mirror of
https://github.com/Horizontal42/netsleuth.git
synced 2026-11-10 22:42:03 +03:00
66dcd6f5bc
The only feature in this batch adding a real dependency, approved up front and landed the same way tcptrace/ndt7 already do: an optional extra (uv sync --extra quic), imported lazily inside measure_quic() so a missing install degrades to a clear skip warning instead of a crash. Verified the actually-installed aioquic 1.3.0 API directly rather than assuming. connect() takes local_port but no local_host/source-address parameter at all, so --quic structurally cannot honor --interface - _quic_section() says so explicitly rather than silently measuring the OS-default path under a report claiming a forced adapter. Its context manager doesn't yield until the handshake finishes, so unlike the TLS RTT probe's two-connection subtraction trick, handshake time here is timed directly. HandshakeCompleted's fields matched what was expected; dropped a planned quic_version field since aioquic has no clean public API for it rather than reach into a private attribute. quic_verdict(quic_ok, tcp_ok) is the actual payoff: QUIC failing while plain TCP to the same host succeeds means the network specifically drops or throttles UDP/443, silently degrading Chrome/YouTube's HTTP/3 preference in a way no TCP-based diagnostic would ever catch. Both failing is ordinary unreachability already covered elsewhere, so it stays silent rather than duplicating that finding. Opt-in --quic, excluded from --full - an optionally-installed extra must never become a silent requirement. Added the quic extra to the release workflow's wheel-install verification. Live-tested against real cloudflare.com/google.com: real handshakes, ALPN h3 negotiated, correct end-to-end timing. This completes the 16-feature extension batch from plans/zesty-zooming-wilkinson.md (gitignored, local planning doc).
66 lines
2.1 KiB
YAML
66 lines
2.1 KiB
YAML
name: release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*.*.*"
|
|
|
|
jobs:
|
|
build-and-test:
|
|
runs-on: windows-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@v3
|
|
|
|
- name: Sync base + optional extras
|
|
run: uv sync --extra tcptrace --extra ndt7 --extra quic
|
|
|
|
- name: Run test suite
|
|
run: uv run pytest -q
|
|
|
|
- name: Build wheel and sdist
|
|
run: uv build
|
|
|
|
- name: Verify extras install cleanly from the built wheel
|
|
shell: bash
|
|
run: |
|
|
python -m venv /tmp/wheel-check
|
|
/tmp/wheel-check/Scripts/pip install "$(ls dist/*.whl)[tcptrace,ndt7,quic]"
|
|
/tmp/wheel-check/Scripts/netsleuth --help
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: dist
|
|
path: dist/
|
|
|
|
# Publishing is intentionally a separate, manually-approved job.
|
|
#
|
|
# RENAMED as of 2026-08-09: the distribution name "netcheck" was already
|
|
# taken on PyPI by an unrelated project (Netchecks / hardbyte, a cloud-native
|
|
# network-assertion tool, https://pypi.org/project/netcheck/). `pyproject.toml`'s
|
|
# [project] name has been changed to "netsleuth" — see TASKS.md.
|
|
#
|
|
# Still needed before this job can be enabled:
|
|
# 1. Confirm "netsleuth" is actually free on PyPI (fresh availability check —
|
|
# it was only checked against the old name).
|
|
# 2. Set up PyPI Trusted Publishing for the new project name
|
|
# (https://docs.pypi.org/trusted-publishers/) — no token needed, this
|
|
# workflow's OIDC identity gets authorized directly on pypi.org.
|
|
# 3. Uncomment the job below and give it an `environment: pypi` protection
|
|
# rule requiring manual approval, so a tag push builds automatically
|
|
# but a human still has to click "publish."
|
|
#
|
|
# publish:
|
|
# needs: build-and-test
|
|
# runs-on: ubuntu-latest
|
|
# environment: pypi
|
|
# permissions:
|
|
# id-token: write
|
|
# steps:
|
|
# - uses: actions/download-artifact@v4
|
|
# with:
|
|
# name: dist
|
|
# path: dist/
|
|
# - uses: pypa/gh-action-pypi-publish@release/v1
|