zdm 0.6.0__tar.gz

zdm-0.6.0/.github/workflows/ci.yml

@@ -0,0 +1,138 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          persist-credentials: false
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+
+      - name: Cache Cargo
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Run tests
+        run: cargo test --locked --all-features
+
+      - name: Run tests (release mode)
+        run: cargo test --locked --release --all-features
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          persist-credentials: false
+
+      - name: Test installer checksum verification
+        run: bash tests/install_checksum.sh
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          components: clippy, rustfmt
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Run Clippy
+        run: cargo clippy --locked --all-targets --all-features -- -D warnings
+
+  security:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          persist-credentials: false
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --version 0.22.1 --locked
+
+      - name: Run security audit
+        run: cargo audit --deny warnings
+
+  build:
+    name: Build (${{ matrix.target }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Linux x86_64
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          # Linux ARM64
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+          # macOS x86_64
+          - os: macos-latest
+            target: x86_64-apple-darwin
+          # macOS ARM64 (Apple Silicon)
+          - os: macos-latest
+            target: aarch64-apple-darwin
+          # Windows x86_64
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+          # Windows ARM64
+          - os: windows-latest
+            target: aarch64-pc-windows-msvc
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          persist-credentials: false
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Install cross-compilation tools (Linux ARM64)
+        if: matrix.target == 'aarch64-unknown-linux-gnu'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu
+
+      - name: Build
+        run: cargo build --locked --release --target ${{ matrix.target }}
+        env:
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: zdm-${{ matrix.target }}
+          path: |
+            target/${{ matrix.target }}/release/zdm${{ matrix.os == 'windows-latest' && '.exe' || '' }}

