chore(ci): ensure __version__ is valid under PEP-440 (#8)

* chore(ci): ensure __version__ is valid under PEP-440

* chore(ci): refine actions perms

.github/workflows/ci.yml

@@ -9,29 +9,27 @@ on:
       - synchronize
   workflow_call:
 
-permissions:
-  contents: read
-  actions: read # required by nrwl/nx-set-shas
-
 jobs:
   ci-javascript:
     name: 'CI: JavaScript'
     uses: secretflow/web-ci/.github/workflows/ci-javascript.yml@main
     with:
       node-version: ${{ matrix.node-version }}
-      python-version: '3.8'
+      python-version: ${{ matrix.python-version }}
     strategy:
       fail-fast: false
       matrix:
         node-version: ['18', '20']
+        python-version: ['3.8']
 
   ci-python:
     name: 'CI: Python'
     uses: secretflow/web-ci/.github/workflows/ci-python.yml@main
     with:
-      node-version: '18'
+      node-version: ${{ matrix.node-version }}
       python-version: ${{ matrix.python-version }}
     strategy:
       fail-fast: false
       matrix:
+        node-version: ['18']
         python-version: ['3.8']

.github/workflows/release.yml

@@ -5,8 +5,6 @@ on:
   push:
     branches: ['main']
 
-permissions: {}
-
 jobs:
   changesets:
     # prevents this action from running on forks
@@ -16,9 +14,7 @@ jobs:
     uses: secretflow/web-ci/.github/workflows/release-changesets.yml@main
 
     permissions:
-      contents: write # to create release (changesets/action)
-      pull-requests: write # to create pull request (changesets/action)
-    secrets: inherit
+      pull-requests: write
 
   ci:
     needs: [changesets]
@@ -40,6 +36,13 @@ jobs:
     name: Publish
     uses: secretflow/web-ci/.github/workflows/release-publish.yml@main
 
+    with:
+      node-version: '18'
+      python-version: '3.8'
+
     permissions:
-      contents: write # to create tags
-    secrets: inherit
+      contents: write
+
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}

.github/workflows/update-labels.yml

@@ -15,4 +15,3 @@ on:
 jobs:
   update:
     uses: secretflow/web-ci/.github/workflows/update-labels.yml@main
-    secrets: inherit

package.json

@@ -14,8 +14,8 @@
     "format:black": "python -m black --check examples",
     "format:prettier": "prettier --check --ignore-unknown .",
     "ci:setup": "nx run-many -p tag:postinstall -t setup:umi -t build",
-    "ci:javascript": "nx run-many -t format:prettier -t lint:eslint -t lint:stylelint -t test:vitest -t typecheck:tsc",
-    "ci:python": "nx run-many -t format:black -t lint:ruff -t test:pytest -t typecheck:pyright",
+    "ci:check:javascript": "nx run-many -t format:prettier -t lint:eslint -t lint:stylelint -t test:vitest -t typecheck:tsc",
+    "ci:check:python": "nx run-many -t format:black -t lint:ruff -t test:pytest -t typecheck:pyright",
     "ci:build": "nx run-many -t build",
     "ci:publish": "nx run-many --nx-bail -t build && changeset publish && nx run-many --nx-bail -t publish"
   },

packages/secretnote-ui/src/components/ExecutionGraph/shapes.ts

@@ -262,7 +262,8 @@ function distance(x1: number, y1: number, x2: number, y2: number): number {
   return Math.sqrt(Math.pow(x2 - x1, 2) + Math.pow(y2 - y1, 2));
 }
 
-// Thank you GPT (and Desmos)
+// https://www.desmos.com/calculator/fjaz7sv20l
+// https://chat.openai.com/share/1f0e4621-9c46-491b-92c1-c62c798f46b8
 function textRotation(x1: number, y1: number, x2: number, y2: number): number {
   const dx = x2 - x1;
   const dy = y2 - y1;

pyprojects/secretnote/README.md

@@ -21,8 +21,14 @@
 
 **Please read our [note about dependencies](#environment-and-dependency-versioning) first.**
 
+We recommend installing in a clean Python environment.
+
 ```bash
-pip install 'secretflow==1.2.0b0' 'secretnote==0.1.0.dev0'
+python --version
+# Python 3.8.18
+python -m venv .venv
+source .venv/bin/activate
+python -m pip install 'secretflow==1.2.0b0' 'secretnote==0.1.0.dev0'
 ```
 
