From 06aa6cbf3579761f4609b1d4668069e787a21f07 Mon Sep 17 00:00:00 2001 From: Adam Getchell Date: Wed, 21 Oct 2026 09:00:25 -0700 Subject: [PATCH 1/3] fix: prepare shared updates for the Semgrep environment - Refresh certifi and the development-tool pins. - Declare the isolated Semgrep project and route Python updates through the shared workflow. - Require the forthcoming research-repo-tools v0.2.3 pin before merging this adoption. --- CONTRIBUTING.md | 4 ++ justfile | 6 +-- pyproject.toml | 11 +++-- tooling/semgrep/uv.lock | 6 +-- tooling/tests/test_maintenance_integration.py | 9 +++++ uv.lock | 40 +++++++++---------- 6 files changed, 45 insertions(+), 31 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 18065d2..ba272d5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -66,6 +66,10 @@ Then `just update-dependencies` upgrades Cargo requirements and refreshes Cargo' lock, resolves exact direct Python `dev` pins, refreshes the complete `uv.lock`, and explicitly synchronizes `dev` with managed Rust available for native builds. Included groups retain their constraints, including the exact shared-package pin. +The shared Python updater also refreshes `tooling/semgrep/uv.lock` and syncs its +separate environment through `deps.python-projects`. It retains the scanner's +exact Semgrep pin, Python 3.14 selector, and dependency overrides. Declare future +independent uv projects in the same list so they participate in `just update`. `just update-cargo-dependencies` excludes `num-bigint` and `num-rational` from incompatible requirement upgrades because their public types must advance together; Cargo can still refresh locked versions within those requirements. diff --git a/justfile b/justfile index 6fd956c..21665cd 100644 --- a/justfile +++ b/justfile @@ -719,11 +719,9 @@ update-cargo-tools: # Dependency-only updates leave uv and managed Cargo tool pins unchanged. update-dependencies: update-cargo-dependencies update-python-dependencies -# Advance direct dev pins, refresh the whole lock, and explicitly synchronize dev. +# Advance main dev pins, then refresh and sync the root and Semgrep environments. update-python-dependencies: - uv run --locked --only-group tooling --inexact research-repo-tools deps update-python - uv lock --upgrade - {{ _run }} uv sync --locked --managed-python --group dev + uv run --locked --only-group tooling --inexact research-repo-tools deps update-python --all-projects alias update-python-deps := update-python-dependencies diff --git a/pyproject.toml b/pyproject.toml index 94f82e3..066d742 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -86,7 +86,7 @@ line-length = 160 [tool.uv] package = false -required-version = "==0.13.3" +required-version = "==0.13.4" # Semgrep has its own locked Python 3.14 environment under tooling/semgrep. [dependency-groups] @@ -98,13 +98,16 @@ dev = [ "ruff==0.17.1", "shellcheck-py==0.11.0.1", "shfmt-py==4.2.0", - "ty==0.0.89", + "ty==0.0.90", "yamllint==1.38.0", ] [tool.research-repo-tools] schema = 1 +[tool.research-repo-tools.deps] +python-projects = [ "tooling/semgrep" ] + [tool.research-repo-tools.toolchain.binaries] gitleaks = "8.30.1" osv-scanner = "2.7.0" @@ -113,9 +116,9 @@ osv-scanner = "2.7.0" cargo-edit = "0.13.13" cargo-llvm-cov = "0.9.1" cargo-machete = "0.9.2" -cargo-nextest = "0.9.148" +cargo-nextest = "0.9.149" clippy-sarif = "0.8.0" -dprint = "0.64.0" +dprint = "0.64.1" git-cliff = "2.14.2" rumdl = "0.3.0" sarif-fmt = "0.8.0" diff --git a/tooling/semgrep/uv.lock b/tooling/semgrep/uv.lock index 8277507..8c72c82 100644 --- a/tooling/semgrep/uv.lock +++ b/tooling/semgrep/uv.lock @@ -56,11 +56,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.7.22" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] diff --git a/tooling/tests/test_maintenance_integration.py b/tooling/tests/test_maintenance_integration.py index 38f7056..3a61e9b 100644 --- a/tooling/tests/test_maintenance_integration.py +++ b/tooling/tests/test_maintenance_integration.py @@ -160,6 +160,15 @@ def test_semgrep_keeps_its_current_version_outside_the_python_315_environment() assert result.stdout.strip() == "1.180.0" +def test_python_update_includes_the_isolated_semgrep_project() -> None: + """The shared updater owns both locks while each project owns its constraints.""" + root = tomllib.loads((REPO_ROOT / "pyproject.toml").read_text(encoding="utf-8")) + assert root["tool"]["research-repo-tools"]["deps"]["python-projects"] == ["tooling/semgrep"] + result = dry_run(REPO_ROOT, "update-python-dependencies") + assert "research-repo-tools deps update-python --all-projects" in result.stderr + assert "uv lock --upgrade" not in result.stderr + + @pytest.mark.parametrize("output_args", [pytest.param((), id="local"), pytest.param(("--sarif",), id="sarif")]) def test_semgrep_production_targets_include_tests_and_exclude_rule_fixtures(tmp_path: Path, output_args: tuple[str, ...]) -> None: """Exercise both scan formats without Git ignores masking Semgrep exclusions.""" diff --git a/uv.lock b/uv.lock index 3fd2c28..c2e5310 100644 --- a/uv.lock +++ b/uv.lock @@ -56,7 +56,7 @@ dev = [ { name = "ruff", specifier = "==0.17.1" }, { name = "shellcheck-py", specifier = "==0.11.0.1" }, { name = "shfmt-py", specifier = "==4.2.0" }, - { name = "ty", specifier = "==0.0.89" }, + { name = "ty", specifier = "==0.0.90" }, { name = "yamllint", specifier = "==1.38.0" }, ] tooling = [{ name = "research-repo-tools", specifier = "==0.2.2" }] @@ -209,27 +209,27 @@ wheels = [ [[package]] name = "ty" -version = "0.0.89" +version = "0.0.90" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/67/ea/dfb9bdbc168c50a568809466596751afa0c7da60da03b8c12906d1decde4/ty-0.0.89.tar.gz", hash = "sha256:bc1027b1ea95cca25c2a3a0b41433c809cf4b86a384d2b2434eba4bcd34548d4", size = 7978241, upload-time = "2026-10-16T10:35:05.249Z" } +sdist = { url = "https://files.pythonhosted.org/packages/68/b1/613b5534624442a9118828d7a9e54d50b16f0f5c8b67c80eb6623f33b921/ty-0.0.90.tar.gz", hash = "sha256:25cef63ec07a0254c2f5d885a63b001d0bfa437b20caa0a408f4f52e66b133e7", size = 7996206, upload-time = "2026-10-20T14:25:19.477Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/c5/84/e199d9a3dc3c94c804ddd9e94b63dbe543ae7f39329574963b6a6a95872f/ty-0.0.89-py3-none-linux_armv6l.whl", hash = "sha256:739b087e8873e177ffda99ff8a3600a4a7704d06523a8e88c4493021eee40b8a", size = 14254879, upload-time = "2026-10-16T10:34:24.813Z" }, - { url = "https://files.pythonhosted.org/packages/e5/d5/5afe09bf5c83c4e3a9e5913386a460e240a7029f2ae5fc96df5b43563a91/ty-0.0.89-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:47ebc98480c8a301955e18a8bdd67ef07090071ad47349b3254f325d3d5ab4e7", size = 13790417, upload-time = "2026-10-16T10:34:27.672Z" }, - { url = "https://files.pythonhosted.org/packages/7e/f9/88648f0ba9400dfd642c1e8dc0aeecb87945b121f3ff51f3902883c016d6/ty-0.0.89-py3-none-macosx_11_0_arm64.whl", hash = "sha256:b0631291af5c850a15007c0ffb906d813966466e4ec12173c44977c0c5a2d51d", size = 12856900, upload-time = "2026-10-16T10:34:29.871Z" }, - { url = "https://files.pythonhosted.org/packages/6a/89/baae2b407101c4cb02f19216123900c147af8fd87cdb1ed7eba139472734/ty-0.0.89-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3d768300ae16274ce656006e9199869ad68684b74400d963e1c82deddf3a22ad", size = 13653330, upload-time = "2026-10-16T10:34:32.296Z" }, - { url = "https://files.pythonhosted.org/packages/ed/1d/293516c2e10a77134cfc40d22c3fc08edd8c5eadae9c75531ec8a9263348/ty-0.0.89-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:3dd4c57ba58bab8f6c816b2c254db52b58834b5dbf8268287382f7a2f9735c8f", size = 13986215, upload-time = "2026-10-16T10:34:34.506Z" }, - { url = "https://files.pythonhosted.org/packages/2f/c3/da911c8fc22d2664692432570619576b25c7cd0a586401cab08987763094/ty-0.0.89-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1af774c24117d366b69142d4f35edee518617f8b926d13560d0334cbe5aa3f85", size = 14905008, upload-time = "2026-10-16T10:34:36.632Z" }, - { url = "https://files.pythonhosted.org/packages/5c/c3/aed8d920b9bbf7b582e9fc0305acb2f2c748ede788e7dba9d6952e939c78/ty-0.0.89-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a8147811b9b3bc2dc9338cd01c7893ac931fc3fae7aace169047ecbd627e6628", size = 15278217, upload-time = "2026-10-16T10:34:39.144Z" }, - { url = "https://files.pythonhosted.org/packages/96/92/c6b4320f08fca44ffe279e5ddeb3eae12869c6341f596931accdefea1182/ty-0.0.89-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6d5f178c91d50fb62461b5e579028b7d2e92872e1d8f02e96ace26464c2277a6", size = 15206289, upload-time = "2026-10-16T10:34:41.626Z" }, - { url = "https://files.pythonhosted.org/packages/3e/61/da22c714fd4f4dff642d60fb0d8bf8da1985d126f21cc89237f8bf707c92/ty-0.0.89-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:95a410f10b26cc3861757b626727db9d979deba7d2a3ab59f964fac8f0514fdc", size = 14510395, upload-time = "2026-10-16T10:34:44.063Z" }, - { url = "https://files.pythonhosted.org/packages/f0/32/5f9ce2377a77ad9ff36d8996edf86b1f069c1e8716e37c7d6d668402b110/ty-0.0.89-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:a70ab1a402746d7837407dc169e461fdf90945bc1eef0d3c0f1be543490060bf", size = 14767366, upload-time = "2026-10-16T10:34:46.154Z" }, - { url = "https://files.pythonhosted.org/packages/63/72/2b28c71d6ebd97b5bb1378f1806598c5dd90278f7b99a431dd3879dddcfc/ty-0.0.89-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:b55c28a49bd2676eac9b3540a1dcc4cc053e4671c65dcec9fdad3dfe55fb148c", size = 13670284, upload-time = "2026-10-16T10:34:48.225Z" }, - { url = "https://files.pythonhosted.org/packages/34/cc/68b8ebf98c9bc582fddc3d2b93f6e0f53719d1ddee1c5037dfa2e1cb8467/ty-0.0.89-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:4c9f22edeb8176f8ab189337e8cbd8f92b66744534a2886df9e252b52ade991c", size = 13997891, upload-time = "2026-10-16T10:34:50.556Z" }, - { url = "https://files.pythonhosted.org/packages/cf/4d/a1d61e06092fd5726f48a8711bd32eac6af132308eb222a0027caba4f42d/ty-0.0.89-py3-none-musllinux_1_2_i686.whl", hash = "sha256:0c186185cad57a1469b851096b51345de7b625e353c1f4acd338402daed22fa7", size = 14326247, upload-time = "2026-10-16T10:34:53.005Z" }, - { url = "https://files.pythonhosted.org/packages/f8/d2/466d3762e330504a2c114dbbd0f0383229f9652dccd56277dde008bfe0da/ty-0.0.89-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:5e38302ac218d2404758241093b5542ed0345d4f569096589f1810034244e998", size = 14661527, upload-time = "2026-10-16T10:34:55.555Z" }, - { url = "https://files.pythonhosted.org/packages/b1/d5/dfd7ed5e4af472b20a11ef651da4bca55f9dc8be485cd152337f94caddde/ty-0.0.89-py3-none-win32.whl", hash = "sha256:0146637ed2321717280bfe4e4b20a18813b741da280e8039d7df2bf22b0251f1", size = 13224078, upload-time = "2026-10-16T10:34:57.735Z" }, - { url = "https://files.pythonhosted.org/packages/b4/14/1ee663c422e3a2d910c5cc27e7d84bd7709a3df0aca28a713843c6c3fa5d/ty-0.0.89-py3-none-win_amd64.whl", hash = "sha256:9fc56322a1aff29a19088d2025f3c42a6d25a7035668048bb908c9f8b66f480d", size = 13727433, upload-time = "2026-10-16T10:35:00.15Z" }, - { url = "https://files.pythonhosted.org/packages/09/93/af8f7250920823ca6d582bcf0abf803fb92c8b99415ba7f40f2304102c6f/ty-0.0.89-py3-none-win_arm64.whl", hash = "sha256:1d4967c8f7bfd67c9708115b41d7049197c5d20c76fb2e136fe78b0437ada05b", size = 13287101, upload-time = "2026-10-16T10:35:02.918Z" }, + { url = "https://files.pythonhosted.org/packages/b2/33/0e3395afa2c31c0e8e91547629858d2a5de213c69af237e6e50f37545565/ty-0.0.90-py3-none-linux_armv6l.whl", hash = "sha256:0dedb54977b40bc86638fec2c90eefd593f3a6683003a86b7e6cb67c17bcc476", size = 14281945, upload-time = "2026-10-20T14:24:21.018Z" }, + { url = "https://files.pythonhosted.org/packages/d7/fd/5d632b2f88d5c18991a4936da8643c7f204cfbc4980f8c7cd9080af988ad/ty-0.0.90-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:3d7c30ceaac76dfbfcf36b72d36272d21c3898e98fc4de296aa9cbae956dec9d", size = 13786355, upload-time = "2026-10-20T14:24:24.392Z" }, + { url = "https://files.pythonhosted.org/packages/79/08/0d2f37bb4f766ab9630f01b07f4d11f1f7a6a6188f920d5ca9fa8a4676b1/ty-0.0.90-py3-none-macosx_11_0_arm64.whl", hash = "sha256:c0b7e4d9ae0939294f0a18652de9ad7d81da2d7f567cf93f1edda1263008c124", size = 12856535, upload-time = "2026-10-20T14:24:27.386Z" }, + { url = "https://files.pythonhosted.org/packages/e4/77/70658f6b80c345ae0c12f2192a5cc89b8ca13eccfe06616b0fac3806c261/ty-0.0.90-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:76c4a095a86a132df374e652894fe08392aeb1601d6347e1eb4b58808094a302", size = 13696342, upload-time = "2026-10-20T14:24:30.413Z" }, + { url = "https://files.pythonhosted.org/packages/b9/3e/693049f93653d2f6412bb0c2c0af1d01675e31643af29bef7177d3ff7e79/ty-0.0.90-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:4e24a8aa07c05d9d14648289e79a88b7c7c2c522c58b53bb5f466a6ba4704e22", size = 14014180, upload-time = "2026-10-20T14:24:33.783Z" }, + { url = "https://files.pythonhosted.org/packages/27/08/19e373f97501eaadc8fc42e8c07cd54a64e375fbcf1470797be13590d5ba/ty-0.0.90-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:40c3ea8fc1dfcf7502f71b93b12e80da1f7a8a5fd7e55ec9feabcf4ac39f72ea", size = 14935189, upload-time = "2026-10-20T14:24:37.459Z" }, + { url = "https://files.pythonhosted.org/packages/33/54/3331984f2c896a7383b6b18c86e968a63dd046baf503119a8e8e7682c752/ty-0.0.90-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1af75532bbe3e305089c30806fa5e804f8b01de231c1fa07918f7f3b335626da", size = 15311482, upload-time = "2026-10-20T14:24:40.87Z" }, + { url = "https://files.pythonhosted.org/packages/bf/f3/179acf8d730c2c864767ffcc9081f5ea6fdb1b34ef711f1bd226200e9cff/ty-0.0.90-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f09449b34d837a044dab043aeb2b4b6ff2d2cef5eaf8116c7c19d34cc2a16a21", size = 15278844, upload-time = "2026-10-20T14:24:44.539Z" }, + { url = "https://files.pythonhosted.org/packages/71/7e/661bc2fa20e0ac84c4d5f92e4c098ec667a0e920851a6d10c10a0251f0dc/ty-0.0.90-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cc868ffa7dfcb3169eea3ba7d634e5a3283c7133fb932c6e47a2e16620d26ca5", size = 14558774, upload-time = "2026-10-20T14:24:47.814Z" }, + { url = "https://files.pythonhosted.org/packages/f4/2e/3f65f61f4545f75255373be7646a606e004bb4cdc851e236bf17ca94bdc2/ty-0.0.90-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:e2405206533dc896a2b711e781f2955d5883d85536f4df0ac262fca6517103c2", size = 14788158, upload-time = "2026-10-20T14:24:51.223Z" }, + { url = "https://files.pythonhosted.org/packages/1e/10/3c91a529591667b89d63c86806bfe2ac56d6989c7e0a09ee0964b7512deb/ty-0.0.90-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:0dca4a29e8778285d2fc204af19254571486106fd14aed60769bfd272c795f6f", size = 13687177, upload-time = "2026-10-20T14:24:54.611Z" }, + { url = "https://files.pythonhosted.org/packages/21/b2/1b6d48606c67614bfb0c8e61a5d67a053ca1e3c5956ddb584f8569b8dc3d/ty-0.0.90-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:d004b8e4e898fead929eceea669b73936444671748e0dd44e624cc109346c0dd", size = 14027780, upload-time = "2026-10-20T14:24:59.045Z" }, + { url = "https://files.pythonhosted.org/packages/4f/c4/a0771debf725312524ca1434f8a146d37e573d45257ca4bebb9cc8e35bbc/ty-0.0.90-py3-none-musllinux_1_2_i686.whl", hash = "sha256:a6be182da4281b4581c4a1b27c6a0caebeed7212e4bdc98c6b8fe0d9bc36dea0", size = 14355890, upload-time = "2026-10-20T14:25:03.034Z" }, + { url = "https://files.pythonhosted.org/packages/a7/4c/036724b6936ffc38e28ff5e20ab7972d609c65a3dd9645f3d10f57cfd16f/ty-0.0.90-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:0ba6fe0a24ff4cbc5034f3aa1c88b3ad1397315dd3369357e694fd157a11864e", size = 14692306, upload-time = "2026-10-20T14:25:07.461Z" }, + { url = "https://files.pythonhosted.org/packages/a8/2a/c74fd5fc3fb5b046fe06a9067cabf5417b73e28249dc9af90ef72700f8fd/ty-0.0.90-py3-none-win32.whl", hash = "sha256:4c46a79caf84c4da0f7293e16bd769bd467c7cbc38015cac7608ab4e5ec8ba9c", size = 13235434, upload-time = "2026-10-20T14:25:10.545Z" }, + { url = "https://files.pythonhosted.org/packages/d2/54/be5cd6b17d8087a5e4c26892311c07e39d42b66c925b0f06cfc51a9ce83b/ty-0.0.90-py3-none-win_amd64.whl", hash = "sha256:8d77c16d20201b7a07ccaafb610eaf60488783dbba9865c4f9182e584f1426f8", size = 13855668, upload-time = "2026-10-20T14:25:13.648Z" }, + { url = "https://files.pythonhosted.org/packages/33/68/6dea089a897e8b314504eecc2633de3c8fe14f70e71a35606d14a2ba169e/ty-0.0.90-py3-none-win_arm64.whl", hash = "sha256:bfb63e74eeedb0a29d49cf58d611c540bfdfc0975dfce26efc6575bcf439208d", size = 13330853, upload-time = "2026-10-20T14:25:16.642Z" }, ] [[package]] From 1c0bd85e28596315b191c11bbbe8e85144653098 Mon Sep 17 00:00:00 2001 From: Adam Date: Wed, 21 Oct 2026 16:33:51 +0000 Subject: [PATCH 2/3] fix: update Semgrep and preserve its isolated dependencies Pin Semgrep 1.182.0 in Python 3.14 while retaining the patched MCP override. Refresh its lock and current guidance, protect the override in consumer tests, disable network version checks in the version probe, and align updater integration expectations with the shared orchestration. Focused updater and Semgrep tests, Ruff and ty pass; published shared-package adoption remains pending. --- docs/code_organization.md | 2 +- docs/dev/performance-tooling-adoption.md | 2 +- tooling/README.md | 2 +- tooling/semgrep/pyproject.toml | 2 +- tooling/semgrep/uv.lock | 20 +++++++++---------- tooling/tests/test_maintenance_integration.py | 11 +++++----- tooling/tests/test_toolchain_integration.py | 6 ++---- 7 files changed, 22 insertions(+), 23 deletions(-) diff --git a/docs/code_organization.md b/docs/code_organization.md index 8592f17..027bcbc 100644 --- a/docs/code_organization.md +++ b/docs/code_organization.md @@ -213,7 +213,7 @@ Original artifacts, including the v0.5.0/v0.4.6 complete run, remain frozen without regeneration or invented acquisition records. New complete runs support offline rendering through the declared eligibility policy. -`tooling/semgrep/` owns a locked Python 3.14 environment for Semgrep 1.180.0 +`tooling/semgrep/` owns a locked Python 3.14 environment for Semgrep 1.182.0 while its wheels exclude Python 3.15. Local scans, shared fixture validation and hosted SARIF use it; ordinary support scripts use Python 3.15. The root `.semgrepignore` keeps ordinary Rust and Python tests in those scans diff --git a/docs/dev/performance-tooling-adoption.md b/docs/dev/performance-tooling-adoption.md index 05129ad..a077e91 100644 --- a/docs/dev/performance-tooling-adoption.md +++ b/docs/dev/performance-tooling-adoption.md @@ -143,7 +143,7 @@ reruns or new performance claims are needed. The dependency-only environment remains Python 3.15. Python supports shared tools and consumer tests; deleting production scripts does not remove it. -Semgrep 1.180.0 still requires its separately locked Python 3.14 environment +Semgrep 1.182.0 still requires its separately locked Python 3.14 environment under `tooling/semgrep/`. Retire that exception only when published scanner wheels support Python 3.15 and native gates pass. diff --git a/tooling/README.md b/tooling/README.md index 10b537b..f0153f3 100644 --- a/tooling/README.md +++ b/tooling/README.md @@ -14,7 +14,7 @@ runs the installed-package integration tests. `just ci` is the final repository validation. Native Linux, macOS and Windows CI is required for adoption; local macOS results do not establish the other platforms. -Semgrep 1.180.0 retains its separate locked Python 3.14 environment in +Semgrep 1.182.0 retains its separate locked Python 3.14 environment in `tooling/semgrep/` while its wheels exclude Python 3.15. Ordinary Rust and Python tests remain scan targets; deliberate `tests/semgrep/` fixtures are checked separately by `just semgrep-test`. diff --git a/tooling/semgrep/pyproject.toml b/tooling/semgrep/pyproject.toml index e40f837..365e374 100644 --- a/tooling/semgrep/pyproject.toml +++ b/tooling/semgrep/pyproject.toml @@ -2,7 +2,7 @@ name = "la-stack-semgrep" version = "0.0.0" requires-python = ">=3.14,<3.15" -dependencies = [ "semgrep==1.180.0" ] +dependencies = [ "semgrep==1.182.0" ] [tool.uv] package = false diff --git a/tooling/semgrep/uv.lock b/tooling/semgrep/uv.lock index 8c72c82..4759bf8 100644 --- a/tooling/semgrep/uv.lock +++ b/tooling/semgrep/uv.lock @@ -406,7 +406,7 @@ dependencies = [ ] [package.metadata] -requires-dist = [{ name = "semgrep", specifier = "==1.180.0" }] +requires-dist = [{ name = "semgrep", specifier = "==1.182.0" }] [[package]] name = "markdown-it-py" @@ -870,7 +870,7 @@ wheels = [ [[package]] name = "semgrep" -version = "1.180.0" +version = "1.182.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "attrs" }, @@ -901,15 +901,15 @@ dependencies = [ { name = "urllib3" }, { name = "wcmatch" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/76/aa/34eac121a4b1859aae125aa8c997bbec1f00b05d3225ba4becff6d3685a1/semgrep-1.180.0.tar.gz", hash = "sha256:14aee785d0bc9656027a33fca7f97e88e089dbc6c7ed3df47f454b0584b0a3d0", size = 518569, upload-time = "2026-10-07T23:22:36.432Z" } +sdist = { url = "https://files.pythonhosted.org/packages/b7/8d/60aa58170c3a8799def291bc3fdf3dd1ec95172dbdc5fed78e92d18f6b42/semgrep-1.182.0.tar.gz", hash = "sha256:9e18507d94cea45ceeabec8c9ce51be155e32ed7ea8323ccbbb396ea2518394f", size = 521961, upload-time = "2026-10-20T20:32:31.377Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/6e/94/8ca81606f09f2c33630409f7e1f2ad89c5841f5da062eec8452cee6d51d7/semgrep-1.180.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-macosx_10_14_x86_64.whl", hash = "sha256:f074dcfd6a56095fde32c354af27ef0cce6d15607bef42fa50964dd7042b667d", size = 45810903, upload-time = "2026-10-07T23:24:26.336Z" }, - { url = "https://files.pythonhosted.org/packages/c1/a1/e29003080506e7666ba8225df63632f1ac6417764d4ee991e5dae04f2c0c/semgrep-1.180.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-macosx_11_0_arm64.whl", hash = "sha256:9c61070eaa7de785a8318e1d00de6c9151efa660cc3e58c3e2ffd6f5e6180af7", size = 49794130, upload-time = "2026-10-07T23:24:30.244Z" }, - { url = "https://files.pythonhosted.org/packages/38/60/66135de6020e792491b0973d95efc89ef729a38c58106394b2798bf58dda/semgrep-1.180.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_aarch64.whl", hash = "sha256:cba06f64b10e5ec86a0b3a9757cfdfdf3ce6c2bbdb5e98762aa2a4b0a296f8ca", size = 72563288, upload-time = "2026-10-07T23:24:34.008Z" }, - { url = "https://files.pythonhosted.org/packages/7c/1f/f4af9cc92651f04ab973eac214a62ed23260da9e0696c105b4b9734da453/semgrep-1.180.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_x86_64.whl", hash = "sha256:16db2e2706ab814a975eeec25debfad49abba846b7c513d88e041447152f8447", size = 70564254, upload-time = "2026-10-07T23:24:38.551Z" }, - { url = "https://files.pythonhosted.org/packages/37/c5/e712830b05b596fee47c4c8e5382c0439c2ac3aa46272f27818479216f38/semgrep-1.180.