Standardise PR workflow on ci.yml and drop scheduled SBOM scan

Use composite action for scans
Bump resrm version to 0.5.1
2026-10-13 07:38:25 +01:00 · 2026-10-10 17:20:00 +01:00 · 2026-10-10 08:37:46 +01:00 · 2026-10-10 07:36:47 +00:00 · 2026-10-10 08:35:03 +01:00 · 2026-10-10 07:34:33 +00:00
12 changed files with 581 additions and 281 deletions
@@ -0,0 +1,109 @@
+name: CI
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-and-security:
+    name: lint-and-security
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install Poetry
+        run: pip install "poetry>=2,<3"
+
+      - name: Install dev dependencies (lockfile-pinned pre-commit)
+        run: poetry install --with dev --no-root
+
+      - name: Run pre-commit hooks
+        run: poetry run pre-commit run --all-files --color always
+
+      - name: Install pip-audit
+        run: pip install "pip-audit==2.10.1"
+
+      - name: Audit dependencies (Poetry lockfile)
+        run: |
+          set -euo pipefail
+
+          poetry self add poetry-plugin-export
+          poetry export -f requirements.txt --without-hashes -o requirements-audit.txt
+
+          # pip-audit exits non-zero for ANY vulnerability; capture the report, then gate below.
+          pip-audit --no-deps -r requirements-audit.txt -f json -o pip-audit.json || true
+
+          echo "Fixable vulnerabilities:"
+          jq -r '
+            .dependencies[]?
+            | select(has("vulns"))
+            | . as $d
+            | .vulns[]
+            | select((.fix_versions | length) > 0)
+            | "\($d.name)@\($d.version) -> \(.id) [fix: \(.fix_versions | join(", "))]"
+          ' pip-audit.json
+
+          echo
+          echo "All reported vulnerabilities:"
+          jq -r '
+            .dependencies[]?
+            | select(has("vulns"))
+            | . as $d
+            | .vulns[]
+            | "\($d.name)@\($d.version) -> \(.id) [fix: \(if (.fix_versions | length) > 0 then (.fix_versions | join(", ")) else "none" end)]"
+          ' pip-audit.json
+
+          # Fail only on fixable findings. The type guard ensures a crashed or empty
+          # report fails rather than silently passing. Dependency security updates
+          # are handled by the central Renovate job.
+          jq -e '
+            (.dependencies | type) == "array"
+            and
+            ( [ .dependencies[] | (.vulns // [])[] | select((.fix_versions | length) > 0) ] | length == 0 )
+          ' pip-audit.json
+
+  tests:
+    name: tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.13"]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install Poetry
+        run: pip install "poetry>=2,<3"
+
+      - name: Install project and dependencies
+        run: poetry install --with dev
+
+      - name: Run tests
+        run: poetry run pytest
@@ -1,36 +0,0 @@
-name: Lint & Security
-
-on:
-  pull_request:
-
-jobs:
-  precommit-and-security:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.13"
-
-      - name: Install pre-commit
-        run: pip install pre-commit
-
-      - name: Run pre-commit hooks
-        run: pre-commit run --all-files --color always
-
-      - name: Install Poetry
-        run: |
-          pip install "poetry>=2,<3"
-          poetry self add poetry-plugin-export
-
-      - name: Install pip-audit
-        run: pip install pip-audit
-
-      - name: Audit dependencies (Poetry lockfile)
-        run: |
-          poetry export -f requirements.txt --without-hashes \
-            | pip-audit -r /dev/stdin
@@ -1,188 +0,0 @@
-name: Security Scan
-
-on:
-  schedule:
-    - cron: 27 8 * * *
-  workflow_dispatch:
-
-jobs:
-  security-scan:
-    runs-on: running-man
-
-    env:
-      TARGET_DIR: .
-      COSIGN_VERSION: v3.0.5
-      SYFT_VERSION: v1.42.3
-      GRYPE_VERSION: v0.110.0
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Cosign (bootstrap)
-        run: |
-          set -euo pipefail
-
-          FILE="cosign-linux-amd64"
-
-          curl -fLO https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/${FILE}
-
-          chmod +x ${FILE}
-          mv ${FILE} /usr/local/bin/cosign
-
-          cosign version
-
-      - name: Install Syft (verified)
-        run: |
-          set -euo pipefail
-
-          VERSION_NO_V="${SYFT_VERSION#v}"
-          FILE="syft_${VERSION_NO_V}_linux_amd64.tar.gz"
-          BASE_URL="https://github.com/anchore/syft/releases/download/${SYFT_VERSION}"
-
-          curl -fLO ${BASE_URL}/${FILE}
-          curl -fLO ${BASE_URL}/syft_${VERSION_NO_V}_checksums.txt
-          curl -fLO ${BASE_URL}/syft_${VERSION_NO_V}_checksums.txt.sig
-          curl -fLO ${BASE_URL}/syft_${VERSION_NO_V}_checksums.txt.pem
-
-          cosign verify-blob \
-            --signature syft_${VERSION_NO_V}_checksums.txt.sig \
-            --certificate syft_${VERSION_NO_V}_checksums.txt.pem \
-            --certificate-identity-regexp "https://github.com/anchore/syft" \
-            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
-            syft_${VERSION_NO_V}_checksums.txt
-
-          CHECKSUM_LINE=$(grep " ${FILE}$" syft_${VERSION_NO_V}_checksums.txt)
-          if [ -z "$CHECKSUM_LINE" ]; then
-            echo "Missing checksum entry for ${FILE}"
-            exit 1
-          fi
-
-          echo "$CHECKSUM_LINE" | sha256sum -c -
-
-          tar -xzf ${FILE}
-          mv syft /usr/local/bin/
-
-          syft version
-
-      - name: Install Grype (verified)
-        run: |
-          set -euo pipefail
-
-          VERSION_NO_V="${GRYPE_VERSION#v}"
-          FILE="grype_${VERSION_NO_V}_linux_amd64.tar.gz"
-          BASE_URL="https://github.com/anchore/grype/releases/download/${GRYPE_VERSION}"
-
-          curl -fLO ${BASE_URL}/${FILE}
-          curl -fLO ${BASE_URL}/grype_${VERSION_NO_V}_checksums.txt
-          curl -fLO ${BASE_URL}/grype_${VERSION_NO_V}_checksums.txt.sig
-          curl -fLO ${BASE_URL}/grype_${VERSION_NO_V}_checksums.txt.pem
-
-          cosign verify-blob \
-            --signature grype_${VERSION_NO_V}_checksums.txt.sig \
-            --certificate grype_${VERSION_NO_V}_checksums.txt.pem \
-            --certificate-identity-regexp "https://github.com/anchore/grype" \
