From 9f3ed25fc0991e3aa9de8411878805c122f90a11 Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:28:03 -0700 Subject: [PATCH 1/3] release: prepare base-cli 0.4.0 --- CHANGELOG.md | 22 +++++++++++++++++++++- SECURITY.md | 5 +++-- VERSION | 2 +- docs/adopter-readiness.md | 2 +- docs/api-stability.md | 2 +- 5 files changed, 27 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d84d020..fa80851 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,21 @@ All notable changes to base-cli will be documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions are tracked in the repo-root `VERSION` file. -## [Unreleased] +## [0.4.0] - 2026-08-05 + +This is a pre-1.0 minor release and therefore a compatibility boundary. See +the API stability policy and migration guide before upgrading from `0.3.x`. + +### Migration notes + +- Consumer profiles should raise `base_cli.ConfigurationError` for expected, + user-correctable configuration failures instead of plain `ValueError`. +- Consumers should import `RuntimeLayout` from `base_cli.runtime`; the private + `_runtime` module is not a compatibility surface. +- `base_cli.testing.invoke()` now exercises the production `run_app()` boundary, + so tests should assert the same exit status users receive. +- Click-native `--option=value` syntax is accepted and redacted like the + space-separated form. ### Added @@ -81,6 +95,12 @@ and versions are tracked in the repo-root `VERSION` file. - Restore Click-native `--option=value` parsing, including redaction of sensitive equals-form values. +## [Unreleased] + +### Planned + +- Continue compatibility hardening and adoption work for the next release. + ## [0.3.0] - 2026-08-01 ### Changed diff --git a/SECURITY.md b/SECURITY.md index f36588e..33ddd99 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -29,13 +29,14 @@ repository maintainers through the private contact route shown on the Security fixes are targeted at the latest released minor line and the current development branch. At the time this policy was published, that means the -`0.3.x` release line and `main`. Older pre-1.0 lines are best effort only; +`0.4.x` release line and `main`. Older pre-1.0 lines are best effort only; upgrade to the latest release before requesting a backport. A release that changes the supported window will update this table and the changelog. | Version | Security support | | --- | --- | -| `0.3.x` | Supported | +| `0.4.x` | Supported | +| `0.3.x` | Upgrade strongly recommended; best effort only | | `main` | Supported for fixes merged before the next release | | `<0.3` | Upgrade strongly recommended; best effort only | diff --git a/VERSION b/VERSION index 0d91a54..1d0ba9e 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.3.0 +0.4.0 diff --git a/docs/adopter-readiness.md b/docs/adopter-readiness.md index 328c334..a9232ef 100644 --- a/docs/adopter-readiness.md +++ b/docs/adopter-readiness.md @@ -10,7 +10,7 @@ owns product configuration, commands, services, and release policy. Before the first production pilot, the adopter should be able to check every box below: -- [ ] Pin a supported `base-cli` minor release (for example, `~=0.3.0`) and +- [ ] Pin a supported `base-cli` minor release (for example, `~=0.4.0`) and record Click, PyYAML, and any optional integration versions in a lock file. - [ ] Run the adopter's command suite on CPython 3.10--3.14 on every platform the product supports; retain at least one installed-wheel smoke job. diff --git a/docs/api-stability.md b/docs/api-stability.md index 1f1b190..96e22b8 100644 --- a/docs/api-stability.md +++ b/docs/api-stability.md @@ -45,7 +45,7 @@ Until 1.0, the leading zero is meaningful: patch releases remain compatible, while a minor release is a compatibility boundary and may contain a breaking change. We still prefer additive changes, and any pre-1.0 break must include a warning where practical, a migration path, and a changelog entry. Consumers -that need a frozen API should pin a minor release (for example, `~=0.3.0`). +that need a frozen API should pin a minor release (for example, `~=0.4.0`). The core package requires Python `>=3.10` and currently tests CPython 3.10 through 3.14 on Linux, macOS, and Windows. Core runtime dependencies are From 317f128138c9cf6b05f72626bc3425b2a264fbfb Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Wed, 5 Aug 2026 12:45:09 -0700 Subject: [PATCH 2/3] ci: audit release candidates without PyPI self-resolution --- .github/workflows/tests.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index a096968..ef99bd4 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -69,7 +69,14 @@ jobs: - name: Run static security checks run: | bandit -q -r lib/python/base_cli scripts -lll -iii - pip-audit --strict + # The project itself is installed from this checkout and may not be + # published to PyPI yet (for example, while validating a release PR). + # Audit every installed third-party package without asking pip-audit + # to resolve the unpublished project distribution. + python -m pip freeze \ + | grep -Eiv '^base-cli[[:space:]]*==' \ + > "$RUNNER_TEMP/base-cli-audit-requirements.txt" + pip-audit --strict -r "$RUNNER_TEMP/base-cli-audit-requirements.txt" linux-distributions: name: Validate (${{ matrix.name }}) From dee1b63daf566aed56254b7e55300dafbcc8fe9e Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Wed, 5 Aug 2026 12:46:29 -0700 Subject: [PATCH 3/3] ci: exclude local base-cli installs from audit input --- .github/workflows/tests.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index ef99bd4..28e252c 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -74,7 +74,7 @@ jobs: # Audit every installed third-party package without asking pip-audit # to resolve the unpublished project distribution. python -m pip freeze \ - | grep -Eiv '^base-cli[[:space:]]*==' \ + | grep -Eiv '^base-cli([[:space:]]|$)' \ > "$RUNNER_TEMP/base-cli-audit-requirements.txt" pip-audit --strict -r "$RUNNER_TEMP/base-cli-audit-requirements.txt"