chore: release v2.0.4 [skip ci]

Reviewed-on: LilleVemmelund/python-repositories#50

.dockerignore

@@ -0,0 +1,16 @@
+.git
+.github
+.gitea
+.mypy_cache
+.pytest_cache
+.ruff_cache
+.venv
+__pycache__
+*.pyc
+.coverage
+coverage-unit
+coverage-integration
+coverage.txt
+dist
+build
+*.egg-info

.gitea/workflows/ci-image.yml

@@ -0,0 +1,52 @@
+# Build and publish the per-repo CI base image to the Gitea container registry.
+
+name: Build CI Image
+
+on:
+  schedule:
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - pyproject.toml
+      - uv.lock
+      - docker/ci/**
+
+env:
+  REGISTRY: gitea.lille-vemmelund.dk
+  REGISTRY_USER: ci-bot
+  IMAGE: gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Log in to Gitea container registry
+        env:
+          CI_RUNNER_TOKEN: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: |
+          echo "$CI_RUNNER_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+
+      - name: Build CI image
+        env:
+          CI_RUNNER_TOKEN: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: |
+          echo "$CI_RUNNER_TOKEN" > /tmp/uv_token
+          docker build --network=host -f docker/ci/Dockerfile \
+            --secret id=uv_token,src=/tmp/uv_token \
+            -t "${IMAGE}:latest" \
+            .
+          rm -f /tmp/uv_token
+
+      - name: Tag and push CI image
+        run: |
+          STAMP="$(date -u +%Y%m%d%H%M)"
+          docker tag "${IMAGE}:latest" "${IMAGE}:${STAMP}"
+          docker push "${IMAGE}:latest"
+          docker push "${IMAGE}:${STAMP}"
+          echo "Pushed ${IMAGE}:latest and ${IMAGE}:${STAMP}"

.gitea/workflows/code-quality.yml

@@ -8,23 +8,17 @@ on:
 
 jobs:
   code-quality:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
+      - name: Sync dependencies
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync --all-extras
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Type check with mypy
         run: uv run mypy .

.gitea/workflows/dependency-update-bot.yml

@@ -7,24 +7,45 @@ on:
 
 jobs:
   update-check:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           token: ${{ secrets.CI_RUNNER_TOKEN }}
 
-      - name: Set up Python
+      - name: Sync dependencies
-        uses: actions/setup-python@v5
+        env:
-        with:
+          UV_LINK_MODE: copy
-          python-version-file: .python-version
+          UV_INDEX_GITEA_USERNAME: ci-bot
-
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
-      - name: Install uv
+        run: uv sync --all-extras
-        run: pip install uv
 
       - name: Upgrade dependencies
+        env:
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
         run: uv lock --upgrade
 
+      - name: Update pre-commit hook revs
+        env:
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv run pre-commit autoupdate
+
+      - name: Sync upgraded dependencies
+        env:
+          UV_LINK_MODE: copy
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras
+
+      - name: Smoke check
+        run: |
+          uv run ruff check .
+          uv run ruff format --check .
+          uv run mypy .
+
       - name: Commit and push changes
         env:
           API_URL: ${{ vars.API_URL }}

.gitea/workflows/publish.yml

@@ -9,25 +9,24 @@ on:
 
 jobs:
   build-and-publish:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
       - name: Update version in pyproject.toml to match tag
+        env:
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
         run: scripts/ci/bump-version.sh --from-tag "${GITHUB_REF##*/}"
 
       - name: Build package
+        env:
+          UV_LINK_MODE: copy
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
         run: |
-          uv sync --no-dev
+          uv sync --no-dev --frozen
           uv build
 
       - name: Publish to Gitea Package Registry

.gitea/workflows/release.yml

@@ -8,7 +8,7 @@ on:
 jobs:
   release:
     if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -22,19 +22,12 @@ jobs:
           COMMIT_MSG: ${{ github.event.head_commit.message }}
         run: scripts/ci/parse-merge-commit.sh "$COMMIT_MSG"
 
-      - name: Set up Python
-        if: steps.meta.outputs.bump != 'skip'
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        if: steps.meta.outputs.bump != 'skip'
-        run: pip install uv
-
       - name: Bump version
         if: steps.meta.outputs.bump != 'skip'
         id: bump
+        env:
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
         run: scripts/ci/bump-version.sh "${{ steps.meta.outputs.bump }}"
 
       - name: Generate release notes
@@ -81,3 +74,23 @@ jobs:
             -H "Authorization: token ${CI_RUNNER_TOKEN}" \
             -H "Content-Type: application/json" \
             -d "$PAYLOAD"
+
+      # Publish here instead of relying on publish.yml tag trigger: release commits use
+      # [skip ci], which suppresses tag-push workflows, and Gitea does not emit release
+      # events for releases created by the CI bot account.
+      - name: Build package
+        if: steps.meta.outputs.bump != 'skip'
+        env:
+          UV_LINK_MODE: copy
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: |
+          uv sync --no-dev --frozen
+          uv build
+
+      - name: Publish to Gitea Package Registry
+        if: steps.meta.outputs.bump != 'skip'
+        env:
+          UV_PUBLISH_TOKEN: ${{ secrets.CI_RUNNER_TOKEN }}
+          UV_PUBLISH_URL: ${{ vars.REPOSITORY_URL }}
+        run: uv publish

.gitea/workflows/security-audit.yml

@@ -7,23 +7,17 @@ on:
 
 jobs:
   safety:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
+      - name: Sync dependencies
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Run safety check
         run: uv run safety check

.gitea/workflows/test.yml

@@ -8,23 +8,17 @@ on:
 
 jobs:
   unit-tests:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
+      - name: Sync dependencies
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync --all-extras
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Run unit tests
         run: |
@@ -43,23 +37,17 @@ jobs:
           compression-level: 0
 
   integration-tests:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
+      - name: Sync dependencies
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync --all-extras
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Verify Docker
         run: docker info
@@ -83,24 +71,18 @@ jobs:
   coverage-report:
     # Merges unit + integration coverage and enforces fail_under from pyproject.toml.
     needs: [unit-tests, integration-tests]
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     if: github.event_name == 'pull_request' || github.event_name == 'push'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
+      - name: Sync dependencies
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync --all-extras
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Download unit coverage
         uses: https://github.com/christopherHX/gitea-download-artifact@v4

.pre-commit-config.yaml

@@ -11,28 +11,30 @@ repos:
       - id: name-tests-test
       - id: check-merge-conflict
 
-  # Python linting and formatting with Ruff
+  # Python tooling via uv (versions pinned in uv.lock)
-  - repo: https://github.com/astral-sh/ruff-pre-commit
+  - repo: local
-    rev: v0.12.8
     hooks:
       - id: ruff-check
-        args: [--fix]
+        name: ruff check
+        entry: uv run ruff check --fix
+        language: system
+        types: [python]
       - id: ruff-format
-
+        name: ruff format
-  # Static type checking with mypy
+        entry: uv run ruff format
-  - repo: https://github.com/pre-commit/mirrors-mypy
+        language: system
-    rev: v1.8.0
+        types: [python]
-    hooks:
       - id: mypy
-        additional_dependencies:
+        name: mypy
-          - types-redis
+        entry: uv run mypy .
-
+        language: system
-  # Python syntax modernization with pyupgrade
+        types: [python]
-  - repo: https://github.com/asottile/pyupgrade
+        pass_filenames: false
-    rev: v3.20.0
-    hooks:
       - id: pyupgrade
-        args: ["--py312-plus"]
+        name: pyupgrade
+        entry: uv run pyupgrade --py312-plus
+        language: system
+        types: [python]
 
   # Formatting for Markdown, JSON, and YAML with Prettier
   - repo: https://github.com/pre-commit/mirrors-prettier

README.md

@@ -166,7 +166,14 @@ uv run pytest -v                                      # full suite (requires Doc
 
 Integration tests are marked with `@pytest.mark.integration` and require Docker (testcontainers). Run unit tests alone for quick local feedback.
 
-CI runs unit and integration tests in parallel with coverage, then merges `.coverage` artifacts in a follow-up job (via [christopherhx/gitea-\*-artifact@v4](https://github.com/christopherHX/gitea-upload-artifact) for Gitea 1.26 compatibility). Combined coverage must be at least **90%**; the floor is set by [`fail_under` in `pyproject.toml`](pyproject.toml#L45-L48) and enforced after merging unit and integration coverage, not on unit-only runs.
+### CI base image
+
+Gitea Actions jobs use a pre-built image (`python-repositories-ci`) with Python 3.12,
+`uv`, and locked dependencies baked in. The image is rebuilt nightly and when
+`uv.lock` changes; see [`docs/ci-image.md`](docs/ci-image.md) for runner setup and
+bootstrap order.
+
+CI runs unit and integration tests in parallel with coverage, then merges `.coverage` artifacts in a follow-up job (via [christopherhx/gitea-\*-artifact@v4](https://github.com/christopherHX/gitea-upload-artifact) for Gitea 1.26 compatibility). Combined coverage must meet the floor in [`fail_under` in `pyproject.toml`](pyproject.toml#L45-L48); enforcement happens after merging unit and integration coverage, not on unit-only runs.
 
 To check coverage locally (requires Docker for the full suite):
 
@@ -191,8 +198,8 @@ Releases are automated when a pull request is merged to `main`. CI reads the **m
 
 1. Open a PR targeting `main` (see [`.gitea/PULL_REQUEST_TEMPLATE.md`](.gitea/PULL_REQUEST_TEMPLATE.md)).
 2. If the PR changes files under `python_repositories/`, the title **must** start with a version bump prefix (enforced by CI).
-3. On merge, [`release.yml`](.gitea/workflows/release.yml) bumps [`pyproject.toml`](pyproject.toml) and syncs [`uv.lock`](uv.lock), commits, tags `vX.Y.Z`, creates a Gitea release with auto-generated notes, and pushes the tag.
+3. On merge, [`release.yml`](.gitea/workflows/release.yml) bumps [`pyproject.toml`](pyproject.toml) and syncs [`uv.lock`](uv.lock), commits, tags `vX.Y.Z`, creates a Gitea release with auto-generated notes, pushes the tag, and publishes the package to the Gitea Package Registry.
-4. [`publish.yml`](.gitea/workflows/publish.yml) builds and publishes the package to the Gitea Package Registry.
+4. [`publish.yml`](.gitea/workflows/publish.yml) handles manual `v*.*.*` tag pushes only (automated releases publish from `release.yml` because release commits use `[skip ci]`, which suppresses tag-push workflows).
 
 Docs-, CI-, and test-only PRs do not need a prefix and will not trigger a release.
 

docker/ci/Dockerfile

@@ -0,0 +1,29 @@
+# CI job image for Gitea Actions (act_runner requires Node.js in job containers).
+FROM node:20-bookworm
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        git \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=docker:27-cli /usr/local/bin/docker /usr/local/bin/docker
+COPY --from=ghcr.io/astral-sh/uv:0.7.0 /uv /usr/local/bin/uv
+
+ENV UV_PYTHON_INSTALL_DIR=/opt/uv-python \
+    UV_LINK_MODE=copy
+
+COPY .python-version /tmp/.python-version
+RUN uv python install "$(cat /tmp/.python-version)"
+
+WORKDIR /app
+
+COPY pyproject.toml uv.lock .python-version ./
+
+ENV PATH="/app/.venv/bin:${PATH}"
+
+RUN --mount=type=secret,id=uv_token \
+    UV_INDEX_GITEA_USERNAME=ci-bot \
+    UV_INDEX_GITEA_PASSWORD="$(cat /run/secrets/uv_token)" \
+    uv sync --all-extras --frozen --no-install-project