-            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
-            grype_${VERSION_NO_V}_checksums.txt
-
-          CHECKSUM_LINE=$(grep " ${FILE}$" grype_${VERSION_NO_V}_checksums.txt)
-          if [ -z "$CHECKSUM_LINE" ]; then
-            echo "Missing checksum entry for ${FILE}"
-            exit 1
-          fi
-
-          echo "$CHECKSUM_LINE" | sha256sum -c -
-
-          tar -xzf ${FILE}
-          mv grype /usr/local/bin/
-
-          grype version
-
-      - name: Generate SBOM
-        working-directory: ${{ env.TARGET_DIR }}
-        run: |
-          syft dir:. -o json > sbom.json
-
-      - name: Show SBOM contents
-        working-directory: ${{ env.TARGET_DIR }}
-        run: |
-          echo "Packages discovered by Syft:"
-          jq -r '.artifacts[] | "\(.name)@\(.version) [\(.type)]"' sbom.json | sort
-
-      - name: Run Grype scan (JSON)
-        id: audit
-        continue-on-error: true
-        working-directory: ${{ env.TARGET_DIR }}
-        run: |
-          grype sbom:sbom.json -o json > grype.json
-
-          echo "Vulnerabilities (fixable only):"
-          jq -r '
-            .matches[]
-            | select((.vulnerability.fix.versions | length) > 0)
-            | "\(.artifact.name)@\(.artifact.version) -> \(.vulnerability.id) [\(.vulnerability.severity)] | fixed: \(.vulnerability.fix.versions[0])"
-          ' grype.json
-
-          # Fail only on fixable MEDIUM/HIGH/CRITICAL
-          jq -e '
-            [
-              .matches[]?
-              | select(
-                  (
-                    .vulnerability.severity == "Medium" or
-                    .vulnerability.severity == "High" or
-                    .vulnerability.severity == "Critical"
-                  )
-                  and
-                  (
-                    (.vulnerability.fix.versions | length) > 0
-                  )
-                )
-            ]
-            | length == 0
-          ' grype.json
-
-      - name: Show full Grype table
-        working-directory: ${{ env.TARGET_DIR }}
-        run: |
-          echo "Full Grype report:"
-          grype sbom:sbom.json -o table
-
-      - name: Notify Node-RED on vulnerabilities
-        if: steps.audit.outcome == 'failure'
-        working-directory: ${{ env.TARGET_DIR }}
-        run: |
-          jq '
-          {
-            repo: "guardutils/resrm",
-            summary: (
-              "Total: " +
-              (
-                [
-                  .matches[]
-                  | select((.vulnerability.fix.versions | length) > 0)
-                ] | length | tostring
-              )
-            ),
-            vulnerabilities: [
-              .matches[]
-              | select((.vulnerability.fix.versions | length) > 0)
-              | {
-                library: .artifact.name,
-                cve: .vulnerability.id,
-                severity: .vulnerability.severity,
-                installed: .artifact.version,
-                fixed: (.vulnerability.fix.versions[0]),
-                title: .vulnerability.description,
-                url: .vulnerability.dataSource
-              }
-            ]
-          }
-          ' grype.json \
-          | curl -s -X POST https://nodered.sysmd.uk/vulns-alert \
-              -H "Content-Type: application/json" \
-              --data-binary @-
-
-      - name: Fail workflow if vulnerabilities found
-        if: steps.audit.outcome == 'failure'
-        run: exit 1
@@ -0,0 +1 @@
+*   @mdaleo404
@@ -0,0 +1,2 @@
+github: mdaleo404
+ko_fi: mdaleo404
@@ -0,0 +1,109 @@
+name: CI
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-and-security:
+    name: lint-and-security
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install Poetry
+        run: pip install "poetry>=2,<3"
+
+      - name: Install dev dependencies (lockfile-pinned pre-commit)
+        run: poetry install --with dev --no-root
+
+      - name: Run pre-commit hooks
+        run: poetry run pre-commit run --all-files --color always
+
+      - name: Install pip-audit
+        run: pip install "pip-audit==2.10.1"
+
+      - name: Audit dependencies (Poetry lockfile)
+        run: |
+          set -euo pipefail
+
+          poetry self add poetry-plugin-export
+          poetry export -f requirements.txt --without-hashes -o requirements-audit.txt
+
+          # pip-audit exits non-zero for ANY vulnerability; capture the report, then gate below.
+          pip-audit --no-deps -r requirements-audit.txt -f json -o pip-audit.json || true
+
+          echo "Fixable vulnerabilities:"
+          jq -r '
+            .dependencies[]?
+            | select(has("vulns"))
+            | . as $d
+            | .vulns[]
+            | select((.fix_versions | length) > 0)
+            | "\($d.name)@\($d.version) -> \(.id) [fix: \(.fix_versions | join(", "))]"
+          ' pip-audit.json
+
+          echo
+          echo "All reported vulnerabilities:"
+          jq -r '
+            .dependencies[]?
+            | select(has("vulns"))
+            | . as $d
+            | .vulns[]
+            | "\($d.name)@\($d.version) -> \(.id) [fix: \(if (.fix_versions | length) > 0 then (.fix_versions | join(", ")) else "none" end)]"
+          ' pip-audit.json
+
+          # Fail only on fixable findings. The type guard ensures a crashed or empty
+          # report fails rather than silently passing. Dependency security updates
+          # are handled by the central Renovate job.
+          jq -e '
+            (.dependencies | type) == "array"
+            and
+            ( [ .dependencies[] | (.vulns // [])[] | select((.fix_versions | length) > 0) ] | length == 0 )
+          ' pip-audit.json
+
+  tests:
+    name: tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.13"]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install Poetry
+        run: pip install "poetry>=2,<3"
+
+      - name: Install project and dependencies
+        run: poetry install --with dev
+
+      - name: Run tests
+        run: poetry run pytest
@@ -58,14 +58,16 @@ src/resrm/
  core.py                  CLI, trash metadata, restore, delete, prune logic

 tests/
-  __init__.py              test package marker; no substantive tests currently
+  __init__.py              test package marker
+  conftest.py              autouse fixture isolating trash state to a temp tree
+  test_core.py             focused unit tests for metadata, move, restore, prune

 pyproject.toml             Poetry package metadata and console script
 poetry.lock                locked dependency graph
 README.md                  user-facing documentation
 LICENCE                    GPL-3.0-or-later licence text
 .pre-commit-config.yaml    Bandit, Black, and generic pre-commit hooks
-.gitea/workflows/          lint, dependency audit, SBOM and Grype workflows
+.gitea/workflows/          lint and dependency-audit workflows
 dist/                      built release artifacts, not source
 ```

@@ -493,13 +495,19 @@ Run pre-commit hooks:
 poetry run pre-commit run --all-files
 ```

+Run the test suite:
+
+```bash
+poetry run pytest
+```
+
 Build release artifacts:

 ```bash
 poetry build
 ```

-There is a `tests/` package marker, but no substantive pytest suite is configured in `pyproject.toml` at the time of writing. If tests are added, add pytest as a development dependency and prefer focused tests using temporary directories and isolated metadata files.
+`pytest` is a development dependency and a focused suite exists in `tests/test_core.py`. `tests/conftest.py` provides an autouse fixture that redirects `TRASH_DIR`, `META_FILE`, `meta`, and `pwd.getpwuid` into a temporary tree, so tests never touch a real user's trash. Prefer adding focused tests using that fixture rather than real files.

