diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index a0bdbf7f..d401b1a3 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "pitloom", - "version": "0.20.0", + "version": "0.20.1", "description": "Generate, enrich, and validate SPDX 3 SBOMs/AIBOMs for Python projects and AI models using Pitloom.", "author": { "name": "Arthit Suriyawongkul", diff --git a/CHANGELOG.md b/CHANGELOG.md index 87fadd54..8f1b454e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,9 +18,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). - Full release notes: -- Commit history: +- Commit history: -## [Unreleased] +## [0.20.1] - 2026-10-07 ### Changed @@ -39,6 +39,10 @@ and this project adheres to line, embed `WHEEL=` record on stderr; `embed-wheel -o -` no longer writes a file named `-` ([#288]) +[#287]: https://github.com/bact/pitloom/pull/287 +[#288]: https://github.com/bact/pitloom/pull/288 +[#289]: https://github.com/bact/pitloom/pull/289 + ## [0.20.0] - 2026-10-05 ### Added @@ -355,9 +359,6 @@ and this project adheres to [#283]: https://github.com/bact/pitloom/pull/283 [#284]: https://github.com/bact/pitloom/pull/284 [#286]: https://github.com/bact/pitloom/pull/286 -[#287]: https://github.com/bact/pitloom/pull/287 -[#288]: https://github.com/bact/pitloom/pull/288 -[#289]: https://github.com/bact/pitloom/pull/289 ## [0.19.0] - 2026-09-18 @@ -376,5 +377,6 @@ and this project adheres to --- +[0.20.1]: https://github.com/bact/pitloom/compare/v0.20.0...v0.20.1 [0.20.0]: https://github.com/bact/pitloom/compare/v0.19.0...v0.20.0 [0.19.0]: https://github.com/bact/pitloom/compare/v0.18.1...v0.19.0 diff --git a/CITATION.cff b/CITATION.cff index 2a00a01c..46a0226e 100644 --- a/CITATION.cff +++ b/CITATION.cff @@ -9,7 +9,7 @@ abstract: Generate SPDX 3 SBOMs for Python projects and AI models, with native H repository-code: "https://github.com/bact/pitloom" type: software doi: 10.5281/zenodo.19246283 -version: 0.20.0 +version: 0.20.1 license-url: "https://spdx.org/licenses/Apache-2.0" keywords: - sbom @@ -27,4 +27,4 @@ keywords: - safetensors - ai sbom - software supply chain security -date-released: 2026-10-05 +date-released: 2026-10-07 diff --git a/README.md b/README.md index 3cdf11c5..3b0e0c65 100644 --- a/README.md +++ b/README.md @@ -114,7 +114,7 @@ wheel built ([PEP 770], compact canonical JSON). Needs Hatchling **1.29.0+**: ```toml [build-system] -requires = ["hatchling>=1.29.0", "pitloom>=0.20.0"] +requires = ["hatchling>=1.29.0", "pitloom>=0.20.1"] build-backend = "hatchling.build" [tool.hatch.build.hooks.pitloom] @@ -183,7 +183,7 @@ SBOM generation in CI, for any Python build backend: - uses: actions/setup-python@v7 with: python-version: "3.x" -- uses: bact/pitloom@v0.20.0 +- uses: bact/pitloom@v0.20.1 ``` Add `embed-wheel: "dist/*.whl"` to embed the SBOM into built wheels. See @@ -280,7 +280,7 @@ gh attestation verify -R bact/pitloom \ If you use this software, please cite it as follows: -> Suriyawongkul, A. (2026). Pitloom - SBOM generator for AI models and Python projects (Version 0.20.0) [Computer software]. +> Suriyawongkul, A. (2026). Pitloom - SBOM generator for AI models and Python projects (Version 0.20.1) [Computer software]. BibTeX: @@ -288,10 +288,10 @@ BibTeX: @software{Suriyawongkul_Pitloom_SBOM_2026, author = {Suriyawongkul, Arthit}, doi = {10.5281/zenodo.19246283}, - month = aug, + month = oct, title = {{Pitloom - SBOM generator for AI models and Python projects}}, url = {https://github.com/bact/pitloom}, - version = {0.20.0}, + version = {0.20.1}, year = {2026} } ``` diff --git a/action.yml b/action.yml index 5d62658c..7a6838b6 100644 --- a/action.yml +++ b/action.yml @@ -195,7 +195,7 @@ inputs: default: "" pitloom-version: description: >- - Pitloom version or version specifier to install, e.g. "0.20.0" or + Pitloom version or version specifier to install, e.g. "0.20.1" or ">=0.20,<1.0". Empty (default) installs the version of the ref this action is pinned to; fails if that version is not on PyPI. required: false diff --git a/codemeta.json b/codemeta.json index 945db1bd..bdd8c50a 100644 --- a/codemeta.json +++ b/codemeta.json @@ -18,8 +18,8 @@ "codeRepository": "https://github.com/bact/pitloom", "copyrightYear": 2026, "dateCreated": "2026-03-27", - "dateModified": "2026-10-05", - "datePublished": "2026-10-05", + "dateModified": "2026-10-07", + "datePublished": "2026-10-07", "description": "Generate SPDX 3 SBOMs for Python projects and AI models, with native Hatchling build-hook support and GitHub Action integration.", "developmentStatus": "active", "downloadUrl": "https://github.com/bact/pitloom/releases", @@ -60,5 +60,5 @@ "programmingLanguage": "Python 3", "readme": "https://github.com/bact/pitloom/blob/main/README.md", "url": "https://github.com/bact/pitloom", - "version": "0.20.0" + "version": "0.20.1" } diff --git a/docs/agent-skills.md b/docs/agent-skills.md index dd900dc7..3659fa6c 100644 --- a/docs/agent-skills.md +++ b/docs/agent-skills.md @@ -45,7 +45,7 @@ Pitloom ships three Skills: The three Skills refer to each other, so install all three together. -**Requirements.** A shell, Python 3.10 or later and `pitloom` 0.20.0 or +**Requirements.** A shell, Python 3.10 or later and `pitloom` 0.20.1 or later (pip, `uvx` or `pipx`; earlier releases lack `--id-registry`, `loom id` and `--build-timeout`, which the Skills use); network access to install it and, for PyPI and Hugging Face lookups, at run time. AI model diff --git a/docs/github-action.md b/docs/github-action.md index 06774695..0b7504d6 100644 --- a/docs/github-action.md +++ b/docs/github-action.md @@ -23,7 +23,7 @@ Standalone SBOM artifact: - uses: actions/setup-python@v7 with: python-version: "3.x" -- uses: bact/pitloom@v0.20.0 +- uses: bact/pitloom@v0.20.1 ``` Set up Python first: the action uses the Python on `PATH`. See @@ -32,7 +32,7 @@ Set up Python first: the action uses the Python on `PATH`. See Generate and embed PEP 770 SBOM into built wheels: ```yaml -- uses: bact/pitloom@v0.20.0 +- uses: bact/pitloom@v0.20.1 with: embed-wheel: "dist/*.whl" ``` @@ -50,21 +50,21 @@ jobs: - uses: actions/setup-python@v7 with: python-version: "3.x" - - uses: bact/pitloom@v0.20.0 + - uses: bact/pitloom@v0.20.1 ``` -Pin a release tag (`@v0.20.0`) or a full commit SHA (`@ # v0.20.0`), +Pin a release tag (`@v0.20.1`) or a full commit SHA (`@ # v0.20.1`), not a branch. The pin also selects the Pitloom version: see [What the pin covers](#what-the-pin-covers). ## What the pin covers - **Pitloom version:** with `pitloom-version` empty, the action installs the - version carried by the pinned ref (tag or SHA) from PyPI. `@v0.20.0` and that - tag's commit SHA both give 0.20.0. It fails if the version is not on PyPI: an + version carried by the pinned ref (tag or SHA) from PyPI. `@v0.20.1` and that + tag's commit SHA both give 0.20.1. It fails if the version is not on PyPI: an unreleased commit, a branch between a version bump and its release, or a tag pushed before the upload finishes. -- **`pitloom-version`** overrides it: a version (`0.20.0`) or a specifier +- **`pitloom-version`** overrides it: a version (`0.20.1`) or a specifier (`>=0.20,<1.0`). - Pitloom's own dependencies are resolved by pip at run time, not pinned. @@ -90,7 +90,7 @@ logic `loom project` uses directly). Point it at an AI model instead of a project directory with `model:`: ```yaml -- uses: bact/pitloom@v0.20.0 +- uses: bact/pitloom@v0.20.1 with: model: path/to/model.safetensors ``` @@ -109,7 +109,7 @@ Pass extra raw CLI flags through with `args:` (shell-quoted, e.g. for [creator/creation metadata](creation-metadata.md)): ```yaml -- uses: bact/pitloom@v0.20.0 +- uses: bact/pitloom@v0.20.1 with: args: '--creator-name "CI Bot" --creator-type software-agent' ``` @@ -166,7 +166,7 @@ Inputs (all optional): | `no-build-isolation` | `false` | With `allow-build: "true"`, skip creating an isolated build environment and use the runner's already-installed build backend instead. No effect without `allow-build`; explicitly set in model mode, it also logs `::warning::no-build-isolation has no effect in model mode (no project-directory file discovery there)`. | | `build-timeout` | *(empty)* | Seconds or `h`/`m`/`s` duration, e.g. `900` or `1h30m`, capping how long an `allow-build` build may run before Pitloom kills it and falls back to static discovery. Passed verbatim to `loom --build-timeout`, which validates it -- no shell-side parsing. Empty uses Pitloom's own default of 20 minutes. No effect without `allow-build`; explicitly set in model mode, it also logs `::warning::build-timeout has no effect in model mode (no project-directory file discovery there)`. See [`--build-timeout`](allow-build.md#timing-out-a-build). | | `args` | *(empty)* | Extra raw flags passed through to the `loom` command, e.g. `--verify --validate` when `embed-wheel` is set. | -| `pitloom-version` | *(empty)* | Pitloom version or specifier, e.g. `0.20.0` or `>=0.20,<1.0`. Empty installs the version of the pinned ref; see [What the pin covers](#what-the-pin-covers). | +| `pitloom-version` | *(empty)* | Pitloom version or specifier, e.g. `0.20.1` or `>=0.20,<1.0`. Empty installs the version of the pinned ref; see [What the pin covers](#what-the-pin-covers). | | `python-version` | *(empty)* | Passed to `actions/setup-python`. Empty uses the Python on `PATH`, falling back to `3.x` with a warning; see [Python selection](#python-selection). | | `install` | `true` | Set `false` to skip installing Python/Pitloom and assume `loom` is already on `PATH`. | | `upload-artifact` | `true` | Upload the generated SBOM via `actions/upload-artifact`. | @@ -199,7 +199,7 @@ jobs: # 2. Generate and embed PEP 770 SBOM into built wheels - name: Embed PEP 770 SBOM - uses: bact/pitloom@v0.20.0 + uses: bact/pitloom@v0.20.1 with: embed-wheel: "dist/*.whl" diff --git a/docs/hatchling-build-hook.md b/docs/hatchling-build-hook.md index a35462d3..79568f12 100644 --- a/docs/hatchling-build-hook.md +++ b/docs/hatchling-build-hook.md @@ -24,7 +24,7 @@ only), as compact canonical JSON. ```toml [build-system] -requires = ["hatchling>=1.29.0", "pitloom>=0.20.0"] +requires = ["hatchling>=1.29.0", "pitloom>=0.20.1"] build-backend = "hatchling.build" [tool.hatch.build.hooks.pitloom] diff --git a/docs/id-registry.md b/docs/id-registry.md index 023b8686..528d2c6b 100644 --- a/docs/id-registry.md +++ b/docs/id-registry.md @@ -199,7 +199,7 @@ jobs: with: python-version: "3.x" # Same release as the action below, which installs its own pinned version. - - run: pip install pitloom==0.20.0 + - run: pip install pitloom==0.20.1 # Extras-free, stem-keyed -- the only path that keeps ai_AIPackage # spdxIds stable regardless of whether "ai" extras are installed @@ -210,7 +210,7 @@ jobs: - name: Seed/refresh AI model registry entries run: loom id generate --id-registry loom-id-registry.json - - uses: bact/pitloom@v0.20.0 + - uses: bact/pitloom@v0.20.1 with: project-path: . # Required: nothing auto-discovers a registry -- declare it. diff --git a/docs/index.md b/docs/index.md index 5007077d..b1331c88 100644 --- a/docs/index.md +++ b/docs/index.md @@ -99,7 +99,7 @@ please read our [Security policy][security]. If you use Pitloom in your academic work, please cite it as follows: -> Suriyawongkul, A. (2026). Pitloom - SBOM generator for AI models and Python projects (Version 0.20.0) [Computer software]. +> Suriyawongkul, A. (2026). Pitloom - SBOM generator for AI models and Python projects (Version 0.20.1) [Computer software]. BibTeX: @@ -107,10 +107,10 @@ BibTeX: @software{Suriyawongkul_Pitloom_SBOM_2026, author = {Suriyawongkul, Arthit}, doi = {10.5281/zenodo.19246283}, - month = aug, + month = oct, title = {{Pitloom - SBOM generator for AI models and Python projects}}, url = {https://github.com/bact/pitloom}, - version = {0.20.0}, + version = {0.20.1}, year = {2026} } ``` diff --git a/scripts/action/pitloom-install.sh b/scripts/action/pitloom-install.sh index 90e3e877..0a4aeee6 100755 --- a/scripts/action/pitloom-install.sh +++ b/scripts/action/pitloom-install.sh @@ -6,7 +6,7 @@ # Installs Pitloom for action.yml's "Install Pitloom" step. # # Env: PL_EXTRAS comma-separated pip extras (may be empty) -# PL_VERSION pitloom-version input: a bare version ("0.20.0"), a +# PL_VERSION pitloom-version input: a bare version ("0.20.1"), a # specifier (">=0.20,<1.0"), or empty to install the version # carried by this pinned action checkout. # diff --git a/skills/sbom-enrich/SKILL.md b/skills/sbom-enrich/SKILL.md index 173938f5..2fe7a6b8 100644 --- a/skills/sbom-enrich/SKILL.md +++ b/skills/sbom-enrich/SKILL.md @@ -23,7 +23,7 @@ description: >- 2026 minimum elements"), sbom-generate triggers and hands off here. license: Apache-2.0 compatibility: >- - Requires a shell, Python 3.10+ and pitloom >= 0.20.0 (pip, uvx or pipx); + Requires a shell, Python 3.10+ and pitloom >= 0.20.1 (pip, uvx or pipx); a local AI model file needs pitloom[ai] and the post-merge check needs pitloom[validate]. Needs an existing Pitloom SBOM (sbom-generate) and file write access to the project. Needs network access to install pitloom; @@ -71,11 +71,11 @@ See `references/examples.md` for a full worked example. ## Requirements -Python >= 3.10 and **pitloom >= 0.20.0** (earlier releases lack +Python >= 3.10 and **pitloom >= 0.20.1** (earlier releases lack `--id-registry`, `loom id` and `--build-timeout`), the `loom`/`pitloom` -entry point: `pip install "pitloom>=0.20.0"`; an AI model file needs -`pip install "pitloom[ai]>=0.20.0"`; the mandatory post-merge check needs -`pip install "pitloom[validate]>=0.20.0"`. Ephemeral runs and the pin +entry point: `pip install "pitloom>=0.20.1"`; an AI model file needs +`pip install "pitloom[ai]>=0.20.1"`; the mandatory post-merge check needs +`pip install "pitloom[validate]>=0.20.1"`. Ephemeral runs and the pin spelling: `sbom-generate`'s "Run without installing anything persistent". Snippets are POSIX shell. On Windows use `python` or `py` for `python3`, @@ -292,8 +292,8 @@ Steps: ``` With no persistent install, replace `python3` by `uvx --from - "pitloom>=0.20.0" python` (or, with pipx, `pipx run --spec - "pitloom>=0.20.0" python`; its "already on your PATH" notice is + "pitloom>=0.20.1" python` (or, with pipx, `pipx run --spec + "pitloom>=0.20.1" python`; its "already on your PATH" notice is harmless). With `pipx install`, use the venv's interpreter (`$(pipx environment --value PIPX_LOCAL_VENVS)/pitloom/bin/python`; `Scripts\python.exe` on Windows); on Windows otherwise use `py` or @@ -328,7 +328,7 @@ Steps: `` -- a syntactically valid fragment can still miss a required property or use the wrong relationship type, which only shape/SHACL validation catches. Minimal fallback: `pip install - "pitloom[validate]>=0.20.0"` then `loom fragment validate + "pitloom[validate]>=0.20.1"` then `loom fragment validate `. 