docs/ci-image.md

@@ -0,0 +1,169 @@
+# CI base image
+
+This repository uses a **per-repo Docker image** for Gitea Actions jobs instead of
+installing Python and `uv` on every run. Infrastructure images (redis, minio, etc.)
+are cached cluster-wide via Harbor (see homelab-platform
+[`docs/harbor-registry-mirror.md`](https://gitea.lille-vemmelund.dk/LilleVemmelund/homelab-platform/src/branch/main/docs/harbor-registry-mirror.md)).
+
+## Image contents
+
+Built from [`docker/ci/Dockerfile`](../docker/ci/Dockerfile):
+
+- Node.js 20 (required by act_runner job containers)
+- Python 3.12 (installed via `uv python install` from [`.python-version`](../.python-version)) and pinned `uv` 0.7.0
+- Docker CLI (integration tests via testcontainers)
+- Dev dependencies from `uv.lock` (`uv sync --all-extras --no-install-project`)
+
+Published to the Gitea container registry (owner segment must be lowercase for Docker):
+
+- `gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci:latest`
+- `gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci:YYYYMMDDHHmm` (timestamped rollback tag)
+
+## Rebuild triggers
+
+[`ci-image.yml`](../.gitea/workflows/ci-image.yml) runs on:
+
+- Nightly cron (`0 2 * * *` UTC)
+- Manual `workflow_dispatch`
+- Push to `main` when `pyproject.toml`, `uv.lock`, or `docker/ci/**` change
+
+## Workflow usage
+
+Python jobs use `runs-on: python-repositories-ci` and a fast incremental sync:
+
+```yaml
+runs-on: python-repositories-ci
+steps:
+  - uses: actions/checkout@v4
+  - name: Sync dependencies
+    env:
+      UV_LINK_MODE: copy
+      UV_INDEX_GITEA_USERNAME: ci-bot
+      UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+    run: uv sync --all-extras --frozen
+```
+
+`ci-image.yml` uses `runs-on: ubuntu-latest` so it can bootstrap before the custom
+image exists.
+
+## Registry authentication
+
+act_runner pulls the job image **before any workflow step runs**, so a `docker
+login` step inside a job cannot authenticate that pull. Authentication must be
+configured on the runner (or via a job-level `container.credentials` block — not
+used here).
+
+### k8s Gitea runners (automatic)
+
+The homelab-platform runners mount Gitea registry credentials automatically:
+
+- Secret: `gitea-runners/gitea-registry-dockerconfig` (created by
+  [`scripts/create-gitea-registry-secret.sh`](https://gitea.lille-vemmelund.dk/LilleVemmelund/homelab-platform/src/branch/main/scripts/create-gitea-registry-secret.sh))
+- Mounted at `/root/.docker/config.json` on the **runner** container (not DinD)
+- Configured in
+  [`platform/gitea-runners/values.yaml`](https://gitea.lille-vemmelund.dk/LilleVemmelund/homelab-platform/src/branch/main/platform/gitea-runners/values.yaml)
+
+No manual `docker login` is required on the in-cluster runners once the secret
+exists. To create or rotate credentials:
+
+```bash
+export KUBECONFIG=/path/to/homelab-cluster/talos/_out/kubeconfig
+export GITEA_REGISTRY_USERNAME='ci-bot'
+export GITEA_REGISTRY_PASSWORD='personal-access-token-with-read-package'
+bash scripts/create-gitea-registry-secret.sh
+```
+
+Then restart runner pods so they pick up the updated secret. See homelab-platform
+[`docs/gitea-actions-runners.md`](https://gitea.lille-vemmelund.dk/LilleVemmelund/homelab-platform/src/branch/main/docs/gitea-actions-runners.md)
+for full runner setup.
+
+Verify on a running pod:
+
+```bash
+kubectl -n gitea-runners exec homelab-cluster-gitea-runner-0 -c runner -- \
+  test -f /root/.docker/config.json && echo "registry auth mounted"
+```
+
+### Standalone runners (e.g. Unraid `homelab`)
+
+The 4th runner is outside the k8s cluster and does **not** get the automatic
+mount. Configure registry auth manually on that host:
+
+```bash
+docker login gitea.lille-vemmelund.dk -u ci-bot -p <token>
+```
+
+Also add the `python-repositories-ci` label to that runner's act_runner config.
+
+### `ci-image.yml` push login
+
+The build workflow still runs `docker login` before `docker push`. That step
+authenticates **DinD inside the job** for pushing the image to Gitea — a different
+code path from act_runner pulling the job container.
+
+## Runner label
+
+Jobs use the `python-repositories-ci` act_runner label, configured in
+homelab-platform
+[`platform/gitea-runners/values.yaml`](https://gitea.lille-vemmelund.dk/LilleVemmelund/homelab-platform/src/branch/main/platform/gitea-runners/values.yaml):
+
+```yaml
+python-repositories-ci:docker://gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci:latest
+```
+
+After label changes, roll runner pods so they re-register with Gitea.
+
+## Bootstrap order
+
+1. Ensure homelab-platform runners have `gitea-registry-dockerconfig` and the
+   `python-repositories-ci` label (see homelab-platform docs).
+2. Merge `ci-image.yml`, `docker/ci/Dockerfile`, and workflow migrations to `main`.
+3. Seed the registry with a first image (see below).
+4. Confirm a test workflow job starts on `python-repositories-ci`.
+
+Until step 3 completes, jobs targeting `python-repositories-ci` will fail because
+the image does not exist in the Gitea registry yet.
+
+### Seed the image
+
+**After merge to `main`:** Actions → **Build CI Image** → **Run workflow**.
+
+**Before merge (e.g. PR branch):** the workflow file is not on `main` yet — build
+and push locally with [`scripts/ci/build-ci-image.sh`](../scripts/ci/build-ci-image.sh):
+
+```bash
+export CI_RUNNER_TOKEN='ci-bot-personal-access-token'
+bash scripts/ci/build-ci-image.sh --push
+```
+
+Run from the repo root on the branch you want to test. Runners pull
+`gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci:latest` from the registry;
+they do not care which git branch built it.
+
+Override registry settings if needed:
+
+```bash
+export REGISTRY=gitea.lille-vemmelund.dk
+export REGISTRY_USER=ci-bot
+export CI_RUNNER_TOKEN='...'
+bash scripts/ci/build-ci-image.sh --push
+```
+
+## Local build
+
+Build only (no registry login or push):
+
+```bash
+export CI_RUNNER_TOKEN='ci-bot-personal-access-token'
+bash scripts/ci/build-ci-image.sh --local
+```
+
+Or manually:
+
+```bash
+echo "$CI_RUNNER_TOKEN" > /tmp/uv_token
+docker build -f docker/ci/Dockerfile \
+  --secret id=uv_token,src=/tmp/uv_token \
+  -t python-repositories-ci:local .
+rm -f /tmp/uv_token
+```

