Merge dev into main

.github/dependabot.yml

@@ -6,16 +6,27 @@
 version: 2
 updates:
   - package-ecosystem: "pip" # See documentation for possible values
-    directory: "/" # Location of package manifests
+    # Location of package manifests. "/" does not reach .github/requirements, which holds the
+    # hash-locked files the CI test job and the two publish jobs install (ci.txt, publish.txt).
+    directories:
+      - "/"
+      - "/.github/requirements"
     # Updates belong on dev: main is the released branch and merging into it
     # publishes, so a PR opened against main just sits there.
     target-branch: "dev"
     schedule:
       interval: "daily"
+    # A new release waits 7 days before Dependabot proposes it, so a
+    # compromised version is more likely to be found and yanked first.
+    # Dependabot's own default is 3 days. Security updates are not delayed.
+    cooldown:
+      default-days: 7
   # Workflow actions are pinned to commit SHAs with the version as a comment
   # (test_workflow_actions.py); Dependabot moves both together.
   - package-ecosystem: "github-actions"
     directory: "/"
     target-branch: "dev"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/requirements/ci.in

@@ -1,12 +1,15 @@
 # What the CI test job installs; ci.txt is generated from this file (the command is in ci.yml).
-# Runtime dependencies (pyproject.toml), the gui and mcp extras, and the test tools.
+# Runtime dependencies (pyproject.toml), the gui, mcp, websocket, grpc and ai extras, and the test tools.
 requests
 Flask
 httpx
 defusedxml
+je_action_core>=0.0.1
 PySide6==6.11.2
-qt-material
 mcp>=1.28.1,<3
+websockets>=12.0
+grpcio>=1.60
+anthropic>=1.0,<2
 pytest
 pytest-asyncio
 pytest-timeout

.github/requirements/publish.in

@@ -0,0 +1,8 @@
+# What the two jobs that upload to PyPI install: publish-dev in ci.yml and publish in publish.yml.
+# publish.txt is generated from this file; the command is in both workflows, above the install step.
+build
+twine
+# The build backend. Both jobs run `python -m build --no-isolation`, so the backend is this locked one
+# and not whatever is newest on PyPI when the job runs. It must satisfy `build-system.requires` in
+# pyproject.toml and dev.toml; test/test_workflow_actions.py fails when it does not.
+setuptools

.github/workflows/ci.yml

@@ -14,6 +14,7 @@ permissions:
 jobs:
   test:
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 15  # about 3x the slowest recent run, at least 15
     strategy:
       fail-fast: false
       matrix:
@@ -31,13 +32,86 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       # Hash-locked, wheels-only, one file for every OS and Python in the matrix. Regenerate with
-      #   uv pip compile .github/requirements/ci.in --universal --python-version 3.10       #     --generate-hashes --only-binary :all: -o .github/requirements/ci.txt
+      #   uv pip compile .github/requirements/ci.in --universal --python-version 3.10 \
+      #     --generate-hashes --only-binary :all: -o .github/requirements/ci.txt
       - name: Install dependencies
         run: |
           pip install --require-hashes --only-binary :all: -r .github/requirements/ci.txt
 
-      # The tests import the checked-out source, not a published package.
+      # PySide6's Qt libraries load these at import; the Ubuntu runner image lacks libEGL.so.1 at least.
+      # The list is the ELF NEEDED entries of QtGui, QtWidgets and the offscreen plugin outside the base system.
+      - name: Install Qt runtime libraries (Linux)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends libegl1 libgl1 libx11-6 libxkbcommon0 libfontconfig1 libfreetype6
+
+      # The tests import the checked-out source, not a published package. APITESTKA_REQUIRE_QT turns a
+      # failed PySide6 import into an error, so the GUI widget tests cannot silently skip in CI.
       - name: Run tests
         env:
           PYTHONPATH: ${{ github.workspace }}
+          APITESTKA_REQUIRE_QT: "1"
         run: python -m pytest test/ -v
+
+  publish-dev:
+    # The dev channel. A push to dev that passes the tests is built from dev.toml and uploaded when
+    # it is still the tip of dev and ships something the newest je_api_testka_dev does not.
+    # scripts/dev_release.py picks the version from PyPI, so nothing is committed back.
+    # This workflow also runs for main, pull requests and the schedule: the condition keeps those out.
+    name: Publish je_api_testka_dev to PyPI
+    needs: [test]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15  # about 3x the slowest recent run, at least 15
+    concurrency:
+      group: publish-dev
+      cancel-in-progress: false
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+
+      # Hash-locked and wheels-only, like the test job: this job holds the PyPI token. Regenerate with
+      #   uv pip compile .github/requirements/publish.in --generate-hashes --python-version 3.12 \
+      #     --python-platform x86_64-manylinux_2_28 --only-binary :all: --exclude-newer 2026-09-24 \
+      #     -o .github/requirements/publish.txt
+      # (--exclude-newer keeps the 7-day wait Dependabot applies; move the date when regenerating)
+      - name: Install build tooling
+        run: |
+          python -m pip install --require-hashes --only-binary :all: -r .github/requirements/publish.txt
+
+      - name: Write pyproject.toml from dev.toml with the next version
+        run: python scripts/dev_release.py prepare
+
+      # --no-isolation: the backend is the setuptools locked in publish.txt, not a fresh download.
+      - name: Build distribution
+        run: python -m build --no-isolation
+
+      - name: Verify distribution metadata
+        run: python -m twine check dist/*
+
+      - name: Compare with the newest published wheel
+        id: compare
+        run: python scripts/dev_release.py changed dist
+
+      # A run that finishes after a newer push would otherwise publish older code as the newest release.
+      - name: Check that this commit is still the tip of dev
+        id: tip
+        run: |
+          tip="$(git ls-remote origin refs/heads/dev | cut -f1)"
+          if [ "$tip" = "$GITHUB_SHA" ]; then current=true; else current=false; fi
+          echo "current=$current" >> "$GITHUB_OUTPUT"
+
+      - name: Publish to PyPI
+        if: steps.compare.outputs.changed == 'true' && steps.tip.outputs.current == 'true'
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        run: python -m twine upload --non-interactive dist/*

