toolframe-auth 0.3.1__tar.gz → 0.3.2__tar.gz

toolframe_auth-0.3.2/.github/workflows/compatibility.yml

@@ -0,0 +1,85 @@
+name: SDK compatibility
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '17 4 * * *'
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  wheel:
+    name: Build the shared plugin wheel
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '0.12.8'
+          enable-cache: false
+      - run: uv build --no-sources --wheel --out-dir build/compatibility-wheel
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: compatibility-wheel
+          path: build/compatibility-wheel/*.whl
+          if-no-files-found: error
+          retention-days: 7
+
+  compatibility:
+    name: SDK ${{ matrix.sdk }}
+    needs: wheel
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        sdk: [minimum, latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '0.12.8'
+          enable-cache: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: compatibility-wheel
+          path: build/compatibility-wheel
+      - name: Select the unchanged wheel
+        id: wheels
+        shell: bash
+        run: |
+          plugin=(build/compatibility-wheel/toolframe_auth-*.whl)
+          test "${#plugin[@]}" = 1
+          echo "plugin=${plugin[0]}" >> "$GITHUB_OUTPUT"
+      - name: Verify installed wheel and package tests
+        uses: toolframe/toolframe-sdk/.github/actions/plugin-compatibility@2e2a3d79f35fbdb04249e8351fe9c75fc2164269
+        with:
+          mode: ${{ matrix.sdk }}
+          wheel: ${{ steps.wheels.outputs.plugin }}
+          output: build/compatibility-${{ matrix.sdk }}
+      - name: Retain compatibility evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: compatibility-${{ matrix.sdk }}
+          path: |
+            build/compatibility-${{ matrix.sdk }}/report.json
+            build/compatibility-${{ matrix.sdk }}/pytest.xml
+          if-no-files-found: warn
+          retention-days: 14

{toolframe_auth-0.3.1 → toolframe_auth-0.3.2}/.github/workflows/publish.yml

@@ -2,21 +2,12 @@ name: Publish Python package
 
 on:
   workflow_dispatch:
-    inputs:
-      repository:
-        description: Package index (run this workflow on a v<project.version> tag)
-        type: choice
-        options:
-          - testpypi
-          - pypi
-        default: testpypi
-        required: true
 
 permissions:
   contents: read
 
 concurrency:
-  group: publish-${{ github.repository }}-${{ github.ref }}-${{ inputs.repository }}
+  group: publish-${{ github.repository }}-${{ github.ref }}-pypi
   cancel-in-progress: false
 
 jobs:
@@ -26,12 +17,15 @@ jobs:
     with:
       release-ref: ${{ github.ref }}
 
+  compatibility:
+    uses: ./.github/workflows/compatibility.yml
+
   publish:
-    needs: validate
+    needs: [validate, compatibility]
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     environment:
-      name: ${{ inputs.repository }}
+      name: pypi
     permissions:
       id-token: write
     steps:
@@ -41,15 +35,7 @@ jobs:
           name: toolframe-auth-dist
           path: dist
 
-      - name: Publish to TestPyPI
-        if: inputs.repository == 'testpypi'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
-        with:
-          repository-url: https://test.pypi.org/legacy/
-          packages-dir: dist/
-
       - name: Publish to PyPI
-        if: inputs.repository == 'pypi'
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: dist/

{toolframe_auth-0.3.1 → toolframe_auth-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: toolframe-auth
-Version: 0.3.1
+Version: 0.3.2
 Summary: Managed access passwords and sessions for Toolframe
 Project-URL: Homepage, https://github.com/toolframe/toolframe-auth
 Project-URL: Repository, https://github.com/toolframe/toolframe-auth
@@ -11,7 +11,7 @@ License-Expression: Apache-2.0
 License-File: LICENSE
 License-File: NOTICE
 Requires-Python: >=3.14
-Requires-Dist: toolframe-sdk<0.5,>=0.4
+Requires-Dist: toolframe-sdk<1,>=0.4.0
 Description-Content-Type: text/markdown
 
 # Toolframe Auth
@@ -25,7 +25,7 @@ database files itself. It requires SDK 0.4 and `toolframe.sql`.
 With a running Toolframe application and an active SQL storage provider:
 
 ```sh
-toolframe --home APP plugin add pypi:toolframe-auth==0.3.1 --enable
+toolframe --home APP plugin add pypi:toolframe-auth==0.3.2 --enable
 ```
 
 The [Entry Register template](https://github.com/toolframe/toolframe-core#readme)
@@ -107,7 +107,7 @@ uv build --wheel
 
 For the same isolated lint, tests, distribution and wheel-install checks used by
 GitHub Actions, run `python3.14 scripts/ci.py`. See [CI and publishing](docs/ci.md)
-for pinned sibling sources, local requirements and TestPyPI/PyPI setup.
+for pinned sibling sources, local requirements and PyPI setup.
 
 Core owns access policy. Its compatible OIDC integration supports
 `access.failure_mode = "closed"` for protected deployments; the default preserves
@@ -129,3 +129,6 @@ retain its private keys and configuration with the application home. Existing
 SQLite records are not imported automatically.
 
 For development hooks and contribution rules, see [Contributing](CONTRIBUTING.md).
+
+Plugin dependencies allow compatible SDK 0.x updates from the declared minimum.
+See the [SDK compatibility policy](https://github.com/toolframe/toolframe-sdk/blob/main/docs/compatibility.md) for API guarantees and minimum/latest verification.

{toolframe_auth-0.3.1 → toolframe_auth-0.3.2}/README.md

@@ -9,7 +9,7 @@ database files itself. It requires SDK 0.4 and `toolframe.sql`.
 With a running Toolframe application and an active SQL storage provider:
 
 ```sh
-toolframe --home APP plugin add pypi:toolframe-auth==0.3.1 --enable
+toolframe --home APP plugin add pypi:toolframe-auth==0.3.2 --enable
 ```
 
 The [Entry Register template](https://github.com/toolframe/toolframe-core#readme)
@@ -91,7 +91,7 @@ uv build --wheel
 
 For the same isolated lint, tests, distribution and wheel-install checks used by
 GitHub Actions, run `python3.14 scripts/ci.py`. See [CI and publishing](docs/ci.md)
-for pinned sibling sources, local requirements and TestPyPI/PyPI setup.
+for pinned sibling sources, local requirements and PyPI setup.
 
 Core owns access policy. Its compatible OIDC integration supports
 `access.failure_mode = "closed"` for protected deployments; the default preserves
@@ -113,3 +113,6 @@ retain its private keys and configuration with the application home. Existing
 SQLite records are not imported automatically.
 
 For development hooks and contribution rules, see [Contributing](CONTRIBUTING.md).
+
+Plugin dependencies allow compatible SDK 0.x updates from the declared minimum.
+See the [SDK compatibility policy](https://github.com/toolframe/toolframe-sdk/blob/main/docs/compatibility.md) for API guarantees and minimum/latest verification.

{toolframe_auth-0.3.1 → toolframe_auth-0.3.2}/docs/ci.md

@@ -68,14 +68,13 @@ the default `GITHUB_TOKEN` cannot read another private repository. Fork pull
 requests cannot access that secret and require publicly readable dependencies
 to pass. Checkout credentials are not persisted.
 
-`publish.yml` supports manual dispatch only, with `testpypi` as the default and
-`pypi` as the other selection. Run it on an existing tag named exactly
-`v<project.version>` (currently `v0.1.1`). A branch ref or mismatched tag fails
-the version gate. The reusable CI workflow validates the selected `github.sha`,
+`publish.yml` publishes to PyPI on manual dispatch only. Run it on an existing
+tag named exactly `v<project.version>`. A branch ref or mismatched tag fails the
+version gate. The reusable CI workflow validates the selected `github.sha`,
 and publishing downloads only that run's validated artifact. The publishing
 job has a 10-minute timeout and is the only job with `id-token: write`. It does
 not rebuild the distributions. Duplicate uploads fail; existing files are not
-silently skipped. Publish runs for the same tag and index are serialized without
+silently skipped. Publish runs for the same tag are serialized without
 cancelling an in-progress run.
 