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "python-repositories"
-version = "2.0.2"
+version = "2.0.4"
 description = "Various python repository interfaces exposed as a python package."
 authors = [
     { name = "Brian Bjarke Jensen", email = "schnitzelen@gmail.com" }
@@ -60,6 +60,18 @@ name = "gitea"
 url = "https://gitea.lille-vemmelund.dk/api/packages/brian/pypi/simple/"
 explicit = true
 
+[tool.ruff]
+line-length = 88
+target-version = "py312"
+
+[tool.ruff.lint]
+extend-select = ["I"]
+
+[tool.ruff.lint.isort]
+known-first-party = ["python_repositories", "tests"]
+combine-as-imports = true
+force-sort-within-sections = true
+
 [tool.mypy]
 python_version = "3.12"
 warn_return_any = true  # nudge to use stricter types
@@ -87,12 +99,12 @@ ignore_missing_imports = true
 
 [dependency-groups]
 dev = [
-    "mypy>=1.17.1",
+    "mypy>=2.1.0",
-    "pre-commit>=4.3.0",
+    "pre-commit>=4.6.0",
     "pytest>=8.4.1",
     "pytest-cov>=7.0.0",
-    "pyupgrade>=3.20.0",
+    "pyupgrade>=3.21.2",
-    "ruff>=0.12.11",
+    "ruff>=0.15.20",
     "safety>=3.6.0",
     "testcontainers>=4.13.0",
     "types-redis>=4.6.0.20241004",

python_repositories/adapters/connection_aware_adapter.py

@@ -2,8 +2,8 @@
 
 from __future__ import annotations
 
-import time
 from abc import abstractmethod
+import time
 from typing import Self
 
 import structlog
@@ -73,7 +73,7 @@ class ConnectionAwareAdapter(ConnectionAwareInterface, ContextAwareInterface):
             self._invalidate_health_cache()
             return
         if self._is_client_ready() and self.is_connected():
-            self.logger.info(f"Already connected to {self.connection_name}")
+            self.logger.info("Already connected", connection_name=self.connection_name)
             return
         self.disconnect()
         self._establish_connection()

python_repositories/adapters/minio_adapter.py

@@ -1,6 +1,7 @@
 """Definition of MinioAdapter class."""
 
 from __future__ import annotations
+
 from io import BytesIO
 
 from python_repositories.adapters.connection_aware_adapter import (
@@ -88,7 +89,7 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
                 raise ConnectionError(
                     f"Bucket '{bucket}' does not exist on Minio at {endpoint}"
                 )
-            self.logger.info(f"Creating bucket '{bucket}'")
+            self.logger.info("Creating bucket", bucket=bucket)
             client.make_bucket(bucket)
         self._client = client
         self._bucket_name = bucket
@@ -138,7 +139,7 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
             content_type=content_type,
         )
         self.logger.debug(
-            f"Put object '{object_name}' into bucket '{self._bucket_name}'"
+            "Put object", object_name=object_name, bucket=self._bucket_name
         )
 
     def get(self, object_name: str) -> BytesIO | None:
@@ -163,13 +164,15 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
                 buffer.write(chunk)
             buffer.seek(0)
             self.logger.debug(
-                f"Got object '{object_name}' from bucket '{self._bucket_name}'"
+                "Got object", object_name=object_name, bucket=self._bucket_name
             )
             return buffer
         except minio.S3Error as exc:
             if exc.code == "NoSuchKey":
                 self.logger.warning(
-                    f"Object '{object_name}' not found in bucket '{self._bucket_name}'"
+                    "Object not found",
+                    object_name=object_name,
+                    bucket=self._bucket_name,
                 )
                 return None
             raise
@@ -193,7 +196,7 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
             object_name=object_name,
         )
         self.logger.debug(
-            f"Deleted object '{object_name}' from bucket '{self._bucket_name}'"
+            "Deleted object", object_name=object_name, bucket=self._bucket_name
         )
 
     def list_objects(self, prefix: str = "") -> list[str]:
@@ -215,6 +218,9 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
             obj.object_name for obj in objects if obj.object_name is not None
         ]
         self.logger.debug(
-            f"Listed {len(object_names)} object(s) in bucket '{self._bucket_name}' with prefix '{prefix}'"
+            "Listed objects",
+            count=len(object_names),
+            bucket=self._bucket_name,
+            prefix=prefix,
         )
         return object_names

python_repositories/adapters/redis_adapter.py

@@ -1,6 +1,7 @@
 """Definition of RedisAdapter class."""
 
