v0.6 (complete rewrite)

.github/workflows/ci.yaml

@@ -2,27 +2,101 @@ name: CI
 
 on:
   push:
-    branches: [ master, main ]
+    branches: [main]
   pull_request:
-    branches: [ master, main ]
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
+  tests:
+    runs-on: ubuntu-latest
+    # 3.15 is still beta and ``granian``'s PyO3 0.27 doesn't support it yet;
+    # the entry is kept as an early-signal channel until PyO3 catches up.
+    continue-on-error: ${{ matrix.experimental || false }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - python: "3.12"
+          - python: "3.13"
+          - python: "3.14"
+          - python: "3.15"
+            experimental: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv python install ${{ matrix.python }}
+      - run: uv sync --python ${{ matrix.python }} --all-groups --all-extras
+      - name: pytest (unit only)
+        timeout-minutes: 5
+        run: uv run --python ${{ matrix.python }} pytest -m "not integration" -v
+
+  tests-ft:
+    runs-on: ubuntu-latest
+    # 3.15t is still beta (uv ships ``cpython-3.15.0b1+freethreaded``).
+    continue-on-error: ${{ matrix.experimental || false }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - python: "3.14t"
+          - python: "3.15t"
+            experimental: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Install Python ${{ matrix.python }}
+        run: uv python install ${{ matrix.python }}
+      - name: Install dependencies (FT-clean subset)
+        # --no-default-groups + narrow opt-in: avoid C extensions that
+        # re-enable the GIL on free-threaded builds (httptools 0.7.x,
+        # grpcio, granian, setproctitle). Covers the pure-Python core
+        # that the FT marking actually claims. ``dev-http`` (httpx,
+        # flask), ``dev-sentry`` (sentry-sdk), and the ``click`` extra
+        # are pure Python — pulled in so tests/http and
+        # tests/hosting/services collect cleanly.
+        run: >
+          uv sync --python ${{ matrix.python }} --no-default-groups
+          --group tests --group tests-unit
+          --group dev-http --group dev-sentry
+          --extra http --extra scheduler --extra cron --extra click
+      - name: pytest
+        timeout-minutes: 5
+        env:
+          PYTHON_GIL: "0"  # fail loudly if any imported C ext re-enables the GIL
+        # Skip ``tests/openapi`` (msgspec C ext) and ``tests/hosting/rsgi.py``
+        # (exercises Granian hooks; granian C ext not in the FT subset).
+        run: >
+          uv run --python ${{ matrix.python }} pytest -v -m "not integration"
+          --ignore=tests/openapi
+          --ignore=tests/hosting/rsgi.py
+
   sonarcloud:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
-          # Disable shallow clone (required for SonarQube to work properly)
-          fetch-depth: 0
-      - uses: pdm-project/setup-pdm@v4
+          fetch-depth: 0  # Sonar needs full history
+      - uses: astral-sh/setup-uv@v5
         with:
+          enable-cache: true
           python-version-file: ".python-version"
-          cache: true
-      - name: pdm install
-        run: pdm install --frozen-lockfile --no-editable
-      - name: pytest
+      - run: uv sync --all-groups --all-extras
+      - name: pytest with coverage
         timeout-minutes: 5
-        run: pdm run pytest --cov-report=term --cov-report=xml --cov-branch --cov -v
+        run: >
+          uv run pytest -m "not integration" -v
+          --cov-report=term --cov-report=xml --cov
       - uses: SonarSource/sonarqube-scan-action@v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docs.yaml

@@ -0,0 +1,42 @@
+name: Docs
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: docs-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Sync docs deps
+        run: uv sync --group docs
+      - name: Build site
+        run: uv run zensical build --clean
+      - uses: actions/configure-pages@v5
+      - uses: actions/upload-pages-artifact@v4
+        with:
+          path: site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/pypi-publish.yaml

@@ -4,23 +4,31 @@ on:
   release:
     types: [ published ]
 
+permissions:
+  contents: read
+
 jobs:
-  # https://pdm-project.org/latest/usage/publish/#publish-with-trusted-publishers
   publish:
     runs-on: ubuntu-latest
     permissions:
-      # Required for PyPI trusted publishing
+      contents: read
+      # Required for PyPI trusted publishing + Sigstore-signed PEP 740 attestations
       id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@v4
         with:
-          # Just "fetch-tags: true" does not work, probably because of
-          #
           fetch-depth: 0
-      - uses: pdm-project/setup-pdm@v4
+      - uses: astral-sh/setup-uv@v5
         with:
+          enable-cache: true
           python-version-file: ".python-version"
-          cache: true
-      - run: pdm install --no-lock --no-editable
-      - run: pdm build
-      - run: pdm publish --no-build
+      - run: uv build
+      # uv publish (as of 0.11) only uploads pre-existing attestations; it does
+      # not generate them. Use the official PyPA action, which generates PEP 740
+      # PyPI Publish Attestations via Sigstore and uploads them alongside the
+      # distributions. Track astral-sh/uv#15618 — once landed we can swap back
+      # to a single `uv publish` step.
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true

.gitignore

@@ -1,6 +1,10 @@
+.venv-*
+
+# --- GitHub template, see https://github.com/github/gitignore/blob/main/Python.gitignore ---
+
 # Byte-compiled / optimized / DLL files
 __pycache__/
-*.py[cod]
+*.py[codz]
 *$py.class
 
 # C extensions
@@ -27,8 +31,8 @@ share/python-wheels/
 MANIFEST
 
 # PyInstaller
-#  Usually these files are written by a python script from a template
-#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
 *.manifest
 *.spec
 
@@ -46,7 +50,8 @@ htmlcov/
 nosetests.xml
 coverage.xml
 *.cover
-*.py,cover
+*.py.cover
+*.lcov
 .hypothesis/
 .pytest_cache/
 cover/
@@ -92,43 +97,65 @@ ipython_config.py
 #   However, in case of collaboration, if having platform-specific dependencies or dependencies
 #   having no cross-platform support, pipenv may install dependencies that don't work, or not
 #   install all needed dependencies.
-#Pipfile.lock
+# Pipfile.lock
 
 # UV
 #   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
 #   This is especially recommended for binary packages to ensure reproducibility, and is more
 #   commonly ignored for libraries.
-#uv.lock
+# uv.lock
 
 # poetry
 #   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
 #   This is especially recommended for binary packages to ensure reproducibility, and is more
 #   commonly ignored for libraries.
 #   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
-#poetry.lock
+# poetry.lock
+# poetry.toml
 
 # pdm
 #   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
-#pdm.lock
-#   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
-#   in version control.
-#   https://pdm.fming.dev/latest/usage/project/#working-with-version-control
-.pdm.toml
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
 .pdm-python
 .pdm-build/
 
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi/*
+!.pixi/config.toml
+
 # PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
 __pypackages__/
 
 # Celery stuff
-celerybeat-schedule
+celerybeat-schedule*
 celerybeat.pid
 
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
 # SageMath parsed files
 *.sage.py
 
 # Environments
 .env
+.envrc
 .venv
 env/
 venv/
@@ -161,11 +188,37 @@ dmypy.json
 cython_debug/
 
 # PyCharm
-#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
-#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
-#  and can be added to the global gitignore or merged into this file.  For a more nuclear
-#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
-#.idea/
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer,
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
 
 # PyPI configuration file
 .pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml