Skip to content

v0.1.1 — the guards, in the version you install

Choose a tag to compare

View all tags
@ferinazumaDEV ferinazumaDEV released this 06 Sep 22:35
· 16 commits to main since this release
v0.1.1
b073d56
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode. 
pip install --upgrade scaffld

Upgrade so that what you install carries the guards. 0.1.0 predates the repository-hygiene incident and its fix: the published package was never affected — the tag came before the mistake, and its artefacts are 31 KB and 32 KB — but it ships with no CI and no protection against a repeat.

Added

  • A guard against committing a virtualenv. A .v/ directory reached main on 6 Sep: 1,380 files and 467,125 lines, 95% of everything the repository tracked. .gitignore listed .venv/, venv/ and env/ — not that spelling.

    .gitignore could not have stopped it and cannot stop the next one: it does nothing for a path already tracked, and nothing against git add -f. So the guard asks git what it is actually tracking and fails on the markers of an environment — pyvenv.cfg, site-packages/, dist-packages/, and bin|lib|Scripts under a venv-shaped directory — whatever it was named.

    Verified against the failure it exists for before being trusted: it passes on the clean tree and finds 1,379 paths in the broken one. It is now a required check.

  • CI across Python 3.9–3.12, plus a job that generates a project from each of the three templates, installs it, runs its tests and builds a wheel. A scaffolder whose output does not build is broken however green its own unit tests are.

  • SECURITY.md — with the point specific to a scaffolder: templates are data, not code (there are no post-generation hooks), but a template still writes files that other tools execute later. A hostile template does not need a hook when it can ship a conftest.py.

  • A changelog.

Changed

  • actions/checkout and actions/setup-python on v7; no deprecated-runtime warnings.

History deliberately not rewritten

It would change every hash after that commit and break clones and links, to fix something that lives in the working tree rather than the object store. main is clean going forward, and this note is here so the decision is visible rather than mysterious.

Provenance

Built from a clean clone of this tag — not a working tree — with python -m build; twine check passed on both artefacts, and both were scanned for vendored environments and repository metadata before upload (126 files, none).

de66a90eb59421cfb970d3e2788b395d48b6f49cccbf00569e1ae528d4a66afd  scaffld-0.1.1-py3-none-any.whl
7ebb77575d98b3db1dff4dd98697dac34aadf319307ed74188c2e28745ad4320  scaffld-0.1.1.tar.gz

Verified against the published package: installed scaffld==0.1.1 from PyPI into a clean venv, scaffld --version reports 0.1.1, and it generated a working python-lib project.

69 tests passing.

Assets 4
Loading