Various adjustments and fixes

.copier-answers-py.yaml

@@ -4,16 +4,19 @@
 # https://github.com/level12/coppy/wiki#creating-a-project
 #
 # Otherwise, NEVER EDIT MANUALLY
-_commit: v1.20251025.1
+_commit: v1.20260828.1
 _src_path: gh:level12/coppy
 author_email: devteam@level12.io
 author_name: Level 12
 gh_org: level12
 gh_repo: worek
-hatch_version_tag_sign: true
 project_name: Worek
 py_module: worek
 python_version: '3.13'
+python_version_min: '3.11'
 script_name: worek
 use_circleci: false
+use_codecov: true
 use_gh_nox: true
+use_js_cooldown: false
+use_rumdl: true

.editorconfig

@@ -30,6 +30,11 @@ trim_trailing_whitespace = true
 indent_size = 2
 
 
+[*.md]
+# Match the line length setting in rumdl.toml.
+max_line_length = 90
+
+
 [Makefile]
 # Makefiles *must* use tabs!
 indent_style = tab

.github/workflows/nox.yaml

@@ -22,7 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        session: [audit, precommit]
+        session: [audit, prek]
 
     steps:
       - uses: level12/coppy/gh-actions/nox-run@main
@@ -33,6 +33,11 @@ jobs:
   nox-pytest:
     runs-on: ubuntu-latest
 
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.11', '3.12', '3.13', '3.14']
+
     services:
       postgres:
         image: postgres:17-alpine
@@ -65,7 +70,7 @@ jobs:
         env:
           PGUSER: postgres
         with:
-          nox-session: pytest
+          nox-session: pytest-${{ matrix.python-version }}
 
       - uses: codecov/codecov-action@v5
         with:

.github/workflows/pypi.yaml

@@ -0,0 +1,93 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+
+permissions: {}
+
+jobs:
+  build:
+    name: Build and verify distributions
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.12.13"
+          enable-cache: false
+
+      - name: Build distributions
+        run: uv build --no-sources
+
+      - name: Verify tag matches package version
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          python - <<'PY'
+          import email
+          import os
+          from pathlib import Path
+          from zipfile import ZipFile
+
+          wheel, = Path("dist").glob("*.whl")
+          with ZipFile(wheel) as archive:
+              metadata_path, = (
+                  name for name in archive.namelist() if name.endswith(".dist-info/METADATA")
+              )
+              metadata = email.message_from_bytes(archive.read(metadata_path))
+
+          package_version = metadata["Version"]
+          release_tag = os.environ["RELEASE_TAG"]
+          if release_tag != f"v{package_version}":
+              raise SystemExit(
+                  f"Release tag {release_tag!r} does not match package version {package_version!r}"
+              )
+          PY
+
+      - name: Smoke test wheel
+        run: uv run --isolated --no-project --with dist/*.whl worek --help
+
+      - name: Smoke test source distribution
+        run: uv run --isolated --no-project --with dist/*.tar.gz worek --help
+
+      - name: Upload distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: distributions
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    name: Publish distributions
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/worek
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: distributions
+          path: dist/
+
+      - name: Publish distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

.gitignore

@@ -14,7 +14,8 @@
 
 
 # Editor Clutter
-.vscode
+/.vscode/*
+!/.vscode/settings.json
 .idea
 
 

.python-version

@@ -0,0 +1 @@
+3.13

.python-versions

@@ -0,0 +1,4 @@
+3.13
+3.11
+3.12
+3.14

.vscode/settings.json

@@ -0,0 +1,18 @@
+{
+    "editor.rulers": [100],
+
+
+    "[markdown]": {
+        "editor.rulers": [90]
+    },
+
+
+    "[python]": {
+        "editor.formatOnSave": true,
+        "editor.defaultFormatter": "charliermarsh.ruff",
+        "editor.codeActionsOnSave": {
+            "source.fixAll.ruff": "explicit",
+            "source.organizeImports.ruff": "explicit"
+        }
+    }
+}