 ## Publication

{toolframe_auth-0.3.1 → toolframe_auth-0.3.2}/docs/releasing.md

@@ -10,13 +10,14 @@ artifacts produced by that successful run.
 Run the repository's existing validation workflow; its local commands and
 integration coverage are described in [CI](ci.md).
 
-Publish `toolframe-sdk==0.4.1` first. The coordinated order and native CLI channels are documented in
+Publish any newly required SDK version before the plugin. Compatible Core or SDK
+updates alone do not require a plugin release. The coordinated order and native CLI channels are documented in
 [Toolframe's release guide](https://github.com/toolframe/toolframe-core/blob/main/docs/releasing.md).
 
 ## Trusted Publishers
 
-Create GitHub environments named `testpypi` and `pypi`. On each corresponding
-package index, configure a normal or pending Trusted Publisher with these values:
+Create a GitHub environment named `pypi`. On PyPI, configure a normal or
+pending Trusted Publisher with these values:
 
 | Field | Value |
 | --- | --- |
@@ -24,7 +25,7 @@ package index, configure a normal or pending Trusted Publisher with these values
 | GitHub owner | `toolframe` |
 | GitHub repository | `toolframe-auth` |
 | Workflow filename | `publish.yml` |
-| Environment | `testpypi` or `pypi`, matching the index |
+| Environment | `pypi` |
 
 If publishing from another owner, use that actual owner in the publisher binding.
 Follow [PyPI's Trusted Publishing guide](https://docs.pypi.org/trusted-publishers/using-a-publisher/).
@@ -40,7 +41,7 @@ sibling owner where the workflow exposes that variable.
 ## Publish and verify
 
 After the release commit and matching tag are available remotely, manually run
-`publish.yml` at `v0.3.1`, selecting `testpypi` first and then `pypi`.
+`publish.yml` at the matching `v<project.version>` tag to publish to PyPI.
 A branch or mismatched tag is rejected. Downloaded files are the artifacts from
 that run; the publishing job does not rebuild them. Published files cannot be
 replaced under the same version.
@@ -49,11 +50,11 @@ After PyPI publication, verify a clean installation:
 
 ```sh
 uv venv --python 3.14.7 build/consumer
-uv pip install --python build/consumer/bin/python 'toolframe-auth==0.3.1'
+uv pip install --python build/consumer/bin/python 'toolframe-auth==0.3.2'
 uv pip check --python build/consumer/bin/python
 ```
 
-TestPyPI does not mirror dependencies. Test the specific artifact against an
-explicit dependency source; a local or TestPyPI check alone does not demonstrate
-that production PyPI resolution works. Keep logs, hashes and exact revisions in
-CI artifacts or ignored local evidence directories.
+Test the specific artifact with dependencies from PyPI. Local artifact checks
+alone do not demonstrate that the published package resolves correctly from
+PyPI. Keep logs, hashes and exact revisions in CI artifacts or ignored local
+evidence directories.

{toolframe_auth-0.3.1 → toolframe_auth-0.3.2}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "hatchling.build"
 
 [project]
 name = "toolframe-auth"
-version = "0.3.1"
+version = "0.3.2"
 description = "Managed access passwords and sessions for Toolframe"
 readme = "README.md"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 authors = [{ name = "byfb", email = "62798989+byfb@users.noreply.github.com" }]
 requires-python = ">=3.14"
-dependencies = ["toolframe-sdk<0.5,>=0.4"]
+dependencies = ["toolframe-sdk<1,>=0.4.0"]
 
 [project.urls]
 Homepage = "https://github.com/toolframe/toolframe-auth"

{toolframe_auth-0.3.1 → toolframe_auth-0.3.2}/uv.lock

@@ -282,7 +282,7 @@ wheels = [
 
 [[package]]
 name = "toolframe-auth"
-version = "0.3.1"
+version = "0.3.2"
 source = { editable = "." }
 dependencies = [
     { name = "toolframe-sdk" },