diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..db1dd05 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,31 @@ +version: 2 +updates: +- package-ecosystem: uv + directory: / + schedule: + interval: cron + cronjob: 27 4 * * * + timezone: Europe/Warsaw + open-pull-requests-limit: 1 + versioning-strategy: increase-if-necessary + allow: + - dependency-name: costs + dependency-type: all + - dependency-name: goal + dependency-type: all + - dependency-name: pfix + dependency-type: all + - dependency-name: clickmd + dependency-type: all + - dependency-name: code2llm + dependency-type: all + groups: + internal-packages: + patterns: + - costs + - goal + - pfix + - clickmd + - code2llm + commit-message: + prefix: deps diff --git a/.github/internal-dependencies.json b/.github/internal-dependencies.json new file mode 100644 index 0000000..ce582b0 --- /dev/null +++ b/.github/internal-dependencies.json @@ -0,0 +1,35 @@ +{ + "schema": "goal.internal-dependencies/v1", + "packages": [ + { + "name": "costs", + "repository": "semcod/costs", + "registry": "pypi", + "versioning": "semver" + }, + { + "name": "goal", + "repository": "semcod/goal", + "registry": "pypi", + "versioning": "semver" + }, + { + "name": "pfix", + "repository": "semcod/pfix", + "registry": "pypi", + "versioning": "semver" + }, + { + "name": "clickmd", + "repository": "semcod/clickmd", + "registry": "pypi", + "versioning": "semver" + }, + { + "name": "code2llm", + "repository": "semcod/code2llm", + "registry": "pypi", + "versioning": "semver" + } + ] +} diff --git a/.github/workflows/internal-dependency-freshness.yml b/.github/workflows/internal-dependency-freshness.yml new file mode 100644 index 0000000..d64bfc8 --- /dev/null +++ b/.github/workflows/internal-dependency-freshness.yml @@ -0,0 +1,36 @@ +name: Internal dependency freshness + +on: + schedule: + - cron: "47 5 * * *" + workflow_dispatch: + pull_request: + paths: + - pyproject.toml + - uv.lock + - .github/internal-dependencies.json + - .github/workflows/internal-dependency-freshness.yml + +permissions: + contents: read + +jobs: + freshness: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 + with: + python-version: "3.12" + - name: Install released checker + run: python -m pip install "goal==2.2.0" + - name: Verify published stable targets + run: goal dependencies --catalog .github/internal-dependencies.json --check > dependency-freshness.json + - name: Retain freshness evidence + if: always() + uses: actions/upload-artifact@v4 + with: + name: dependency-freshness + path: dependency-freshness.json + if-no-files-found: ignore diff --git a/.github/workflows/test-locked.yml b/.github/workflows/test-locked.yml new file mode 100644 index 0000000..ec77b71 --- /dev/null +++ b/.github/workflows/test-locked.yml @@ -0,0 +1,30 @@ +name: Locked tests + +on: + push: + branches: [main] + pull_request: + branches: [main] + workflow_dispatch: + +permissions: + contents: read + +jobs: + test: + runs-on: ubuntu-latest + timeout-minutes: 15 + strategy: + fail-fast: false + matrix: + python-version: ["3.11", "3.13"] + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 + with: + python-version: ${{ matrix.python-version }} + - run: python -m pip install uv + - name: Install locked test dependencies + run: uv sync --locked --extra dev --python "${{ matrix.python-version }}" + - name: Test supported Python versions + run: uv run --no-sync python -m pytest -q diff --git a/README.md b/README.md index a609701..dcc6fcd 100644 --- a/README.md +++ b/README.md @@ -273,3 +273,7 @@ and in blocks tagged `markpact:analysis`: ## License Licensed under Apache-2.0. + +## Dependency maintenance + +See [dependency updates and Python tool groups](docs/dependencies.md) for locked tests, daily updates and freshness checks. diff --git a/docs/dependencies.md b/docs/dependencies.md new file mode 100644 index 0000000..3b4ba0e --- /dev/null +++ b/docs/dependencies.md @@ -0,0 +1,26 @@ +# Internal dependency updates + +This repository owns its dependency configuration and this guide. The shared checker is