow on this exact commit (gh run rerun <run-id>). If it concludes success, re-dispatch this publish workflow at the tag ref: gh workflow run <publish workflow> --ref $GITHUB_REF_NAME"
+                    ;;
+                  skipped)
+                    echo "A CI check run matching the filter was SKIPPED. The gate cannot treat a skipped check as passing: this project must actually run its own CI on the release commit."
+                    echo "Remedy: check paths filters and job conditions so CI runs for this project, re-run CI on this commit, then re-dispatch this publish workflow at the tag ref."
+                    ;;
+                  *)
+                    echo "CI check concluded '$conclusion' (not success). The gate only proceeds when every matching check concluded success."
+                    ;;
+                esac
+              done <<< "$(jq -r '.[].conclusion' <<< "$not_success" | sort -u)"
+              exit 1
+            fi
+
+            echo "Publish gate: all $total matching CI check runs succeeded."
+            jq -r '.[] | "  \(.name): \(.conclusion)"' <<< "$runs"
+            exit 0
+          done
+  pypi:
+    needs: gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.tag || github.event.release.tag_name }}
+      - uses: astral-sh/setup-uv@v7
+      - name: Install gitleaks
+        run: |
+          GITLEAKS_VERSION=8.24.3
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin gitleaks
+      - run: uv build --out-dir dist
+      - name: Scan artifacts for secrets
+        run: |
+          gitleaks dir dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true

testisolation-0.3.0/.gitignore

@@ -0,0 +1,18 @@
+node_modules/
+__pycache__/
+*.pyc
+*.log
+.DS_Store
+coverage/
+build/
+dist/
+target/
+*.egg-info/
+.rlsbl-notes-*.tmp
+.rlsbl/lock
+.rlsbl-monorepo/lock
+.credentials.json
+.*-cache.json
+.env
+.env.local
+*.local-only

testisolation-0.3.0/.rlsbl/config.json

@@ -0,0 +1,14 @@
+{
+  "targets": [
+    "pypi"
+  ],
+  "publish_mode": "ci",
+  "pipelines": {
+    "pypi": {
+      "type": "pypi",
+      "local": false,
+      "target": "pypi"
+    }
+  },
+  "changelog_format_version_enforced": true
+}

testisolation-0.3.0/.rlsbl/lint/python.toml

@@ -0,0 +1,25 @@
+[forbidden-imports]
+modules = [
+    "argparse",
+    "click",
+    "typer",
+    "flask",
+    "fastapi",
+    "django",
+    "uvicorn",
+    "granian",
+    "starlette",
+    "tornado",
+    "bottle",
+]
+
+[stdout]
+enabled = true
+ignore = []
+
+[entry-point]
+enabled = true
+ignore = []
+
+[files]
+exclude = []

testisolation-0.3.0/.rlsbl/managed-files.json

@@ -0,0 +1,9 @@
+{
+  "version": 1,
+  "files": {
+    ".github/workflows/ci.yml": "317dad66e40c753dfa18b5d143ea16cb1c9b4e8426eb3d8f703b67589d8ac129",
+    ".github/workflows/publish.yml": "bfa60b4f497b67e71b31336e0373a3730aca9b16e6b35d1f7a3e003ee406c01a",
+    ".gitignore": "c32366f560dbf628eb04a94d25e8d8acf719605b2ea27d31047df16e13580c04",
+    ".rlsbl/lint/python.toml": "9cfbcef2e010d5fad243437bf2fd8df54a1fae70ee0762f9d11da70fe207501c"
+  }
+}

testisolation-0.3.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 smm-h
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

