Merge pull request #30 from nickroci/fix/version-from-metadata

fix(version): derive version from metadata; re-lock on release (fixes red main)

Author: nickroci

.github/workflows/release.yml

@@ -27,6 +27,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+
       - name: Validate version
         run: |
           printf '%s' "${{ inputs.version }}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$' \
@@ -38,6 +43,9 @@ jobs:
       - name: Verify coherence
         run: bash scripts/check-version-coherence.sh
 
+      - name: Verify the lockfile (the meaningful CI check for a version-only bump)
+        run: uv sync --locked
+
       - name: Open (or update) the release PR
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -65,14 +73,15 @@ jobs:
           set -euo pipefail
           # A PR opened by GITHUB_TOKEN does not trigger ci.yml (GitHub's loop
           # prevention), so the required `ci-success` check would never report and
-          # would block the merge. This diff is version/spec strings ONLY and its
-          # coherence is verified by the step above, so post a passing `ci-success`
-          # status on the release commit directly. Branch protection matches the
-          # context name, so this satisfies the gate.
+          # would block the merge. This diff is version/spec/lock strings ONLY, and
+          # the steps above verified both coherence AND `uv sync --locked` — the
+          # only checks that can change for a version bump — so post a passing
+          # `ci-success` status on the release commit directly. Branch protection
+          # matches the context name, so this satisfies the gate.
           # Safe ONLY because nothing but set-version.sh ever touches a release/*
           # branch — never hand-push code there.
           SHA="$(git rev-parse HEAD)"
           gh api -X POST "repos/${{ github.repository }}/statuses/$SHA" \
             -f state=success \
             -f context=ci-success \
-            -f description="version-only release bump; coherence verified by release workflow"
+            -f description="version-only release bump; coherence + lockfile verified by release workflow"

scripts/set-version.sh

@@ -10,6 +10,8 @@
 #   - "version" in .claude-plugin/plugin.json
 #   - the git ref of the `git+https://github.com/nickroci/ultan@<ref>` install
 #     spec in plugin.json AND scripts/ensure-ultan.sh  ->  @v<version>
+#   - uv.lock (re-locked so `uv sync --locked` stays valid — the member version
+#     bump otherwise leaves the lock stale and reddens CI on main)
 #
 # It does NOT commit, tag, or push. The caller does that, so the version edits
 # always land in the commit the tag will point at (the plugin.json install spec
@@ -46,4 +48,14 @@ V="$VERSION" perl -0pi -e 's/("version":\s*")[^"]*(")/$1$ENV{V}$2/' "$ROOT/.clau
 TAG="$TAG" perl -0pi -e 's{(nickroci/ultan)\@[A-Za-z0-9._/-]+}{$1\@$ENV{TAG}}g' \
   "$ROOT/.claude-plugin/plugin.json" "$ROOT/scripts/ensure-ultan.sh"
 
+# Re-lock: the workspace-member version bumps make uv.lock stale, so
+# `uv sync --locked` (CI) would fail on main after the release merges. uv lock
+# only rewrites the version strings here (no dependency change), and resolves
+# from cache in milliseconds. Guarded so a uv-less local run still does the edits.
+if command -v uv >/dev/null 2>&1; then
+  ( cd "$ROOT" && uv lock )
+else
+  echo "warning: uv not found — skipped 'uv lock'; run it before committing or CI will fail" >&2
+fi
+
 echo "set version -> $VERSION  (install spec ref -> $TAG)"

ultan/__init__.py

@@ -1,3 +1,22 @@
 """Ultan — thin CLI wrapper package (entry-level install)."""
 
-__version__ = "0.2.0"
+
+def __getattr__(name: str) -> str:
+    # Single source of truth for the version: the installed package metadata
+    # (derived from pyproject at build time), so it can never drift from the
+    # released dist the way a hardcoded literal did. Computed lazily via PEP 562
+    # so `import ultan` — and the per-turn `ultan hook` hot path — never pay the
+    # importlib.metadata lookup; only `ultan --version` / `ultan doctor` touch it.
+    if name == "__version__":
+        from importlib.metadata import (  # noqa: PLC0415 — lazy by design
+            PackageNotFoundError,
+            version,
+        )
+
+        try:
+            return version("ultan")
+        except PackageNotFoundError:
+            # A source tree that was never installed as a dist (rare; the tool is
+            # always `uv tool install`ed in practice).
+            return "0+unknown"
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

ultan/__main__.py

@@ -15,8 +15,6 @@
 import argparse
 import sys
 
-from . import __version__
-
 
 def main() -> int:
     ap = argparse.ArgumentParser(prog="ultan", description="Ultan — local memory for Claude Code.")
@@ -48,6 +46,8 @@ def main() -> int:
     args = ap.parse_args()
 
     if args.version:
+        from . import __version__  # lazy: keeps the metadata lookup off the hook path
+
         print(f"ultan {__version__}")
         return 0
     if args.cmd == "doctor":