maintained in [semcod/goal](https://github.com/semcod/goal/blob/84f18540d14c24cc8ff5b7f202d2874344779ecc/docs/internal-dependencies.md). Documentation follows the repository ownership principle in [wellmanifest/docs](https://github.com/wellmanifest/docs/blob/f64de5806577769672ebc1730d2e144b4c7671ec/README.md). + +## Python support and tools + +Application Python support remains `>=3.11`. Goal is used as a development/release tool; source inspection found no Goal imports or executable invocation in the application Python code. Its old declarations (runtime, dev) moved to an `automation` dependency group requiring Python >=3.12. The normal dev/test installation remains usable on the application's minimum Python version. + +```sh +uv sync --locked --extra dev +uv sync --locked --group automation --python 3.12 +``` + +The second command selects an automation environment; use a separate UV_PROJECT_ENVIRONMENT when keeping application and tool environments side by side. `mdflow` itself is excluded from the registry catalog when it is the local editable package. + +## Daily updates and verification + +[Dependabot configuration](../.github/dependabot.yml) checks the explicit internal package allowlist daily, including weekends, and groups updates in one PR. It includes transitive dependencies and may widen a manifest constraint when needed. Local or Git sources require separate review. + +[Freshness CI](../.github/workflows/internal-dependency-freshness.yml) compares uv.lock with the highest published stable three-part versions using Goal 2.2.0. It runs daily, manually and on dependency PRs, has read-only repository permissions and retains JSON evidence. Resolver failures and mismatched targets stay visible. A successful audit says nothing about an already installed development or production environment. + +[Locked tests](../.github/workflows/test-locked.yml) run on Python 3.11 and 3.13 before merge. Update creation does not grant merge approval. The `>=` declarations alone do not refresh uv.lock; environments must be synchronized after a tested update is merged. + +## Delivery record + +This change updates the internal packages to the registry targets observed on 2026-09-05, preserves application Python support and adds the scheduled checks above. Test and publication results are recorded in this repository's PR and Actions checks. The ecosystem rollout history is maintained in [costs documentation](https://github.com/semcod/costs/tree/main/docs/dependencies). diff --git a/pyproject.toml b/pyproject.toml index 36da6e3..db6ef1e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -18,19 +18,16 @@ classifiers = [ ] # No required dependencies — mdflow works with stdlib only. # Optional: graphviz for SVG output. -dependencies = [ - "goal>=2.1.0", - "costs>=0.1.20", - "pfix>=0.1.60", -] +dependencies = ["costs>=0.1.20", "pfix>=0.1.60"] [project.license] text = "Apache-2.0" [project.optional-dependencies] graphviz = ["graphviz>=0.20"] -dev = ["pytest>=7", "pytest-cov", - "goal>=2.1.0", +dev = [ + "pytest>=7", + "pytest-cov", "costs>=0.1.20", "pfix>=0.1.60", ] @@ -73,3 +70,9 @@ max_commits = 500 # Cost thresholds for badge colors (USD) badge_color_thresholds = { low = 1.0, medium = 5.0, high = 10.0, critical = 50.0 } + +[tool.uv.dependency-groups] +automation = {requires-python = ">=3.12"} + +[dependency-groups] +automation = ["goal>=2.2.0"] diff --git a/uv.lock b/uv.lock index d4b0579..463f8b0 100644 --- a/uv.lock +++ b/uv.lock @@ -5,9 +5,12 @@ resolution-markers = [ "python_full_version >= '3.14' and sys_platform == 'win32'", "python_full_version >= '3.14' and sys_platform == 'emscripten'", "python_full_version >= '3.14' and sys_platform != 'emscripten' and sys_platform != 'win32'", - "python_full_version < '3.14' and sys_platform == 'win32'", - "python_full_version < '3.14' and sys_platform == 'emscripten'", - "python_full_version < '3.14' and sys_platform != 'emscripten' and sys_platform != 'win32'", + "python_full_version >= '3.12' and python_full_version < '3.14' and sys_platform == 'win32'", + "python_full_version < '3.12' and sys_platform == 'win32'", + "python_full_version >= '3.12' and python_full_version < '3.14' and sys_platform == 'emscripten'", + "python_full_version < '3.12' and sys_platform == 'emscripten'", + "python_full_version >= '3.12' and python_full_version < '3.14' and sys_platform != 'emscripten' and sys_platform != 'win32'", + "python_full_version < '3.12' and sys_platform != 'emscripten' and sys_platform != 'win32'", ] [[package]] @@ -264,7 +267,7 @@ name = "cffi" version = "2.0.