Version bump, GitHub Actions workflow, and validation improvements

.github/workflows/sync.yaml

@@ -0,0 +1,95 @@
+name: Sync to Public Repo
+
+on:
+  workflow_call:
+    inputs:
+      private_repo:
+        required: true
+        type: string
+        description: Private repository URL
+      public_repo:
+        required: true
+        type: string
+        description: Public repository URL
+      keep:
+        required: false
+        type: string
+        default: src
+        description: Space-separated paths to keep
+      keep_from_file:
+        required: false
+        type: string
+        default: ""
+        description: File containing paths to keep
+      sync_branch:
+        required: false
+        type: string
+        default: upstream/sync
+        description: Sync branch name
+      main_branch:
+        required: false
+        type: string
+        default: main
+        description: Main branch name
+      private_branch:
+        required: false
+        type: string
+        default: main
+        description: Private branch to sync from
+      merge:
+        required: false
+        type: boolean
+        default: false
+        description: Merge into main after sync
+      force:
+        required: false
+        type: boolean
+        default: false
+        description: Force push
+      dry_run:
+        required: false
+        type: boolean
+        default: false
+        description: Dry run mode
+    secrets:
+      GH_TOKEN:
+        required: true
+        description: GitHub token with push access to public repo
+
+permissions:
+  contents: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install git-sync-filtered
+        run: pip install git-sync-filtered
+
+      - name: Sync filtered repo
+        run: |
+          ARGS=(
+            --private "${{ inputs.private_repo }}"
+            --public "${{ inputs.public_repo }}"
+            --sync-branch "${{ inputs.sync_branch }}"
+            --main-branch "${{ inputs.main_branch }}"
+            --private-branch "${{ inputs.private_branch }}"
+          )
+
+          if [ -n "${{ inputs.keep_from_file }}" ]; then
+            ARGS+=(--keep-from-file "${{ inputs.keep_from_file }}")
+          fi
+
+          if [ -n "${{ inputs.keep }}" ]; then
+            for path in ${{ inputs.keep }}; do
+              ARGS+=(--keep "$path")
+            done
+          fi
+
+          [ "${{ inputs.merge }}" = "true" ] && ARGS+=(--merge)
+          [ "${{ inputs.force }}" = "true" ] && ARGS+=(--force)
+          [ "${{ inputs.dry_run }}" = "true" ] && ARGS+=(--dry-run)
+
+          git-sync-filtered "${ARGS[@]}"
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}

README.md

@@ -1,8 +1,10 @@
 # git-sync-filtered
 
 ![GitHub Repo stars](https://img.shields.io/github/stars/Merge-42/git-sync-filtered?style=social)
-![Python versions](https://img.shields.io/pypi/pyversions/git-sync-filtered)
-![License](https://img.shields.io/pypi/l/git-sync-filtered)
+![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/Merge-42/git-sync-filtered/python_ci.yaml)
+![Supported Python versions](https://img.shields.io/pypi/pyversions/git-sync-filtered)
+![GitHub Release](https://img.shields.io/github/v/release/Merge-42/git-sync-filtered)
+![License](https://img.shields.io/github/license/Merge-42/git-sync-filtered)
 
 A thin wrapper around [git-filter-repo](https://github.com/newren/git-filter-repo) for syncing filtered commits from a private repository to a public repository.
 
@@ -34,6 +36,51 @@ uvx git-sync-filtered \
   --keep docs
 ```
 
+## GitHub Actions
+
+You can use this workflow to sync from your private repo to a public repo when the private repo receives a push.
+
+In your **private repository**, create `.github/workflows/sync.yaml`:
+
+```yaml
+name: Sync to Public Repo
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  sync:
+    uses: Merge-42/git-sync-filtered/.github/workflows/sync.yaml@v0.1.4
+    with:
+      private_repo: ${{ github.repositoryUrl }}
+      public_repo: git@github.com:org/public.git
+      keep: src docs
+      merge: true
+    secrets:
+      GH_TOKEN: ${{ secrets.GH_PAT }}
+```
+
+Required secrets:
+
+- `GH_PAT` - A GitHub Personal Access Token with `repo` scope (for pushing to the public repo)
+
+Available inputs:
+
+| Input            | Description                   | Default         |
+| ---------------- | ----------------------------- | --------------- |
+| `private_repo`   | Private repository URL        | Required        |
+| `public_repo`    | Public repository URL         | Required        |
+| `keep`           | Space-separated paths to keep | -               |
+| `keep_from_file` | File containing paths to keep | -               |
+| `sync_branch`    | Sync branch name              | `upstream/sync` |
+| `main_branch`    | Main branch name              | `main`          |
+| `private_branch` | Private branch to sync from   | `main`          |
+| `merge`          | Merge into main after sync    | `false`         |
+| `force`          | Force push                    | `false`         |
+| `dry_run`        | Dry run mode                  | `false`         |
+
 ## Usage
 