 from __future__ import annotations
+
 from collections.abc import Iterator
 from typing import Any, cast
 
@@ -101,7 +102,7 @@ class RedisAdapter(JsonRepositoryInterface, ConnectionAwareAdapter):
         assert self._client is not None
         # Set data
         self._client.json().set(key, self.path, data)
-        self.logger.debug(f"Set {key} to {data}")
+        self.logger.debug("Set key", key=key, data_keys=list(data.keys()))
 
     def get(self, key: str) -> dict[str, Any] | None:
         """Get a JSON object from Redis."""
@@ -116,7 +117,7 @@ class RedisAdapter(JsonRepositoryInterface, ConnectionAwareAdapter):
             dict[str, Any] | None,
             self._client.json().get(key),
         )
-        self.logger.debug(f"Got {data} from {key}")
+        self.logger.debug("Got value", key=key, found=data is not None)
         return data
 
     def delete(self, key: str) -> None:
@@ -129,7 +130,7 @@ class RedisAdapter(JsonRepositoryInterface, ConnectionAwareAdapter):
         assert self._client is not None
         # Delete data
         self._client.json().delete(key)
-        self.logger.debug(f"Deleted {key}")
+        self.logger.debug("Deleted key", key=key)
 
     def _validate_pattern(self, pattern: str) -> None:
         if not isinstance(pattern, str) or len(pattern) == 0:
@@ -147,7 +148,7 @@ class RedisAdapter(JsonRepositoryInterface, ConnectionAwareAdapter):
             self._client.keys(pattern),
         )
         keys: list[str] = [key.decode(self.encoding) for key in keys_raw]
-        self.logger.debug(f"Got {keys} matching {pattern}")
+        self.logger.debug("Listed keys", pattern=pattern, count=len(keys))
         return keys
 
     def scan_keys(

python_repositories/config/minio_config.py

@@ -2,8 +2,8 @@
 
 from __future__ import annotations
 
-import os
 from dataclasses import dataclass
+import os
 
 from python_utils import check_env
 

python_repositories/config/redis_config.py

@@ -2,8 +2,8 @@
 
 from __future__ import annotations
 
-import os
 from dataclasses import dataclass
+import os
 
 from python_utils import check_env
 

python_repositories/interfaces/json_repository_interface.py

@@ -1,7 +1,7 @@
 """Definition of JsonRepositoryInterface abstract base class."""
 
-from collections.abc import Iterator
 from abc import ABC, abstractmethod
+from collections.abc import Iterator
 from typing import Any
 
 

scripts/ci/build-ci-image.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Build and optionally push the Gitea Actions CI base image locally.
+#
+# Use when ci-image.yml is not yet on main (e.g. bootstrapping a PR branch) or
+# when you need to rebuild without waiting for the nightly workflow.
+#
+# Build only (smoke test):
+#   export CI_RUNNER_TOKEN='ci-bot-personal-access-token'
+#   bash scripts/ci/build-ci-image.sh --local
+#
+# Build and push to Gitea (unblocks python-repositories-ci jobs):
+#   export CI_RUNNER_TOKEN='ci-bot-personal-access-token'
+#   bash scripts/ci/build-ci-image.sh --push
+#
+# Optional overrides:
+#   REGISTRY=gitea.lille-vemmelund.dk
+#   REGISTRY_USER=ci-bot
+#   IMAGE_OWNER=lillevemmelund
+#   IMAGE_NAME=python-repositories-ci
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+
+REGISTRY="${REGISTRY:-gitea.lille-vemmelund.dk}"
+REGISTRY_USER="${REGISTRY_USER:-ci-bot}"
+IMAGE_OWNER="${IMAGE_OWNER:-lillevemmelund}"
+IMAGE_NAME="${IMAGE_NAME:-python-repositories-ci}"
+IMAGE="${IMAGE:-${REGISTRY}/${IMAGE_OWNER}/${IMAGE_NAME}}"
+
+MODE="push"
+if [[ "${1:-}" == "--local" ]]; then
+  MODE="local"
+elif [[ "${1:-}" == "--push" || -z "${1:-}" ]]; then
+  MODE="push"
+elif [[ -n "${1:-}" ]]; then
+  echo "Usage: build-ci-image.sh [--local | --push]" >&2
+  exit 1
+fi
+
+: "${CI_RUNNER_TOKEN:?CI_RUNNER_TOKEN is required (ci-bot token with read/write package access)}"
+
+TOKEN_FILE="$(mktemp)"
+cleanup() {
+  rm -f "$TOKEN_FILE"
+}
+trap cleanup EXIT
+
+printf '%s' "$CI_RUNNER_TOKEN" >"$TOKEN_FILE"
+
+cd "$REPO_ROOT"
+
+if [[ "$MODE" == "local" ]]; then
+  echo "=== Building local CI image (no push): python-repositories-ci:local ==="
+  docker build --network=host -f docker/ci/Dockerfile \
+    --secret "id=uv_token,src=${TOKEN_FILE}" \
+    -t python-repositories-ci:local \
+    .
+  echo "Built python-repositories-ci:local"
+  exit 0
+fi
+
+echo "=== Logging in to ${REGISTRY} as ${REGISTRY_USER} ==="
+echo "$CI_RUNNER_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+
+echo "=== Building ${IMAGE}:latest ==="
+docker build --network=host -f docker/ci/Dockerfile \
+  --secret "id=uv_token,src=${TOKEN_FILE}" \
+  -t "${IMAGE}:latest" \
+  .
+
+STAMP="$(date -u +%Y%m%d%H%M)"
+echo "=== Pushing ${IMAGE}:latest and ${IMAGE}:${STAMP} ==="
+docker tag "${IMAGE}:latest" "${IMAGE}:${STAMP}"
+docker push "${IMAGE}:latest"
+docker push "${IMAGE}:${STAMP}"
+
+echo "Done. Re-run failing CI jobs — runners pull ${IMAGE}:latest"