 ---

@@ -509,22 +517,16 @@ Gitea pull request workflow:

 ```text
 .gitea/workflows/lint-and-security.yml
-  -> install pre-commit
-  -> pre-commit run --all-files
-  -> install Poetry and poetry-plugin-export
-  -> poetry export dependencies
-  -> pip-audit dependency audit
-```
-
-Scheduled/manual security workflow:
-
-```text
-.gitea/workflows/security-scan.yml
-  -> install verified Cosign, Syft, and Grype
-  -> generate SBOM
-  -> scan for vulnerabilities
-  -> notify Node-RED on fixable Medium/High/Critical vulnerabilities
-  -> fail workflow on those vulnerabilities
+  -> job lint-and-security:
+     -> install pre-commit
+     -> pre-commit run --all-files
+     -> install Poetry and poetry-plugin-export
+     -> poetry export dependencies
+     -> pip-audit dependency audit
+  -> job tests:
+     -> install Poetry
+     -> poetry install --with dev
+     -> poetry run pytest
 ```

 Pre-commit currently includes Bandit, Black, trailing whitespace, EOF, YAML, and TOML checks.
@@ -27,7 +27,7 @@ It moves files to a per-user _trash_ instead of permanently deleting them, while

 ## Installation

-### From GuardUtils package repo
+### From the SysMD package repository

 This is the preferred method of installation.

@@ -37,7 +37,7 @@ This is the preferred method of installation.

 ```bash
 sudo mkdir -p /usr/share/keyrings
-curl -fsSL https://repo.sysmd.uk/guardutils/guardutils.gpg | sudo gpg --dearmor -o /usr/share/keyrings/guardutils.gpg
+curl -fsSL https://repo.sysmd.uk/sysmd/sysmd.gpg | sudo gpg --dearmor -o /usr/share/keyrings/sysmd.gpg
 ```

 The GPG fingerprint is `0032C71FA6A11EF9567D4434C5C06BD4603C28B1`.
@@ -45,7 +45,7 @@ The GPG fingerprint is `0032C71FA6A11EF9567D4434C5C06BD4603C28B1`.
 #### 2) Add the APT source

 ```bash
-echo "deb [arch=amd64 signed-by=/usr/share/keyrings/guardutils.gpg] https://repo.sysmd.uk/guardutils/debian stable main" | sudo tee /etc/apt/sources.list.d/guardutils.list
+echo "deb [arch=amd64 signed-by=/usr/share/keyrings/sysmd.gpg] https://repo.sysmd.uk/sysmd/debian stable main" | sudo tee /etc/apt/sources.list.d/sysmd.list
 ```

 #### 3) Update and install
@@ -60,20 +60,20 @@ sudo apt install resrm
 #### 1) Import the GPG key

 ```
-sudo rpm --import https://repo.sysmd.uk/guardutils/guardutils.gpg
+sudo rpm --import https://repo.sysmd.uk/sysmd/sysmd.gpg
 ```

 #### 2) Add the repository configuration

 ```
-sudo tee /etc/yum.repos.d/guardutils.repo > /dev/null << 'EOF'
-[guardutils]
-name=GuardUtils Repository
-baseurl=https://repo.sysmd.uk/guardutils/rpm/$basearch
+sudo tee /etc/yum.repos.d/sysmd.repo > /dev/null << 'EOF'
+[sysmd]
+name=SysMD Repository
+baseurl=https://repo.sysmd.uk/sysmd/rpm/$basearch
 enabled=1
 gpgcheck=1
 repo_gpgcheck=1
-gpgkey=https://repo.sysmd.uk/guardutils/guardutils.gpg
+gpgkey=https://repo.sysmd.uk/sysmd/sysmd.gpg
 EOF
 ```

@@ -1,15 +1,15 @@
-# This file is automatically @generated by Poetry 2.5.0 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.4.0 and should not be changed by hand.

