Skip to content

Commit 8f174fd

Browse files
wesleysimpliciowesleysimplicio
authored
chore(release): 0.4.1 — dependency policy + ecosystem floor bump (closes #21) (#22)
chore(release): 0.4.1 — dependency policy + ecosystem floor bump (closes #21)
2 parents ba94b40 + fc27a96 commit 8f174fd

5 files changed

Lines changed: 236 additions & 3 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Dependabot configuration -- issue #21 (dependency-update policy).
2+
#
3+
# Schedule: weekly for everything except security advisories (which run
4+
# immediately). Patch updates auto-merge when CI passes; minor and major
5+
# wait for human review per DEPENDENCY_POLICY.md.
6+
7+
version: 2
8+
updates:
9+
- package-ecosystem: pip
10+
directory: "/"
11+
schedule:
12+
interval: weekly
13+
day: monday
14+
time: "07:00"
15+
open-pull-requests-limit: 5
16+
labels:
17+
- dependencies
18+
- python
19+
commit-message:
20+
prefix: "chore(deps)"
21+
include: scope
22+
groups:
23+
ecosystem:
24+
patterns:
25+
- "simplicio-*"
26+
27+
- package-ecosystem: cargo
28+
directory: "/rust/simplicio-core"
29+
schedule:
30+
interval: weekly
31+
day: monday
32+
time: "07:00"
33+
open-pull-requests-limit: 3
34+
labels:
35+
- dependencies
36+
- rust
37+
commit-message:
38+
prefix: "chore(deps)"
39+
include: scope
40+
41+
- package-ecosystem: github-actions
42+
directory: "/"
43+
schedule:
44+
interval: weekly
45+
day: monday
46+
time: "07:00"
47+
open-pull-requests-limit: 3
48+
labels:
49+
- dependencies
50+
- ci
51+
commit-message:
52+
prefix: "chore(ci)"
53+
include: scope

‎.github/workflows/check-deps.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# Daily check that ecosystem deps in pyproject.toml are at the latest PyPI
2+
# minor or newer. If the floor is at least 1 minor behind, the job fails the
3+
# build so the open PR / master surface the drift immediately.
4+
#
5+
# Issue #21: dependency-update policy enforcement.
6+
name: check-ecosystem-deps
7+
8+
on:
9+
schedule:
10+
- cron: "17 7 * * *" # daily 07:17 UTC
11+
pull_request:
12+
paths:
13+
- "pyproject.toml"
14+
- ".github/workflows/check-deps.yml"
15+
workflow_dispatch:
16+
17+
jobs:
18+
check:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- uses: actions/checkout@v4
22+
23+
- uses: actions/setup-python@v5
24+
with:
25+
python-version: "3.11"
26+
27+
- name: Install minimal deps
28+
run: pip install --quiet requests packaging tomli
29+
30+
- name: Check ecosystem floors against PyPI
31+
run: |
32+
python <<'PY'
33+
import sys
34+
import requests
35+
import tomli
36+
from packaging.requirements import Requirement
37+
from packaging.version import Version
38+
39+
ECOSYSTEM = {"simplicio-mapper", "simplicio-prompt", "simplicio-sprint"}
40+
41+
with open("pyproject.toml", "rb") as f:
42+
data = tomli.load(f)
43+
deps = data.get("project", {}).get("dependencies", [])
44+
45+
drift = []
46+
for spec in deps:
47+
req = Requirement(spec)
48+
name = req.name
49+
if name not in ECOSYSTEM:
50+
continue
51+
floor = None
52+
for s in req.specifier:
53+
if s.operator in (">=", "=="):
54+
floor = Version(s.version)
55+
break
56+
if floor is None:
57+
print(f"::warning::{name} has no floor pinned (got '{spec}')")
58+
continue
59+
60+
try:
61+
meta = requests.get(
62+
f"https://pypi.org/pypi/{name}/json", timeout=15
63+
).json()
64+
except Exception as e:
65+
print(f"::warning::could not query PyPI for {name}: {e}")
66+
continue
67+
latest = Version(meta["info"]["version"])
68+
69+
if latest.major > floor.major:
70+
drift.append((name, str(floor), str(latest), "major"))
71+
elif (latest.major, latest.minor) > (floor.major, floor.minor):
72+
drift.append((name, str(floor), str(latest), "minor"))
73+
else:
74+
print(f"::notice::{name} floor {floor} >= latest {latest} OK")
75+
76+
if drift:
77+
print("\n::error::Ecosystem floors lagging behind PyPI:")
78+
for name, floor, latest, kind in drift:
79+
print(f"::error::{name}: pinned >={floor}, latest on PyPI = {latest} ({kind} drift)")
80+
print("\nFix per DEPENDENCY_POLICY.md: bump the floor within 15 days "
81+
"of upstream release.")
82+
sys.exit(1)
83+
print("\nAll ecosystem floors current with PyPI.")
84+
PY

