mirror of
https://github.com/trustedsec/hate_crack.git
synced 2026-07-28 22:51:14 -07:00
Justin BollingerandClaude
665c8ab47c
The repo had no CI: ruff/ty/pytest ran only in local prek pre-push hooks, so a commit pushed without hooks installed reached main unvalidated -- and auto-tag would then cut a release from it. Adds ci.yml (ruff, ty, pytest on 3.13) and gates tagging on it. Auto-tagged versions also never produced a release. The tag is pushed with the default GITHUB_TOKEN, and GitHub suppresses workflow triggers for GITHUB_TOKEN-created events, so the tag-triggered release.yml never fired -- v2.11.3 was tagged with no release. auto-tag now creates the release itself, idempotently; release.yml stays as the manual-tag path. Also fixes version logic that matched the `!` breaking marker but only ever bumped minor (and never saw BREAKING CHANGE: footers, since only subjects were inspected), serializes concurrent merges that both computed the same tag, and repins softprops/action-gh-release from an arbitrary master commit to v2.6.2 with all workflows on one actions/checkout version. Clears the pre-existing ty error in notify/tailer.py that would have made the new type-check step red: _read_new_lines read self._file_pos (int | None) while its only None-guard lived in the caller, so the position is passed in explicitly as an int. Behavior unchanged. Co-Authored-By: Claude <noreply@anthropic.com>
30 lines
1.1 KiB
YAML
30 lines
1.1 KiB
YAML
version: 2
|
|
|
|
updates:
|
|
# Python dependencies (PEP 621 pyproject.toml + uv.lock).
|
|
# The native "uv" ecosystem is used instead of "pip" because it reads
|
|
# pyproject.toml and uv.lock directly (GA since 2025-03; security updates
|
|
# since 2025-12).
|
|
- package-ecosystem: "uv"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
# "chore" deliberately does NOT match the feat|fix|perf patterns in
|
|
# .github/workflows/auto-tag.yml, so dependency PRs never auto-cut a tag.
|
|
commit-message:
|
|
prefix: "chore(deps)"
|
|
prefix-development: "chore(deps-dev)"
|
|
|
|
# GitHub Actions are SHA-pinned in .github/workflows; Dependabot keeps the
|
|
# pins current (and refreshes the trailing "# vN" comment).
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
# "chore(ci)" deliberately does NOT match the feat|fix|perf patterns in
|
|
# .github/workflows/auto-tag.yml, so dependency PRs never auto-cut a tag.
|
|
commit-message:
|
|
prefix: "chore(ci)"
|