 [[package]]
 name = "argcomplete"
-version = "3.6.3"
+version = "3.7.2"
 description = "Bash tab completion for argparse"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.10"
 groups = ["main"]
 files = [
-    {file = "argcomplete-3.6.3-py3-none-any.whl", hash = "sha256:f5007b3a600ccac5d25bbce33089211dfd49eab4a7718da3f10e3082525a92ce"},
-    {file = "argcomplete-3.6.3.tar.gz", hash = "sha256:62e8ed4fd6a45864acc8235409461b72c9a28ee785a2011cc5eb78318786c89c"},
+    {file = "argcomplete-3.7.2-py3-none-any.whl", hash = "sha256:6029205678bdd9c1c728a155f5f9ecf5812393f969eef58807641a2bc2aa5b19"},
+    {file = "argcomplete-3.7.2.tar.gz", hash = "sha256:aad8b69a0b9969edb62db0d1752354c0d50717b10e0cbb00e2a958381b9fc6b9"},
 ]

 [package.extras]
@@ -27,6 +27,19 @@ files = [
    {file = "cfgv-3.4.0.tar.gz", hash = "sha256:e52591d4c5f5dead8e0f673fb16db7949d2cfb3f7da4582893288f0ded8fe560"},
 ]

+[[package]]
+name = "colorama"
+version = "0.4.6"
+description = "Cross-platform colored terminal text."
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
+groups = ["dev"]
+markers = "sys_platform == \"win32\""
+files = [
+    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
+    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+]
+
 [[package]]
 name = "distlib"
 version = "0.4.0"
@@ -66,6 +79,18 @@ files = [
 [package.extras]
 license = ["ukkonen"]

+[[package]]
+name = "iniconfig"
+version = "2.3.1"
+description = "brain-dead simple config-ini parsing"
+optional = false
+python-versions = ">=3.10"
+groups = ["dev"]
+files = [
+    {file = "iniconfig-2.3.1-py3-none-any.whl", hash = "sha256:9121e2c1fdb355232495be3194c8dfe87ccc2d5dee45947b78e68f499790d7a7"},
+    {file = "iniconfig-2.3.1.tar.gz", hash = "sha256:67f4b9c50da0dedf52af349e7749a80a9057a5031199791b906c3bb3ae878960"},
+]
+
 [[package]]
 name = "nodeenv"
 version = "1.9.1"
@@ -108,15 +133,31 @@ test = ["appdirs (==1.4.4)", "covdefaults (>=2.3)", "pytest (>=8.4.2)", "pytest-
 type = ["mypy (>=1.18.2)"]

 [[package]]
-name = "pre-commit"
-version = "3.8.0"
-description = "A framework for managing and maintaining multi-language pre-commit hooks."
+name = "pluggy"
+version = "1.6.0"
+description = "plugin and hook calling mechanisms for python"
 optional = false
 python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "pre_commit-3.8.0-py2.py3-none-any.whl", hash = "sha256:9a90a53bf82fdd8778d58085faf8d83df56e40dfe18f45b19446e26bf1b3a63f"},
-    {file = "pre_commit-3.8.0.tar.gz", hash = "sha256:8bb6494d4a20423842e198980c9ecf9f96607a07ea29549e180eef9ae80fe7af"},
+    {file = "pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746"},
+    {file = "pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3"},
+]
+
+[package.extras]
+dev = ["pre-commit", "tox"]
+testing = ["coverage", "pytest", "pytest-benchmark"]
+
+[[package]]
+name = "pre-commit"
+version = "4.6.2"
+description = "A framework for managing and maintaining multi-language pre-commit hooks."
+optional = false
+python-versions = ">=3.10"
+groups = ["dev"]
+files = [
+    {file = "pre_commit-4.6.2-py2.py3-none-any.whl", hash = "sha256:e2dde9a75d3bce11bd3831c26d134df00a2803c1d818be6a0383c3dcda25dc4e"},
+    {file = "pre_commit-4.6.2.tar.gz", hash = "sha256:8f5d7bfb021ecdbcd9d49d89847082dd24172ccde534390081a679ad046e2441"},
 ]

 [package.dependencies]
@@ -126,6 +167,43 @@ nodeenv = ">=0.11.1"
 pyyaml = ">=5.1"
 virtualenv = ">=20.10.0"

+[[package]]
+name = "pygments"
+version = "2.21.0"
+description = "Pygments is a syntax highlighting package written in Python."
+optional = false
+python-versions = ">=3.9"
+groups = ["dev"]
+files = [
+    {file = "pygments-2.21.0-py3-none-any.whl", hash = "sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9"},
+    {file = "pygments-2.21.0.tar.gz", hash = "sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c"},
+]
+
+[package.extras]
+windows-terminal = ["colorama (>=0.4.6)"]
+
+[[package]]
+name = "pytest"
+version = "9.1.1"
+description = "pytest: simple powerful testing with Python"
+optional = false
+python-versions = ">=3.10"
+groups = ["dev"]
+files = [
+    {file = "pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c"},
+    {file = "pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313"},
+]
+
+[package.dependencies]
+colorama = {version = ">=0.4", markers = "sys_platform == \"win32\""}
+iniconfig = ">=1.0.1"
+packaging = ">=22"
+pluggy = ">=1.5,<2"
+pygments = ">=2.7.2"
+
+[package.extras]
+dev = ["argcomplete", "attrs (>=19.2)", "hypothesis (>=3.56)", "mock", "requests", "setuptools", "xmlschema"]
+
 [[package]]
 name = "python-discovery"
 version = "1.6.1"
@@ -224,19 +302,6 @@ files = [
    {file = "pyyaml-6.0.3.tar.gz", hash = "sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f"},
 ]

-[[package]]
-name = "typing-extensions"
-version = "4.15.0"
-description = "Backported and Experimental Type Hints for Python 3.9+"
-optional = false
-python-versions = ">=3.9"
-groups = ["dev"]
-markers = "python_version == \"3.10\""
-files = [
-    {file = "typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548"},
-    {file = "typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466"},
-]
-
 [[package]]
 name = "virtualenv"
 version = "21.14.2"
@@ -255,9 +320,8 @@ filelock = {version = ">=3.24.2,<5", markers = "python_version >= \"3.10\""}
 packaging = ">=23.1"
 platformdirs = ">=3.9.1,<5"
 python-discovery = ">=1.6"
-typing-extensions = {version = ">=4.13.2", markers = "python_version < \"3.11\""}

 [metadata]
 lock-version = "2.1"
-python-versions = ">=3.10,<4.0"
-content-hash = "48203cd9c9c4027b78f2f8ee405683b62aeda2cdeb1ec84bba0f193b80ad12b9"
+python-versions = ">=3.11,<4.0"
+content-hash = "04806371cb668f5a99f2fae31494f1f88805cbcaa2cb29e7f379037cf08d9f26"
@@ -1,11 +1,11 @@
 [project]
 name = "resrm"
-version = "0.4.2"
+version = "0.5.1"
 description = "drop-in replacement for rm with undo/restore built-in."
 authors = [{ name = "Marco D'Aleo", email = "marco@marcodaleo.com" }]
 license = "GPL-3.0-or-later"
 readme = "README.md"
-requires-python = ">=3.10,<4.0"
+requires-python = ">=3.11,<4.0"
 dependencies = [
    "argcomplete>=2",
 ]
@@ -21,7 +21,8 @@ resrm = "resrm.cli:main"
 packages = [{include = "resrm", from = "src"}]

 [tool.poetry.group.dev.dependencies]
-pre-commit = "^3.8"
+pre-commit = "^4.0.0"
+pytest = "^9.1.1"

