mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 19:27:16 +01:00
Krzysztof kuhy Rudnicki
2a2f18ca56
"Are we on the newest version?" was not mechanically answerable across these repos: constraint styles had drifted per-ecosystem and a caret range is "newest-compatible" by definition, which gives a checker nothing to compare. This gate makes it answerable and then enforces the answer. Checks two things at once -- that every dependency carries an exact pin, and that the pin equals its registry's latest STABLE release -- across pub.dev, PyPI, npm, crates.io, the Go proxy, kuhyx/utils git tags, and the Flutter / Node / Python toolchains. Three deliberate design points: * Pre-releases are rejected per-ecosystem, because every ecosystem leaks them differently and each leak fails GREEN. npm lets a maintainer point `dist-tags.latest` at an rc; crates.io's `max_version` includes them; PyPI's legacy `info.version` includes yanked releases. Unit-tested with fixtures, since an end-to-end run cannot surface a wrong "up to date". * Offline, the gate serves an expired cache entry and PASSES with a DEGRADED banner (exit 3 only under --strict, which is CI). `--no-verify` is banned here, so a hook that hard-failed offline would leave no way to commit at all. * The allowlist has two entry classes. `blocked_by: transitive:<pkg>@<ver>` is a predicate that clears itself when upstream moves and must NOT carry a date; everything else is discretionary and requires `expires`, capped at 90 days. Exact pins plus latest-everywhere is provably unsatisfiable when a dependency internally constrains a shared transitive, and expiring the predicate class on a calendar would turn the gate red for a reason no commit could fix. An entry with nothing left to excuse is itself an error. One hook id, one shim, one shared implementation -- always delegating, so it cannot fork the way the 250-line cap forked into four ids, two of which were independent reimplementations. 256 tests, 100% branch coverage on every module of the gate. Also adds the workflow that runs them, which incidentally gives md_naming's 71 tests their first CI run. Not yet installed in any repo: a repo that gets the gate before its deps are bumped is instantly and permanently red, so the gate and the upgrade land together, per repo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
40 lines
1.4 KiB
Python
40 lines
1.4 KiB
Python
"""Best-effort line numbers for keys the structured parsers give us untagged.
|
|
|
|
`yaml.safe_load` and `tomllib` both discard positions. Reporting a violation
|
|
without a line makes the fix a search, so the key is located textually after
|
|
the fact; a miss degrades to line 0 rather than failing.
|
|
|
|
Ties are broken by *indentation*, not by order: a pubspec that declares
|
|
`path: ^1.9.1` as a dependency also has a nested `path:` inside a git block six
|
|
spaces in, and first-match would point the fix at the wrong line.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
import re
|
|
|
|
_KEY = re.compile(r'^(?P<indent>\s*)-?\s*["\']?(?P<key>[A-Za-z0-9_.@/-]+)["\']?\s*[:=]')
|
|
|
|
|
|
def index(path: Path) -> dict[str, int]:
|
|
"""Map `key` -> the 1-based line where it appears least-indented."""
|
|
best: dict[str, tuple[int, int]] = {}
|
|
try:
|
|
text = path.read_text(encoding="utf-8", errors="replace")
|
|
except OSError:
|
|
return {}
|
|
for number, line in enumerate(text.splitlines(), start=1):
|
|
match = _KEY.match(line)
|
|
if not match:
|
|
continue
|
|
key = match.group("key")
|
|
depth = len(match.group("indent").expandtabs(4))
|
|
if key not in best or depth < best[key][0]:
|
|
best[key] = (depth, number)
|
|
return {key: number for key, (_, number) in best.items()}
|
|
|
|
|
|
def find(path: Path, name: str) -> int:
|
|
return index(path).get(name, 0)
|