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "pycparser", marker = "implementation_name != 'PyPy'" }, + { name = "pycparser" }, ] sdist = { url = "https://files.pythonhosted.org/packages/eb/56/b1ba7935a17738ae8453301356628e8147c79dbb825bcbc73dc7401f9846/cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529", size = 523588, upload-time = "2025-09-08T23:24:04.541Z" } wheels = [ @@ -432,16 +435,16 @@ wheels = [ [[package]] name = "clickmd" -version = "1.1.14" +version = "1.1.15" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "costs" }, { name = "goal" }, { name = "pfix" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/0e/1b/84df87d056991c2fb0789ae47b49d5afb8496f2c45541760e81553d00b43/clickmd-1.1.14.tar.gz", hash = "sha256:a3625777736ba5d3d43f7de8ff81bc01d2a4d77f6c252ce6ea7d55b860279f43", size = 41134, upload-time = "2026-04-08T09:11:28.657Z" } +sdist = { url = "https://files.pythonhosted.org/packages/3a/12/82b3b80bb2751e0d6c120c1beb11116527cca9322202b5a1924811b58376/clickmd-1.1.15.tar.gz", hash = "sha256:0a2971b952e471c4726bc2f88ed397abd395283c79e4885e435921426493d01c", size = 41145, upload-time = "2026-06-29T07:35:58.128Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/89/29/625bc2004029ce7297d0709e6486447c4a0f0d832c2ddd962cada14d32c7/clickmd-1.1.14-py3-none-any.whl", hash = "sha256:005bbc7cd97d8a58ba25b4fc0018b7970e37b57ee50d53aa33df5f445b4ff46b", size = 45540, upload-time = "2026-04-08T09:11:27.228Z" }, + { url = "https://files.pythonhosted.org/packages/d7/5c/398fafad25e456d86fe8fe7bf9a3873f2077564d42dcdd1426b76d01e915/clickmd-1.1.15-py3-none-any.whl", hash = "sha256:b191c0c26be5ef009ea27a3e88c1c7d633d95a6da2fc737f04f6727481bfeb5e", size = 45514, upload-time = "2026-06-29T07:35:56.53Z" }, ] [[package]] @@ -455,7 +458,7 @@ wheels = [ [[package]] name = "costs" -version = "0.1.50" +version = "0.2.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "anthropic" }, @@ -468,9 +471,9 @@ dependencies = [ { name = "tiktoken" }, { name = "typer" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/89/25/0778be9c7c3ef2cd5b9f8c59ac2c49af885099edbc41aaeef5312c6c2fe0/costs-0.1.50.tar.gz", hash = "sha256:2a452e126ada7597a0a6134d3d185afdcad65ad08f9d4ed7e1502199c6c7320e", size = 30275, upload-time = "2026-04-20T14:11:06.415Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e4/6f/7f3c72d6d4b5264bd5a3447e18a3b5184bffee143f72c8d023bb759afd1a/costs-0.2.0.tar.gz", hash = "sha256:3782bae859725dae30f697b5f3e5aa5d84e06feadebc5782ae706e21d46437af", size = 44606, upload-time = "2026-09-05T15:49:55.524Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/fe/83/1dca023a2fdccc2082ee22fc9848b6b453e4d673c4218c323e9f24882efa/costs-0.1.50-py3-none-any.whl", hash = "sha256:3224dab8005b9765219c0bd224731554aa67878b86e67f9afa8edecfd991d8a8", size = 35506, upload-time = "2026-04-20T14:11:04.754Z" }, + { url = "https://files.pythonhosted.org/packages/1d/7e/fc91d9fdc7a1ceb9116daffab27124a54f6e8887c9d59d906df43dcbfa6a/costs-0.2.0-py3-none-any.whl", hash = "sha256:4798b8535cbbcbb354e440ebce91365f17c910414bf5831a0610998ae6e679af", size = 48625, upload-time = "2026-09-05T15:49:54.054Z" }, ] [[package]] @@ -838,7 +841,7 @@ wheels = [ [[package]] name = "goal" -version = "2.1.218" +version = "2.2.