 [tool.black]
 line-length = 79
@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import pytest
+
+from resrm import core
+
+
+@pytest.fixture(autouse=True)
+def isolated_trash(tmp_path, monkeypatch):
+    """Redirect all trash state into a temporary tree.
+
+    resrm resolves the trash base from the file owner's home directory and
+    loads metadata once at import time, so both are redirected here.
+    Without this fixture a test that moved a file would write into the
+    real ``~/.local/share/resrm``.
+    """
+    home = tmp_path / "home"
+    base = home / ".local" / "share" / "resrm"
+    trash_dir = base / "files"
+    meta_file = base / "metadata.json"
+    trash_dir.mkdir(parents=True, exist_ok=True)
+
+    monkeypatch.setattr(core, "TRASH_DIR", trash_dir)
+    monkeypatch.setattr(core, "META_FILE", meta_file)
+    monkeypatch.setattr(core, "meta", [])
+
+    # move_to_trash() and get_trash_base_for_user() import pwd locally and
+    # resolve the owner's home, so patch the module attribute rather than
+    # core's namespace.
+    monkeypatch.setattr(
+        "pwd.getpwuid", lambda uid: SimpleNamespace(pw_dir=str(home))
+    )
+
+    monkeypatch.chdir(tmp_path)
+    return SimpleNamespace(home=home, trash_dir=trash_dir, meta_file=meta_file)
@@ -0,0 +1,199 @@
+from __future__ import annotations
+
+import datetime
+import json
+from pathlib import Path
+
+import pytest
+
+from resrm import core
+
+
+def _entry(id_, orig_path, timestamp="2026-01-01T00:00:00"):
+    return {"id": id_, "orig_path": str(orig_path), "timestamp": timestamp}
+
+
+def _iso_days_ago(days):
+    moment = datetime.datetime.now() - datetime.timedelta(days=days)
+    return moment.isoformat()
+
+
+def test_trash_base_for_root_is_fixed_path():
+    assert core.get_trash_base_for_user(0) == Path("/root/.local/share/resrm")
+
+
+def test_trash_base_uses_user_home(isolated_trash):
+    base = core.get_trash_base_for_user(12345)
+    assert base == isolated_trash.home / ".local" / "share" / "resrm"
+
+
+def test_load_meta_missing_file_returns_empty(isolated_trash):
+    assert not isolated_trash.meta_file.exists()
+    assert core.load_meta() == []
+
+
+def test_load_meta_malformed_file_returns_empty(isolated_trash):
+    isolated_trash.meta_file.write_text("{not json", encoding="utf-8")
+    assert core.load_meta() == []
+
+
+def test_find_candidates_prefers_exact_basename(isolated_trash):
+    by_name = _entry("deadbeef" + "0" * 24, "/x/report.txt")
+    by_prefix = _entry("report.txt-extra", "/x/notes.md")
+    core.meta = [by_prefix, by_name]
+    assert core.find_candidates("report.txt") == [by_name]
+
+
+def test_find_candidates_matches_id_prefix(isolated_trash):
+    first = _entry("abcd1234" + "0" * 24, "/x/a")
+    second = _entry("abcd9999" + "0" * 24, "/x/b")
+    core.meta = [first, second]
+    assert core.find_candidates("abcd12") == [first]
+    assert core.find_candidates("abcd") == [first, second]
+    assert core.find_candidates("zzz") == []
+
+
+def test_move_to_trash_moves_file_and_writes_metadata(
+    isolated_trash, tmp_path
+):
+    src = tmp_path / "keep.txt"
+    src.write_text("data", encoding="utf-8")
+
+    core.move_to_trash(src, interactive=False, force=False, skip_trash=False)
+
+    assert not src.exists()
+    stored = list(isolated_trash.trash_dir.iterdir())
+    assert len(stored) == 1
+    saved = json.loads(isolated_trash.meta_file.read_text(encoding="utf-8"))
+    assert saved[0]["orig_path"] == str(src.resolve())
+    assert saved[0]["id"] == stored[0].name
+
+
+def test_skip_trash_deletes_file_permanently(isolated_trash, tmp_path):
+    src = tmp_path / "gone.txt"
+    src.write_text("x", encoding="utf-8")
+
+    core.move_to_trash(src, interactive=False, force=False, skip_trash=True)
+
+    assert not src.exists()
+    assert list(isolated_trash.trash_dir.iterdir()) == []
+    assert core.load_meta() == []
+
+
+def test_skip_trash_removes_symlink_not_target(isolated_trash, tmp_path):
+    target = tmp_path / "target.txt"
+    target.write_text("data", encoding="utf-8")
+    link = tmp_path / "link.txt"
+    link.symlink_to(target)
+
+    core.move_to_trash(link, interactive=False, force=False, skip_trash=True)
+
+    assert not link.exists()
+    assert target.exists()
+
+
+def test_missing_path_without_force_reports_error(
+    isolated_trash, tmp_path, capsys
+):
+    missing = tmp_path / "nope.txt"
+    core.move_to_trash(
+        missing, interactive=False, force=False, skip_trash=False
+    )
+    assert "No such file or directory" in capsys.readouterr().out
+
+
+def test_missing_path_with_force_is_silent(isolated_trash, tmp_path, capsys):
+    missing = tmp_path / "nope.txt"
+    core.move_to_trash(
+        missing, interactive=False, force=True, skip_trash=False
+    )
+    assert capsys.readouterr().out == ""
+
+
