Skip to content

Commit d74dfd9

Browse files
author
Convilyn Release
committed
Release v1.2.0b13
Generated public mirror snapshot.
1 parent 6c7115c commit d74dfd9

3 files changed

Lines changed: 114 additions & 114 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 82 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -1,82 +1,82 @@
1-
# Public-mirror CI (fork-safe). Runs on every push + community PR.
2-
#
3-
# SECURITY POSTURE (do not weaken):
4-
# * permissions: contents: read ONLY — no write scope.
5-
# * NO secrets are referenced — so a fork PR can never exfiltrate one.
6-
# * trigger is `pull_request` (NOT `pull_request_target`) — the classic
7-
# fork-secret footgun is intentionally avoided.
8-
#
9-
# The internal-vocabulary (blackbox) gate + contract/conformance run in the
10-
# UPSTREAM monorepo when a community PR is upstreamed — deliberately NOT here:
11-
# shipping the internal-term blocklist into a public repo would itself leak
12-
# internal architecture vocabulary. So this CI covers lint / format / test /
13-
# secret-scan; every PR is vocabulary-checked at the upstream step, and the
14-
# mirror is only ever refreshed from the (already-clean) monorepo.
15-
name: ci
16-
17-
on:
18-
push:
19-
branches: [main]
20-
pull_request:
21-
22-
permissions:
23-
contents: read
24-
25-
concurrency:
26-
group: ci-${{ github.ref }}
27-
cancel-in-progress: true
28-
29-
jobs:
30-
test:
31-
runs-on: ubuntu-latest
32-
steps:
33-
- uses: actions/checkout@v4
34-
- uses: actions/setup-python@v5
35-
with:
36-
python-version: '3.12'
37-
- name: Install (editable + dev extras)
38-
run: python -m pip install -e ".[dev]"
39-
- name: Lint (ruff)
40-
run: python -m ruff check .
41-
- name: Format check (ruff)
42-
run: python -m ruff format --check .
43-
- name: Tests
44-
run: python -m pytest
45-
46-
secret-scan:
47-
runs-on: ubuntu-latest
48-
steps:
49-
- uses: actions/checkout@v4
50-
- uses: actions/setup-python@v5
51-
with:
52-
python-version: '3.12'
53-
- name: detect-secrets (against the shipped baseline)
54-
run: |
55-
python -m pip install detect-secrets==1.5.0
56-
# detect-secrets-hook exits non-zero ONLY on NEW, un-baselined secrets.
57-
# (A plain `scan --baseline` + `git diff --exit-code` would ALWAYS fail:
58-
# detect-secrets rewrites the baseline's `generated_at` timestamp every
59-
# run, so the diff is never empty even with zero findings.)
60-
git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline
61-
62-
# DCO (§7d): every PR commit must carry a Signed-off-by trailer. Fork-safe —
63-
# read-only, no secrets, plain git; complements (does not require) the DCO
64-
# GitHub App. Push events skip it: only refresh commits land on main, and
65-
# they are generated by the release identity, not community contributions.
66-
dco:
67-
if: github.event_name == 'pull_request'
68-
runs-on: ubuntu-latest
69-
steps:
70-
- uses: actions/checkout@v4
71-
with:
72-
fetch-depth: 0
73-
- name: Sign-off check (git commit -s)
74-
run: |
75-
missing=0
76-
for sha in $(git rev-list "${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"); do
77-
if ! git log -1 --format=%B "$sha" | grep -Eq '^Signed-off-by: .+ <.+>'; then
78-
echo "::error::commit $sha lacks a Signed-off-by trailer — amend with: git rebase --signoff"
79-
missing=1
80-
fi
81-
done
82-
exit $missing
1+
# Public-mirror CI (fork-safe). Runs on every push + community PR.
2+
#
3+
# SECURITY POSTURE (do not weaken):
4+
# * permissions: contents: read ONLY — no write scope.
5+
# * NO secrets are referenced — so a fork PR can never exfiltrate one.
6+
# * trigger is `pull_request` (NOT `pull_request_target`) — the classic
7+
# fork-secret footgun is intentionally avoided.
8+
#
9+
# The internal-vocabulary (blackbox) gate + contract/conformance run in the
10+
# UPSTREAM monorepo when a community PR is upstreamed — deliberately NOT here:
11+
# shipping the internal-term blocklist into a public repo would itself leak
12+
# internal architecture vocabulary. So this CI covers lint / format / test /
13+
# secret-scan; every PR is vocabulary-checked at the upstream step, and the
14+
# mirror is only ever refreshed from the (already-clean) monorepo.
15+
name: ci
16+
17+
on:
18+
push:
19+
branches: [main]
20+
pull_request:
21+
22+
permissions:
23+
contents: read
24+
25+
concurrency:
26+
group: ci-${{ github.ref }}
27+
cancel-in-progress: true
28+
29+
jobs:
30+
test:
31+
runs-on: ubuntu-latest
32+
steps:
33+
- uses: actions/checkout@v4
34+
- uses: astral-sh/setup-uv@v5
35+
with:
36+
python-version: '3.12'
37+
- name: Install (project + dev group)
38+
run: uv sync
39+
- name: Lint (ruff)
40+
run: uv run ruff check .
41+
- name: Format check (ruff)
42+
run: uv run ruff format --check .
43+
- name: Tests
44+
run: uv run pytest
45+
46+
secret-scan:
47+
runs-on: ubuntu-latest
48+
steps:
49+
- uses: actions/checkout@v4
50+
- uses: actions/setup-python@v5
51+
with:
52+
python-version: '3.12'
53+
- name: detect-secrets (against the shipped baseline)
54+
run: | # pragma: allowlist secret
55+
python -m pip install detect-secrets==1.5.0
56+
# detect-secrets-hook exits non-zero ONLY on NEW, un-baselined secrets.
57+
# (A plain `scan --baseline` + `git diff --exit-code` would ALWAYS fail:
58+
# detect-secrets rewrites the baseline's `generated_at` timestamp every
59+
# run, so the diff is never empty even with zero findings.)
60+
git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline
61+
62+
# DCO (§7d): every PR commit must carry a Signed-off-by trailer. Fork-safe —
63+
# read-only, no secrets, plain git; complements (does not require) the DCO
64+
# GitHub App. Push events skip it: only refresh commits land on main, and
65+
# they are generated by the release identity, not community contributions.
66+
dco:
67+
if: github.event_name == 'pull_request'
68+
runs-on: ubuntu-latest
69+
steps:
70+
- uses: actions/checkout@v4
71+
with:
72+
fetch-depth: 0
73+
- name: Sign-off check (git commit -s)
74+
run: |
75+
missing=0
76+
for sha in $(git rev-list "${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"); do
77+
if ! git log -1 --format=%B "$sha" | grep -Eq '^Signed-off-by: .+ <.+>'; then
78+
echo "::error::commit $sha lacks a Signed-off-by trailer — amend with: git rebase --signoff"
79+
missing=1
80+
fi
81+
done
82+
exit $missing

