Skip to content

Commit 9b8b52c

Browse files
OmarAlJarrahOmarAlJarrah
authored
chore: packaging metadata, CI cleanup, and community health docs (#1)
PR: #1
1 parent f172ff1 commit 9b8b52c

15 files changed

Lines changed: 303 additions & 26 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: Bug report
2+
description: Something behaves incorrectly
3+
labels: ["bug"]
4+
body:
5+
- type: dropdown
6+
id: package
7+
attributes:
8+
label: Package
9+
description: Which distribution is affected?
10+
options:
11+
- dexpace-sdk-core
12+
- dexpace-sdk-http-stdlib
13+
- dexpace-sdk-http-httpx
14+
- dexpace-sdk-http-aiohttp
15+
- dexpace-sdk-http-requests
16+
- not sure
17+
validations:
18+
required: true
19+
- type: textarea
20+
id: description
21+
attributes:
22+
label: Description
23+
description: What happened, and what did you expect instead?
24+
validations:
25+
required: true
26+
- type: textarea
27+
id: reproduction
28+
attributes:
29+
label: Minimal reproduction
30+
description: The smallest code snippet that triggers the bug.
31+
render: python
32+
validations:
33+
required: true
34+
- type: textarea
35+
id: traceback
36+
attributes:
37+
label: Traceback / output
38+
render: text
39+
- type: input
40+
id: python-version
41+
attributes:
42+
label: Python version
43+
placeholder: "3.12.4"
44+
validations:
45+
required: true
46+
- type: input
47+
id: sdk-version
48+
attributes:
49+
label: SDK version(s)
50+
placeholder: "dexpace-sdk-core 0.1.0"
51+
validations:
52+
required: true

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
blank_issues_enabled: true
2+
contact_links:
3+
- name: Security vulnerability
4+
url: https://github.com/dexpace/python-sdk/security/advisories/new
5+
about: Please report security issues privately, not as public issues.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Feature request
2+
description: Propose a new capability or improvement
3+
labels: ["enhancement"]
4+
body:
5+
- type: textarea
6+
id: problem
7+
attributes:
8+
label: Problem
9+
description: What are you trying to do that the SDK doesn't support today?
10+
validations:
11+
required: true
12+
- type: textarea
13+
id: proposal
14+
attributes:
15+
label: Proposed solution
16+
description: >-
17+
What would the API look like? Note that core stays free of new
18+
runtime dependencies — third-party needs belong behind the
19+
`HttpClient`/`Serde` seams or in a transport package.
20+
validations:
21+
required: true
22+
- type: textarea
23+
id: alternatives
24+
attributes:
25+
label: Alternatives considered

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
## What
2+
3+
<!-- What does this PR change, and why? Link related issues with "Fixes #123". -->
4+
5+
## Checklist
6+
7+
- [ ] `uv run pytest -q` passes
8+
- [ ] `uv run mypy --strict` passes
9+
- [ ] `uv run ruff check` and `uv run ruff format --check` pass
10+
- [ ] New/changed public symbols have Google-style docstrings and appear in `__all__`
11+
- [ ] New `.py` files carry the two-line MIT licence header
12+
- [ ] Commit messages use the `feat:` / `fix:` / `chore:` / `docs:` / `ci:` prefixes

‎.github/dependabot.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
groups:
8+
actions:
9+
patterns: ["*"]
10+
11+
- package-ecosystem: uv
12+
directory: /
13+
schedule:
14+
interval: weekly
15+
groups:
16+
python-deps:
17+
patterns: ["*"]

‎.github/workflows/ci.yml‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ concurrency:
1010
group: ${{ github.workflow }}-${{ github.ref }}
1111
cancel-in-progress: true
1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
test:
1518
name: test (Python ${{ matrix.python-version }})
@@ -20,17 +23,13 @@ jobs:
2023
python-version: ["3.12", "3.13", "3.14"]
2124
steps:
2225
- name: Checkout
23-
uses: actions/checkout@v4
24-
25-
- name: Set up Python ${{ matrix.python-version }}
26-
uses: actions/setup-python@v5
27-
with:
28-
python-version: ${{ matrix.python-version }}
26+
uses: actions/checkout@v6
2927

3028
- name: Install uv
31-
uses: astral-sh/setup-uv@v3
29+
uses: astral-sh/setup-uv@v8.2.0
3230
with:
3331
enable-cache: true
32+
python-version: ${{ matrix.python-version }}
3433

3534
- name: Sync workspace
3635
run: uv sync

‎CODE_OF_CONDUCT.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Code of Conduct
2+
3+
## Our pledge
4+
5+
We as members, contributors, and maintainers pledge to make participation in
6+
this project a harassment-free experience for everyone, regardless of age,
7+
body size, visible or invisible disability, ethnicity, sex characteristics,
8+
gender identity and expression, level of experience, education, socio-economic
9+
status, nationality, personal appearance, race, religion, or sexual identity
10+
and orientation.
11+
12+
## Our standards
13+
14+
Examples of behaviour that contributes to a positive environment:
15+
16+
- Showing empathy and kindness toward other people
17+
- Being respectful of differing opinions, viewpoints, and experiences
18+
- Giving and gracefully accepting constructive feedback
19+
- Focusing on what is best for the community
20+
21+
Examples of unacceptable behaviour:
22+
23+
- Trolling, insulting or derogatory comments, and personal or political attacks
24+
- Public or private harassment
25+
- Publishing others' private information without explicit permission
26+
- Other conduct which could reasonably be considered inappropriate in a
27+
professional setting
28+
29+
## Enforcement
30+
31+
Instances of abusive, harassing, or otherwise unacceptable behaviour may be
32+
reported to the maintainers at
33+
[o.mazari.om63@gmail.com](mailto:o.mazari.om63@gmail.com). All complaints will
34+
be reviewed and investigated promptly and fairly. Maintainers are obligated to
35+
respect the privacy and security of the reporter of any incident.
36+
37+
## Attribution
38+
39+
This Code of Conduct is adapted from the
40+
[Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

