diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..99d61fa --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,31 @@ +version: 2 +updates: +- package-ecosystem: uv + directory: / + schedule: + interval: cron + cronjob: 47 4 * * * + timezone: Europe/Warsaw + open-pull-requests-limit: 1 + versioning-strategy: increase-if-necessary + allow: + - dependency-name: costs + dependency-type: all + - dependency-name: goal + dependency-type: all + - dependency-name: pfix + dependency-type: all + - dependency-name: clickmd + dependency-type: all + - dependency-name: code2llm + dependency-type: all + groups: + internal-packages: + patterns: + - costs + - goal + - pfix + - clickmd + - code2llm + commit-message: + prefix: "chore(deps)" diff --git a/.github/internal-dependencies.json b/.github/internal-dependencies.json new file mode 100644 index 0000000..ce582b0 --- /dev/null +++ b/.github/internal-dependencies.json @@ -0,0 +1,35 @@ +{ + "schema": "goal.internal-dependencies/v1", + "packages": [ + { + "name": "costs", + "repository": "semcod/costs", + "registry": "pypi", + "versioning": "semver" + }, + { + "name": "goal", + "repository": "semcod/goal", + "registry": "pypi", + "versioning": "semver" + }, + { + "name": "pfix", + "repository": "semcod/pfix", + "registry": "pypi", + "versioning": "semver" + }, + { + "name": "clickmd", + "repository": "semcod/clickmd", + "registry": "pypi", + "versioning": "semver" + }, + { + "name": "code2llm", + "repository": "semcod/code2llm", + "registry": "pypi", + "versioning": "semver" + } + ] +} diff --git a/.github/workflows/internal-dependency-freshness.yml b/.github/workflows/internal-dependency-freshness.yml new file mode 100644 index 0000000..e43f08e --- /dev/null +++ b/.github/workflows/internal-dependency-freshness.yml @@ -0,0 +1,36 @@ +name: Internal dependency freshness + +on: + schedule: + - cron: "17 6 * * *" + workflow_dispatch: + pull_request: + paths: + - pyproject.toml + - uv.lock + - .github/internal-dependencies.json + - .github/workflows/internal-dependency-freshness.yml + +permissions: + contents: read + +jobs: + freshness: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 + with: + python-version: "3.12" + - name: Install released checker + run: python -m pip install "goal==2.2.0" + - name: Verify published stable targets + run: goal dependencies --catalog .github/internal-dependencies.json --check > dependency-freshness.json + - name: Retain freshness evidence + if: always() + uses: actions/upload-artifact@v4 + with: + name: dependency-freshness + path: dependency-freshness.json + if-no-files-found: ignore diff --git a/.github/workflows/test-locked.yml b/.github/workflows/test-locked.yml new file mode 100644 index 0000000..8070c25 --- /dev/null +++ b/.github/workflows/test-locked.yml @@ -0,0 +1,49 @@ +name: Locked tests + +on: + push: + branches: [main] + pull_request: + branches: [main] + workflow_dispatch: + +permissions: + contents: read + +jobs: + test: + runs-on: ubuntu-latest + timeout-minutes: 15 + strategy: + fail-fast: false + matrix: + python-version: ["3.11", "3.13"] + steps: + - uses: actions/checkout@v7 + with: + fetch-depth: 0 + - uses: actions/setup-python@v7 + with: + python-version: ${{ matrix.python-version }} + - name: Check out immutable documentation standard + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: wellmanifest/docs + ref: ebe7501063ef4f3e63ded610c2d3183010ca636e # v0.1.1 + path: .docs-standard + token: ${{ secrets.ORG_SYNC_PAT }} + persist-credentials: false + - name: Validate documentation placement + shell: bash + env: + DOCS_BASE: ${{ github.event.pull_request.base.sha }} + run: | + set -euo pipefail + args=(--root . --standard-revision ebe7501063ef4f3e63ded610c2d3183010ca636e) + if [[ -n "$DOCS_BASE" ]]; then args+=(--base "$DOCS_BASE"); fi + python .docs-standard/docs/standard/check.py "${args[@]}" + - run: python -m pip install uv + - name: Install locked test dependencies + run: uv sync --locked --extra dev --python "${{ matrix.python-version }}" + - name: Test supported Python versions + run: uv run --no-sync python -m pytest -q diff --git a/.governance/docs.json b/.governance/docs.json new file mode 100644 index 0000000..91398a5 --- /dev/null +++ b/.governance/docs.json @@ -0,0 +1,7 @@ +{ + "schema": "wellmanifest.docs/adoption/v1", + "repository": "semcod/testless", + "standard": "wellmanifest/docs", + "source_revision": "ebe7501063ef4f3e63ded610c2d3183010ca636e", + "policy_sha256": "f6ba9c011ea1d9260e7fac3a1638a767d5ebc9f7d9b32ed51cc3aea22fe95d8c" +} diff --git a/docs/README.md b/docs/README.md new file mode 100644 index 0000000..a53402a --- /dev/null +++ b/docs/README.md @@ -0,0 +1,3 @@ +# Dokumentacja + +- [Aktualizacja zależności wewnętrznych](information/internal-dependencies.md) — lockfile, testy i codzienny audyt. diff --git a/docs/information/internal-dependencies.md b/docs/information/internal-dependencies.md new file mode 100644 index 0000000..7039829 --- /dev/null +++ b/docs/information/internal-dependencies.md @@ -0,0 +1,81 @@ +--- +{ + "schema": "wellmanifest.docs/document/v1", + "id": "internal-dependencies", + "kind": "information", + "version": 1, + "title": "Aktualizacja i kontrola zależności wewnętrznych", + "status": "implemented", + "owner": "semcod/testless", + "created": "2026-09-06", + "updated": "2026-09-06", + "review_after": "2026-09-13", + "source_revision": "2a847ef3f3ae4a4e5164f567bdb21944e5bde6be", + "affected_repositories": [ + "semcod/testless" + ], + "evidence": [ + "https://github.com/semcod/testless/blob/2a847ef3f3ae4a4e5164f567bdb21944e5bde6be/pyproject.toml", + "https://pypi.org/project/goal/2.2.0/", + "https://docs.astral.sh/uv/concepts/projects/dependencies/", + "https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference" + ] +} +--- + +# Aktualizacja i kontrola zależności wewnętrznych + + +## Cel + +Utrzymywać aktualne, przetestowane zależności projektu `semcod/testless` przy zachowaniu Pythona 3.11 jako minimalnej wersji aplikacji. + + +## Zakres + +Właścicielem lockfile i CI jest `semcod/testless`. Katalog [.github/internal-dependencies.json](../../.github/internal-dependencies.json) obejmuje pięć jawnie wskazanych dystrybucji PyPI: costs, goal, pfix, clickmd i code2llm. Audyt sprawdza te z nich, które występują w uv.lock. Nie obejmuje dowolnego pakietu tylko na podstawie nazwy organizacji. + + +## Dowody + +Przed zmianą wersja źródłowa wskazana w metadanych miała starsze zależności i nie miała workflow testów lockfile ani audytu aktualności. W odczycie PyPI z 2026-09-06 aktualnymi stabilnymi wersjami były costs 0.2.0, goal 2.2.0, pfix 0.1.79 i clickmd 1.1.15; te wersje zapisano w uv.lock. + +Lokalne testy zatwierdzanego lockfile: 47 testów przeszło na Pythonie 3.11 oraz 3.13. Wyniki publikacji i kolejnych kontroli są dostępne w [GitHub Actions](https://github.com/semcod/testless/actions). + + +## Obsługa + +Goal jest narzędziem automatyzacji, bez importów w kodzie aplikacji. Grupa `automation` wymaga Pythona >=3.12 i nie jest domyślnie instalowana z aplikacją ani dodatkiem `dev`. Zastosowano [oddzielny zakres Pythona grupy uv](https://docs.astral.sh/uv/concepts/projects/dependencies/#group-requires-python). + +```bash +uv sync --locked --extra dev --python 3.11 +uv run --no-sync python -m pytest -q +``` + +Dependabot codziennie proponuje aktualizację wewnętrznych pakietów w jednym PR. Testy uruchamiają zatwierdzony lockfile na Pythonie 3.11 i 3.13. Osobny workflow codziennie oraz po zmianie zależności w PR porównuje lockfile z najwyższymi stabilnymi wydaniami w katalogu; zachowuje raport jako artefakt. Obie automatyzacje można uruchomić ręcznie. + +Ręczny audyt używa grupy narzędziowej: + +```bash +uv run --locked --group automation --python 3.12 goal dependencies --catalog .github/internal-dependencies.json --check +``` + +Aktualizacja wybranych pakietów: + +```bash +uv lock --upgrade-package costs --upgrade-package goal --upgrade-package pfix --upgrade-package clickmd --upgrade-package code2llm +``` + +Po aktualizacji uruchom testy, opublikuj PR, a po jego sprawdzeniu i scaleniu zsynchronizuj środowisko. CI kontroluje też położenie i metadane dokumentacji według wellmanifest/docs 0.1.1, przypiętego do `ebe7501063ef4f3e63ded610c2d3183010ca636e` w `.governance/docs.json`. + + +## Ograniczenia + +Ograniczenie `>=` dopuszcza nowszą wersję, lecz nie zmienia istniejącego środowiska. `uv sync --locked` odtwarza wersje z lockfile. Codzienny PR nie jest automatycznie scalany ani wdrażany. Opóźnienie zależy od harmonogramu, testów i procesu publikacji. + +Checker w CI jest przypięty do Goal 2.2.0. Jego aktualizację trzeba wykonać jawnie. Audyt tej wersji porównuje stabilne wersje x.y.z i nie jest pełnym resolverem wszystkich formatów wersji ani kontrolą pochodzenia każdego pakietu. Dokładne przypięcie standardu dokumentacji podlega osobnej, sprawdzanej aktualizacji. + + +## Utrzymanie + +Sprawdzaj nieudane harmonogramy i zaległe PR-y. Nową dystrybucję dodaj do katalogu dopiero po potwierdzeniu jej właściciela i sposobu wersjonowania. Wyniki przekrojowe rozwijaj w [kanonicznym raporcie subactor/docs](https://github.com/subactor/docs/blob/main/architecture/analysis/internal-dependencies.md). Zwiększ wersję tego dokumentu po zmianie mechanizmu. diff --git a/pyproject.toml b/pyproject.toml index 52f9abd..03115fb 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -32,7 +32,6 @@ dependencies = [ dev = [ "ruff>=0.4", "mypy>=1.10", - "goal>=2.1.0", "costs>=0.1.20", "pfix>=0.1.60", ] @@ -92,3 +91,9 @@ max_commits = 500 # Cost thresholds for badge colors (USD) badge_color_thresholds = { low = 1.0, medium = 5.0, high = 10.0, critical = 50.0 } + +[tool.uv.dependency-groups.automation] +requires-python = ">=3.12" + +[dependency-groups] +automation = ["goal>=2.2.0"] diff --git a/uv.lock b/uv.lock index 6413416..8d242e6 100644 --- a/uv.lock +++ b/uv.lock @@ -8,9 +8,12 @@ resolution-markers = [ "python_full_version == '3.14.*' and sys_platform == 'win32'", "python_full_version == '3.14.*' and sys_platform == 'emscripten'", "python_full_version == '3.14.*' and sys_platform != 'emscripten' and sys_platform != 'win32'", - "python_full_version < '3.14' and sys_platform == 'win32'", - "python_full_version < '3.14' and sys_platform == 'emscripten'", - "python_full_version < '3.14' and sys_platform != 'emscripten' and sys_platform != 'win32'", + "python_full_version >= '3.12' and python_full_version < '3.14' and sys_platform == 'win32'", + "python_full_version < '3.12' and sys_platform == 'win32'", + "python_full_version >= '3.12' and python_full_version < '3.14' and sys_platform == 'emscripten'", + "python_full_version < '3.12' and sys_platform == 'emscripten'", + "python_full_version >= '3.12' and python_full_version < '3.14' and sys_platform != 'emscripten' and sys_platform != 'win32'", + "python_full_version < '3.12' and sys_platform != 'emscripten' and sys_platform != 'win32'", ] [[package]] @@ -307,7 +310,7 @@ name = "cffi" version = "2.0.