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-musllinux_1_2_aarch64.whl", hash = "sha256:1bab359e562f0af00217f9f827531c2e1375499b8559c90bed9690007e82565d", size = 79472194, upload-time = "2026-10-07T23:24:43.39Z" }, - { url = "https://files.pythonhosted.org/packages/a1/40/21fefcbf9fe3d9670e98504f71a0974805812bbb308ddee5a31a7c5ba12b/semgrep-1.180.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-musllinux_1_2_x86_64.whl", hash = "sha256:d19b447b5d49c435dda099fd5f9d96ec7822e98a8ea6df16630f4f0596ed27ed", size = 77124939, upload-time = "2026-10-07T23:24:47.921Z" }, - { url = "https://files.pythonhosted.org/packages/82/75/3e3a75297e8f181e0a32b5691ee55c78a214d4a72a0370841f9c7674a5da/semgrep-1.180.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-win_amd64.whl", hash = "sha256:b403865e64f5ba0691630adf9bc13592cc38830726d4a114960d7e2d3fb21fc6", size = 58108036, upload-time = "2026-10-07T23:24:52.232Z" }, + { url = "https://files.pythonhosted.org/packages/05/bd/62412a31140b0a339f4785d4505186ed64a5d61252b5e70b52e06827cf7f/semgrep-1.182.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-macosx_10_14_x86_64.whl", hash = "sha256:56f609a26dfba5e16428485f120f671e216ae3d3329697e8cf0075fb8a17c10a", size = 46795879, upload-time = "2026-10-20T20:34:11.122Z" }, + { url = "https://files.pythonhosted.org/packages/4e/6d/74dcb9ef5d7ff61918df79d6ce8e3dc2ae3d839b42cded4401e51993a7b3/semgrep-1.182.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-macosx_11_0_arm64.whl", hash = "sha256:675e69cbc71827a36eb490745d3d56c846c356b70072933c5513587a684767b0", size = 50877783, upload-time = "2026-10-20T20:34:14.772Z" }, + { url = "https://files.pythonhosted.org/packages/ca/24/db102993a4a8fb32addc6c2bee1311b4b4faf81e9287596c1eaddfb1aaf7/semgrep-1.182.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_aarch64.whl", hash = "sha256:e20485948f87a7a8e5ef099bb0ef80beae8c5f53a19d55de94e89c516eb9f731", size = 73885611, upload-time = "2026-10-20T20:34:18.617Z" }, + { url = "https://files.pythonhosted.org/packages/62/85/2e4bd385c4cd55d3ec293a328ffb98115277fb08b8b98be5848ec035e9fd/semgrep-1.182.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_x86_64.whl", hash = "sha256:19a82868830389c039bb71bfc0aeebb28385e5b65740120710eff050324ad14f", size = 71826876, upload-time = "2026-10-20T20:34:23.349Z" }, + { url = "https://files.pythonhosted.org/packages/3b/06/0b184e78ba910d43f0faf730c38f4dc44c5a26101a2df23615716af1f5dd/semgrep-1.182.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-musllinux_1_2_aarch64.whl", hash = "sha256:02cbad24b4409b5b85df11aea123f6cf74232858db570b1d28dce0e6109004a0", size = 80961859, upload-time = "2026-10-20T20:34:27.337Z" }, + { url = "https://files.pythonhosted.org/packages/7d/3e/52c40aacf843d10820525b78dfe57af1bac936ab63b38cbf79dda4632b8a/semgrep-1.182.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-musllinux_1_2_x86_64.whl", hash = "sha256:6263233c3f2e7b05c2d89b1de7408e91c0238014ab67bb68746c0c452d33b828", size = 78543086, upload-time = "2026-10-20T20:34:31.532Z" }, + { url = "https://files.pythonhosted.org/packages/e0/9b/69da1bff8b978390f3c59283f45f1b881a347185ddd598fbb751d3108379/semgrep-1.182.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-win_amd64.whl", hash = "sha256:d1cc11b4662175d62c0296c6e4944483104a9ede26ae1a3c1723abab234815ce", size = 59174689, upload-time = "2026-10-20T20:34:35.252Z" }, ] [[package]] diff --git a/tooling/tests/test_maintenance_integration.py b/tooling/tests/test_maintenance_integration.py index 3a61e9b..a0d24ed 100644 --- a/tooling/tests/test_maintenance_integration.py +++ b/tooling/tests/test_maintenance_integration.py @@ -149,15 +149,16 @@ def test_semgrep_adapter_uses_real_consumer_rules_and_fixtures() -> None: assert "research-repo-tools semgrep check-fixtures" in result.stderr -def test_semgrep_keeps_its_current_version_outside_the_python_315_environment() -> None: - """The generic dev updater cannot downgrade the isolated native scanner.""" +def test_semgrep_preserves_its_pin_and_mcp_override_in_python_314() -> None: + """The isolated native scanner retains its exact pin and patched MCP API.""" root = tomllib.loads((REPO_ROOT / "pyproject.toml").read_text(encoding="utf-8")) scanner = tomllib.loads((REPO_ROOT / "tooling/semgrep/pyproject.toml").read_text(encoding="utf-8")) assert not any(isinstance(item, str) and item.startswith("semgrep") for item in root["dependency-groups"]["dev"]) - assert scanner["project"]["dependencies"] == ["semgrep==1.180.0"] + assert scanner["project"]["dependencies"] == ["semgrep==1.182.0"] assert scanner["project"]["requires-python"] == ">=3.14,<3.15" - result = run_command("uv", ["run", "--locked", "--project", "tooling/semgrep", "semgrep", "--version"], cwd=REPO_ROOT) - assert result.stdout.strip() == "1.180.0" + assert scanner["tool"]["uv"]["override-dependencies"] == ["mcp>=1.30.0,<2"] + result = run_command("uv", ["run", "--locked", "--project", "tooling/semgrep", "semgrep", "--disable-version-check", "--version"], cwd=REPO_ROOT) + assert result.stdout.strip() == "1.182.0" def test_python_update_includes_the_isolated_semgrep_project() -> None: diff --git a/tooling/tests/test_toolchain_integration.py b/tooling/tests/test_toolchain_integration.py index ce22077..60091cb 100644 --- a/tooling/tests/test_toolchain_integration.py +++ b/tooling/tests/test_toolchain_integration.py @@ -29,9 +29,7 @@ [*UPDATER, "toolchain", "run", "--", "cargo", "update"], ] PYTHON_UPDATE = [ - [*UPDATER, "deps", "update-python"], - ["lock", "--upgrade"], - [*CHECKED, "uv", "sync", "--locked", "--managed-python", "--group", "dev"], + [*UPDATER, "deps", "update-python", "--all-projects"], ] WORKFLOWS = { "update": [UV_UPDATE, TOOL_UPDATE, SETUP, *CARGO_UPDATE, *PYTHON_UPDATE], @@ -107,7 +105,7 @@ def test_update_recipes_sequence_and_preserve_coupled_exclusions(consumer: Path, assert calls == WORKFLOWS[recipe] -@pytest.mark.parametrize("step", range(1, 9)) +@pytest.mark.parametrize("step", range(1, len(WORKFLOWS["update"]) + 1)) def test_update_failure_stops_later_steps(consumer: Path, monkeypatch: pytest.MonkeyPatch, step: int) -> None: monkeypatch.setenv("UPDATE_FAIL_STEP", str(step)) result, calls = invoke(consumer, "update") From fae5c9ebd7826ec2450045d2e6c5c27a3c91eeb1 Mon Sep 17 00:00:00 2001 From: Adam Date: Wed, 21 Oct 2026 23:27:22 +0000 Subject: [PATCH 3/3] fix: adopt published shared updater and audit Python locks - Pin research-repo-tools 0.2.3 from PyPI and verify exact published hashes. - Refresh root and isolated Semgrep locks through the released updater while retaining Python selectors, exact tool pins, MCP override and certifi fix. - Align release-tool installations and docs with the actual published package. - Add read-only hosted OSV coverage for both Python locks while preserving the native Cargo audit and its narrowly scoped SARIF permission. - Validate 107 Python integration tests, scanner production and fixtures, workflow/config lint, Markdown/spelling and default/exact Rustdocs. - Record local OSV API HTTP 403 as an incomplete audit, not a security pass. Refs #298 and acgetchell/research-repo-tools#122. --- .github/workflows/audit.yml | 34 +++++++++++++++++++-- .github/workflows/release-benchmarks.yml | 4 +-- CONTRIBUTING.md | 4 ++- docs/RELEASING.md | 2 +- docs/dev/performance-tooling-adoption.md | 24 ++++++++------- pyproject.toml | 2 +- tooling/semgrep/uv.lock | 18 +++++------ tooling/tests/test_toolchain_integration.py | 6 ++-- uv.lock | 10 +++--- 9 files changed, 69 insertions(+), 35 deletions(-) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index e972d08..38a26c3 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -8,12 +8,18 @@ on: - "**/Cargo.toml" - "**/Cargo.lock" - rust-toolchain.toml + - "**/pyproject.toml" + - "**/uv.lock" + - .github/actions/setup-tools/action.yml pull_request: paths: - .github/workflows/audit.yml - "**/Cargo.toml" - "**/Cargo.lock" - rust-toolchain.toml + - "**/pyproject.toml" + - "**/uv.lock" + - .github/actions/setup-tools/action.yml schedule: - cron: "0 6 * * 1" # Monday at 6 AM UTC workflow_dispatch: @@ -28,13 +34,37 @@ concurrency: cancel-in-progress: true permissions: - actions: read contents: read - security-events: write jobs: + python-audit: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Set up declared tools + uses: ./.github/actions/setup-tools # zizmor: ignore[self-repository] actionlint 1.7.12 does not accept $/... + + - name: Audit root and independent Python locks + run: uv run --locked --group dev research-repo-tools security osv uv.lock tooling/semgrep/uv.lock + + - name: Retain dependency audit reports + if: ${{ !cancelled() }} + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: python-audit-results + path: target/security/osv-* + audit: runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write env: CARGO_AUDIT_VERSION: "0.22.2" steps: diff --git a/.github/workflows/release-benchmarks.yml b/.github/workflows/release-benchmarks.yml index e3b4cdd..3b77176 100644 --- a/.github/workflows/release-benchmarks.yml +++ b/.github/workflows/release-benchmarks.yml @@ -54,7 +54,7 @@ jobs: echo "::error::Dispatch with --ref $RELEASE_TAG and the matching tag input" exit 1 fi - target="$(uvx --python 3.15 --from research-repo-tools==0.2.2 research-repo-tools \ + target="$(uvx --python 3.15 --from research-repo-tools==0.2.3 research-repo-tools \ --root "$RUNNER_TEMP" performance release-draft "$GH_REPO" "$RELEASE_TAG" \ --commit "$GITHUB_SHA" --expected-title "$RELEASE_TAG" | jq -c .)" echo "target=$target" >> "$GITHUB_OUTPUT" @@ -194,7 +194,7 @@ jobs: [[ "$RELEASE_ASSET" == "la-stack-${RELEASE_TAG}-criterion-baseline.tar.gz" ]] || exit 1 printf '%s\n' "$RELEASE_TARGET" > "$RUNNER_TEMP/release-target.json" - uvx --python 3.15 --from research-repo-tools==0.2.2 research-repo-tools \ + uvx --python 3.15 --from research-repo-tools==0.2.3 research-repo-tools \ --root "$RUNNER_TEMP" performance release-upload "$GH_REPO" "$RELEASE_TAG" \ "$GITHUB_WORKSPACE/$RELEASE_ASSET" --target "$RUNNER_TEMP/release-target.json" diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ba272d5..7513e11 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -39,7 +39,7 @@ change files. Run bare `just` for the complete generated command list, including arguments and descriptions. The [command policy](docs/dev/docs.md#command-discovery-and-placement) owns recipe naming and documentation placement. -Setup, tool checks, updates, changelog, and opt-in CodeRabbit review use the published `research-repo-tools==0.2.2` package, +Setup, tool checks, updates, changelog, and opt-in CodeRabbit review use the published `research-repo-tools==0.2.3` package, locked in the `tooling` dependency group and included by `dev`. Normal setup and CI install it from PyPI through `uv sync --locked --group dev`; a sibling checkout is unnecessary. To upgrade it deliberately, review the exact @@ -70,6 +70,8 @@ The shared Python updater also refreshes `tooling/semgrep/uv.lock` and syncs its separate environment through `deps.python-projects`. It retains the scanner's exact Semgrep pin, Python 3.14 selector, and dependency overrides. Declare future independent uv projects in the same list so they participate in `just update`. +The hosted dependency audit checks both Python lockfiles with the shared OSV +adapter; its existing Cargo audit retains the native Rust advisory policy. `just update-cargo-dependencies` excludes `num-bigint` and `num-rational` from incompatible requirement upgrades because their public types must advance together; Cargo can still refresh locked versions within those requirements. diff --git a/docs/RELEASING.md b/docs/RELEASING.md index c28cff4..e3fa5fe 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -337,7 +337,7 @@ release ID and tag commit before attaching the archive. Do not edit the draft, move the tag, or publish manually while the workflow is running. -The privileged jobs install the exact published `research-repo-tools==0.2.2` +The privileged jobs install the exact published `research-repo-tools==0.2.3` package on Python 3.15 without repository checkout. Preflight emits versioned target JSON with the captured ID, commit and title assertion. Its trusted job output passes directly to the publisher, separately from the producer's inert diff --git a/docs/dev/performance-tooling-adoption.md b/docs/dev/performance-tooling-adoption.md index a077e91..8b20edc 100644 --- a/docs/dev/performance-tooling-adoption.md +++ b/docs/dev/performance-tooling-adoption.md @@ -8,23 +8,25 @@ belong to research-repo-tools. ## Publication boundary -The dependency-only environment pins the published `research-repo-tools==0.2.2` +The dependency-only environment pins the published `research-repo-tools==0.2.3` package, including the release workflow's isolated installations. -Upstream [#118](https://github.com/acgetchell/research-repo-tools/pull/118) -adds the missing minimum-release acquisition contract; release -[#119](https://github.com/acgetchell/research-repo-tools/pull/119) published it -from commit `e9310163d2789532bdcb155ef93b721473dc5523`. v0.2.1 supplied the declarative workflow interfaces but could -not express the consumer's v0.5.0 measurement floor. - -[PyPI v0.2.2](https://pypi.org/project/research-repo-tools/0.2.2/) lists both +Upstream [#123](https://github.com/acgetchell/research-repo-tools/pull/123) +adds trusted main-validation artifact reuse for release promotion; v0.2.3 +was published from commit `4085125526e21b2855eb7c61a52ee312782ae31a`. +It also refreshes explicitly declared independent Python projects while +preserving their selectors, exact pins, overrides, and separate environments. +The minimum-release acquisition contract introduced by v0.2.2 remains in place: +v0.2.1 could not express the consumer's v0.5.0 measurement floor. + +[PyPI v0.2.3](https://pypi.org/project/research-repo-tools/0.2.3/) lists both distributions as unyanked. Their SHA-256 hashes match the signed -[GitHub release assets](https://github.com/acgetchell/research-repo-tools/releases/tag/v0.2.2) +[GitHub release assets](https://github.com/acgetchell/research-repo-tools/releases/tag/v0.2.3) and the exact registry lock entries: | Distribution | SHA-256 | | --- | --- | -| Wheel | `b82e11ef8265f0b03c37cac93f59d5854a63543c29ee378f5980623af57d9381` | -| Source distribution | `4937f202a55c5678af30bae915e01ddbc17f9dd8dd9e143b2f430331b42e8f50` | +| Wheel | `da5f0259027662e7706b7f2b8a38d8e1f1d8a5dce314e2c996177b2947514fc6` | +| Source distribution | `13700b174656ffad265ecb926dd66013949853b7a39c088ab6d3852aba72df95` | Runtime imports and acceptance checks use this installed package. No sibling checkout, private API, or release-candidate installation supplies final evidence. diff --git a/pyproject.toml b/pyproject.toml index 066d742..317a6d8 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -90,7 +90,7 @@ required-version = "==0.13.4" # Semgrep has its own locked Python 3.14 environment under tooling/semgrep. [dependency-groups] -tooling = [ "research-repo-tools==0.2.2" ] +tooling = [ "research-repo-tools==0.2.3" ] dev = [ { include-group = "tooling" }, "actionlint-py==1.7.12.25", diff --git a/tooling/semgrep/uv.lock b/tooling/semgrep/uv.lock index 4759bf8..0a7eb15 100644 --- a/tooling/semgrep/uv.lock +++ b/tooling/semgrep/uv.lock @@ -690,7 +690,7 @@ wheels = [ [[package]] name = "pydantic-settings" -version = "2.16.0" +version = "2.16.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "pydantic" }, @@ -698,9 +698,9 @@ dependencies = [ { name = "typing-extensions" }, { name = "typing-inspection" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/2e/3b/a5d2294799b53b448319978cfb5bd139d5a9d45e862af91661614f14c922/pydantic_settings-2.16.0.tar.gz", hash = "sha256:5b6c578049ede4db0e2ef3b4eaa4ad4069cfa9211f83fb38df899dfade50a614", size = 301031, upload-time = "2026-10-14T12:44:09.998Z" } +sdist = { url = "https://files.pythonhosted.org/packages/05/ca/7817b4bf0c4b15c6a6ab8cdf4cb96c268335a8ca2f525de93b6ebe4c7d28/pydantic_settings-2.16.1.tar.gz", hash = "sha256:aff602a1886338c2df3d1e958e2193a8dc33cec75b91f202e83fd98484b4b0da", size = 303436, upload-time = "2026-10-20T11:37:19.024Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/53/f4/b987bf8c51e5b19a95fa66d1ee596074141e085d9c2ddf97920803c7029b/pydantic_settings-2.16.0-py3-none-any.whl", hash = "sha256:7e73acf7f61936a15e5a3b6eedaea29f133357faf7272f2607ba479b049dd7f2", size = 80364, upload-time = "2026-10-14T12:44:08.233Z" }, + { url = "https://files.pythonhosted.org/packages/3c/74/fdf926afe145d8629c4b2ff57f4ea1d64ed7abc4d84d97463b2517a2547e/pydantic_settings-2.16.1-py3-none-any.whl", hash = "sha256:30f5313340da4e8f1b440d1910b92a5bc3ccbb6b4ba70ec2b8395bc921f418f5", size = 80771, upload-time = "2026-10-20T11:37:17.298Z" }, ] [[package]] @@ -927,14 +927,14 @@ wheels = [ [[package]] name = "starlette" -version = "1.8.0" +version = "1.9.