build(deps): bump setuptools from 82.0.1 to 83.0.0 #190
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Setup Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install uv | |
| run: python -m pip install --upgrade uv | |
| - name: Install dependencies (with dev extras) | |
| run: uv sync --extra dev --frozen | |
| - name: Ruff check | |
| run: uv run ruff check src tests scripts td_component | |
| - name: Ruff format check | |
| # v1.4.4: flipped from continue-on-error to enforcing after the | |
| # mechanical `ruff format` pass landed (commit e9ca15e). If this | |
| # step fails, run `uv run ruff format .` locally, commit, and | |
| # add the commit hash to .git-blame-ignore-revs if it's purely | |
| # mechanical. | |
| run: uv run ruff format --check src tests scripts td_component | |
| - name: Version drift check | |
| run: uv run python scripts/check_versions.py | |
| - name: .tox freshness check | |
| run: uv run python scripts/check_tox_freshness.py | |
| - name: API .tox freshness check | |
| run: uv run python scripts/check_tox_api_freshness.py | |
| # Static script invocation — no GitHub event data consumed, so no | |
| # injection risk from user-controlled inputs. The script greps tracked | |
| # files for /Users/<name>/ and C:\Users\<name>\ patterns. | |
| - name: Personal path leak check | |
| run: bash scripts/check_no_personal_paths.sh | |
| # Tag-freshness gate (post-v2.5.4 audit). scripts/check_versions.py | |
| # enforces *intra-tree* parity but has no concept of *temporal* | |
| # drift — PR-#53 + PR-#54 demonstrated this by letting main carry | |
| # code past v2.5.3 with version files still at v2.5.3, yielding | |
| # two functionally different "v2.5.3" artifacts (npm/release vs | |
| # git HEAD). This step closes that loop on main pushes. | |
| # | |
| # Untrusted commit-message input is captured via the env: block | |
| # before reference in run: — per | |
| # https://github.blog/security/vulnerability-research/how-to-catch-github-actions-workflow-injections-before-attackers-do/ | |
| - name: Tag-freshness gate (main only) | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| env: | |
| COMMIT_MSG: ${{ github.event.head_commit.message }} | |
| run: | | |
| if printf '%s' "$COMMIT_MSG" | grep -q '\[skip-version-check\]'; then | |
| echo "Skipped via [skip-version-check] commit footer." | |
| exit 0 | |
| fi | |
| git fetch --tags --depth=1 origin 2>/dev/null || true | |
| LATEST_TAG=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -1) | |
| if [ -z "$LATEST_TAG" ]; then | |
| echo "No stable semver tag found — bootstrap mode, skipping freshness gate." | |
| exit 0 | |
| fi | |
| PKG_VER=$(uv run python -c "import re,pathlib; m=re.search(r'__version__\s*=\s*\"([^\"]+)\"', pathlib.Path('src/td_mcp/__init__.py').read_text()); print(m.group(1) if m else 'parse-failed')") | |
| TAG_VER=${LATEST_TAG#v} | |
| echo "latest tag: $LATEST_TAG · src/td_mcp/__init__.py: $PKG_VER" | |
| if [ "$TAG_VER" != "$PKG_VER" ]; then | |
| echo "Version bumped past latest tag ($TAG_VER → $PKG_VER). Gate satisfied." | |
| exit 0 | |
| fi | |
| CODE_DIFF=$(git diff --name-only "$LATEST_TAG..HEAD" -- \ | |
| ':!*.md' \ | |
| ':!docs/' \ | |
| ':!.github/' \ | |
| ':!CHANGELOG.md' \ | |
| ':!skills/' \ | |
| ':!tests/' \ | |
| | head -5) | |
| if [ -n "$CODE_DIFF" ]; then | |
| echo "::error::Code changed since $LATEST_TAG but version still $PKG_VER." | |
| echo "::error::Bump __version__ + the 6 sibling manifests + API_VERSION," | |
| echo "::error::OR add [skip-version-check] to the commit message." | |
| echo "First offending file(s):" | |