 ```bash

git_sync_filtered/cli.py

@@ -1,8 +1,52 @@
+from fnmatch import translate as glob_translate
+from pathlib import Path
+
 import click
+from pydantic import BaseModel, ConfigDict, FilePath, field_validator
 
 from git_sync_filtered.sync import sync
 
 
+class SyncConfig(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    private: str
+    public: str
+    keep: tuple[str, ...]
+    keep_from_file: FilePath | None = None
+    sync_branch: str = "upstream/sync"
+    main_branch: str = "main"
+    private_branch: str = "main"
+    dry_run: bool = False
+    merge: bool = False
+    force: bool = False
+
+    @field_validator("keep", mode="before")
+    @classmethod
+    def ensure_non_empty(cls, v: tuple[str, ...]) -> tuple[str, ...]:
+        if not v:
+            raise ValueError("At least one --keep path required")
+        return v
+
+    @field_validator("keep", mode="after")
+    @classmethod
+    def validate_glob_paths(cls, v: tuple[str, ...]) -> tuple[str, ...]:
+        for path in v:
+            if not path:
+                raise ValueError("Keep path cannot be empty")
+            glob_translate(path)
+        return v
+
+    @field_validator("sync_branch", "main_branch", "private_branch", mode="after")
+    @classmethod
+    def validate_branch_name(cls, v: str) -> str:
+        if not v:
+            raise ValueError("Branch name cannot be empty")
+        if v.startswith("/") or ".." in v:
+            raise ValueError(f"Invalid branch name: {v!r}")
+        return v
+
+
 @click.command()
 @click.option("--private", required=True, help="Private repo path or URL")
 @click.option("--public", required=True, help="Public repo path or URL")
@@ -21,32 +65,44 @@
 @click.option("--merge", is_flag=True, help="Merge into main branch after sync")
 @click.option("--force", is_flag=True, help="Force push")
 def main(
-    private,
-    public,
-    keep,
-    keep_from_file,
-    sync_branch,
-    main_branch,
-    private_branch,
-    dry_run,
-    merge,
-    force,
-):
+    private: str,
+    public: str,
+    keep: tuple[str, ...],
+    keep_from_file: str | None,
+    sync_branch: str,
+    main_branch: str,
+    private_branch: str,
+    dry_run: bool,
+    merge: bool,
+    force: bool,
+) -> None:
     """Sync filtered commits from private to public repository."""
 
     try:
-        result = sync(
+        config = SyncConfig(
             private=private,
             public=public,
             keep=keep,
-            keep_from_file=keep_from_file,
+            keep_from_file=Path(keep_from_file) if keep_from_file else None,
             sync_branch=sync_branch,
             main_branch=main_branch,
             private_branch=private_branch,
             dry_run=dry_run,
             merge=merge,
             force=force,
         )
+        result = sync(
+            private=config.private,
+            public=config.public,
+            keep=config.keep,
+            keep_from_file=config.keep_from_file,
+            sync_branch=config.sync_branch,
+            main_branch=config.main_branch,
+            private_branch=config.private_branch,
+            dry_run=config.dry_run,
+            merge=config.merge,
+            force=config.force,
+        )
     except ValueError as e:
         raise click.ClickException(str(e))
 

git_sync_filtered/sync.py

@@ -2,29 +2,35 @@
 from itertools import filterfalse
 from pathlib import Path
 from tempfile import TemporaryDirectory
-from typing import Optional
+from typing import Optional, TypedDict
 
 import git
 from git_filter_repo import FilteringOptions, RepoFilter
 
 
+class SyncResult(TypedDict):
+    paths_to_keep: list[str]
+    dry_run_commits: list[str]
+    merge_success: bool | None
+
+
 def read_paths_from_file(path: Path) -> list[str]:
     lines = (line.strip() for line in path.read_text().splitlines())
     return list(filterfalse(lambda line: line.startswith("#") or not line, lines))
 
 
 def collect_paths_to_keep(
-    keep: tuple[str, ...], keep_from_file: Optional[str]
+    keep: tuple[str, ...], keep_from_file: Optional[Path]
 ) -> list[str]:
-    paths_to_keep = set(keep)
+    paths_to_keep: set[str] = set(keep)
 
     if keep_from_file:
-        paths_to_keep.update(read_paths_from_file(Path(keep_from_file)))
+        paths_to_keep.update(read_paths_from_file(keep_from_file))
 
-    return sorted(list(paths_to_keep))
+    return sorted(paths_to_keep)
 
 
-def run_filter_repo(repo_path: str, paths_to_keep: list[str]) -> None:
+def run_filter_repo(repo_path: Path | str, paths_to_keep: list[str]) -> None:
     old_cwd = os.getcwd()
     os.chdir(repo_path)
 
@@ -89,14 +95,14 @@ def sync(
     private: str,
     public: str,
     keep: tuple[str, ...],
-    keep_from_file: Optional[str],
+    keep_from_file: Optional[Path],
     sync_branch: str,
     main_branch: str,
     private_branch: str,
     dry_run: bool,
     merge: bool,
     force: bool,
-):
+) -> SyncResult:
     paths_to_keep = collect_paths_to_keep(keep, keep_from_file)
 
     if not paths_to_keep:

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "git-sync-filtered"
-version = "0.1.3"
+version = "0.1.4"
 description = "Sync filtered commits from private to public repository"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -22,7 +22,12 @@ classifiers = [
   "Programming Language :: Python :: 3.14",
 ]
 
-dependencies = ["click>=8.0", "gitpython>=3.1", "git-filter-repo>=2.0"]
+dependencies = [
+  "click>=8.0",
+  "gitpython>=3.1",
+  "git-filter-repo>=2.0",
+  "pydantic>=2.12.5",
+]
 
 [project.optional-dependencies]
 dev = ["pytest", "ruff", "mypy"]
@@ -37,9 +42,7 @@ include = ["git_sync_filtered*"]
 [tool.ruff]
 line-length = 100
 target-version = "py310"
-
-[tool.mypy]
-python_version = "3.10"
+lint.select = ["E", "F", "ANN"]
 
 [dependency-groups]
 dev = ["pytest>=9.0.2"]

tests/integration/test_filter_repo.py

@@ -1,9 +1,10 @@
 import subprocess
+from pathlib import Path
 
 from git_sync_filtered.sync import run_filter_repo
 
 
-def test_run_filter_repo_filters_correctly(tmp_path):
+def test_run_filter_repo_filters_correctly(tmp_path: Path) -> None:
     repo_path = tmp_path / "repo"
     repo_path.mkdir()