11. Tell the user what was found deterministically (step 2), what was inferred from prose (step 6), and what the SBOM author supplied diff --git a/skills/sbom-enrich/references/examples.md b/skills/sbom-enrich/references/examples.md index 8f0cd1a9..1855205e 100644 --- a/skills/sbom-enrich/references/examples.md +++ b/skills/sbom-enrich/references/examples.md @@ -193,7 +193,7 @@ Read both fragments -- `model.enrich.spdx3.json` from step 1 and `fragments/agent-enrichment.spdx3.json` from step 2 -- with the SPDX 3 JSON-LD deserialiser `merge_fragments()` itself uses, as `../SKILL.md`'s step 7 describes: run its one-line snippet (with the interpreter Pitloom -is installed in; `uvx --from "pitloom>=0.20.0" python` for a `uvx` run) on +is installed in; `uvx --from "pitloom>=0.20.1" python` for a `uvx` run) on those two files. Exit 0 is a pass. Do not run `loom fragment validate` on a fragment: it names the base @@ -235,7 +235,7 @@ CreationInfo, the agent-inferred one via its `comment`). Use the `sbom-validate` skill on `sbom.spdx3.json` -- this catches SPDX-shape/SHACL problems (e.g. a missing required property or the wrong relationship type) that plain JSON-syntax validity would miss. Minimal fallback: -`pip install "pitloom[validate]>=0.20.0"` then +`pip install "pitloom[validate]>=0.20.1"` then `loom fragment validate sbom.spdx3.json`. ## 7. Report back to the user diff --git a/skills/sbom-enrich/references/minimum-elements.md b/skills/sbom-enrich/references/minimum-elements.md index 00f1dbf2..3ebf0b7c 100644 --- a/skills/sbom-enrich/references/minimum-elements.md +++ b/skills/sbom-enrich/references/minimum-elements.md @@ -196,5 +196,5 @@ run themselves -- it is not wired into this skill, and its absence shouldn't block anything here. The mandatory validation step remains the `sbom-validate` skill (; -minimal fallback: `pip install "pitloom[validate]>=0.20.0"` then +minimal fallback: `pip install "pitloom[validate]>=0.20.1"` then `loom fragment validate `). diff --git a/skills/sbom-generate/SKILL.md b/skills/sbom-generate/SKILL.md index 22f44354..eda3b8d2 100644 --- a/skills/sbom-generate/SKILL.md +++ b/skills/sbom-generate/SKILL.md @@ -25,7 +25,7 @@ description: >- one is sbom-enrich. license: Apache-2.0 compatibility: >- - Requires a shell, Python 3.10+ and pitloom >= 0.20.0 (pip, uvx or pipx). + Requires a shell, Python 3.10+ and pitloom >= 0.20.1 (pip, uvx or pipx). AI model targets need pitloom[ai] (or a format extra such as pitloom[gguf]); --allow-build needs pitloom[build]; --content-type needs pitloom[content-type]. Needs network access to install pitloom and for @@ -68,11 +68,11 @@ See `references/examples.md` for copy-paste recipes. ## Requirements -- Python >= 3.10 and **pitloom >= 0.20.0** (earlier releases lack +- Python >= 3.10 and **pitloom >= 0.20.1** (earlier releases lack `--id-registry`, `loom id` and `--build-timeout`), the `loom`/`pitloom` - entry point -- `pip install "pitloom>=0.20.0"`, or run ephemeral via + entry point -- `pip install "pitloom>=0.20.1"`, or run ephemeral via `uvx`/`pipx`. Extras take the floor after the extra: - `"pitloom[ai]>=0.20.0"`. + `"pitloom[ai]>=0.20.1"`. - AI model targets, and any project or wheel that ships model files, need the `ai` extra (`pitloom[ai]`) or a format-specific one (`pitloom[huggingface_hub]`, `pitloom[gguf]`, @@ -89,19 +89,19 @@ and PowerShell equivalents (PowerShell 5.1 has no `&&`: run the commands one per line): ```bash -uvx --from "pitloom>=0.20.0" loom generate -o sbom.spdx3.json +uvx --from "pitloom>=0.20.1" loom generate -o sbom.spdx3.json ``` or ```bash -pipx run --spec "pitloom>=0.20.0" loom generate -o sbom.spdx3.json +pipx run --spec "pitloom>=0.20.1" loom generate -o sbom.spdx3.json ``` Fall back to a normal install only if neither `uv` nor `pipx` is available: ```bash -pip install "pitloom>=0.20.0" +pip install "pitloom>=0.20.1" loom generate -o sbom.spdx3.json ``` diff --git a/skills/sbom-generate/references/examples.md b/skills/sbom-generate/references/examples.md index 81f2464e..90756963 100644 --- a/skills/sbom-generate/references/examples.md +++ b/skills/sbom-generate/references/examples.md @@ -16,9 +16,9 @@ adapted with minimal edits. Snippets are POSIX shell; on Windows use ## Project SBOM (directory or sdist), ephemeral run ```bash -uvx --from "pitloom>=0.20.0" loom project . -o sbom.spdx3.json --pretty +uvx --from "pitloom>=0.20.1" loom project . -o sbom.spdx3.json --pretty # or sdist archive -uvx --from "pitloom>=0.20.0" loom project dist/mypackage-1.0.0.tar.gz -o sbom.spdx3.json +uvx --from "pitloom>=0.20.1" loom project dist/mypackage-1.0.0.tar.gz -o sbom.spdx3.json ``` ## Project SBOM with lock file (resolved transitive dependencies) @@ -32,7 +32,7 @@ loom project . -o sbom.spdx3.json --pretty ## Project SBOM, already-installed Pitloom ```bash -pip install "pitloom>=0.20.0" +pip install "pitloom>=0.20.1" loom project /path/to/project -o sbom.spdx3.json ``` @@ -65,13 +65,13 @@ with zipfile.ZipFile(sys.argv[1]) as zf: ## AI model SBOM, local file ```bash -uvx --from 'pitloom[ai]>=0.20.0' loom model model.safetensors -o model.spdx3.json +uvx --from 'pitloom[ai]>=0.20.1' loom model model.safetensors -o model.spdx3.json ``` ## AI model SBOM, Hugging Face Hub model ```bash -uvx --from 'pitloom[huggingface_hub]>=0.20.0' loom model mistralai/Mistral-7B-v0.1 \ +uvx --from 'pitloom[huggingface_hub]>=0.20.1' loom model mistralai/Mistral-7B-v0.1 \ -o mistral.spdx3.json --pretty ``` @@ -118,7 +118,7 @@ print("@graph present:", len(d["@graph"]), "nodes (not validated)") - `../SKILL.md` -- operating instructions for this skill. - The sibling `sbom-validate` skill -- schema/SHACL conformance check - (minimal: `pip install "pitloom[validate]>=0.20.0"` then + (minimal: `pip install "pitloom[validate]>=0.20.1"` then `loom fragment validate sbom.spdx3.json`). - `docs/resources.md` -- SPDX 3 spec, ontology, and JSON Schema links. diff --git a/skills/sbom-validate/SKILL.md b/skills/sbom-validate/SKILL.md index aaaec210..8bd8eba5 100644 --- a/skills/sbom-validate/SKILL.md +++ b/skills/sbom-validate/SKILL.md @@ -23,7 +23,7 @@ description: >- NTIA/CISA/G7 completeness (sbom-enrich). license: Apache-2.0 compatibility: >- - Requires a shell, Python 3.10+ and pitloom >= 0.20.0 with the validate + Requires a shell, Python 3.10+ and pitloom >= 0.20.1 with the validate extra (pitloom[validate], which brings spdx3-validate) via pip, uvx or pipx, or spdx3-validate alone. Needs network access to install them. Not usable where packages cannot be installed, e.g. Claude API code execution. @@ -76,11 +76,11 @@ See `references/examples.md` for copy-paste recipes. ## Requirements -Python >= 3.10 and **pitloom >= 0.20.0** (earlier releases lack +Python >= 3.10 and **pitloom >= 0.20.1** (earlier releases lack `--id-registry`, `loom id` and `--build-timeout`, which the sibling skills use), the `loom`/`pitloom` entry point or standalone `spdx3-validate` CLI; `loom fragment validate` needs the `validate` extra (`pip install -"pitloom[validate]>=0.20.0"`). +"pitloom[validate]>=0.20.1"`). ## Run the validator @@ -89,11 +89,11 @@ and PowerShell equivalents (PowerShell 5.1 has no `&&`: run the commands one per line). ```bash -pip install "pitloom[validate]>=0.20.0" # if not already installed +pip install "pitloom[validate]>=0.20.1" # if not already installed loom fragment