zdm-0.6.0/.github/workflows/release.yml

@@ -0,0 +1,337 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+env:
+  CARGO_TERM_COLOR: always
+
+permissions:
+  contents: read
+
+jobs:
+  validate-release:
+    name: Validate release metadata
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Check tag is releasable
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin main
+          git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+          version="${GITHUB_REF_NAME#v}"
+          grep -qx "version = \"$version\"" Cargo.toml
+          grep -qx "version = \"$version\"" pyproject.toml
+          grep -Eq "^## (\\[$version\\]|$version) - [0-9]{4}-[0-9]{2}-[0-9]{2}$" CHANGELOG.md
+
+  verify:
+    name: Verify release source
+    needs: validate-release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          persist-credentials: false
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          components: clippy, rustfmt
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Run Clippy
+        run: cargo clippy --locked --all-targets --all-features -- -D warnings
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --version 0.22.1 --locked
+
+      - name: Run security audit
+        run: cargo audit --deny warnings
+
+      - name: Run tests
+        run: cargo test --locked --all-features
+
+      - name: Run tests (release mode)
+        run: cargo test --locked --release --all-features
+
+      - name: Check package contents
+        run: cargo package --locked --list
+
+  build-wheels:
+    name: Build wheels (${{ matrix.target }})
+    needs: verify
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Linux x86_64
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            manylinux: 2_28
+            asset: zdm-x86_64-unknown-linux-gnu
+            script: zdm
+            native: true
+            before_script_linux: dnf -y install perl-IPC-Cmd perl-Time-Piece
+          # Linux ARM64
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+            manylinux: 2_28
+            asset: zdm-aarch64-unknown-linux-gnu
+            script: zdm
+            native: false
+          # macOS x86_64 (Intel)
+          - os: macos-15-intel
+            target: x86_64-apple-darwin
+            asset: zdm-x86_64-apple-darwin
+            script: zdm
+            native: true
+          # macOS ARM64 (Apple Silicon)
+          - os: macos-15
+            target: aarch64-apple-darwin
+            asset: zdm-aarch64-apple-darwin
+            script: zdm
+            native: true
+          # Windows x86_64
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            asset: zdm-x86_64-pc-windows-msvc.exe
+            script: zdm.exe
+            native: true
+          # Windows ARM64
+          - os: windows-latest
+            target: aarch64-pc-windows-msvc
+            asset: zdm-aarch64-pc-windows-msvc.exe
+            script: zdm.exe
+            native: false
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        with:
+          python-version: '3.12'
+
+      - name: Build wheel
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b
+        with:
+          command: build
+          target: ${{ matrix.target }}
+          args: --locked --release --out dist
+          manylinux: ${{ matrix.manylinux || '' }}
+          before-script-linux: ${{ matrix.before_script_linux || '' }}
+
+      - name: Extract standalone binary from wheel
+        shell: bash
+        env:
+          ASSET: ${{ matrix.asset }}
+          SCRIPT: ${{ matrix.script }}
+        run: |
+          set -euo pipefail
+          python - <<'PY'
+          import glob
+          import os
+          import shutil
+          import zipfile
+
+          wheels = glob.glob("dist/*.whl")
+          if len(wheels) != 1:
+              raise SystemExit(f"expected one wheel, found {wheels}")
+          with zipfile.ZipFile(wheels[0]) as wheel:
+              suffix = f".data/scripts/{os.environ['SCRIPT']}"
+              scripts = [name for name in wheel.namelist() if name.endswith(suffix)]
+              if len(scripts) != 1:
+                  raise SystemExit(f"expected one {suffix} entry, found {scripts}")
+              with wheel.open(scripts[0]) as source, open(os.environ["ASSET"], "wb") as target:
+                  shutil.copyfileobj(source, target)
+          PY
+          if [[ "$ASSET" != *.exe ]]; then chmod +x "$ASSET"; fi
+
+      - name: Smoke test wheel and binary (Unix)
+        if: matrix.native && runner.os != 'Windows'
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m venv .venv-wheel
+          .venv-wheel/bin/pip install dist/*.whl
+          test "$(.venv-wheel/bin/zdm --version)" = "zdm ${GITHUB_REF_NAME#v}"
+          test "$(./${{ matrix.asset }} --version)" = "zdm ${GITHUB_REF_NAME#v}"
+          set +e
+          .venv-wheel/bin/zdm tests/fixtures/rules/R001/fail_non_concurrent_add_index.py --select R001
+          status=$?
+          set -e
+          test "$status" -eq 1
+
+      - name: Smoke test manylinux baseline
+        if: matrix.target == 'x86_64-unknown-linux-gnu'
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(docker run --rm -v "$PWD:/io" quay.io/pypa/manylinux_2_28_x86_64 "/io/${{ matrix.asset }}" --version)" = "zdm ${GITHUB_REF_NAME#v}"
+
+      - name: Smoke test wheel and binary (Windows)
+        if: matrix.native && runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          python -m venv .venv-wheel
+          $wheel = (Get-ChildItem dist/*.whl).FullName
+          & .venv-wheel/Scripts/python -m pip install $wheel
+          $version = $env:GITHUB_REF_NAME.Substring(1)
+          if ((& .venv-wheel/Scripts/zdm.exe --version).Trim() -ne "zdm $version") {
+            throw "installed wheel has the wrong version"
+          }
+          if ((& ./${{ matrix.asset }} --version).Trim() -ne "zdm $version") {
+            throw "standalone binary has the wrong version"
+          }
+          & .venv-wheel/Scripts/zdm.exe tests/fixtures/rules/R001/fail_non_concurrent_add_index.py --select R001
+          $status = $LASTEXITCODE
+          if ($status -ne 1) {
+            throw "known R001 violation returned $status instead of 1"
+          }
+          $global:LASTEXITCODE = 0
+
+      - name: Upload wheel
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: wheel-${{ matrix.target }}
+          path: dist/*.whl
+
+      - name: Upload standalone binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: binary-${{ matrix.target }}
+          path: ${{ matrix.asset }}
+
+  build-sdist:
+    name: Build source distribution
+    needs: verify
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        with:
+          python-version: '3.12'
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+
+      - name: Build sdist
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b
+        with:
+          command: sdist
+          args: --out dist
+
+      - name: Smoke test source distribution
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m venv .venv-sdist
+          .venv-sdist/bin/pip install dist/*.tar.gz
+          test "$(.venv-sdist/bin/zdm --version)" = "zdm ${GITHUB_REF_NAME#v}"
+
+      - name: Upload sdist
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: sdist
+          path: dist/*.tar.gz
+
+  verify-release-artifacts:
+    name: Verify release artifacts
+    needs: [build-wheels, build-sdist]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          path: artifacts
+
+      - name: Prepare and verify release assets
+        run: |
+          set -euo pipefail
+          mkdir -p release pypi
+          find artifacts -name "*.whl" -exec mv {} release/ \;
+          find artifacts -name "*.tar.gz" -exec mv {} release/ \;
+          find artifacts -name "zdm-*" -exec mv {} release/ \;
+          test "$(find release -maxdepth 1 -name '*.whl' | wc -l)" -eq 6
+          test "$(find release -maxdepth 1 -name '*.tar.gz' | wc -l)" -eq 1
+          for asset in \
+            zdm-x86_64-unknown-linux-gnu \
+            zdm-aarch64-unknown-linux-gnu \
+            zdm-x86_64-apple-darwin \
+            zdm-aarch64-apple-darwin \
+            zdm-x86_64-pc-windows-msvc.exe \
+            zdm-aarch64-pc-windows-msvc.exe; do
+            test -f "release/$asset"
+          done
+          cp release/*.whl release/*.tar.gz pypi/
+          (cd release && sha256sum * > SHA256SUMS)
+          ls -la release/ pypi/
+
+      - name: Upload verified PyPI distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: pypi-distributions
+          path: pypi/
+
+      - name: Upload verified release assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: release-assets
+          path: release/
+
+  publish:
+    name: Publish to PyPI
+    needs: verify-release-artifacts
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write  # For trusted publishing
+    steps:
+      - name: Download verified distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          path: dist
+          name: pypi-distributions
+
+      - name: List artifacts
+        run: ls -la dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+        with:
+          packages-dir: dist/
+
+  github-release:
+    name: Create GitHub Release
+    needs: [verify-release-artifacts, publish]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download verified release assets
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          path: release
+          name: release-assets
+
+      - name: Create Release
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65
+        with:
+          files: release/*
+          generate_release_notes: true