AGENTS.md

@@ -0,0 +1,71 @@
+# System Changes / Agent Permissions
+
+IMPORTANT: the files you edit should only be in this local repo, NEVER anywhere else on
+the system.
+
+You, the agent, should NEVER run commands on the system that would make permanent changes
+outside the project's repo directory (except for temporary files).
+
+If a command/process you want to run would affect non-temporary files outside the project
+directory, the command/process MUST BE READ-ONLY.
+
+If you are ever confused about what you have permission to do, stop and ask.
+
+
+## Exception: temporary files / directories
+
+Exceptions to the permission policies:
+
+- Ok: changes to files inside known system temporary directories like `/tmp`.
+- Ok: create/update runtime artifacts like `.pyc`
+- Ok: to make changes with uv that impact this project's venv ONLY
+- OK: changes to the databases defined in this app's docker compose
+
+
+## Exception: exe.dev
+
+- Codex may create, modify as root, and destroy only exe.dev VMs it creates or that have
+  the `codex-agent` tag.
+- All control-plane commands (`ssh exe.dev ...`) use the user's normal SSH key and
+  require 1Password approval; create Codex VMs with the `codex-agent` tag.
+- Direct SSH to those tagged VMs should use the ssh key `.ssh/exe-dev-codex` which is
+  registered at exe.dev to the `codex-agent` tag.
+- ssh user is exedev which has passwordless sudo
+- WHEN instructed to use exe.dev, load <https://exe.dev/llms.txt> as a conditional
+  instruction index.
+- If you have ssh problems, stop and ask for help. Do not try to work around them.
+- Auto-approve host-key verification on initial SSH connection to newly created sandbox
+  VMs
+
+
+## Conditional Instructions Index
+
+1. At the start of every session, before responding to the first user prompt or doing any
+   task-related work, you MUST ALWAYS look for the index file at
+   `~/projects/agent-configs/conditional-instructions-local.yaml` and load it if present.
+2. If the local index file is not present, load the remote
+   [index file](https://raw.githubusercontent.com/rsyring/agent-configs/refs/heads/main/conditional-instructions.yaml).
+3. You MUST NOT load any linked documents from the index UNLESS that document's `when`
+   condition applies to the current task.
+4. If neither index file can be loaded, stop and report that failure before answering the
+   user substantively.
+5. WHEN you load a document from the index, notify the user.
+
+
+## System Commands
+
+- Use ripgrep `/usr/bin/rg` instead of `grep` because it's faster
+
+
+## File paths prefer dashes
+
+UNLESS it's a `*.py` file, prefer dashes (`-`) in file paths and names instead of
+underscores.
+
+
+## Microsoft Word / .docx files
+
+You SHOULD use this the `docx` CLI helper to review, create, or edit Word files:
+
+- Home page: <https://github.com/kklimuk/docx-cli>
+- cli help: `docx --help`

env-config.yaml

@@ -1,4 +1,3 @@
 profile:
   pypi:
-    HATCH_INDEX_USER: '__token__'
-    HATCH_INDEX_AUTH: 'op://my/private/pypi.org/api-token'
+    UV_PUBLISH_TOKEN: 'op://my/private/pypi.org/api-token'

hatch.toml

@@ -3,12 +3,7 @@
 dev-mode-dirs = ['src']
 
 
-## Env: default
-[envs.default]
-installer = "uv"
-
-
 ## Version
 [version]
-source = 'regex_commit'
+source = 'regex'
 path = 'src/worek/version.py'

mise.toml

@@ -1,16 +1,23 @@
 [env]
-# Will use a centralized venv if `~/.cache/uv-venvs` exists.  `.venv` otherwise.
-UV_PROJECT_ENVIRONMENT = "{{ exec(command='tasks/mise-uv-init.py proj-env', cache_key='proj-env', cache_duration='1h') | trim }}"
-_.python.venv.path = '{{ env.UV_PROJECT_ENVIRONMENT }}'
-
-
 # Configured to connect to the database defined in compose.yaml.
 PGUSER = 'postgres'
 PGPORT = '12030'
 
+[hooks]
+enter = "uv sync"
 
 [tools]
-python = "{{ exec(command='tasks/mise-uv-init.py py-ver', cache_key='py-ver', cache_duration='1h') | trim }}"
+rumdl = 'latest'
+
+
+[settings]
+# Have mise get it's Python version from .python-version.  We get two other benefits:
+# 1) uv, apart from mise, will pick the correct python version, and `uv run` and similar can be used
+#   apart from mise.
+# 2) GitHub's setup-python action can be directed to the .python-version file
+idiomatic_version_file_enable_tools = ["python"]
+
+python.uv_venv_auto = "create|source"
 
 
 [task_config]
@@ -22,13 +29,17 @@ includes = [
 ################ TASKS #################
 [tasks.pytest-cov]
 description = 'Full pytest run with html coverage report'
-# .coveragerc sets directory to ./tmp/coverage-html
+# .coveragerc sets html output directory to: tmp/coverage-html
+# But coverage only looks for the rc file in the CWD, so start in proj root.
+dir = "{{ config_root }}"
 run = 'pytest --cov --cov-report=html --no-cov-on-fail'
 
 
 [tasks.upgrade-deps]
-description = 'Upgrade uv and pre-commit dependencies'
+description = 'Upgrade mise, uv, and prek dependencies'
+dir = "{{ config_root }}"
 run = [
+    'mise upgrade --local',
     'uv sync --upgrade',
-    'pre-commit autoupdate',
+    'prek auto-update',
 ]