You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by ak...@apache.org on 2026/05/20 21:18:17 UTC
(tooling-asfswhid) 03/03: Configure monorepo: path dependency, release workflow, .asf.yaml
This is an automated email from the ASF dual-hosted git repository.
andrewmusselman pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-asfswhid.git
commit d1224e2e1862e67db6a2b41b6a08059899984b49
Author: Andrew Musselman <an...@gmail.com>
AuthorDate: Wed May 20 14:13:57 2026 -0700
Configure monorepo: path dependency, release workflow, .asf.yaml
---
.asf.yaml | 29 ++++++++++++++++
.github/workflows/release.yml | 2 +-
Cargo.lock | 19 +++++------
Cargo.toml | 6 ++--
README.md | 77 +++++++++++++++++++++++++++++++++----------
5 files changed, 101 insertions(+), 32 deletions(-)
diff --git a/.asf.yaml b/.asf.yaml
new file mode 100644
index 0000000..9b50c83
--- /dev/null
+++ b/.asf.yaml
@@ -0,0 +1,29 @@
+github:
+ description: "Python bindings for the swhid-rs SWHID v1.2 reference implementation (ISO/IEC 18670:2025)"
+ homepage: https://tooling.apache.org/
+ del_branch_on_merge: true
+ features:
+ issues: true
+ discussions: true
+ enabled_merge_buttons:
+ squash: true
+ squash_commit_message: DEFAULT
+ merge: false
+ rebase: true
+ custom_subjects:
+ new_pr: "[PR] {title} ({repository})"
+ close_pr: "Re: [PR] {title} ({repository})"
+ comment_pr: "Re: [PR] {title} ({repository})"
+ merge_pr: "Re: [PR] {title} ({repository})"
+ new_issue: "[I] {title} ({repository})"
+ comment_issue: "Re: [I] {title} ({repository})"
+ close_issue: "Re: [I] {title} ({repository})"
+ catchall: "[GH] {title} ({repository})"
+ protected_branches:
+ main: {}
+
+notifications:
+ commits: commits@tooling.apache.org
+ issues: dev@tooling.apache.org
+ pullrequests: dev@tooling.apache.org
+ discussions: dev@tooling.apache.org
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7fa60dc..575940f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -129,4 +129,4 @@ jobs:
- name: List built distributions
run: ls -la dist/
- name: Publish to PyPI
- uses: pypa/gh-action-pypi-publish@release/v1
\ No newline at end of file
+ uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/Cargo.lock b/Cargo.lock
index ce2760e..3cba27f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -91,6 +91,15 @@ version = "0.7.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
+[[package]]
+name = "asfswhid"
+version = "0.1.0"
+dependencies = [
+ "gix",
+ "pyo3",
+ "swhid",
+]
+
[[package]]
name = "autocfg"
version = "1.5.0"
@@ -1677,7 +1686,6 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
[[package]]
name = "swhid"
version = "0.2.2"
-source = "git+https://github.com/andrewmusselman/swhid-rs?branch=gitoxide-feature-43#8414cdff71a48fc760697704241fec3910d3b068"
dependencies = [
"clap",
"git2",
@@ -1688,15 +1696,6 @@ dependencies = [
"thiserror 1.0.69",
]
-[[package]]
-name = "swhid-py"
-version = "0.1.0"
-dependencies = [
- "gix",
- "pyo3",
- "swhid",
-]
-
[[package]]
name = "syn"
version = "2.0.117"
diff --git a/Cargo.toml b/Cargo.toml
index a4d62eb..d811309 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ version = "0.1.0"
edition = "2021"
license = "Apache-2.0"
description = "Python bindings for the swhid-rs SWHID v1.2 reference implementation"
-repository = "https://github.com/apache/asfswhid"
+repository = "https://github.com/apache/tooling-asfswhid"
[lib]
name = "asfswhid"
@@ -12,9 +12,7 @@ crate-type = ["cdylib"]
[dependencies]
pyo3 = { version = "0.23", features = ["extension-module"] }
-# Once the gitoxide PR is merged upstream, switch to the crates.io release:
-# swhid = { version = "0.3", features = ["gitoxide"] }
-swhid = { git = "https://github.com/andrewmusselman/swhid-rs", branch = "gitoxide-feature-43" }
+swhid = { path = "swhid-rs", features = ["gitoxide"] }
# Needed for ObjectId type in revision/release functions
gix = { version = "0.72", optional = true, default-features = false }
diff --git a/README.md b/README.md
index 27b1db4..697979f 100644
--- a/README.md
+++ b/README.md
@@ -26,13 +26,13 @@ VCS integration (revision, release, snapshot) uses [gitoxide](https://github.com
### From PyPI (once published)
```bash
-uv pip install asfswhid
+pip install asfswhid
```
### From Git
```bash
-uv pip install git+https://github.com/apache/asfswhid.git
+pip install git+https://github.com/apache/tooling-asfswhid.git
```
This requires the Rust toolchain to be installed. If you don't have it:
@@ -44,8 +44,8 @@ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
### From source
```bash
-git clone https://github.com/apache/asfswhid.git
-cd asfswhid
+git clone https://github.com/apache/tooling-asfswhid.git
+cd tooling-asfswhid
uv venv && source .venv/bin/activate
uv pip install maturin
maturin develop # dev install into current venv
@@ -114,13 +114,13 @@ These functions use [gitoxide](https://github.com/GitoxideLabs/gitoxide) (MIT/Ap
Add to your `requirements.txt`:
```
-asfswhid @ git+https://github.com/apache/asfswhid.git
+asfswhid @ git+https://github.com/apache/tooling-asfswhid.git
```
Or pin to a specific release tag:
```
-asfswhid @ git+https://github.com/apache/asfswhid.git@v0.1.0
+asfswhid @ git+https://github.com/apache/tooling-asfswhid.git@v0.1.0
```
Then install with `uv pip install -r requirements.txt` (or `pip install -r requirements.txt`).