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "pycparser", marker = "implementation_name != 'PyPy'" }, + { name = "pycparser" }, ] sdist = { url = "https://files.pythonhosted.org/packages/eb/56/b1ba7935a17738ae8453301356628e8147c79dbb825bcbc73dc7401f9846/cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529", size = 523588, upload-time = "2025-09-08T23:24:04.541Z" } wheels = [ @@ -475,16 +478,16 @@ wheels = [ [[package]] name = "clickmd" -version = "1.1.14" +version = "1.1.15" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "costs" }, { name = "goal" }, { name = "pfix" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/0e/1b/84df87d056991c2fb0789ae47b49d5afb8496f2c45541760e81553d00b43/clickmd-1.1.14.tar.gz", hash = "sha256:a3625777736ba5d3d43f7de8ff81bc01d2a4d77f6c252ce6ea7d55b860279f43", size = 41134, upload-time = "2026-04-08T09:11:28.657Z" } +sdist = { url = "https://files.pythonhosted.org/packages/3a/12/82b3b80bb2751e0d6c120c1beb11116527cca9322202b5a1924811b58376/clickmd-1.1.15.tar.gz", hash = "sha256:0a2971b952e471c4726bc2f88ed397abd395283c79e4885e435921426493d01c", size = 41145, upload-time = "2026-06-29T07:35:58.128Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/89/29/625bc2004029ce7297d0709e6486447c4a0f0d832c2ddd962cada14d32c7/clickmd-1.1.14-py3-none-any.whl", hash = "sha256:005bbc7cd97d8a58ba25b4fc0018b7970e37b57ee50d53aa33df5f445b4ff46b", size = 45540, upload-time = "2026-04-08T09:11:27.228Z" }, + { url = "https://files.pythonhosted.org/packages/d7/5c/398fafad25e456d86fe8fe7bf9a3873f2077564d42dcdd1426b76d01e915/clickmd-1.1.15-py3-none-any.whl", hash = "sha256:b191c0c26be5ef009ea27a3e88c1c7d633d95a6da2fc737f04f6727481bfeb5e", size = 45514, upload-time = "2026-06-29T07:35:56.53Z" }, ] [[package]] @@ -498,7 +501,7 @@ wheels = [ [[package]] name = "costs" -version = "0.1.51" +version = "0.2.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "anthropic" }, @@ -511,9 +514,9 @@ dependencies = [ { name = "tiktoken" }, { name = "typer" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/92/2c/d9f9a9c0acd33bc40788aaeef792fe045efd42368cde2ad00a0e15eeb625/costs-0.1.51.tar.gz", hash = "sha256:727f5f14874c41731e2485cc309ec4cc87c447288c8be4c0ddb38f72391d49cc", size = 30777, upload-time = "2026-05-12T08:33:20.439Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e4/6f/7f3c72d6d4b5264bd5a3447e18a3b5184bffee143f72c8d023bb759afd1a/costs-0.2.0.tar.gz", hash = "sha256:3782bae859725dae30f697b5f3e5aa5d84e06feadebc5782ae706e21d46437af", size = 44606, upload-time = "2026-09-05T15:49:55.524Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/81/15/4490e3afc8e0e903a984582db06a34ec9feeddf52ef99902d456a2e15da5/costs-0.1.51-py3-none-any.whl", hash = "sha256:15e2ebf518fec04e5883612d96dd2673f56cbeaf58408e448eb0837c01a2dc85", size = 35771, upload-time = "2026-05-12T08:33:19.271Z" }, + { url = "https://files.pythonhosted.org/packages/1d/7e/fc91d9fdc7a1ceb9116daffab27124a54f6e8887c9d59d906df43dcbfa6a/costs-0.2.0-py3-none-any.whl", hash = "sha256:4798b8535cbbcbb354e440ebce91365f17c910414bf5831a0610998ae6e679af", size = 48625, upload-time = "2026-09-05T15:49:54.054Z" }, ] [[package]] @@ -881,7 +884,7 @@ wheels = [ [[package]] name = "goal" -version = "2.1.234" +version = "2.2.