 ## Start
@@ -54,11 +60,11 @@ secretnote --ServerApp.port 8889
 ```python
 from secretnote.instrumentation.sdk import create_profiler
 
-profiler = create_profiler()
-
-with profiler.start():
+with create_profiler() as profiler:
     # SecretFlow code here
-    result = spu(fit)(...)
+    weights = alice(...)(...)
+    bias = bob(...)(...)
+    result = spu(...)(...)
 
 profiler.visualize()
 ```
@@ -67,9 +73,11 @@ profiler.visualize()
 
 ### Environment and dependency versioning
 
+_For best results, install this project in a clean Python environment._
+
 SecretFlow has many platform-specific dependencies. As this project is in early stage, we do not yet guarantee that this project will work in all environments, or even that installation will succeed.
 
-For best results, install this project in a clean Python environment.
+Supported Python versions match those of [SecretFlow], currently only Python 3.8.
 
 To see versions of commonly used dependencies, run `python -m secretnote.utils.version`:
 

pyprojects/secretnote/package.json

@@ -9,11 +9,11 @@
   "scripts": {
     "format:black": "python -m black --check src tests",
     "lint:ruff": "python -m ruff check src tests",
-    "publish": "python -m hatch publish ./dist",
     "test:pytest": "python -m pytest",
     "typecheck:pyright": "pyright --project ../.. src tests",
     "dev": "NODE_ENV=development python -m secretnote.server --config=./.jupyter/config_dev.py --debug --no-browser",
-    "build": "python scripts/copy_static_files.py && python -m hatch clean && python -m hatch build -t sdist -t wheel"
+    "build": "python scripts/copy_static_files.py && python -m hatch clean && python -m hatch build -t sdist -t wheel",
+    "publish": "python -m hatch publish ./dist"
   },
   "devDependencies": {
     "@secretflow/secretnote": "workspace:^",

pyprojects/secretnote/pyproject.toml

@@ -25,9 +25,9 @@ dependencies = [
   "pydantic>=1.10, <2",
   "pymysql~=1.1",
   "ray[default]~=2.6.3", # FIXME: ideally from upstream
+  "rich>=13.7.0",
   "stack_data>=0.6.3",
   "tqdm>=4.66.1",
-  "rich>=13.7.0",
 ]
 description = "Notebook suite for SecretFlow"
 dynamic = ["version"]
@@ -41,7 +41,7 @@ secretnote = "secretnote.server.app:SecretNoteApp.launch"
 
 [build-system]
 build-backend = "hatchling.build"
-requires = ["hatchling"]
+requires = ["hatchling", "packaging>=23.1"]
 
 [tool.rye]
 dev-dependencies = [

pyprojects/secretnote/src/secretnote/_version.py

@@ -4,21 +4,46 @@
 
 def get_version() -> str:
     try:
-        # read from package.json
+        from packaging.version import InvalidVersion, parse
+
+        def normalize(version: str):
+            try:
+                return str(parse(version))
+            except InvalidVersion:
+                return version
+
+    except ImportError:
+
+        def normalize(version: str):
+            return version
+
+    try:
+        # during development and after install
+        # read from require
         from secretnote._resources import require
 
-        return require.package.info.version
+        return normalize(require.package.info.version)
     except Exception:
         pass
 
     try:
-        # for distribution, during which dependencies are not installed
+        # during packaging, where dependencies are not installed
         # read from ./dist/resources.json
-
         resources = Path(__file__).with_name("dist").joinpath("resources.json")
-
         with open(resources, "r") as file:
-            return json.load(file)["root"]["version"]
+            return normalize(json.load(file)["root"]["version"])
+
     except Exception:
-        # could happen during repo bootstrapping
-        return "0.0.0"
+        pass
+
+    try:
+        # during repo bootstrapping
+        # read from ../package.json
+        package_json = Path(__file__).parent.joinpath("package.json")
+        with open(package_json, "r") as file:
+            return normalize(json.load(file)["version"])
+
+    except Exception:
+        pass
+
+    return "0.0.0"

pyprojects/secretnote/src/secretnote/server/app.py

@@ -54,13 +54,13 @@ def get_extension_package(cls):
         return JUPYTER_SERVER_EXTENSION_MODULE
 
     @classmethod
-    def launch(self, argv=None):
+    def launch(cls, argv=None):
         if argv is None:
             args = sys.argv[1:]  # slice out extension config.
         else:
             args = argv
 