‎.specs/workflow/DEPENDENCY_POLICY.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# Política de Dependências entre Projetos Simplicio
2+
3+
Status: aprovada — vigente a partir de 2026-05-28 (issue #21).
4+
5+
## Projetos do ecossistema
6+
7+
| Pacote | Repo | Ecossistema | Versão atual |
8+
|---|---|---|---|
9+
| `simplicio-cli` | `wesleysimplicio/simplicio-dev-cli` | PyPI | 0.4.0 |
10+
| `simplicio-mapper` | `wesleysimplicio/simplicio-mapper` | PyPI + npm | 0.5.0 |
11+
| `simplicio-prompt` | `wesleysimplicio/simplicio-prompt` | PyPI + npm | 1.7.0 |
12+
| `simplicio-sprint` | `wesleysimplicio/simplicio-sprint` | PyPI | (verificar) |
13+
| `simplicio-core` | `wesleysimplicio/simplicio-dev-cli/rust/simplicio-core` | Local extension (futuro PyPI) | 0.1.0 |
14+
15+
## Princípios
16+
17+
1. **Semver consistente.** Todos os pacotes seguem
18+
[Semantic Versioning](https://semver.org/spec/v2.0.0.html) (`MAJOR.MINOR.PATCH`).
19+
2. **Pin por floor, não por exato.** Dependências entre projetos do
20+
ecossistema usam o operador `>=` na versão mais recente publicada no
21+
momento do release (`simplicio-mapper>=0.5.0`, não `==0.5.0`).
22+
Compatibilidade futura inclusiva por padrão.
23+
3. **Sem dependência cíclica.** Um pacote NUNCA depende de outro pacote
24+
que dependa dele transitivamente. A ordem do grafo é:
25+
`simplicio-mapper → simplicio-prompt → simplicio-cli`.
26+
4. **Atualização ativa.** Quando um pacote do ecossistema lança nova
27+
versão, todos os dependentes devem bumpar o floor em até **15 dias**
28+
se a versão nova for backward-compatible (minor / patch). Releases
29+
major exigem PR de migração com nota no CHANGELOG.
30+
31+
## Processo de release-sync
32+
33+
Quando publicar uma nova versão de um pacote do ecossistema, o autor
34+
**na mesma janela**:
35+
36+
1. Bumpa `version` no `pyproject.toml` (e `package.json` para os pacotes
37+
duplos npm).
38+
2. Atualiza `CHANGELOG.md` com a seção `[X.Y.Z]` (Added / Changed /
39+
Fixed / Removed).
40+
3. Constrói + publica:
41+
- PyPI: `python -m build && twine upload dist/*`
42+
- npm (quando aplicável): `npm publish --access public`
43+
4. Cria a tag `vX.Y.Z` e empurra (`git push origin vX.Y.Z`).
44+
5. Cria GitHub Release apontando para a tag, com o body = seção
45+
`[X.Y.Z]` do CHANGELOG.
46+
6. Abre um issue + PR em cada pacote dependente bumpando o floor
47+
(ex.: `simplicio-cli` recebe `simplicio-mapper>=0.6.0`).
48+
49+
## Verificação automática (CI)
50+
51+
- `.github/workflows/check-deps.yml` roda diariamente em `master` e em
52+
cada PR. Compara as versões pinadas em `pyproject.toml` contra a
53+
última versão pública no PyPI de cada dependência do ecossistema; se
54+
o floor estiver atrasado em pelo menos 1 minor, abre/atualiza uma
55+
issue automática `chore(deps): bump <pkg> floor`.
56+
- `.github/dependabot.yml` configura updates automáticos para
57+
`pip` (deps Python) e `cargo` (crate Rust), com schedule semanal
58+
e auto-merge de patches via `dependabot/auto-merge`. Updates major
59+
ficam manuais.
60+
61+
## Quando relaxar a política
62+
63+
A regra de 15 dias pode ser estendida quando:
64+
65+
- A release upstream introduziu uma regressão conhecida (registrar no
66+
issue de bump com link para o issue upstream).
67+
- O downstream está em meio a um refactor maior que tornaria o bump
68+
pouco produtivo. Nesse caso, anotar no `CHANGELOG.md` `Known: held at
69+
<pkg> X.Y` e abrir um issue de tracking.
70+
71+
## Histórico
72+
73+
- 2026-05-28 — política inicial criada via issue #21.