@@ -130,7 +130,7 @@ Then install with `uv pip install -r requirements.txt` (or `pip install -r requi
```toml
[project]
dependencies = [
- "asfswhid @ git+https://github.com/apache/asfswhid.git",
+ "asfswhid @ git+https://github.com/apache/tooling-asfswhid.git",
]
```
@@ -143,8 +143,6 @@ dependencies = [
]
```
-Then `uv pip install .` or `uv sync` to pull it in.
-
### Calling from your code
#### Hash a release archive after unpacking
@@ -343,7 +341,7 @@ ObjectType.Revision
## ATR use-cases
-This package supports two key use-cases for [Apache Trusted Releases](https://github.com/apache/tooling-trusted-releases):
+This package supports key use-cases for [Apache Trusted Releases](https://github.com/apache/tooling-trusted-releases):
### Cross-format archive comparison
@@ -388,17 +386,20 @@ SWHID_CLI=swhid pytest tests/test_conformance.py -v
```bash
# Prerequisites: Rust toolchain, Python 3.9+, uv
-git clone https://github.com/apache/asfswhid.git
-cd asfswhid
+git clone https://github.com/apache/tooling-asfswhid.git
+cd tooling-asfswhid
uv venv && source .venv/bin/activate
uv pip install maturin pytest
# Build + install in dev mode
maturin develop
-# Run tests
+# Run Python tests
pytest tests/ -v
+# Run Rust tests on the forked crate
+cargo test --manifest-path swhid-rs/Cargo.toml --features gitoxide
+
# Build release wheel
maturin build --release
@@ -410,8 +411,8 @@ cargo clippy -- -D warnings
## Architecture
```
-asfswhid/
-├── Cargo.toml # Rust dependencies (swhid + pyo3)
+tooling-asfswhid/
+├── Cargo.toml # Bindings crate (path dep on swhid-rs/)
├── pyproject.toml # Python package metadata (maturin build)
├── example_usage.py # Runnable demo with expected outputs
├── src/
@@ -420,15 +421,57 @@ asfswhid/
│ └── asfswhid/
│ ├── __init__.py # Re-exports from native module
│ └── __init__.pyi # Type stubs for IDE support
+├── swhid-rs/ # Forked upstream crate (git subtree)
+│ ├── Cargo.toml
+│ ├── src/
+│ ├── tests/
+│ └── docs/
├── tests/
│ ├── test_asfswhid.py # Unit tests
│ └── test_conformance.py # Cross-implementation conformance tests
└── .github/
└── workflows/
- └── ci.yml # CI: test matrix + wheel builds
+ ├── ci.yml # CI: test on push/PR
+ └── release.yml # Build wheels + publish to PyPI on tag
```
-The Rust side (`src/lib.rs`) is pure glue — it calls into the `swhid` crate's public API and exposes it via PyO3. No cryptographic or hashing code lives here; that's all in the upstream Rust crate.
+The Rust side (`src/lib.rs`) is pure glue — it calls into the `swhid` crate's public API and exposes it via PyO3. No cryptographic or hashing code lives here; that's all in `swhid-rs/`.
+
+The `swhid-rs/` directory is a [git subtree](https://www.atlassian.com/git/tutorials/git-subtree) of the upstream [`swhid/swhid-rs`](https://github.com/swhid/swhid-rs) crate with the gitoxide backend addition. It is consumed via `swhid = { path = "swhid-rs", features = ["gitoxide"] }` in the root `Cargo.toml`.
+
+## Keeping the upstream crate in sync
+
+The `swhid-rs/` directory is managed as a git subtree. To pull in upstream changes:
+
+```bash
+# Pull latest from upstream
+git subtree pull --prefix=swhid-rs \
+ https://github.com/swhid/swhid-rs.git main --squash
+
+# Verify nothing broke
+maturin develop
+pytest tests/ -v
+
+# Push
+git push origin main
+```
+
+If the upstream crate publishes a crates.io release with the gitoxide feature, you can drop the subtree entirely and switch to a version dependency:
+
+```toml
+# In Cargo.toml, replace:
+swhid = { path = "swhid-rs", features = ["gitoxide"] }
+
+# With:
+swhid = { version = "0.3", features = ["gitoxide"] }
+```
+
+Then remove the `swhid-rs/` directory:
+
+```bash
+git rm -r swhid-rs/
+git commit -m "Switch to crates.io swhid release, remove subtree"
+```
## License
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org