scripts/ci/create-deps-update-pr.sh

@@ -11,15 +11,16 @@ set -euo pipefail
 BRANCH="${BRANCH:-renovate/auto-deps-update}"
 BASE_BRANCH="${BASE_BRANCH:-main}"
 LOCKFILE="${LOCKFILE:-uv.lock}"
+PRE_COMMIT_CONFIG="${PRE_COMMIT_CONFIG:-.pre-commit-config.yaml}"
 
-if git diff --quiet "$LOCKFILE"; then
+if git diff --quiet "$LOCKFILE" && git diff --quiet "$PRE_COMMIT_CONFIG"; then
   echo "No dependency updates available."
   exit 0
 fi
 
 git config user.name "CI Bot"
 git config user.email "ci-bot@example.com"
-git add "$LOCKFILE"
+git add "$LOCKFILE" "$PRE_COMMIT_CONFIG"
 git commit -m "chore(deps): update dependencies [automated]"
 
 git remote set-url origin "https://x-access-token:${CI_RUNNER_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git"
@@ -48,7 +49,12 @@ print(
     json.dumps(
         {
             "title": "chore(deps): update dependencies",
-            "body": "This PR was created automatically to update dependencies.",
+            "body": (
+                "This PR was created automatically to update dependencies.\n\n"
+                "- `uv.lock`: upgraded Python dependencies\n"
+                "- `.pre-commit-config.yaml`: updated remote hook revs via "
+                "`pre-commit autoupdate`"
+            ),
             "head": os.environ["BRANCH"],
             "base": os.environ["BASE_BRANCH"],
         }

tests/integration/conftest.py

@@ -1,13 +1,13 @@
 """Integration tests configuration."""
 
-import logging
 from collections.abc import Generator
+import logging
 from typing import Any, cast
 
+from minio import Minio
 import pytest
 import redis
 import structlog
-from minio import Minio
 from testcontainers.core.container import DockerContainer
 from testcontainers.core.waiting_utils import WaitStrategy, WaitStrategyTarget
 from testcontainers.minio import MinioContainer

tests/integration/examples_test.py

@@ -5,8 +5,8 @@ from io import BytesIO
 import os
 import random
 
-import pytest
 from minio import Minio
+import pytest
 
 from python_repositories.examples.artifact_object_repository import (
     ArtifactObjectRepository,

tests/integration/minio_adapter_test.py

@@ -2,13 +2,13 @@
 
 from collections.abc import Generator
 from dataclasses import replace
+from io import BytesIO
 import logging
 import random
-from io import BytesIO
 from unittest.mock import MagicMock
 
-import pytest
 from minio import Minio, S3Error
+import pytest
 from urllib3.response import BaseHTTPResponse
 
 from python_repositories.adapters.minio_adapter import MinioAdapter
@@ -102,7 +102,8 @@ def test_should_log_info_when_already_connected(
     """Test that the MinioAdapter logs info when connect is called while already connected."""
     with caplog.at_level(logging.INFO):
         minio_adapter.connect()
-    assert "Already connected to Minio" in caplog.text
+    assert "Already connected" in caplog.text
+    assert "Minio" in caplog.text
 
 
 def test_should_raise_connection_error_when_unable_to_connect() -> None:
@@ -150,7 +151,8 @@ def test_connect_creates_bucket_when_create_bucket_if_missing_enabled(
     with caplog.at_level(logging.INFO):
         adapter.connect()
 
