Release tabcmd 2.0.34

.github/dependabot.yml

@@ -7,14 +7,14 @@
 
 version: 2
 updates:
-  - package-ecosystem: "pip" # See documentation for possible values
-    directory: "/" # Location of package manifests
-    # Raise pull requests for version updates to pip against the `develop` branch
-    target-branch: "develop"
+  - package-ecosystem: "pip"
+    directory: "/"
+    target-branch: "development"
     schedule:
       interval: "weekly"
 
   - package-ecosystem: "github-actions"
     directory: "/"
+    target-branch: "development"
     schedule:
       interval: "weekly"

.github/workflows/check-coverage.yml

@@ -21,7 +21,7 @@ jobs:
     - uses: actions/checkout@v7
 
     - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
 
@@ -32,6 +32,8 @@ jobs:
         python -m pip install --upgrade build
         pip install .[versioning]
         doit version
+        pip install .[localize]
+        doit localize
         pip install .
         python -m build
         pip install .[test]

.github/workflows/check-strings.yml

@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: '3.12'
 

.github/workflows/codeql-analysis.yml

@@ -42,7 +42,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.39.1
+      uses: github/codeql-action/init@v4.39.3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,6 +53,6 @@ jobs:
         # queries: security-extended,security-and-quality
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.39.1
+      uses: github/codeql-action/analyze@v4.39.3
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/generate-metadata.yml

@@ -14,7 +14,7 @@ jobs:
     - uses: actions/checkout@v7
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: '3.12'
 
@@ -25,6 +25,8 @@ jobs:
         python -m pip install --upgrade build
         pip install .[versioning]
         doit version
+        pip install .[localize]
+        doit localize
         pip install .
         python -m build
         pip install .[test]

.github/workflows/package.yml

@@ -9,16 +9,33 @@ name: Package-and-Upload
 # https://anshumanfauzdar.medium.com/using-github-actions-to-bundle-python-application-into-a-single-package-and-automatic-release-834bd42e0670
 
 on:
-  push:
-    tags:
-      - '*'
+  release:
+    types: [published]
+  # Manual repair path for a published release. The release tag is resolved from
+  # the release event, then inputs.release_tag, then github.ref_name when
+  # dispatched at a tag ref. Don't dispatch for a draft release: the upload step
+  # finds the release by tag, drafts can't be found that way, and the action then
+  # creates a second release for the same tag.
+  # There is deliberately no `push: tags` trigger: release-on-merge.yml pushes a
+  # tag on every merge to main, and a build should only run once a release is published.
   workflow_dispatch:
+    inputs:
+      release_tag:
+        description: 'Release tag to attach binaries to. Required when dispatching from a branch rather than a tag ref.'
+        required: false
+        type: string
+
+concurrency:
+  group: package-${{ github.event.release.tag_name || inputs.release_tag || github.ref_name }}
+  cancel-in-progress: false
 
 jobs:
 
   buildexe:
-    name: Build executables and upload them to the existing release
+    name: Build executables
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -63,7 +80,7 @@ jobs:
     steps:
     - uses: actions/checkout@v7
 
-    - uses: actions/setup-python@v6
+    - uses: actions/setup-python@v7
       with:
         python-version: 3.12
 
@@ -74,6 +91,8 @@ jobs:
         python -m pip install --upgrade build
         pip install .[versioning]
         doit version
+        pip install .[localize]
+        doit localize
         pip install .
         python -m build
         pip install .[package]
@@ -89,6 +108,32 @@ jobs:
       if: matrix.TARGET == 'macos'
       run: ./dist/${{ matrix.TARGET }}/${{ matrix.OUT_FILE_NAME }}/Contents/MacOS/${{ matrix.APP_BINARY_FILE_NAME }}
 
