feat: fail CI if pyproject.toml still has placeholder strings (#59)

* feat: fail CI if pyproject.toml still has placeholder strings

Adds a `placeholders` tox env that greps `pyproject.toml` for the
template's placeholder strings (`placeholder-my-plugin`,
`Your Name placeholder`, `placeholder@placeholder.com`) and fails if
any are present.

The check is wired into `test.yml` as a step gated by
`github.repository != 'mloda-ai/mloda-plugin-template'` (and pinned
to the 3.10 matrix leg so it runs once per workflow). This keeps the
template repo's own CI green while scaffolded plugins fail until
they update `pyproject.toml`.

README "Setup Your Plugin" documents how to run the check locally and
the template-repo exemption. `docs/github-repository-settings.md`
notes that the check rides on the 3.10 matrix leg.

Closes #47

* feat: broaden placeholder check to cover all five pyproject fields

The check now flags the description and the setuptools/pytest
placeholder entries in addition to name and authors, so it matches
every field the README setup walks the user through. Patterns use
POSIX character classes ([.], [*]) instead of backslash escapes for
portability across GNU and BSD grep.

Author: TKaltofen

.github/workflows/test.yml

@@ -31,3 +31,11 @@ jobs:
       - name: Run tox
         run: tox
         timeout-minutes: 2
+
+      # Skip on the template repo itself: the placeholders are intentional there.
+      # Scaffolded plugins inherit no exemption and must update pyproject.toml
+      # before this check passes. Runs once per workflow (only on the 3.10 leg).
+      - name: Check pyproject.toml for template placeholders
+        if: matrix.python-version == '3.10' && github.repository != 'mloda-ai/mloda-plugin-template'
+        run: tox -e placeholders
+        timeout-minutes: 1

README.md

@@ -70,6 +70,14 @@ The package name must be a valid Python identifier (lowercase letters, digits, u
 uv venv && source .venv/bin/activate && uv sync --all-extras && tox
 ```
 
+After `tox` passes, confirm `pyproject.toml` no longer contains the template's placeholder strings:
+
+```bash
+tox -e placeholders
+```
+
+This is also enforced in CI: the `test.yml` workflow fails on scaffolded plugins until the template's placeholder strings are removed from `pyproject.toml`. The check covers every field listed in step 2 above: `name`, `authors` (name and email), `description`, `tool.setuptools.packages.find.include`, and `tool.pytest.ini_options.testpaths`. It is skipped on the `mloda-ai/mloda-plugin-template` repository itself, where the placeholders are intentional.
+
 #### 3. Remove template-only files
 
 After `tox` passes, remove the files that only exist to support the template itself:

docs/github-repository-settings.md

@@ -49,7 +49,7 @@ The test workflow (`test.yml`) declares a job called `test` with a matrix over P
 - `test (3.12)`
 - `test (3.13)`
 
-If you drop a Python version from the matrix in `test.yml`, also drop it from the required checks; otherwise PRs will block forever waiting for a check that never runs.
+If you drop a Python version from the matrix in `test.yml`, also drop it from the required checks; otherwise PRs will block forever waiting for a check that never runs. The placeholder check rides on the `3.10` leg via an `if:` guard in `test.yml`; if you change which Python version runs that step, update the guard to match.
 
 The security scan (`security-scan.yaml`) and template sync (`template-sync.yaml`) workflows run on a schedule and do not produce per-PR checks, so they should not be added as required.
 

tox.ini

@@ -12,6 +12,16 @@ commands =
     mypy --strict --ignore-missing-imports .
     bandit -c pyproject.toml -r -q .
 
+[testenv:placeholders]
+# Fail if pyproject.toml still has the template's placeholder strings.
+# Covers every field the README setup walks through: name, authors,
+# description, tool.setuptools.packages.find.include, tool.pytest.ini_options.testpaths.
+# Run in CI for scaffolded plugins; skipped on the template repo itself.
+skip_install = true
+allowlist_externals = sh
+commands =
+    sh -c 'if grep -nE "placeholder-my-plugin|Your Name placeholder|placeholder@placeholder[.]com|TEMPLATE PLACEHOLDER|\"placeholder[*]\"|\"placeholder\"" pyproject.toml; then echo; echo "ERROR: pyproject.toml still contains template placeholder strings."; echo "Update name, authors, description, tool.setuptools.packages.find.include, and tool.pytest.ini_options.testpaths before publishing."; exit 1; fi'
+
 [testenv:security]
 # CVE scanning environment - builds and scans the local package
 usedevelop = true