zdm-0.6.0/.gitignore

@@ -0,0 +1,3 @@
+/target
+/dist
+/zdm_ext_test

zdm-0.6.0/.pre-commit-config.yaml

@@ -0,0 +1,25 @@
+# Local pre-commit setup for zero-downtime-migrations contributors.
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: check-yaml
+      - id: check-added-large-files
+      - id: check-toml
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+
+  - repo: local
+    hooks:
+      - id: cargo-fmt
+        name: cargo fmt --all
+        entry: cargo fmt --all
+        language: system
+        pass_filenames: false
+        types: [rust]
+      - id: cargo-clippy
+        name: cargo clippy --all-targets --all-features
+        entry: cargo clippy --all-targets --all-features -- -D warnings
+        language: system
+        pass_filenames: false
+        types: [rust]

zdm-0.6.0/.pre-commit-hooks.yaml

@@ -0,0 +1,28 @@
+# Pre-commit hooks for zero-downtime-migrations
+# See https://pre-commit.com for more information
+
+- id: zdm
+  name: Zero-Downtime Migrations Linter
+  description: Check Django migrations for PostgreSQL safety issues
+  entry: zdm
+  language: python
+  types: [python]
+  files: .*/migrations/.*\.py$
+  exclude: __init__\.py$
+
+- id: zdm-diff
+  name: Zero-Downtime Migrations Linter (diff mode)
+  description: Check changed Django migrations for PostgreSQL safety issues
+  entry: zdm --diff-staged origin/main
+  language: python
+  pass_filenames: false
+  always_run: true
+
+- id: zdm-rust
+  name: Zero-Downtime Migrations Linter (built from source)
+  description: Check Django migrations for PostgreSQL safety issues (auto-builds via cargo install)
+  entry: zdm
+  language: rust
+  types: [python]
+  files: .*/migrations/.*\.py$
+  exclude: __init__\.py$