‎CONTRIBUTING.md‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Contributing
2+
3+
Thanks for your interest in the Dexpace Python SDK. External pull requests
4+
are welcome — this page covers everything you need to get a change merged.
5+
6+
## Setup
7+
8+
The repository is a [`uv`](https://docs.astral.sh/uv/)-managed workspace of
9+
five packages. One sync provisions everything in editable mode along with
10+
the dev toolchain:
11+
12+
```bash
13+
git clone https://github.com/dexpace/python-sdk.git
14+
cd python-sdk
15+
uv sync
16+
```
17+
18+
## Quality gates
19+
20+
Every pull request must pass the same four gates CI runs (on Python 3.12,
21+
3.13, and 3.14):
22+
23+
```bash
24+
uv run pytest -q # full test suite
25+
uv run mypy --strict # type-check
26+
uv run ruff check # lint
27+
uv run ruff format --check # formatting
28+
```
29+
30+
Run them locally before opening a PR.
31+
32+
## Conventions
33+
34+
The full convention set lives in [`CLAUDE.md`](CLAUDE.md). The essentials:
35+
36+
- **Python 3.12+** with modern syntax: `X | None`, built-in generics,
37+
PEP 695 type parameters, `from __future__ import annotations` everywhere.
38+
- **Immutable models**: `@dataclass(frozen=True, slots=True)`; mutate via
39+
`dataclasses.replace` or `with_*` helpers — no builders.
40+
- **`Protocol` for SPIs, `ABC` for shared behaviour.**
41+
- **No new runtime dependencies.** `core` ships against the standard
42+
library plus `furl` only; new third-party needs belong behind the
43+
`HttpClient` or `Serde` seams, or in a new transport package.
44+
- **Google-style docstrings** on every public symbol; functions capped at
45+
50 lines.
46+
- **MIT licence header** (two lines) at the top of every `.py` file, src
47+
and tests alike.
48+
49+
## Commit messages
50+
51+
Use the prefixes the history already follows:
52+
53+
| Prefix | Use for |
54+
|----------|----------------------------------|
55+
| `feat:` | new features |
56+
| `fix:` | bug fixes |
57+
| `chore:` | refactors and cleanup |
58+
| `docs:` | documentation-only changes |
59+
| `ci:` | CI configuration |
60+
61+
## Reporting issues
62+
63+
Use the [issue templates](https://github.com/dexpace/python-sdk/issues/new/choose).
64+
For security vulnerabilities, follow [`SECURITY.md`](SECURITY.md) instead of
65+
opening a public issue.

‎README.md‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -244,8 +244,14 @@ Documented in [`CLAUDE.md`](CLAUDE.md). The short version:
244244

245245
## Contributing
246246

247-
External pull requests are welcome. Run the gates above before opening
248-
one, and follow the conventions in [`CLAUDE.md`](CLAUDE.md).
247+
External pull requests are welcome. See [`CONTRIBUTING.md`](CONTRIBUTING.md)
248+
for setup, the quality gates, and commit conventions, and
249+
[`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md) for community expectations.
250+
251+
## Security
252+
253+
To report a vulnerability, follow [`SECURITY.md`](SECURITY.md) — please do
254+
not open a public issue.
249255

250256
## License
251257

‎SECURITY.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Security Policy
2+
3+
## Supported versions
4+
5+
| Version | Supported |
6+
|---------|--------------------|
7+
| 0.1.x | :white_check_mark: |
8+
9+
## Reporting a vulnerability
10+
11+
Please **do not** open a public issue for security vulnerabilities.
12+
13+
Instead, report privately via
14+
[GitHub private vulnerability reporting](https://github.com/dexpace/python-sdk/security/advisories/new)
15+
(Security tab → "Report a vulnerability"). If you cannot use GitHub, email
16+
[o.mazari.om63@gmail.com](mailto:o.mazari.om63@gmail.com) with
17+
`[SECURITY]` in the subject line.
18+
19+
Include what you can of the following:
20+
21+
- The affected package(s) and version(s)
22+
- A description of the vulnerability and its impact
23+
- Steps or a proof of concept to reproduce it
24+
25+
You can expect an acknowledgement within a few days. Please allow time for
26+
a fix to land and be released before disclosing publicly.
27+
28+
## Scope notes
29+
30+
- The SDK is a **toolkit**, not a service: it executes no network I/O of
31+
its own. Transport-level vulnerabilities (TLS, connection handling)
32+
usually belong to the underlying HTTP library (`httpx`, `aiohttp`,
33+
`requests`, or the standard library) — report those upstream.
34+
- In scope here: credential handling (`http.auth`), header/URL redaction
35+
in logging, redirect safety (`Authorization` stripping, userinfo
36+
dropping), body capture, and challenge parsing.

0 commit comments

Comments
 (0)