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "click" }, @@ -848,9 +851,9 @@ dependencies = [ { name = "tomlkit" }, { name = "typer" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/d8/d3/c6d31f1087257adddaac23b243d133f49061d155b6c7f26804b9846d64a4/goal-2.1.218.tar.gz", hash = "sha256:209e403df9d44a9d533f6784d564af1e1622965ca76900ee9ee5ae08fff57d77", size = 257431, upload-time = "2026-04-26T12:00:47.589Z" } +sdist = { url = "https://files.pythonhosted.org/packages/c7/9c/135e3f67a7324c3c49ef4246f5518b59ad90226e62c3d30ae20cba005c1d/goal-2.2.0.tar.gz", hash = "sha256:e9e2c1ac9493dae3b887b16d503f7c1f83d02ddcbdd3c5cf58d44a458bb2662f", size = 399786, upload-time = "2026-09-05T19:41:55.329Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/9b/71/26e4e65d187ba5c2e1f0885ec135f2442d18f52f70c6f2d4ac5e17df2a3a/goal-2.1.218-py3-none-any.whl", hash = "sha256:752f77c5160c929bdbf2e5ab3d07b327a81d8d4dddc8691ba4d80895886f36db", size = 251843, upload-time = "2026-04-26T12:00:45.61Z" }, + { url = "https://files.pythonhosted.org/packages/24/69/8a4cf5710683bb777f1f6e4cd44dd3907befe97b94c6ea6e97d4305b4e44/goal-2.2.0-py3-none-any.whl", hash = "sha256:0d8f93aa317ac92a66b64b797e210a5d66044ce8db2cb05b012b03d42aced95e", size = 349709, upload-time = "2026-09-05T19:41:53.615Z" }, ] [[package]] @@ -1310,14 +1313,12 @@ version = "0.1.7" source = { editable = "." } dependencies = [ { name = "costs" }, - { name = "goal" }, { name = "pfix" }, ] [package.optional-dependencies] dev = [ { name = "costs" }, - { name = "goal" }, { name = "pfix" }, { name = "pytest" }, { name = "pytest-cov" }, @@ -1326,12 +1327,15 @@ graphviz = [ { name = "graphviz" }, ] +[package.dev-dependencies] +automation = [ + { name = "goal", marker = "python_full_version >= '3.12'" }, +] + [package.metadata] requires-dist = [ { name = "costs", specifier = ">=0.1.20" }, { name = "costs", marker = "extra == 'dev'", specifier = ">=0.1.20" }, - { name = "goal", specifier = ">=2.1.0" }, - { name = "goal", marker = "extra == 'dev'", specifier = ">=2.1.0" }, { name = "graphviz", marker = "extra == 'graphviz'", specifier = ">=0.20" }, { name = "pfix", specifier = ">=0.1.60" }, { name = "pfix", marker = "extra == 'dev'", specifier = ">=0.1.60" }, @@ -1340,6 +1344,9 @@ requires-dist = [ ] provides-extras = ["graphviz", "dev"] +[package.metadata.requires-dev] +automation = [{ name = "goal", marker = "python_full_version >= '3.12'", specifier = ">=2.2.0" }] + [[package]] name = "mdurl" version = "0.1.2" @@ -1729,7 +1736,7 @@ name = "pexpect" version = "4.9.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "ptyprocess", marker = "sys_platform != 'win32'" }, + { name = "ptyprocess" }, ] sdist = { url = "https://files.pythonhosted.org/packages/42/92/cc564bf6381ff43ce1f4d06852fc19a2f11d180f23dc32d9588bee2f149d/pexpect-4.9.0.tar.gz", hash = "sha256:ee7d41123f3c9911050ea2c2dac107568dc43b2d3b0c7557a33212c398ead30f", size = 166450, upload-time = "2023-11-25T09:07:26.339Z" } wheels = [ @@ -1738,7 +1745,7 @@ wheels = [ [[package]] name = "pfix" -version = "0.1.72" +version = "0.1.79" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "litellm" }, @@ -1747,9 +1754,9 @@ dependencies = [ { name = "python-dotenv" }, { name = "rich" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/af/e7/5f5ed8d95da0205422dea693f5b68077665540c3fcddab448f17f58c8304/pfix-0.1.72.tar.gz", hash = "sha256:c2dbcb29ef4f037bf5d31d33a872476dee669e092a68de9e8dd324952c0e9574", size = 2538020, upload-time = "2026-03-29T19:26:46.122Z" } +sdist = { url = "https://files.pythonhosted.org/packages/ae/7e/252be5e1d55321b947013010f45b02d781de87e25b9a524c0ee72c1ad3c0/pfix-0.1.79.tar.gz", hash = "sha256:6bc4c572e22e0f0d952bc5e2df78f52f8f999cab64e22138b097b2eab4d83092", size = 2845663, upload-time = "2026-07-05T17:00:57.331Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/f0/b0/4c68ab0b9e784eb9685805f46523af0875c9cb0c88072c047e5c38ed600a/pfix-0.1.72-py3-none-any.whl", hash = "sha256:608c33964aed46d0a7c02417463513e5ab2fea0f4ee6309ab6769d7f837e1d6e", size = 152417, upload-time = "2026-03-29T19:26:41.235Z" }, + { url = "https://files.pythonhosted.org/packages/39/bf/548982294e795d79003680b2214c7f5dd00ca4b0ea856064bf9cb6869ba7/pfix-0.1.79-py3-none-any.whl", hash = "sha256:bb7ab83b99c0bfbaae5e6e95cb801a27d4fd68749485600fdfe49dad00607461", size = 151754, upload-time = "2026-07-05T17:00:52.816Z" }, ] [[package]]