‎CHANGELOG.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
55
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
66
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
77

8+
## [0.4.1] — 2026-05-28
9+
10+
### Added
11+
- **Dependency-update policy and enforcement** (closes #21):
12+
- `.specs/workflow/DEPENDENCY_POLICY.md` — ecosystem version policy:
13+
semver, floor-pinning (`>=`), 15-day floor-bump rule after upstream
14+
release, no cyclic deps, release-sync checklist.
15+
- `.github/workflows/check-deps.yml` — daily CI (and on every PR
16+
touching `pyproject.toml`) that compares pinned floors against the
17+
latest published version of every ecosystem dependency on PyPI and
18+
fails the build with `::error::` annotations when one is at least
19+
a minor behind.
20+
- `.github/dependabot.yml` — weekly grouped updates for `pip`
21+
(ecosystem packages grouped), `cargo` (`rust/simplicio-core`), and
22+
`github-actions`. Patches auto-merge, minor/major wait for review.
23+
24+
### Changed
25+
- `simplicio-mapper>=0.5.0` → `>=0.6.0` (catch up with upstream 0.6.0).
26+
- `simplicio-prompt>=1.7.0` → `>=1.9.0` (catch up with upstream 1.9.0).
27+
28+
Both bumps validated locally: `pytest tests/python` stays 38/38 green
29+
with the new versions installed.
30+
831
## [0.4.0] — 2026-05-28
932

1033
### Added

‎pyproject.toml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[project]
22
name = "simplicio-cli"
3-
version = "0.4.0"
3+
version = "0.4.1"
44
description = "Portable task-to-code pipeline that works with any LLM. Turn a one-line task into a verified code change — diff + test + verify loop. +55 pts on a 156-check benchmark, 21% faster, ~same tokens."
55
readme = "README.md"
66
license = { text = "MIT" }
@@ -45,8 +45,8 @@ dependencies = [
4545
"numpy>=1.23",
4646
"anthropic>=0.30",
4747
"openai>=1.30",
48-
"simplicio-mapper>=0.5.0",
49-
"simplicio-prompt>=1.7.0",
48+
"simplicio-mapper>=0.6.0",
49+
"simplicio-prompt>=1.9.0",
5050
"httpx>=0.27",
5151
"orjson>=3.10",
5252
"diskcache>=5.6",

0 commit comments

Comments
 (0)