| echo "$CODE_DIFF" | |
| exit 1 | |
| fi | |
| echo "Version $PKG_VER matches latest tag $LATEST_TAG; only safe-path changes — gate passed." | |
| test: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| # post-v2.1.5 (Codex review on PR #30): pyproject.toml declares | |
| # `requires-python = ">=3.10"` but pre-fix the matrix only ran | |
| # 3.11 + 3.12, leaving the 3.10 claim untested. Reviewer ran the | |
| # full suite under 3.10 locally (1688/1688 pass); adding it to | |
| # the matrix pins that claim against accidental future regressions. | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12"] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Setup Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install uv | |
| run: python -m pip install --upgrade uv | |
| - name: Install dependencies | |
| run: uv sync --extra dev --frozen | |
| - name: Run tests with coverage | |
| run: uv run pytest tests/ -q --cov=src/td_mcp --cov-report=term --cov-report=xml | |
| - name: Upload coverage report | |
| if: matrix.python-version == '3.12' | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: coverage-xml | |
| path: coverage.xml | |
| - name: Run registry smoke check | |
| run: uv run python scripts/smoke_mcp_registry.py | |
| - name: Run doctor (offline mode) | |
| run: uv run tdpilot-dpsk4 doctor --json --skip-td-check | |
| - name: Validate release-gate checker | |
| run: | | |
| cat > /tmp/bench.json <<'JSON' | |
| { | |
| "benchmarks": { | |
| "td_get_nodes": {"latency_ms": {"p95": 250.0}, "error_rate_pct": 0.0}, | |
| "td_get_params": {"latency_ms": {"p95": 200.0}, "error_rate_pct": 0.0}, | |
| "td_set_params": {"latency_ms": {"p95": 150.0}, "error_rate_pct": 0.0}, | |
| "td_capture_and_analyze_capture_only": {"latency_ms": {"p95": 600.0}, "error_rate_pct": 0.0} | |
| } | |
| } | |
| JSON | |
| uv run python scripts/check_release_gates.py --bench-report /tmp/bench.json --require-complete | |
| - name: Validate bundle integrity | |
| run: | | |
| uv run python -c " | |
| import json, sys | |
| from td_mcp import __version__, TOX_FILENAME | |
| manifest = json.load(open('mcp/manifest.json')) | |
| errors = [] | |
| if manifest['version'] != __version__: | |
| errors.append(f'manifest version {manifest[\"version\"]} != {__version__}') | |
| expected_tox = f'td_component/{TOX_FILENAME}' | |
| if manifest['artifacts']['td_component_tox'] != expected_tox: | |
| errors.append(f'manifest tox {manifest[\"artifacts\"][\"td_component_tox\"]} != {expected_tox}') | |
| if errors: | |
| print('\n'.join(errors)); sys.exit(1) | |
| print('Bundle integrity OK') | |
| " | |
| - name: Ensure no legacy repo/path drift | |
| run: | | |
| if rg -n "TDPilot-v1\.0|TDPilot-claude-refactor|mcp_server_codex" README.md pyproject.toml src npm install.sh install.ps1 mcp scripts td_component setup_mcp_in_td.py plugin_README.md; then | |
| echo "Legacy references found." | |
| exit 1 | |
| fi | |
| - name: Package build smoke (wheel + npm pack + plugin zip) | |
| run: bash scripts/check_package_builds.sh --cleanup | |
| install-parse: | |
| name: Install script parse-check (${{ matrix.os }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [macos-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Bash install script syntax-check (macOS) | |
| if: runner.os == 'macOS' | |
| run: bash -n install.sh | |
| - name: PowerShell install script parse-check (Windows) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| $script = Get-Content install.ps1 -Raw | |
| $null = [ScriptBlock]::Create($script) | |
| Write-Host "install.ps1 parses cleanly" |