Merge pull request #8 from eccenca/feature/useCmemClient-CMEM-7987

update template and replace cmempy with cmem-client

Author: peterfreytag

.copier-answers.yml

@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: v7.3.0-24-g169e035
+_commit: v8.5.0-3-g60fcc85
 _src_path: gh:eccenca/cmem-plugin-template
 author_mail: cmempy-developer@eccenca.com
 author_name: eccenca GmbH

.github/workflows/check.yml

@@ -22,6 +22,13 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v5
 
+      - name: Cache Trivy DB
+        id: cache-trivydb
+        uses: actions/cache@v4
+        with:
+          path: .trivycache
+          key: ${{ runner.os }}-trivydb
+
       - name: Install Task
         uses: arduino/setup-task@v2
 
@@ -38,10 +45,6 @@ jobs:
           virtualenvs-in-project: true
           installer-parallel: true
 
-      - name: Install dynamic versioning plugin
-        run: |
-          poetry self add "poetry-dynamic-versioning[plugin]"
-
       - name: mypy
         run: |
           task check:mypy
@@ -61,9 +64,13 @@ jobs:
         run: |
           task check:deptry
 
-      - name: safety
+      - name: trivy
+        env:
+          TRIVY_NO_PROGRESS: "true"
+          TRIVY_CACHE_DIR: ".trivycache/"
+          TRIVY_DISABLE_VEX_NOTICE: "true"
         run: |
-          task check:safety
+          task check:trivy
 
       - name: Publish Test Report in Action
         uses: mikepenz/action-junit-report@v4

.github/workflows/publish.yml

@@ -35,10 +35,6 @@ jobs:
           virtualenvs-in-project: true
           installer-parallel: true
 
-      - name: Install dynamic versioning plugin
-        run: |
-          poetry self add "poetry-dynamic-versioning[plugin]"
-
       - name: Publish Package
         env:
           PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}

.gitignore

@@ -138,6 +138,9 @@ dmypy.json
 # Cython debug symbols
 cython_debug/
 
+# Claude code specifics
+.claude/settings.local.json
+
 # project build plan specific ignores
 version.py
 co

.gitlab-ci.yml

@@ -1,6 +1,6 @@
 ---
 default:
-  image: docker-registry.eccenca.com/eccenca-python:v3.13.8
+  image: docker-registry.eccenca.com/eccenca-python:v3.13.13
   # all jobs can be interrupted in case a new commit is pushed
   interruptible: true
   before_script:
@@ -60,17 +60,24 @@ deptry:
   script:
     - task check:deptry
 
-safety:
+trivy:
   stage: test
+  variables:
+    TRIVY_NO_PROGRESS: "true"
+    TRIVY_CACHE_DIR: ".trivycache/"
+    TRIVY_DISABLE_VEX_NOTICE: "true"
   script:
-    - task check:safety
+    - task check:trivy
+  cache:
+    paths:
+      - .trivycache/
 
 build:
   stage: build
   needs:
     - mypy
     - pytest
-    - safety
+    - trivy
     - deptry
   script:
     - task build

.pre-commit-config.yaml

@@ -1,4 +1,7 @@
 ---
+default_language_version:
+  python: python3.13
+
 repos:
   - repo: local
     hooks:
@@ -36,3 +39,9 @@ repos:
         stages: [post-checkout, post-merge]
         always_run: true
 
+      - id: trivy
+        name: check:trivy
+        description: run trivy to scan for vulnerabilities
+        entry: task check:trivy
+        language: python
+        pass_filenames: false

.trivyignore

@@ -0,0 +1,4 @@
+# .trivyignore
+
+# ignore 51358 safety - dev dependency only
+CVE-2022-39280

CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](https://semver.org/)
 
+## [5.1.0] 2026-08-05
+
+### Changed
+
+- Update dependencies and template
+- Replace `cmem-cmempy` with `cmem-client`
+
+
 ## [5.0.0] 2024-10-16
 
