Skip to content

Release 0.4.1 #35

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yudelevi merged 4 commits into from
Sep 24, 2026
Merged

Release 0.4.1 #35

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0f15d43
Fix CLI import crash on Typer 0.27 and release 0.4.1
yudelevi Sep 24, 2026
980398c
Test the dependency ranges users resolve, not just uv.lock
yudelevi Sep 24, 2026
62838c3
Pin the cli extra to the matching 0.4.1 CLI
yudelevi Sep 24, 2026
546d02d
Merge pull request #34 from discolike/fix/typer-0.27-abort
yudelevi Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,28 @@ jobs:
- run: uv run pytest packages/discolike/tests -q
- run: uv run pytest packages/discolike-cli/tests -q

# uv.lock pins one version of every dependency; users resolve fresh from the
# pyproject ranges. Test both ends of those ranges and the built wheels.
test-resolution:
runs-on: ubuntu-latest
strategy:
matrix:
include:
- resolution: highest
python-version: '3.14'
- resolution: lowest-direct
python-version: '3.10'
steps:
- uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v5
Comment on lines +41 to +42

@greptile-apps greptile-apps Bot Sep 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 security Mutable Actions Run in CI

The new resolution job uses mutable major-version tags for actions/checkout and astral-sh/setup-uv. If either upstream tag is repointed or compromised, pull-request and push workflows will execute substituted code with read access to the repository. This is a non-blocking hardening concern; pin both actions to full commit SHAs while retaining version comments for maintainability.

How this was verified: Both mutable references execute before repository-controlled test commands on every pull-request and selected push run with read access to the repository.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 41-42

Comment:
**Mutable Actions Run in CI**

The new resolution job uses mutable major-version tags for `actions/checkout` and `astral-sh/setup-uv`. If either upstream tag is repointed or compromised, pull-request and push workflows will execute substituted code with read access to the repository. This is a non-blocking hardening concern; pin both actions to full commit SHAs while retaining version comments for maintainability.

**How this was verified:** Both mutable references execute before repository-controlled test commands on every pull-request and selected push run with read access to the repository.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Claude Code Fix in Codex

@yudelevi yudelevi Sep 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not in this hotfix: every workflow here (ci, contract, publish) uses the same major tags, so pinning only the new job would be inconsistent. SHA-pinning all workflows is a separate change.

@greptile-apps greptile-apps Bot Sep 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That’s fair. Since ci, contract, and publish all currently use the same major-version action tags, pinning only the new resolution job would create inconsistent hardening rather than address the repository-wide risk. I’ll treat this as out of scope for the 0.4.1 hotfix; SHA-pinning all workflows is better handled in a separate change.

with:
python-version: ${{ matrix.python-version }}
- run: uv sync --all-packages --upgrade --resolution ${{ matrix.resolution }}
- run: uv run --no-sync pytest packages/discolike/tests -q
- run: uv run --no-sync pytest packages/discolike-cli/tests -q
- run: uv build --all-packages -o dist
- run: uv run --no-project --isolated --resolution ${{ matrix.resolution }} --find-links dist --with dist/discolike_cli-*.whl discolike --version

# 3.15 is still prerelease; non-blocking until 3.15.0 final, when it moves
# into the matrix above and gets a classifier.
test-prerelease:
Expand Down
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
# Changelog

## 0.4.1 (2026-09-23)

- CLI: fix `ImportError: cannot import name 'Abort' from 'typer._click.exceptions'` on every command in a fresh 0.4.0 install. Typer 0.27 moved `Abort`; the CLI now imports the public `typer.Abort` and requires `typer>=0.26.1,<0.28`, since it still relies on Typer's vendored Click for its error envelope and help formatting.

## 0.4.0 (2026-09-23)

- SDK: `validate_icp` can run without an LLM key. Pass `integration_id=NATIVE_ICP_ENGINE` (exported from `discolike`, the string `"native-icp"`) to score with DiscoLike's own ICP-fit model instead of your BYOK LLM: no LLM cost, no LLM key, and no web search on that run. The same sentinel works on `discogen.process` for a prompt that already carries the validation structure. Two new errors are specific to it: a 400 `ValidationError` when the ICP text does not yield a Mandatory / Reject if / Nice-to-have prompt, and a 503 `ServerError` when no ICP-fit engine is available. Task lifecycle, polling and statuses are unchanged.
Expand Down
6 changes: 3 additions & 3 deletions packages/discolike-cli/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,16 +4,16 @@ build-backend = "hatchling.build"

[project]
name = "discolike-cli"
version = "0.4.0"
version = "0.4.1"
description = "Official CLI for the DiscoLike API"
readme = "README.md"
license = "MIT"
license-files = ["LICENSE"]
requires-python = ">=3.10"
authors = [{ name = "DiscoLike", email = "support@discolike.com" }]
dependencies = [
"discolike==0.4.0",
"typer>=0.12",
"discolike==0.4.1",
"typer>=0.26.1,<0.28",
"rich>=13.0",
]
keywords = ["discolike", "cli", "business-data", "enrichment"]
Expand Down
2 changes: 1 addition & 1 deletion packages/discolike-cli/src/discolike_cli/main.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
from typing import Any

import typer
from typer._click.exceptions import Abort
from typer import Abort
from typer._click.exceptions import ClickException
from typer._click.exceptions import NoArgsIsHelpError
from typer._click.exceptions import UsageError
Expand Down
6 changes: 3 additions & 3 deletions packages/discolike-cli/tests/test_entrypoint.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,8 @@ def _run(argv: list[str], capsys: pytest.CaptureFixture[str]) -> tuple[int, str,
("argv", "fragment"),
[
(["count", "--nope"], "--nope"),
(["discover", "--max-records", "abc"], "not a valid integer"),
(["discogen", "status"], "TASK_ID"),
(["discover", "--max-records", "abc"], "--max-records"),
(["discogen", "status"], "task_id"),
(["auth", "login", "--method", "bogus"], "--method"),
],
)
Expand All @@ -37,7 +37,7 @@ def test_parser_errors_use_the_json_envelope(
assert payload["code"] == "validation_error"
assert payload["error"] == "ValidationError"
assert payload["exit_code"] == 2
assert fragment in payload["message"]
assert fragment.lower() in payload["message"].lower()


def test_help_still_renders(capsys: pytest.CaptureFixture[str]) -> None:
Expand Down
2 changes: 1 addition & 1 deletion packages/discolike/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ classifiers = [
]

[project.optional-dependencies]
cli = ["discolike-cli==0.4.0"]
cli = ["discolike-cli==0.4.1"]

[project.urls]
Homepage = "https://www.discolike.com"
Expand Down
2 changes: 1 addition & 1 deletion packages/discolike/src/discolike/_version.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
__version__ = "0.4.0"
__version__ = "0.4.1"
2 changes: 1 addition & 1 deletion packages/discolike/tests/test_package.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@


def test_version() -> None:
assert discolike.__version__ == "0.4.0"
assert discolike.__version__ == "0.4.1"
4 changes: 2 additions & 2 deletions uv.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading