feat: guard against reserved mloda namespace package roots - #72
Merged
Conversation
A plugin scaffolded from this template that renames the package root to 'mloda' or 'mloda_plugins' would ship mloda/__init__.py and collapse the shared PEP 420 namespace, making the core framework unimportable for anyone who installs the plugin. - bin/customize.sh rejects the reserved names at rename time - tests/test_reserved_namespace.py fails (in default tox / CI) if the repo would ship a reserved namespace root - README notes the reserved names in the customization step Closes #71
Recursively scan the source tree (pruning venv/build/cache dirs) for a reserved 'mloda/__init__.py' or 'mloda_plugins/__init__.py', so a src/-style layout that would still collapse the namespace is caught, not just the default where=["."] root layout.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #71.
Problem
A plugin scaffolded from this template that renames the
placeholder/package root tomlodaormloda_pluginswould shipmloda/__init__.pyand collapse the shared PEP 420mlodanamespace, making the core framework unimportable for everyone who installs the plugin. Nothing guarded against it.Change (three layers)
bin/customize.shrejects the reserved namesmloda/mloda_pluginsat rename time, mirroring the existingplaceholderguard.tests/test_reserved_namespace.pyis the CI gate. It runs in the defaulttoxpytest step (so it covers manual renames that bypass the script, and runs on every scaffolded plugin across the 3.10-3.13 matrix). It fails if:mloda/mloda_plugins, ormloda/__init__.py/mloda_plugins/__init__.pyexists anywhere in the source tree (coverssrc/-style layouts, not just the defaultwhere = ["."]; virtualenv/build/cache dirs are pruned so installed deps never trip it).The detection logic is unit-tested (root layout, src layout, bare namespace dir, excluded dirs, clean tree).
README.mdnotes the reserved names in the customization step.This invariant has no template-repo exemption (neither the template nor any plugin should ever ship
mloda/__init__.py), so it lives in the defaulttoxrun rather than the placeholder-only env.Verification
toxpasses locally (15 tests; ruff format, ruff check, mypy --strict, bandit all clean).Review
Implementation was reviewed by two independent deep reviews (Claude Opus + codex). The accepted finding (the guard initially only scanned the repo root and would miss a
src/-layoutmloda/__init__.py) is addressed by the recursive source-tree scan in the second commit.🤖 Generated with Claude Code