+def test_directory_without_recursive_is_rejected(
+    isolated_trash, tmp_path, capsys
+):
+    directory = tmp_path / "adir"
+    directory.mkdir()
+
+    core.main([str(directory)])
+
+    assert "Is a directory" in capsys.readouterr().out
+    assert directory.is_dir()
+
+
+def test_restore_one_returns_to_original_path(isolated_trash, tmp_path):
+    original = tmp_path / "restored.txt"
+    stored = isolated_trash.trash_dir / ("a" * 32)
+    stored.write_text("data", encoding="utf-8")
+    entry = _entry("a" * 32, original)
+    core.meta = [entry]
+
+    assert core.restore_one(entry) is True
+
+    assert original.read_text(encoding="utf-8") == "data"
+    assert not stored.exists()
+    assert core.meta == []
+    assert core.load_meta() == []
+
+
+def test_restore_one_falls_back_to_cwd_when_original_exists(
+    isolated_trash, tmp_path
+):
+    (tmp_path / "sub").mkdir()
+    original = tmp_path / "sub" / "taken.txt"
+    original.write_text("original", encoding="utf-8")
+    stored = isolated_trash.trash_dir / ("b" * 32)
+    stored.write_text("trashed", encoding="utf-8")
+    entry = _entry("b" * 32, original)
+    core.meta = [entry]
+
+    assert core.restore_one(entry) is True
+
+    fallback = tmp_path / "taken.txt"
+    assert fallback.read_text(encoding="utf-8") == "trashed"
+    assert original.read_text(encoding="utf-8") == "original"
+
+
+@pytest.mark.parametrize(
+    "life, days_old, expect_pruned",
+    [
+        ("7", 10, True),
+        ("7", 1, False),
+        ("not-a-number", 10, True),
+        ("0", 2, True),
+    ],
+)
+def test_prune_old_trash_retention(
+    isolated_trash, monkeypatch, life, days_old, expect_pruned
+):
+    monkeypatch.setenv("RESRM_TRASH_LIFE", life)
+    old = isolated_trash.trash_dir / ("c" * 32)
+    old.write_text("old", encoding="utf-8")
+    entry = _entry("c" * 32, "/x/old.txt", timestamp=_iso_days_ago(days_old))
+    core.meta = [entry]
+
+    core.prune_old_trash()
+
+    if expect_pruned:
+        assert not old.exists()
+        assert core.meta == []
+    else:
+        assert old.exists()
+        assert core.meta == [entry]
+
+
+def test_empty_trash_clears_files_and_metadata(isolated_trash):
+    file_entry = isolated_trash.trash_dir / ("d" * 32)
+    file_entry.write_text("1", encoding="utf-8")
+    dir_entry = isolated_trash.trash_dir / ("e" * 32)
+    dir_entry.mkdir()
+    (dir_entry / "inner").write_text("2", encoding="utf-8")
+    core.meta = [_entry("d" * 32, "/x/1"), _entry("e" * 32, "/x/2")]
+
+    core.empty_trash()
+
+    assert list(isolated_trash.trash_dir.iterdir()) == []
+    assert core.meta == []
+    saved = json.loads(isolated_trash.meta_file.read_text(encoding="utf-8"))
+    assert saved == []
Author	SHA1	Message	Date
mdaleo404	ab6b78e408	Standardise PR workflow on ci.yml and drop scheduled SBOM scan	2026-10-13 07:38:25 +01:00
mdaleo404	4697891fea	Use composite action for scans	2026-10-10 17:20:00 +01:00
mdaleo404	a6dfb4e627	Bump resrm version to 0.5.1	2026-10-10 08:37:46 +01:00
mdaleo404	23138a1d5e	Merge pull request 'Update dependency pre-commit to v4' (#32 ) from renovate/pre-commit-4.x into main Reviewed-on: #32	2026-10-10 07:36:47 +00:00
mdaleo404	0588915bc1	Merge branch 'main' into renovate/pre-commit-4.x Lint & Security / lint-and-security (pull_request) Successful in 1m4s Details Lint & Security / tests (pull_request) Successful in 20s Details	2026-10-10 08:35:03 +01:00
mdaleo404	daf17175d0	Merge pull request 'Update dependency argcomplete to v3.7.2' (#31 ) from renovate/non-major-dependencies into main Reviewed-on: #31	2026-10-10 07:34:33 +00:00
kamabot	272ea7ec59	Update dependency pre-commit to v4 renovate/stability-days Updates have met minimum release age requirement Details Lint & Security / lint-and-security (pull_request) Successful in 1m6s Details Lint & Security / tests (pull_request) Successful in 20s Details	2026-10-09 17:07:57 +00:00
kamabot	74642385f1	Update dependency argcomplete to v3.7.2 renovate/stability-days Updates have met minimum release age requirement Details Lint & Security / lint-and-security (pull_request) Successful in 1m3s Details Lint & Security / tests (pull_request) Successful in 21s Details	2026-10-09 17:07:53 +00:00
mdaleo404	9323e2d6ae	Update workflows and tests	2026-10-09 18:00:50 +01:00
mdaleo404	aae2c572fa	Update package installation for sysmd repository	2026-10-06 18:45:16 +01:00
mdaleo404	650c3a82c3	Merge pull request 'Drop Python 3.10 support' (#30 ) from mdaleo404/drop-python3.10 into main Reviewed-on: #30	2026-10-05 10:01:06 +00:00
mdaleo404	337625dcf3	Drop Python 3.10 support Lint & Security / lint-and-security (pull_request) Successful in 1m21s Details	2026-10-05 10:57:52 +01:00
mdaleo404	4200498273	Add FUNDING.yml	2026-10-03 11:33:31 +01:00
mdaleo404	9b121ebd3a	Harden lint workflow and add GitHub mirror support	2026-10-03 09:51:59 +01:00