feat(python): the Python SDK, stackencrypt

.changeset/supply-chain-skill-uv.md

@@ -0,0 +1,5 @@
+---
+'stash': patch
+---
+
+The `stash-supply-chain-security` skill now lists `uv` among the ecosystems Dependabot updates. The repository's Python SDK has a `uv.lock` for its test dependencies, and a Dependabot entry for it.

.github/dependabot.yml

@@ -249,10 +249,10 @@ updates:
 
   # ── Cargo (the root workspace — the stack-* crates) ─────────────
   # The root workspace (the six stack-* crates and the three node binding
-  # crates) and the six detached workspaces beside it: the three cargo-fuzz
-  # crates, the two Go WASI guests and the EQL ORE timing harness's ciphertext
-  # generator. Each has its own Cargo.lock, and each is its own workspace
-  # root, so each is listed.
+  # crates) and the detached workspaces beside it: the three cargo-fuzz
+  # crates, the two Go WASI guests, the EQL ORE timing harness's ciphertext
+  # generator, and the Python SDK. Each has its own Cargo.lock, and each is
+  # its own workspace root, so each is listed.
   - package-ecosystem: cargo
     directories:
       - /
@@ -262,9 +262,10 @@ updates:
       - /languages/golang/encrypt/guest
       - /languages/golang/auth/guest
       - /packages/eql/tests/timing/ore_block_256/ctgen
+      - /languages/python
     # Lockfile only, like the other two cargo entries. Every one of these
-    # workspaces shares crates by path with another: the fuzz crates and both
-    # guests depend on root-workspace crates, the encrypt guest also on
+    # workspaces shares crates by path with another: the fuzz crates, both
+    # guests and the Python SDK depend on root-workspace crates, the encrypt guest also on
     # eql-bindings, and the EQL workspace on stack-encrypt and stack-kms. Those
     # root crates take `{ workspace = true }` requirements from the root
     # Cargo.toml, so a manifest edit made for any one of these lockfiles can
@@ -369,6 +370,45 @@ updates:
         update-types:
           - version-update:semver-major
 
+  # ── uv (languages/python — the Python SDK's test and build tools) ──
+  # The package has no runtime dependency. So uv.lock contains two sets of
+  # tools: the `test` extra (pytest, attrs, Pydantic, SQLAlchemy, psycopg and
+  # Alembic), and the `build` dependency group (maturin, the build backend),
+  # with what they need. `mise run build` installs both with
+  # `uv sync --locked`. Dependabot's uv parser reads `[dependency-groups]`
+  # as well as the extras, so maturin is updated with the rest. Both have
+  # lower bounds and no major upper bound, so a new minor or patch release
+  # changes only the lock.
+  - package-ecosystem: uv
+    directory: /languages/python
+    # Monthly, matching the other non-npm toolchains. No `day:`, for the
+    # reason recorded on the cargo entries.
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+      - supply-chain
+    commit-message:
+      prefix: "chore"
+      include: scope
+    groups:
+      # One pull request for the set, so the tests run once against all the
+      # new versions together.
+      python-test-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # Major bumps are reviewed and applied manually, not by Dependabot.
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+
   # ── GitHub Actions ─────────────────────────────────────────────
   - package-ecosystem: github-actions
     directory: /

.github/workflows/fuzz.yml

@@ -1,9 +1,11 @@
 name: Fuzz (crates)
 
 # libFuzzer fuzzing for the stack crates' untrusted-input parsers (the
-# detached `packages/*/fuzz/` crates and the `fuzz:*` mise tasks). Ported from
-# cipherstash-suite's `fuzz.yml`, for the six targets in the imported set; the
-# suite keeps its three cts-common targets. Two jobs with different roles:
+# detached `packages/*/fuzz/` crates and the `fuzz:*` mise tasks), and the
+# Python SDK's value conversion (`languages/python/crates/core/fuzz/`). Ported from
+# cipherstash-suite's `fuzz.yml`, which keeps its three cts-common targets.
+# The two matrices below list every target here. Two jobs with different
+# roles:
 #
 #   * fuzz-regression (pull_request and manual, blocking on PRs): builds every harness, which
 #     catches harness and API drift, and replays the committed seed corpus with
@@ -24,6 +26,18 @@ on:
       - packages/stack-auth/**
       - packages/stack-kms/**
       - packages/stack-encrypt/**
+      # Every other crate a target compiles, from each fuzz crate's
+      # Cargo.lock: scripts/__tests__/fuzz-workflow-paths.test.mjs derives
+      # this list and fails when a path dependency is missing from it.
+      - packages/stack-profile/**
+      - packages/stack-encrypt-derive/**
+      - packages/eql/crates/eql-bindings/**
+      # The Python SDK's core crate, the manifest its dependencies come
+      # from, and the Go guest's EQL resolver it compiles by #[path]: the
+      # fuzz:python-values target.
+      - languages/python/crates/core/**
+      - languages/python/Cargo.toml
+      - languages/golang/encrypt/guest/src/targets.rs
       - Cargo.toml
       - Cargo.lock
       - mise.toml
@@ -116,6 +130,7 @@ jobs:
           - { task: "fuzz:plan-build", slug: plan-build }
           - { task: "fuzz:json-wire", slug: json-wire }
           - { task: "fuzz:json-text", slug: json-text }
+          - { task: "fuzz:python-values", slug: python-values }
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -140,6 +155,7 @@ jobs:
             packages/stack-auth/fuzz
             packages/stack-kms/fuzz
             packages/stack-encrypt/fuzz
+            languages/python/crates/core/fuzz
           key: ${{ matrix.slug }}
 
       # `-runs=0` replays the committed seed corpus once and exits without
@@ -166,6 +182,7 @@ jobs:
           - { task: "fuzz:plan-build",   slug: plan-build,   dir: packages/stack-encrypt, target: plan_build }
           - { task: "fuzz:json-wire",    slug: json-wire,    dir: packages/stack-encrypt, target: json_wire_decode }
           - { task: "fuzz:json-text",    slug: json-text,    dir: packages/stack-encrypt, target: json_text }
+          - { task: "fuzz:python-values", slug: python-values, dir: languages/python/crates/core, target: value_frame }
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -205,13 +222,16 @@ jobs:
         run: mise run ${{ matrix.task }} -- "-max_total_time=$MAX_TOTAL_TIME"
 
       # Drops inputs that add no coverage, so the saved corpus stays small.
-      # Skipped when the fuzz step found a crash.
+      # Skipped when the fuzz step found a crash. Run from the root, naming
+      # the fuzz crate: from languages/python, mise would load that folder's
+      # mise.toml and install its Python and uv, which this job does not
+      # cache.
       - name: Minimise the corpus (${{ matrix.slug }})
-        working-directory: ${{ matrix.dir }}
         env:
           TARGET: ${{ matrix.target }}
+          FUZZ_DIR: ${{ matrix.dir }}/fuzz
         run: |
-          cargo +nightly fuzz cmin "$TARGET" --sanitizer none --target "$(rustc -vV | sed -n 's/^host: //p')"
+          cargo +nightly fuzz cmin "$TARGET" --fuzz-dir "$FUZZ_DIR" --sanitizer none --target "$(rustc -vV | sed -n 's/^host: //p')"
 
       # Saved even on a crash: the grown corpus is still worth keeping, and the
       # crash input lives in artifacts/, not corpus/.