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "click" }, @@ -891,9 +894,9 @@ dependencies = [ { name = "tomlkit" }, { name = "typer" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/d1/e6/f4812ac246a688d5aef6e8286f69512eb455c241b663bf7870d9802eb673/goal-2.1.234.tar.gz", hash = "sha256:8d13444d44437bedefc2cd9a2b0729e1e348b5be845dae3a242bd786990efd6f", size = 272197, upload-time = "2026-05-24T19:48:37.869Z" } +sdist = { url = "https://files.pythonhosted.org/packages/c7/9c/135e3f67a7324c3c49ef4246f5518b59ad90226e62c3d30ae20cba005c1d/goal-2.2.0.tar.gz", hash = "sha256:e9e2c1ac9493dae3b887b16d503f7c1f83d02ddcbdd3c5cf58d44a458bb2662f", size = 399786, upload-time = "2026-09-05T19:41:55.329Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/00/bc/7c8f8fe905261fcff237419c132061812136cb06c8e7c1c6ae06a36151ff/goal-2.1.234-py3-none-any.whl", hash = "sha256:55b7f4230704b74244d910817b2deb623c18f23b3b421e53cfcdfcbd8f7148b2", size = 268706, upload-time = "2026-05-24T19:48:36.062Z" }, + { url = "https://files.pythonhosted.org/packages/24/69/8a4cf5710683bb777f1f6e4cd44dd3907befe97b94c6ea6e97d4305b4e44/goal-2.2.0-py3-none-any.whl", hash = "sha256:0d8f93aa317ac92a66b64b797e210a5d66044ce8db2cb05b012b03d42aced95e", size = 349709, upload-time = "2026-09-05T19:41:53.615Z" }, ] [[package]] @@ -1869,7 +1872,7 @@ name = "pexpect" version = "4.9.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "ptyprocess", marker = "sys_platform != 'win32'" }, + { name = "ptyprocess" }, ] sdist = { url = "https://files.pythonhosted.org/packages/42/92/cc564bf6381ff43ce1f4d06852fc19a2f11d180f23dc32d9588bee2f149d/pexpect-4.9.0.tar.gz", hash = "sha256:ee7d41123f3c9911050ea2c2dac107568dc43b2d3b0c7557a33212c398ead30f", size = 166450, upload-time = "2023-11-25T09:07:26.339Z" } wheels = [ @@ -1878,7 +1881,7 @@ wheels = [ [[package]] name = "pfix" -version = "0.1.73" +version = "0.1.79" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "litellm" }, @@ -1887,9 +1890,9 @@ dependencies = [ { name = "python-dotenv" }, { name = "rich" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/04/76/982888ddbfd8398ac2c1a04bfe16caddfa4091f84af347ee878cdb5e5cf9/pfix-0.1.73.tar.gz", hash = "sha256:f1c55a01b738b5c6465815ad9d61371d6e2a1a6074199fa0174309996de7310c", size = 2837935, upload-time = "2026-05-12T08:34:08.486Z" } +sdist = { url = "https://files.pythonhosted.org/packages/ae/7e/252be5e1d55321b947013010f45b02d781de87e25b9a524c0ee72c1ad3c0/pfix-0.1.79.tar.gz", hash = "sha256:6bc4c572e22e0f0d952bc5e2df78f52f8f999cab64e22138b097b2eab4d83092", size = 2845663, upload-time = "2026-07-05T17:00:57.331Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/2d/4f/abe3e6992a7df0237fc75d000ad950da8cf20d1c767415e4605b31fa143a/pfix-0.1.73-py3-none-any.whl", hash = "sha256:0e0f022c0277b8c9633a2be2d2def366c856170953d2f9ff9acf4a473c1c6bf2", size = 149278, upload-time = "2026-05-12T08:34:04.109Z" }, + { url = "https://files.pythonhosted.org/packages/39/bf/548982294e795d79003680b2214c7f5dd00ca4b0ea856064bf9cb6869ba7/pfix-0.1.79-py3-none-any.whl", hash = "sha256:bb7ab83b99c0bfbaae5e6e95cb801a27d4fd68749485600fdfe49dad00607461", size = 151754, upload-time = "2026-07-05T17:00:52.816Z" }, ] [[package]] @@ -2729,18 +2732,21 @@ dependencies = [ [package.optional-dependencies] dev = [ { name = "costs" }, - { name = "goal" }, { name = "mypy" }, { name = "pfix" }, { name = "ruff" }, ] +[package.dev-dependencies] +automation = [ + { name = "goal", marker = "python_full_version >= '3.12'" }, +] + [package.metadata] requires-dist = [ { name = "click", specifier = ">=8.1" }, { name = "costs", marker = "extra == 'dev'", specifier = ">=0.1.20" }, { name = "coverage", specifier = ">=7.0" }, - { name = "goal", marker = "extra == 'dev'", specifier = ">=2.1.0" }, { name = "mypy", marker = "extra == 'dev'", specifier = ">=1.10" }, { name = "networkx", specifier = ">=3.0" }, { name = "pfix", marker = "extra == 'dev'", specifier = ">=0.1.60" }, @@ -2752,6 +2758,9 @@ requires-dist = [ ] provides-extras = ["dev"] +[package.metadata.requires-dev] +automation = [{ name = "goal", marker = "python_full_version >= '3.12'", specifier = ">=2.2.0" }] + [[package]] name = "tiktoken" version = "0.13.0"