-        self.launch_instance(
+        cls.launch_instance(
             [
                 "--ServerApp.token=''",
                 "--ServerApp.allow_origin=*",

pyprojects/secretnote/src/secretnote/utils/node/resolve.mjs

@@ -1,5 +1,4 @@
 // @ts-check
-
 import { createRequire } from 'node:module';
 import * as process from 'node:process';
 import * as readline from 'node:readline';
@@ -14,7 +13,6 @@ const rl = readline.createInterface({ input: process.stdin });
  * @property {string} cwd
  * @property {Record<string, string>} resolved
  * @property {string[]} errors
- * @null
  */
 
 /** @type {ResolutionInfo} */
@@ -46,7 +44,7 @@ for await (const identifier of rl) {
   }
 }
 
-console.log(JSON.stringify(info, null, 2));
+process.stdout.write(JSON.stringify(info, null, 2));
 
 if (Object.keys(info.errors).length) {
   process.exit(2);

requirements-dev.lock

@@ -9,7 +9,7 @@
 -e file:.
 -e file:pyprojects/secretnote
 -e file:pyprojects/spu-stubs
-aiohttp==3.9.0
+aiohttp==3.9.1
 aiohttp-cors==0.7.0
 aiosignal==1.3.1
 anyio==4.1.0
@@ -42,7 +42,7 @@ comm==0.2.0
 contourpy==1.1.1
 coverage==7.3.2
 cycler==0.12.1
-datamodel-code-generator==0.24.2
+datamodel-code-generator==0.25.1
 debugpy==1.8.0
 decorator==5.1.1
 defusedxml==0.7.1
@@ -73,15 +73,15 @@ h11==0.14.0
 hatch==1.7.0
 hatchling==1.18.0
 httpcore==1.0.2
-httpx==0.25.1
+httpx==0.25.2
 huggingface-hub==0.19.4
 hyperlink==21.0.0
-idna==3.4
+idna==3.6
 importlib-metadata==6.8.0
 importlib-resources==6.1.1
 inflect==5.6.2
 iniconfig==2.0.0
-ipykernel==6.27.0
+ipykernel==6.26.0
 ipython==8.12.3
 ipython-genutils==0.2.0
 ipython-sql==0.5.0
@@ -101,7 +101,7 @@ jsonschema-specifications==2023.11.1
 jupyter-client==8.6.0
 jupyter-core==5.5.0
 jupyter-events==0.9.0
-jupyter-lsp==2.2.0
+jupyter-lsp==2.2.1
 jupyter-resource-usage==1.0.1
 jupyter-server==2.10.1
 jupyter-server-terminals==0.4.4
@@ -156,7 +156,7 @@ pandocfilters==1.5.0
 parso==0.8.3
 pathspec==0.11.2
 patsy==0.5.3
-pexpect==4.8.0
+pexpect==4.9.0
 pickleshare==0.7.5
 pillow==10.1.0
 pkgutil-resolve-name==1.3.10
@@ -246,7 +246,7 @@ wcwidth==0.2.12
 webcolors==1.13
 webencodings==0.5.1
 websocket-client==1.6.4
-wheel==0.41.3
+wheel==0.42.0
 widgetsnbextension==4.0.9
 wrapt==1.16.0
 yarl==1.9.3

requirements.lock

@@ -9,7 +9,7 @@
 -e file:.
 -e file:pyprojects/secretnote
 -e file:pyprojects/spu-stubs
-aiohttp==3.9.0
+aiohttp==3.9.1
 aiohttp-cors==0.7.0
 aiosignal==1.3.1
 anyio==4.1.0
@@ -48,10 +48,10 @@ google-auth==2.23.4
 googleapis-common-protos==1.61.0
 gpustat==1.1.1
 grpcio==1.59.3
-idna==3.4
+idna==3.6
 importlib-metadata==6.8.0
 importlib-resources==6.1.1
-ipykernel==6.27.0
+ipykernel==6.26.0
 ipython==8.12.3
 ipython-genutils==0.2.0
 ipython-sql==0.5.0
@@ -96,7 +96,7 @@ overrides==7.4.0
 packaging==23.2
 pandocfilters==1.5.0
 parso==0.8.3
-pexpect==4.8.0
+pexpect==4.9.0
 pickleshare==0.7.5
 pkgutil-resolve-name==1.3.10
 platformdirs==3.11.0
@@ -148,7 +148,7 @@ wcwidth==0.2.12
 webcolors==1.13
 webencodings==0.5.1
 websocket-client==1.6.4
-wheel==0.41.3
+wheel==0.42.0
 widgetsnbextension==4.0.9
 wrapt==1.16.0
 yarl==1.9.3