validate ``` -Without a persistent install: `uvx --from "pitloom[validate]>=0.20.0" +Without a persistent install: `uvx --from "pitloom[validate]>=0.20.1" loom fragment validate `. Despite the `fragment` grouping (shared with `loom merge`), the diff --git a/src/pitloom/__about__.py b/src/pitloom/__about__.py index 7b673e34..aa37b125 100644 --- a/src/pitloom/__about__.py +++ b/src/pitloom/__about__.py @@ -5,4 +5,4 @@ """Package information for Pitloom.""" -__version__ = "0.20.0" +__version__ = "0.20.1" diff --git a/tests/test_changelog.py b/tests/test_changelog.py index bc68dc0d..69b86f43 100644 --- a/tests/test_changelog.py +++ b/tests/test_changelog.py @@ -42,14 +42,37 @@ def _section_pr_keys(text: str) -> dict[str, list[int]]: def _unreleased_bullets(text: str) -> list[str]: - """Entries of ``[Unreleased]``, else (right after a release is cut) of - the newest released section.""" - sections = text.split("## [Unreleased]", 1)[1].split("\n## [") + """Entries of ``[Unreleased]``, else (right after a release is cut, with + the heading empty or removed) of the newest released section.""" + _, found_heading, after = text.partition("## [Unreleased]") + sections = (after if found_heading else text).split("\n## [") + if not found_heading: + sections = sections[1:] # what precedes the first version heading return next( (found for body in sections[:2] if (found := _BULLET.findall(body))), [] ) +_NEW = "### Fixed\n\n- new ([#3])\n" +_OLD = "### Fixed\n\n- old ([#1])\n" +_RELEASE_STATES = [ + f"# C\n\n## [Unreleased]\n\n{_NEW}\n## [1.0.0]\n\n{_OLD}", + f"# C\n\n## [Unreleased]\n\n## [1.0.0]\n\n{_NEW}", + f"# C\n\n## [1.0.0] - 2026-01-01\n\n{_NEW}\n## [0.9.0]\n\n{_OLD}", +] + + +@pytest.mark.parametrize( + "text", + _RELEASE_STATES, + ids=["unreleased-filled", "unreleased-empty", "unreleased-removed"], +) +def test_unreleased_bullets_in_every_release_state(text: str) -> None: + """Right after a release is cut the heading may be empty or gone; the + newest entry is still found, never the older release's.""" + assert [b.split(" (")[0] for b in _unreleased_bullets(text)] == ["- new"] + + def test_every_unreleased_entry_links_its_pr() -> None: bullets = _unreleased_bullets(_text()) assert bullets # not vacuous: the section was found and split diff --git a/working-docs/implementation/github-action.md b/working-docs/implementation/github-action.md index 4559610e..fd53cf21 100644 --- a/working-docs/implementation/github-action.md +++ b/working-docs/implementation/github-action.md @@ -29,7 +29,7 @@ Pass them through `args` (the Action itself has no dedicated multi-creator input): ```yaml -- uses: bact/pitloom@v0.20.0 +- uses: bact/pitloom@v0.20.1 with: project-path: "." output: "sbom.spdx3.json" @@ -57,7 +57,7 @@ jobs: - uses: actions/setup-python@v7 with: python-version: "3.x" - - uses: bact/pitloom@v0.20.0 + - uses: bact/pitloom@v0.20.1 id: pitloom with: project-path: "." @@ -87,7 +87,7 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - uses: actions/checkout@v7 - - uses: bact/pitloom@v0.20.0 + - uses: bact/pitloom@v0.20.1 with: project-path: "." python-version: ${{ matrix.python-version }} diff --git a/working-docs/implementation/hatchling-build-hook.md b/working-docs/implementation/hatchling-build-hook.md index 41e551d9..6dea049f 100644 --- a/working-docs/implementation/hatchling-build-hook.md +++ b/working-docs/implementation/hatchling-build-hook.md @@ -101,7 +101,7 @@ The user adds `pitloom` to their build dependencies and enables the hook: ```toml [build-system] -requires = ["hatchling>=1.29.0", "pitloom>=0.20.0"] +requires = ["hatchling>=1.29.0", "pitloom>=0.20.1"] build-backend = "hatchling.build" [tool.hatch.build.hooks.pitloom]