feat(models): update Python SDK schemas for UCP release 2026-08-25

- Update schema preprocessing pipeline for v2026-08-25 response definitions
- Regenerate Pydantic models from UCP release/2026-08-25 JSON schemas
- Restructure models into common, shopping, and transport verticals
- Add Location Search/Lookup, Loyalty, Request Constraints, Permalinks, and Actions models
- Move shared primitives and payment extensions to common namespace
- Bump package version to 0.5.0 in pyproject.toml and update README.md

Author: segiodongo

.codespellignore

@@ -2,3 +2,4 @@ mor
 tok
 fpan
 dpan
+requestor

.github/workflows/conventional-commits.yml

@@ -33,7 +33,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: semantic-pull-request
-        uses: amannn/action-semantic-pull-request@v6
+        # zizmor: ignore[unpinned-uses]
+        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/governance.yml

@@ -2,6 +2,7 @@
 name: PR Governance
 
 on:
+  # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types: [
       opened, 
@@ -13,23 +14,21 @@ on:
       assigned, 
       unassigned
     ]
-  workflow_run:
-    workflows: ["PR Review Listener"]
-    types: [completed]
+  pull_request_review:
+    types: [submitted, dismissed]
 
 jobs:
   governance:
     name: Reviews
+    # skip for draft PRs
+    if: github.event.pull_request.draft == false
     permissions:
       statuses: write
       contents: read
       pull-requests: read
     # Use the reusable workflow defined in the central governance repository
     # zizmor: ignore[ref-confusion]
-    uses: Universal-Commerce-Protocol/.github/.github/workflows/reusable-governance.yml@main
-    with:
-      pr-number: ${{ github.event.pull_request.number }}
-      commit-sha: ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}
+    uses: Universal-Commerce-Protocol/.github/.github/workflows/reusable-governance.yml@dc6fd211c5e46503fb56983146d8004ef2e514fb # main
     secrets:
       # Required: An org-level Read token to read team memberships
       ORG_READ_TOKEN: ${{ secrets.ORG_READ_TOKEN }}

.github/workflows/linter.yml

@@ -20,15 +20,20 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-python@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
       with:
         python-version: '3.x'
-    - uses: pre-commit/action@v3.0.1
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
       env:
         # workaround for pre-commit/action not being updated to node24
         FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

.github/workflows/pr-review-listener.yml

@@ -3,6 +3,9 @@ on:
   pull_request_review:
     types: [submitted, dismissed]
 
+permissions:
+  contents: read
+
 jobs:
   signal:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -18,17 +18,20 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       # Installs uv (and manages Python automatically)
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.2.0
+        # zizmor: ignore[cache-poisoning]
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
 
-      # 'uv build' automatically creates the sdist and wheel inz 'dist/'
+      # 'uv build' automatically creates the sdist and wheel in 'dist/'
       - name: Build package
         run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128480b75e93ec # release/v1

.github/workflows/tests.yml

@@ -34,6 +34,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
@@ -49,14 +51,16 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Install uv
         uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
       - name: Regenerate models from the pinned spec version
-        # SDK 0.4.x targets UCP 2026-04-08 (see the README compatibility
+        # SDK 0.5.x targets UCP 2026-08-25 (see the README compatibility
         # table). Bump this pin together with the SDK version line.
-        run: ./generate_models.sh 2026-04-08
+        run: ./generate_models.sh 2026-08-25
       - name: Normalize file endings (as pre-commit's end-of-file-fixer does)
         run: |
           python3 - <<'PY'
@@ -72,7 +76,7 @@ jobs:
         run: |
           git add -A -- src/ucp_sdk/models/schemas
           if ! git diff --cached --quiet -- src/ucp_sdk/models/schemas; then
-            echo "::error::Committed models differ from regeneration against the pinned UCP spec. Either the generation pipeline is broken, or the models were edited without regenerating. Run ./generate_models.sh 2026-04-08 and commit the result."
+            echo "::error::Committed models differ from regeneration against the pinned UCP spec. Either the generation pipeline is broken, or the models were edited without regenerating. Run ./generate_models.sh 2026-08-25 and commit the result."
             git --no-pager diff --cached --stat -- src/ucp_sdk/models/schemas
             git --no-pager diff --cached -- src/ucp_sdk/models/schemas
             exit 1

.gitignore

@@ -3,3 +3,5 @@ node_modules/
 __pycache__/
 .venv/
 *.py[cod]
+ucp/
+uv.lock

README.md

@@ -35,17 +35,6 @@ This repository contains the Python SDK for the
 models for UCP schemas, making it easy to build UCP-compliant applications in
 Python.
 