+    # -v checks the bundled version file. The login probe checks that requests/urllib3/certifi are bundled:
+    # a closed port must fail with a connection error, not an import error.
+    - name: Smoke test package for ${{matrix.TARGET}}
+      shell: bash
+      env:
+        TARGET: ${{ matrix.TARGET }}
+        OUT_FILE_NAME: ${{ matrix.OUT_FILE_NAME }}
+        APP_BINARY_FILE_NAME: ${{ matrix.APP_BINARY_FILE_NAME }}
+      run: |
+        case "$TARGET" in
+          macos) BIN="./dist/macos/$OUT_FILE_NAME/Contents/MacOS/$APP_BINARY_FILE_NAME" ;;
+          *) BIN="./dist/$TARGET/$OUT_FILE_NAME" ;;
+        esac
+        "$BIN" -v
+        if out=$("$BIN" login -s https://localhost:1 -u a -p b --no-certcheck 2>&1); then
+          echo "$out"
+          echo "login to a closed port unexpectedly succeeded"
+          exit 1
+        fi
+        echo "$out"
+        if echo "$out" | grep -Eq "ImportError|ModuleNotFoundError|Unhandled exception"; then
+          echo "packaged binary failed with an import error"
+          exit 1
+        fi
+        echo "$out" | grep -q "Max retries exceeded" || { echo "expected a connection error from requests"; exit 1; }
+
     - name: Tar app bundle for Mac
       if: matrix.TARGET == 'macos'
       run: |
@@ -97,18 +142,103 @@ jobs:
         tar -cvf ${{ matrix.UPLOAD_FILE_NAME }} ${{ matrix.OUT_FILE_NAME }}
 
 
+    # UPLOAD_FILE_NAME distinguishes the two macOS artifacts (x86 vs arm64);
+    # the shared artifact name `tabcmd-macos` would otherwise collide and each
+    # upload would clobber the other in the artifact store.
     - name: Upload build artifact for ${{ matrix.TARGET }}
       uses: actions/upload-artifact@v7
       with:
-        name: tabcmd-${{ matrix.TARGET }}
+        name: ${{ matrix.UPLOAD_FILE_NAME }}
         path: ./dist/${{ matrix.TARGET }}/${{ matrix.UPLOAD_FILE_NAME }}
 
-    - name: Upload binaries to release for ${{ matrix.TARGET }}
-      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+  # Attach the built binaries to the target GitHub release. Split into its own
+  # job so we can gate it behind the `release` environment: a required-reviewer
+  # protection on that environment means publishing a release triggers a build,
+  # but only an approved reviewer can actually attach binaries to that release.
+  # The workflow pauses at this job until a reviewer clicks Approve.
+  #
+  # `needs: buildexe` waits for ALL matrix legs to succeed. If any leg fails
+  # this job is skipped (default behavior with no `if: always()`), so a partial
+  # release upload where e.g. macOS is missing is never possible.
+  upload_to_release:
+    name: Attach build artifacts to release
+    needs: buildexe
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
+    steps:
+    # download-artifact versions independently of upload-artifact; v7 reads the
+    # zipped artifacts that upload-artifact@v7 produces by default
+    - name: Download all build artifacts
+      uses: actions/download-artifact@v7
+      with:
+        path: artifacts/
+
+    # Resolve the release tag, in order of preference: the release event's
+    # tag_name, the workflow_dispatch release_tag input, then github.ref_name
+    # when the run was dispatched from a tag ref. A dispatch from a branch
+    # with no release_tag fails fast rather than treating the branch name as
+    # a tag, and an empty result never reaches the upload steps.
+    - name: Resolve release tag
+      id: tag
+      env:
+        RELEASE_TAG: ${{ github.event.release.tag_name }}
+        INPUT_TAG: ${{ inputs.release_tag }}
+        REF_NAME: ${{ github.ref_name }}
+        REF_TYPE: ${{ github.ref_type }}
+        EVENT_NAME: ${{ github.event_name }}
+      run: |
+        TAG="$RELEASE_TAG"
+        if [ -z "$TAG" ]; then
+          TAG="$INPUT_TAG"
+        fi
+        if [ -z "$TAG" ] && [ "$REF_TYPE" = "tag" ]; then
+          TAG="$REF_NAME"
+        fi
+        if [ -z "$TAG" ] && [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+          echo "::error::workflow_dispatch from $REF_TYPE '$REF_NAME' has no release_tag input; pass -f release_tag=<tag> or dispatch with --ref <tag>"
+          exit 1
+        fi
+        if [ -z "$TAG" ]; then
+          echo "::error::No release tag resolvable (event=$EVENT_NAME, release.tag_name empty, release_tag input empty, ref_type=$REF_TYPE)"
+          exit 1
+        fi
+        echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+        echo "Resolved release tag: $TAG"
+
+    - name: Upload tabcmd.exe (Windows) to release
+      uses: svenstaro/upload-release-action@v2
+      with:
+        repo_token: ${{ secrets.GITHUB_TOKEN }}
+        asset_name: tabcmd.exe
+        file: artifacts/tabcmd.exe/tabcmd.exe
+        tag: ${{ steps.tag.outputs.tag }}
+        overwrite: true
+
+    - name: Upload tabcmd (Ubuntu) to release
+      uses: svenstaro/upload-release-action@v2
+      with:
+        repo_token: ${{ secrets.GITHUB_TOKEN }}
+        asset_name: tabcmd
+        file: artifacts/tabcmd/tabcmd
+        tag: ${{ steps.tag.outputs.tag }}
+        overwrite: true
+
+    - name: Upload tabcmd-x86.app.tar (macOS x86) to release
+      uses: svenstaro/upload-release-action@v2
+      with:
+        repo_token: ${{ secrets.GITHUB_TOKEN }}
+        asset_name: tabcmd-x86.app.tar
+        file: artifacts/tabcmd-x86.app.tar/tabcmd-x86.app.tar
+        tag: ${{ steps.tag.outputs.tag }}
+        overwrite: true
+
+    - name: Upload tabcmd_arm64.app.tar (macOS ARM64) to release
       uses: svenstaro/upload-release-action@v2
       with:
         repo_token: ${{ secrets.GITHUB_TOKEN }}
-        asset_name: ${{ matrix.UPLOAD_FILE_NAME }}
-        file: ./dist/${{ matrix.TARGET }}/${{ matrix.UPLOAD_FILE_NAME }}
-        tag: ${{ github.ref_name }}
+        asset_name: tabcmd_arm64.app.tar
+        file: artifacts/tabcmd_arm64.app.tar/tabcmd_arm64.app.tar
+        tag: ${{ steps.tag.outputs.tag }}
         overwrite: true