testisolation-0.3.0/PKG-INFO

@@ -0,0 +1,50 @@
+Metadata-Version: 2.5
+Name: testisolation
+Version: 0.3.0
+Summary: Uncompromising test isolation: your tests structurally cannot touch your real files, secrets, or git identity -- First-class support for Go, Python with pytest, and TypeScript with Node
+Project-URL: Homepage, https://smmh.dev/testisolation/
+Project-URL: Documentation, https://smmh.dev/testisolation/
+Project-URL: Repository, https://github.com/stricttools/testisolation
+Project-URL: Issues, https://github.com/stricttools/testisolation/issues
+Project-URL: Changelog, https://github.com/stricttools/testisolation/blob/main/CHANGELOG.md
+Author-email: "S. M. Hosseini" <m.hosseini@veliu.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: credentials,isolation,node-test,pytest,rlsbl,sandbox,security,test-isolation,testing
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: Pytest
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.11
+Requires-Dist: pytest>=7.0
+Description-Content-Type: text/markdown
+
+# testisolation (Python)
+
+Uncompromising test isolation: your tests structurally cannot touch your real files, secrets, or git identity -- First-class support for Go, Python with pytest, and TypeScript with Node
+
+This is the pytest plugin.
+
+```bash
+pip install testisolation
+```
+
+Installing it is adoption: the plugin loads through its `pytest11` entry point
+and refuses to run a suite that has not declared its safety stance.
+
+```toml
+[tool.pytest.ini_options]
+testisolation_sockets = "deny"
+testisolation_socket_allowlist = []
+testisolation_unix_socket_allowlist = []
+testisolation_loopback = "deny"
+testisolation_sandbox_required = "false"
+```
+
+See the [repository README](https://github.com/stricttools/testisolation) for the full
+key reference and what each guard does.
+
+## License
+
+MIT

testisolation-0.3.0/README.md

@@ -0,0 +1,28 @@
+# testisolation (Python)
+
+Uncompromising test isolation: your tests structurally cannot touch your real files, secrets, or git identity -- First-class support for Go, Python with pytest, and TypeScript with Node
+
+This is the pytest plugin.
+
+```bash
+pip install testisolation
+```
+
+Installing it is adoption: the plugin loads through its `pytest11` entry point
+and refuses to run a suite that has not declared its safety stance.
+
+```toml
+[tool.pytest.ini_options]
+testisolation_sockets = "deny"
+testisolation_socket_allowlist = []
+testisolation_unix_socket_allowlist = []
+testisolation_loopback = "deny"
+testisolation_sandbox_required = "false"
+```
+
+See the [repository README](https://github.com/stricttools/testisolation) for the full
+key reference and what each guard does.
+
+## License
+
+MIT

testisolation-0.3.0/pyproject.toml

@@ -0,0 +1,60 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "testisolation"
+version = "0.3.0"
+description = "Uncompromising test isolation: your tests structurally cannot touch your real files, secrets, or git identity -- First-class support for Go, Python with pytest, and TypeScript with Node"
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "S. M. Hosseini", email = "m.hosseini@veliu.com" }]
+keywords = [
+    "testing",
+    "test-isolation",
+    "isolation",
+    "sandbox",
+    "security",
+    "credentials",
+    "pytest",
+    "node-test",
+    "rlsbl",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Framework :: Pytest",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Topic :: Software Development :: Testing",
+]
+dependencies = ["pytest>=7.0"]
+
+[project.entry-points.pytest11]
+testisolation = "testisolation.plugin"
+
+[dependency-groups]
+dev = ["pytest", "pytest-xdist"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/testisolation"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+# testisolation is active in its own suite through the pytest11 entry point, so
+# this project declares its safety stance like any other consumer.
+testisolation_sockets = "deny"
+testisolation_socket_allowlist = []
+testisolation_unix_socket_allowlist = []
+testisolation_loopback = "deny"
+# No sandbox runner exists in this repo yet; the runner ships as a scaffold
+# template from rlsbl. Flip to "true" at adoption.
+testisolation_sandbox_required = "false"
+
+[project.urls]
+Homepage = "https://smmh.dev/testisolation/"
+Documentation = "https://smmh.dev/testisolation/"
+Repository = "https://github.com/stricttools/testisolation"
+Issues = "https://github.com/stricttools/testisolation/issues"
+Changelog = "https://github.com/stricttools/testisolation/blob/main/CHANGELOG.md"

testisolation-0.3.0/src/testisolation/__init__.py

@@ -0,0 +1,18 @@
+"""testisolation -- always-on test isolation for pytest suites.
+
+The package ships a ``pytest11`` plugin. Installing it is adoption: the plugin
+loads automatically and refuses to run a suite that has not declared its safety
+stance. See :mod:`testisolation.config` for the ini keys.
+"""
+
+from .config import PRESERVE_VARS, REQUIRED_KEYS, Settings
+from .socketguard import NetworkBlocked, Policy
+
+__version__ = "0.3.0"
+
+# No ``__all__`` here on purpose. Every name above is defined -- and documented
+# -- on its own module's API-reference page; re-listing them here would make the
+# package root claim them a second time, double-counting them in documentation
+# coverage. The re-exports themselves are the public import path
+# (``from testisolation import NetworkBlocked``) and are covered by the suite.
+_REEXPORTS = (PRESERVE_VARS, REQUIRED_KEYS, Settings, NetworkBlocked, Policy)