fix: semantic-release push=false to avoid branch protection - #41
Merged
Merged
Conversation
added 30 commits
July 3, 2026 16:01
…, stale bot, CONTRIBUTING.md, release config
- mypy config in pyproject.toml (check_untyped_defs, explicit_package_bases) - CI typecheck job on Python 3.12 - Fix backup_cron.py type annotation (Coroutine vs dict) - detect-secrets workflow scans for leaked credentials - Branch protection will be updated to include typecheck
19 property-based tests covering: - rag/conflict.py: similarity range, symmetry, empty input - rag/scoring.py: weighted sum invariant, ordering, weights clamping - rag/quantize.py: binary output length, hamming distance properties - features/secrets.py: encrypt/decrypt roundtrip, min blob size
…ate docs - Delete requirements.txt (duplicate of pyproject.toml deps) - Add 6 Hypothesis tests for ReflexBuffer (size invariant, FIFO, concurrency) - ROADMAP: add key rotation and adaptive importance threshold items - README: fix sync fallback description (asyncio.to_thread, not blocking) - README: fix keychain-first security description - 338/338 tests pass
- mkdocs.yml with Material theme, code highlighting, search - 30+ documentation pages organized by topic - API reference auto-generated from docstrings (mkdocstrings) - GitHub Pages deployment workflow (docs.yml) - mkdocs, mkdocs-material, mkdocstrings in docs optional deps - site/ added to .gitignore - Documentation URL: https://cipher208.github.io/mcp-ariel-memory/
…st_bearer_token_encrypted Replace is_encrypted_blob assertion with functional rotation check: read data back with fresh APIKeyAuth instance to verify it survived.
When libsodium nonce first byte happens to be '{' or '[' (~0.78% probability),
is_encrypted_blob returns False and code tries to parse binary as JSON.
Fix: try decrypt_json first, catch exception, then fall back to JSON parsing.
This handles the nonce collision case without relying on the heuristic.
Also applies same fix to BearerAuth._load_or_create.
- README.md: 313→338 tests, add docs badge, add CI pipeline info - docs/00-index.md: 313→338 tests - docs/features/secrets.md: add decrypt-first pattern explanation - docs/operations/deployment.md: add CI pipeline table (10 jobs)
- New audit job in ci.yml (pip-audit --strict --desc --skip-editable) - Skips editable installs (agent-reach, mcp-ariel-memory itself) - Found and fixed cryptography CVE (46.0.7 → 49.0.0) - 11 CI jobs total now
- bug_report.yml: required fields (version, python, os, transport, description, steps, expected, actual) - feature_request.yml: required fields (problem, solution, area) - config.yml: disable blank issues, add docs/discussions links
- CodeQL workflow: weekly + on push/PR, security-extended queries - Dockerfile: add non-root user (UID 1000) for container security - Push Protection: enabled via API (secret scanning blocks secret commits)
added 22 commits
July 4, 2026 01:02
…release - ROADMAP: 35/65 items done, updated security/testing/docs sections - CI: add coverage job (fail-under=60), pytest-cov in dev deps - Architecture: 5 mermaid diagrams (system, consolidation, RAG, security, saga, CI) - MkDocs: add diagrams page to nav - Release: v1.0.0 tag + GitHub Release
Badges: CI, codecov, license, Python version, Ruff, MCP, docs, release Diagram: memory consolidation flow, RAG pipeline, wiki, knowledge graphs
- Generate coverage.xml for codecov - Upload via codecov/codecov-action@v4 - Add security-events: write permission
- CONTRIBUTING.md: add ruff/mypy/pytest requirements, conventional commits, PR rules - SECURITY.md: proper security policy with GitHub Private Vulnerability Reporting - GitHub Discussions enabled
- pyproject.toml: semantic_release config with changelog categories - release.yml: auto-release on push to master, builds wheel, publishes to PyPI - commit-lint.yml: enforces conventional commits via commitizen
Branch protection blocks direct pushes to master. Setting push=false means semantic-release creates tags and releases but doesn't commit version bumps to master.
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Branch protection blocks direct pushes to master. Setting push=false means semantic-release creates tags and releases but doesn't commit version bumps to master.