.github/workflows/publish-pypi.yml

@@ -14,11 +14,12 @@ jobs:
   build-n-publish:
     name: Build dist files for PyPi
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: 3.12
       - name: Build dist files
@@ -28,6 +29,8 @@ jobs:
           python -m pip install --upgrade build
           pip install .[versioning]
           doit version
+          pip install .[localize]
+          doit localize
           pip install .
           python -m build
 

.github/workflows/python-app.yml

@@ -3,17 +3,20 @@
 
 name: Pypi smoke tests
 
-# maybe we want this triggered after the publish-pypi workflow?
 on:
   workflow_dispatch:
   schedule:
     - cron: 0 11 * * * # Every day at 11AM UTC (7AM EST)
+  workflow_run:
+    workflows: ["Publish to PyPi"]
+    types: [completed]
 
 permissions:
   contents: read
 
 jobs:
   build:
+    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
     strategy:
       fail-fast: false
       matrix:
@@ -24,7 +27,7 @@ jobs:
 
     steps:
     - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
     - name: pip install Tabcmd

.github/workflows/release-on-merge.yml

@@ -1,9 +1,9 @@
 name: Draft release on merge to main
 
 # Triggers when a PR is merged into main (push to main covers all merge strategies).
-# Creates a draft GitHub release with auto-generated notes and pushes the version tag.
-# The tag push triggers package.yml to build and attach binaries.
-# When you publish the draft release, publish-pypi.yml uploads to PyPI automatically.
+# Pushes the next patch version tag and creates a draft GitHub release with auto-generated notes.
+# Nothing is built here. When you publish the draft release, package.yml builds and attaches
+# the binaries and publish-pypi.yml uploads to PyPI.
 
 on:
   push:

.github/workflows/run-e2-tests.yml

@@ -80,7 +80,7 @@ jobs:
     - uses: actions/checkout@v7
 
     - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
 
@@ -91,6 +91,8 @@ jobs:
         python -m pip install --upgrade build
         pip install .[versioning]
         doit version
+        pip install .[localize]
+        doit localize
         pip install .
         python -m build
         pip install .[test]

.github/workflows/run-tests.yml

@@ -23,7 +23,7 @@ jobs:
     - uses: actions/checkout@v7
 
     - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
 
@@ -34,6 +34,8 @@ jobs:
         python -m pip install --upgrade build
         pip install .[versioning]
         doit version
+        pip install .[localize]
+        doit localize
         pip install .
         python -m build
         pip install .[test]