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "anyio" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/e9/0c/6efb252d091ecccd7d62048ae11f0ea35cd75a4fbaeea5e30f9c3bf91d10/starlette-1.8.0.tar.gz", hash = "sha256:1565dc0b35d5737a271ed1e0e04e949f4e81198799f216d2667b0a0fb9cf9522", size = 2730457, upload-time = "2026-10-13T07:54:39.53Z" } +sdist = { url = "https://files.pythonhosted.org/packages/ad/eb/4e197bf26b023abafc5e9043ec8710d7de0fcb032d0969045236d72aa0b1/starlette-1.9.0.tar.gz", hash = "sha256:3d931de246ed870e35ce605974440816ef895e592f255d1396cfdf191d4c4318", size = 2732466, upload-time = "2026-10-18T15:50:33.189Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/c1/b0/5742e4ac7af5eb58ec3470a537a49d7aa507e5539413e504b3a65ef50ba8/starlette-1.8.0-py3-none-any.whl", hash = "sha256:dfdd6b29c26483288088d990eee59631dedadd66ce20d203402a7ca8e3c4656f", size = 79612, upload-time = "2026-10-13T07:54:38.019Z" }, + { url = "https://files.pythonhosted.org/packages/f3/93/181df62699d9b5aca1d87e5cfda131dac87e3cdaebf668662f7206ca3470/starlette-1.9.0-py3-none-any.whl", hash = "sha256:fd3f159936e882d06c1108f84688f7cda2cf85fc6a592a50edbd175e882c2ddc", size = 80335, upload-time = "2026-10-18T15:50:31.526Z" }, ] [[package]] @@ -1050,9 +1050,9 @@ wheels = [ [[package]] name = "zipp" -version = "4.1.1" +version = "4.1.2" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/dc/23/655a1802fe8041302c959774ca7c80b53bc24737ff3ef45cb50ef11bd96c/zipp-4.1.1.tar.gz", hash = "sha256:7ebb7a44c021b29fd8dbd7cce6812d0d7b5b454521f93cc71af6ccd155aaa70b", size = 27649, upload-time = "2026-10-03T17:03:03.452Z" } +sdist = { url = "https://files.pythonhosted.org/packages/18/05/ba1458dee0ac485b2a01071c1b88f5199fe878a485df482e10e1ef2205cc/zipp-4.1.2.tar.gz", hash = "sha256:cf474b90b07ea932637e17c6b9479de2b2882900b0d311bdaf4f5c000a15a97f", size = 27864, upload-time = "2026-10-21T18:57:04.743Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/b5/98/df615823cd9419131ce19fba00de53a663794369e198aade064a244b385d/zipp-4.1.1-py3-none-any.whl", hash = "sha256:8979f52d874162f485ff2981e3891f3a3317b7a3dd43ff1e1775b9304f307a9c", size = 10582, upload-time = "2026-10-03T17:03:02.506Z" }, + { url = "https://files.pythonhosted.org/packages/b8/44/7bd2007260da11cccca29ba2d4c345f1287aa663db38ee7cefeabf6386a5/zipp-4.1.2-py3-none-any.whl", hash = "sha256:b30cb6cd253122169c47de245ca24a86bac2a5d3802ba15bf7ba6414eb9e144d", size = 10581, upload-time = "2026-10-21T18:57:03.79Z" }, ] diff --git a/tooling/tests/test_toolchain_integration.py b/tooling/tests/test_toolchain_integration.py index 60091cb..8fcd16c 100644 --- a/tooling/tests/test_toolchain_integration.py +++ b/tooling/tests/test_toolchain_integration.py @@ -45,7 +45,7 @@ def test_published_tooling_package_matches_manifest_lock_and_installation() -> None: """Keep the exact published-package contract in one consumer test.""" - expected_version = "0.2.2" + expected_version = "0.2.3" manifest = tomllib.loads((REPO_ROOT / "pyproject.toml").read_text(encoding="utf-8")) assert manifest["project"]["dependencies"] == [] assert manifest["tool"]["uv"]["package"] is False @@ -57,8 +57,8 @@ def test_published_tooling_package_matches_manifest_lock_and_installation() -> N package = next(item for item in lock["package"] if item["name"] == "research-repo-tools") assert package["version"] == expected_version assert package["source"] == {"registry": "https://pypi.org/simple"} - assert package["wheels"][0]["hash"] == "sha256:b82e11ef8265f0b03c37cac93f59d5854a63543c29ee378f5980623af57d9381" - assert package["sdist"]["hash"] == "sha256:4937f202a55c5678af30bae915e01ddbc17f9dd8dd9e143b2f430331b42e8f50" + assert package["wheels"][0]["hash"] == "sha256:da5f0259027662e7706b7f2b8a38d8e1f1d8a5dce314e2c996177b2947514fc6" + assert package["sdist"]["hash"] == "sha256:13700b174656ffad265ecb926dd66013949853b7a39c088ab6d3852aba72df95" @pytest.fixture diff --git a/uv.lock b/uv.lock index c2e5310..6348c34 100644 --- a/uv.lock +++ b/uv.lock @@ -52,14 +52,14 @@ tooling = [ dev = [ { name = "actionlint-py", specifier = "==1.7.12.25" }, { name = "pytest", specifier = "==9.1.1" }, - { name = "research-repo-tools", specifier = "==0.2.2" }, + { name = "research-repo-tools", specifier = "==0.2.3" }, { name = "ruff", specifier = "==0.17.1" }, { name = "shellcheck-py", specifier = "==0.11.0.1" }, { name = "shfmt-py", specifier = "==4.2.0" }, { name = "ty", specifier = "==0.0.90" }, { name = "yamllint", specifier = "==1.38.0" }, ] -tooling = [{ name = "research-repo-tools", specifier = "==0.2.2" }] +tooling = [{ name = "research-repo-tools", specifier = "==0.2.3" }] [[package]] name = "packaging" @@ -121,16 +121,16 @@ sdist = { url = "https://files.pythonhosted.org/packages/05/8e/961c0007c59b8dd77 [[package]] name = "research-repo-tools" -version = "0.2.2" +version = "0.2.3" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "packaging" }, { name = "pyyaml" }, { name = "rust-just" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/9c/d1/a2f0444e568abe7529721d7b8e342c5fd4ecb9021333d06b66be420215d5/research_repo_tools-0.2.2.tar.gz", hash = "sha256:4937f202a55c5678af30bae915e01ddbc17f9dd8dd9e143b2f430331b42e8f50", size = 872467, upload-time = "2026-10-21T10:17:15.454Z" } +sdist = { url = "https://files.pythonhosted.org/packages/96/0f/13f1c4eac70a510a452fcad67c95eaa05ab93ae143428e5e2e625a9abb3e/research_repo_tools-0.2.3.tar.gz", hash = "sha256:13700b174656ffad265ecb926dd66013949853b7a39c088ab6d3852aba72df95", size = 894191, upload-time = "2026-10-21T23:18:17.334Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/6c/5c/cd74485ccb20cf85d615402097b5e216b55a95c83475cb9b51ed329a739a/research_repo_tools-0.2.2-py3-none-any.whl", hash = "sha256:b82e11ef8265f0b03c37cac93f59d5854a63543c29ee378f5980623af57d9381", size = 378782, upload-time = "2026-10-21T10:17:13.727Z" }, + { url = "https://files.pythonhosted.org/packages/01/ad/a522413628887cc54c06fe2186ad5490a25e6a098057a71df47a99bb9c63/research_repo_tools-0.2.3-py3-none-any.whl", hash = "sha256:da5f0259027662e7706b7f2b8a38d8e1f1d8a5dce314e2c996177b2947514fc6", size = 391281, upload-time = "2026-10-21T23:18:14.975Z" }, ] [[package]]