‎.github/workflows/dco.yml‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,31 @@
1-
# DCO — verify every commit in a PR carries a `Signed-off-by` trailer.
2-
# Fork-safe: read-only, no secrets. See CONTRIBUTING.md ("Sign your commits").
3-
name: dco
4-
5-
on:
6-
pull_request:
7-
8-
permissions:
9-
contents: read
10-
11-
jobs:
12-
dco-check:
13-
runs-on: ubuntu-latest
14-
steps:
15-
- uses: actions/checkout@v4
16-
with:
17-
fetch-depth: 0
18-
- name: Check Signed-off-by on every commit
19-
run: |
20-
base="${{ github.event.pull_request.base.sha }}"
21-
head="${{ github.event.pull_request.head.sha }}"
22-
missing=0
23-
for c in $(git rev-list "$base".."$head"); do
24-
author="$(git show -s --format='%an <%ae>' "$c")"
25-
if ! git show -s --format='%b' "$c" | grep -qiE "^Signed-off-by: .+ <.+@.+>"; then
26-
echo "::error::commit $c ($author) is missing a Signed-off-by (DCO). Run: git commit -s (or git rebase --signoff)."
27-
missing=1
28-
fi
29-
done
30-
[ "$missing" -eq 0 ] && echo "All commits signed off ✔"
31-
exit $missing
1+
# DCO — verify every commit in a PR carries a `Signed-off-by` trailer.
2+
# Fork-safe: read-only, no secrets. See CONTRIBUTING.md ("Sign your commits").
3+
name: dco
4+
5+
on:
6+
pull_request:
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
dco-check:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@v4
16+
with:
17+
fetch-depth: 0
18+
- name: Check Signed-off-by on every commit
19+
run: |
20+
base="${{ github.event.pull_request.base.sha }}"
21+
head="${{ github.event.pull_request.head.sha }}"
22+
missing=0
23+
for c in $(git rev-list "$base".."$head"); do
24+
author="$(git show -s --format='%an <%ae>' "$c")"
25+
if ! git show -s --format='%b' "$c" | grep -qiE "^Signed-off-by: .+ <.+@.+>"; then
26+
echo "::error::commit $c ($author) is missing a Signed-off-by (DCO). Run: git commit -s (or git rebase --signoff)."
27+
missing=1
28+
fi
29+
done
30+
[ "$missing" -eq 0 ] && echo "All commits signed off ✔"
31+
exit $missing

‎.secrets.baseline‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,5 +119,5 @@
119119
}
120120
],
121121
"results": {},
122-
"generated_at": "2026-07-21T08:02:12Z"
122+
"generated_at": "2026-07-21T08:13:47Z"
123123
}

0 commit comments

Comments
 (0)