-    assert f"Creating bucket '{bucket_name}'" in caplog.text
+    assert "Creating bucket" in caplog.text
+    assert bucket_name in caplog.text
 
 
 def test_should_log_error_on_exception_during_exit(
@@ -233,10 +235,11 @@ def test_should_log_warning_when_getting_nonexistent_object(
     with caplog.at_level("WARNING"):
         result = adapter.get(object_name)
     assert result is None
-    assert (
+    assert "Object not found" in caplog.text
-        f"Object '{object_name}' not found in bucket '{adapter._bucket_name}'"
+    assert object_name in caplog.text
-        in caplog.text
+    bucket_name = adapter._bucket_name
-    )
+    assert bucket_name is not None
+    assert bucket_name in caplog.text
 
 
 def test_should_reraise_s3error_other_than_no_such_key() -> None:

tests/integration/redis_adapter_test.py

@@ -56,7 +56,8 @@ def test_should_log_info_when_already_connected(
     """Test that the RedisAdapter logs info when connect is called while already connected."""
     with caplog.at_level(logging.INFO):
         redis_adapter.connect()
-    assert "Already connected to Redis" in caplog.text
+    assert "Already connected" in caplog.text
+    assert "Redis" in caplog.text
 
 
 def test_should_raise_connection_error_when_unable_to_connect() -> None:

tests/unit/adapters_test.py

@@ -3,12 +3,12 @@
 from __future__ import annotations
 
 import builtins
+from collections.abc import Callable, Mapping, Sequence
 import importlib
 import os
+from pathlib import Path
 import subprocess
 import sys
-from collections.abc import Callable, Mapping, Sequence
-from pathlib import Path
 from types import ModuleType
 from unittest.mock import patch
 

tests/unit/conftest.py

@@ -4,9 +4,9 @@ from __future__ import annotations
 
 from unittest.mock import MagicMock
 
+from minio import Minio
 import pytest
 import redis
-from minio import Minio
 
 from python_repositories.adapters.minio_adapter import MinioAdapter
 from python_repositories.adapters.redis_adapter import RedisAdapter

tests/unit/connection_aware_interface_test.py

@@ -1,6 +1,7 @@
 """Unit tests for ConnectionAwareInterface."""
 
 import pytest
+
 from python_repositories.interfaces.connection_aware_interface import (
     ConnectionAwareInterface,
 )

tests/unit/context_aware_interface_test.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import pytest
+
 from python_repositories.interfaces.context_aware_interface import ContextAwareInterface
 
 

tests/unit/json_repository_interface_test.py

@@ -3,6 +3,7 @@
 from typing import Any
 
 import pytest
+
 from python_repositories.interfaces.json_repository_interface import (
     JsonRepositoryInterface,
 )

tests/unit/minio_adapter_test.py

@@ -5,8 +5,8 @@ from __future__ import annotations
 from dataclasses import replace
 from unittest.mock import MagicMock
 
-import pytest
 from minio import Minio, S3Error
+import pytest
 from urllib3.response import BaseHTTPResponse
 
 from python_repositories.adapters.minio_adapter import MinioAdapter

tests/unit/object_repository_interface_test.py

@@ -3,6 +3,7 @@
 from io import BytesIO
 
 import pytest
+
 from python_repositories.interfaces.object_repository_interface import (
     ObjectRepositoryInterface,
 )

uv.lock

@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 2
 requires-python = ">=3.12"
 resolution-markers = [
     "python_full_version >= '3.15'",
@@ -1056,7 +1056,7 @@ wheels = [
 
 [[package]]
 name = "python-repositories"
-version = "2.0.2"
+version = "2.0.4"
 source = { editable = "." }
 dependencies = [
     { name = "python-dotenv" },
@@ -1097,12 +1097,12 @@ provides-extras = ["redis", "minio"]
 
 [package.metadata.requires-dev]
 dev = [
-    { name = "mypy", specifier = ">=1.17.1" },
+    { name = "mypy", specifier = ">=2.1.0" },
-    { name = "pre-commit", specifier = ">=4.3.0" },
+    { name = "pre-commit", specifier = ">=4.6.0" },
     { name = "pytest", specifier = ">=8.4.1" },
     { name = "pytest-cov", specifier = ">=7.0.0" },
-    { name = "pyupgrade", specifier = ">=3.20.0" },
+    { name = "pyupgrade", specifier = ">=3.21.2" },
-    { name = "ruff", specifier = ">=0.12.11" },
+    { name = "ruff", specifier = ">=0.15.20" },
     { name = "safety", specifier = ">=3.6.0" },
     { name = "testcontainers", specifier = ">=4.13.0" },
     { name = "types-redis", specifier = ">=4.6.0.20241004" },