 ### Changed

CLAUDE.md

@@ -0,0 +1,81 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+`cmem-plugin-graphql` is a [Corporate Memory (CMEM)](https://documentation.eccenca.com) plugin that executes GraphQL queries/mutations against an endpoint and saves results to a JSON dataset. It is generated from the [`eccenca/cmem-plugin-template`](https://github.com/eccenca/cmem-plugin-template).
+
+## Quick Commands
+
+```bash
+# Install dependencies
+poetry install
+
+# Run all checks (linters + tests)
+task check
+
+# Run only unit tests (no CMEM server required)
+task check:pytest
+
+# Lint / format
+task check:ruff          # lint only (non-fatal --exit-zero)
+task check:mypy          # type checking
+task check:deptry        # unused/missing deps
+task check:trivy         # vulnerability scan
+task format:fix          # auto-format + safe fixes
+task format:fix-unsafe   # auto-format + unsafe fixes
+
+# Build distribution
+task build               # poetry build + export requirements.txt
+
+# Install/uninstall plugin in a CMEM workspace
+task install             # build + cmemc admin workspace python install
+task uninstall           # cmemc admin workspace python uninstall
+```
+
+Tests that require a live CMEM server are guarded with `@needs_cmem` (skips unless `CMEM_BASE_URI` is set). The lone non-CMEM test is `test_is_string_jinja_template` and `test_dummy`.
+
+## Architecture
+
+```
+cmem_plugin_graphql/
+  __init__.py              # package marker (empty)
+  workflow/
+    graphql.py             # GraphQLPlugin — the single WorkflowPlugin entry point
+    utils.py               # jinja template detection, entity/dict conversion helpers
+tests/
+  test_graphql.py          # integration tests against a public test GraphQL endpoint
+```
+
+### Key module: `workflow/graphql.py`
+
+- **`GraphQLPlugin`** — decorated with `@Plugin(...)` to register as a CMEM workflow task. Parameters: `graphql_url`, `graphql_query`, `graphql_variable_values`, `graphql_dataset` (optional), `oauth_access_token` (optional).
+- Query validation: detects Jinja templates via `is_jinja_template()` (renders and checks for substitution); otherwise validates as pure GraphQL syntax with `gql()`.
+- Variable values validation: detects Jinja templates or validates as JSON.
+- **`execute()`** branching logic:
+  - If Jinja is detected in either query or variables → iterates over input `Entities`, renders per-entity, executes per entity via `process_entities()`.
+  - Otherwise → single-shot execution against the endpoint with static variables.
+- Results are collected into a list; if `graphql_dataset` is set, payload is written to that CMEM dataset via `write_to_dataset()`.
+
+### Key module: `workflow/utils.py`
+
+- **`is_jinja_template(value)`** — renders through Jinja's `Environment`; if the rendered output differs from the input, Jinja variables were present.
+- **`get_dict(entities)`** — iterator that flattens `Entities` into per-entity dicts keyed by schema path.
+- **`get_entities_from_list(data)` / `create_entity(paths, dict_)`** — bidirectional helpers for converting between `list[dict]` and `Entities`.
+
+## Dependencies
+
+| Category | Key packages |
+|----------|-------------|
+| Runtime | `graphql-core`, `gql[all]`, `Jinja2`, `validators` |
+| CMEM base | `cmem-plugin-base ^4.19.0` (declared as a Poetry `[tool.poetry.dependencies.cmem-plugin-base]` extra) |
+| Dev | `ruff`, `mypy`, `deptry`, `trivy-py-ecc`, `pytest` + cov, html, memray, dotenv |
+
+Python version: **3.13** (pinned in `.python-version`).
+
+## CI/CD
+
+- `.github/workflows/check.yml` — runs mypy, ruff, pytest, deptry, trivy on PRs/pushes to `main`/`develop`.
+- `.github/workflows/publish.yml` — publishes to PyPI on tag push or manual dispatch.
+- Pre-commit hooks mirror the CI linters (ruff, poetry-check, poetry-lock) plus trivy.

Taskfile.yaml

@@ -44,36 +44,9 @@ tasks:
     cmds:
       - mkdir -p {{.DIST_DIR}}/coverage
 
-  poetry:check:
-    internal: true
-    platforms: [darwin, linux]
-    summary: |
-      Check poetry versioning plugin. Currently not under Windows
-    run: once
-    preconditions:
-      - sh: '[ -d .git ]'
-        msg: >
-          Your newly created project directory needs to be initialized
-          as a git repository.
-      - sh: '[[ {{.PDV_VERSION}} > {{.PDV_VERSION_MIN}} ]]'
-        msg: >
-          This project needs the poetry-dynamic-versioning
-          plugin > v{{.PDV_VERSION_MIN}}.
-
-          You can install it with the following command:
-          poetry self add "poetry-dynamic-versioning[plugin]"
-    vars:
-      PDV_VERSION_MIN: 0.20
-      PDV_VERSION:
-        sh: >
-            poetry self show --addons poetry-dynamic-versioning --tree
-            | head -1 | cut -d " " -f 2 | cut -d "." -f 1-2
-
   poetry:install:
     desc: Install dependencies managed by Poetry
     run: once
-    deps:
-      - poetry:check
     cmds:
       - poetry install
 
@@ -112,7 +85,7 @@ tasks:
       - task: check:ruff
       - task: check:mypy
       - task: check:deptry
-      - task: check:safety
+      - task: check:trivy
 
   check:pytest:
     desc: Run unit and integration tests
@@ -154,12 +127,17 @@ tasks:
     vars:
       JUNIT_FILE: ./{{.DIST_DIR}}/junit-mypy.xml
 
-  check:safety:
-    desc: Complain about vulnerabilities in dependencies
+  check:trivy:
+    desc: Scan for vulnerabilities using Trivy
     <<: *preparation
     cmds:
-      # ignore 51358 safety - dev dependency only
-      - poetry run safety check -i 51358
+      - >
+        poetry run trivy fs
+        --include-dev-deps
+        --scanners vuln
+        --skip-files .poetry/plugins/poetry.lock
+        --exit-code 1
+        .
 
   check:deptry:
     desc: Complain about unused or missing dependencies
@@ -185,7 +163,7 @@ tasks:
     <<: *preparation
     deps:
       - clean
-      - poetry:check
     cmds:
       - poetry build
+      - poetry export --without=dev -f requirements.txt >dist/requirements.txt