-### UCP Version Compatibility
-
-Each version of the Python SDK is generated against a specific version of the
-UCP schema:
-
-| SDK Version       | UCP Schema Version |
-| ----------------- | ------------------ |
-| **`0.4.x`**       | **`2026-04-08`**   |
-| `0.3.x`           | `2026-01-23`       |
-| `0.2.x` / `0.1.x` | `2026-01-11`       |
-
 ## Installation
 
 To use this SDK in your own project, install it from PyPI:
@@ -71,20 +60,22 @@ from ucp_sdk.models.schemas.shopping.checkout import Checkout
 checkout = Checkout.model_validate(checkout_data)
 
 # Access typed fields
-print(checkout.status)  # "incomplete" | "ready_for_complete" | ...
-print(checkout.currency)  # ISO 4217 currency code
+print(checkout.status)       # "incomplete" | "ready_for_complete" | ...
+print(checkout.currency)     # ISO 4217 currency code
 for item in checkout.line_items:
     print(f"{item.item.title}: {item.quantity}")
 ```
 
 ### Available model packages
 
-| Package                                 | Description                                         |
-| --------------------------------------- | --------------------------------------------------- |
-| `ucp_sdk.models.schemas.shopping`       | Checkout, cart, catalog, order, payment models      |
-| `ucp_sdk.models.schemas.shopping.types` | Line items, totals, buyer, fulfillment, signals     |
-| `ucp_sdk.models.schemas.transports`     | REST, MCP, and embedded protocol bindings           |
-| `ucp_sdk.models.schemas`                | Service definitions, capabilities, payment handlers |
+| Package                                 | Description                                                       |
+| --------------------------------------- | ----------------------------------------------------------------- |
+| `ucp_sdk.models.schemas.common`         | Location search/lookup, identity linking, loyalty, payment terms  |
+| `ucp_sdk.models.schemas.common.types`   | Shared primitives (amounts, prices, totals, postal address, etc.) |
+| `ucp_sdk.models.schemas.shopping`       | Checkout, cart, catalog, order, buyer consent, permalink models   |
+| `ucp_sdk.models.schemas.shopping.types` | Line items, adjustments, fulfillments, destinations, attribution  |
+| `ucp_sdk.models.schemas.transports`     | REST, MCP, and embedded protocol bindings                         |
+| `ucp_sdk.models.schemas`                | Service definitions, capabilities, profile, payment handlers      |
 
 ### Validation
 
@@ -133,21 +124,13 @@ uv sync
 ```
 
 Where `<version>` is the version of the UCP specification to use (for example,
-"2026-04-08").
+"2026-08-25").
 
 If no version is specified, the `main` branch of the
 [UCP repo](https://github.com/Universal-Commerce-Protocol/ucp) will be used.
 
 The generated code is automatically formatted using `ruff`.
 
-### Running Tests
-
-Run the schema preprocessing test suite with:
-
-```bash
-uv run python -m unittest discover -s tests -p "test_*.py"
-```
-
 ## Contributing
 
 We welcome community contributions. See our

generate_models.sh

@@ -27,13 +27,6 @@ if ! command -v git &> /dev/null; then
     exit 1
 fi
 
-# Check if uv is installed before cloning or modifying generated files
-if ! command -v uv &> /dev/null; then
-    echo "Error: uv not found."
-    echo "Please install uv: curl -LsSf https://astral.sh/uv/install.sh | sh"
-    exit 1
-fi
-
 # UCP Version to use (if provided, use release/$1 branch; otherwise, use main)
 if [ -z "$1" ]; then
     BRANCH="main"
@@ -46,6 +39,7 @@ fi
 # Ensure ucp directory is clean before cloning
 rm -rf ucp
 git clone -b "$BRANCH" --depth 1 https://github.com/Universal-Commerce-Protocol/ucp ucp
+rm -rf ucp/.git
 
 # Output directory
 OUTPUT_DIR="src/ucp_sdk/models/schemas"
@@ -101,9 +95,19 @@ uv run \
 echo "Post-processing generated models (constraints the generator ignores)..."
 uv run python postprocess_models.py || exit 1
 
+# Normalize file endings (as pre-commit's end-of-file-fixer does)
+python3 - <<'PY'
+from pathlib import Path
+
+for path in Path("src/ucp_sdk/models/schemas").rglob("*.py"):
+    text = path.read_text(encoding="utf-8")
+    fixed = text.rstrip("\n") + "\n" if text.strip() else ""
+    if fixed != text:
+        path.write_text(fixed, encoding="utf-8")
+PY
+
 echo "Formatting generated models..."
 uv run ruff format
 uv run ruff check --fix "$OUTPUT_DIR"
 
-
 echo "Done. Models generated in $OUTPUT_DIR"