.github/workflows/publish.yml

@@ -14,6 +14,7 @@ concurrency:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 15  # about 3x the slowest recent run, at least 15
     if: "!contains(github.event.head_commit.message, 'chore: bump version')"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -26,10 +27,15 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Install build tools
+      # Hash-locked and wheels-only, the same file as the publish-dev job of ci.yml: this job holds the
+      # PyPI token. Regenerate with
+      #   uv pip compile .github/requirements/publish.in --generate-hashes --python-version 3.12 \
+      #     --python-platform x86_64-manylinux_2_28 --only-binary :all: --exclude-newer 2026-09-24 \
+      #     -o .github/requirements/publish.txt
+      # (--exclude-newer keeps the 7-day wait Dependabot applies; move the date when regenerating)
+      - name: Install build tooling
         run: |
-          python -m pip install --upgrade pip
-          pip install build twine
+          python -m pip install --require-hashes --only-binary :all: -r .github/requirements/publish.txt
 
       - name: Bump patch version in pyproject.toml
         id: bump
@@ -59,8 +65,9 @@ jobs:
           print(f"Bumped version -> {new_version}")
           EOF
 
+      # --no-isolation: the backend is the setuptools locked in publish.txt, not a fresh download.
       - name: Build distribution
-        run: python -m build
+        run: python -m build --no-isolation
 
       - name: Publish to PyPI
         env:

CLAUDE.md

@@ -5,8 +5,8 @@
 APITestka (`je_api_testka`) is a lightweight, cross-platform Python framework for automated API testing. Supports HTTP/HTTPS, SOAP/XML, JSON with `requests` and `httpx` backends.
 
 - **Python**: 3.10+
-- **Dependencies**: `requests`, `Flask`, `httpx`
-- **Optional GUI**: `PySide6==6.11.0`, `qt-material`
+- **Dependencies**: `requests`, `Flask`, `httpx`, `defusedxml`, `je_action_core` (the executor core shared with LoadDensity, MailThunder and FileAutomation)
+- **Optional GUI**: `PySide6==6.11.2`
 
 ## Build & Test Commands
 
@@ -39,8 +39,8 @@ je_api_testka/
 │   ├── assert_result/     # Strategy pattern - response validation (JSON Schema, JSONPath, snapshots)
 │   ├── callback/          # Observer pattern - post-request callbacks
 │   ├── executor/          # Command pattern - JSON keyword-driven actions (AT_* commands)
-│   ├── generate_report/   # Template Method - HTML/JSON/XML/JUnit/Allure/Markdown reports
-│   ├── mock_server/       # Flask-based mock server
+│   ├── generate_report/   # Template Method - HTML/JSON/XML/JUnit/Allure/Markdown reports, latency trends
+│   ├── mock_server/       # Flask mock server plus WebSocket and gRPC mocks
 │   ├── socket_server/     # TCP remote automation server
 │   ├── project/           # Factory pattern - project scaffolding
 │   ├── json/, xml/        # JSON and XML I/O utilities
@@ -53,11 +53,12 @@ je_api_testka/
 │   └── exception/         # Custom exception hierarchy
 ├── data/                  # Variable store, templates, env profiles, fake data
 ├── connection/            # Connection options, DNS override, record/replay cassettes
-├── diff/, spec/           # Response and contract diff, SLA checks; schema inference, OpenAPI export
+├── diff/, spec/           # Response and contract diff, SLA checks; schema inference, OpenAPI export, test-as-spec loop
+├── contract/              # Pact-style consumer contracts, provider verification, OpenAPI check
 ├── security/              # Auth helpers, header scan, fuzzing, pip-audit wrapper
 ├── runner/                # Parallel runner, tag filter, dependency ordering
-├── integrations/          # cURL and HAR import, webhook notify, GitHub PR comment
-├── ai/                    # Pluggable text-completion backend (no-op by default)
+├── integrations/          # cURL and HAR import, webhook notify, GitHub PR comment, LoadDensity bridge
+├── ai/                    # Pluggable text-completion backend (no-op by default; Anthropic reference backend)
 ├── cli/                   # Subcommand CLI (`apitestka`)
 ├── mcp_server/            # MCP stdio server (`apitestka-mcp`)
 ├── pytest_plugin/         # pytest fixtures via the pytest11 entry point
@@ -211,6 +212,7 @@ Workspace rule shared by every repository under `D:\Codes` (full text: `D:\Codes
   - Stage only the files that stage touched (`git add <path>`, never `git add -A`), follow this file's commit-message rules, and never add AI attribution.
   - Committing is not pushing: push or open a PR only as this project's branch flow says or when asked.
   - **Commit and push frequently.** After each big feature — a self-contained stage that passes this project's checks — commit and push to the remote; do not pile up a large batch of work before committing or pushing. Smaller batches collide less with other sessions, let CI catch problems earlier, and are easier to revert. Follow this project's normal branch flow (usually `dev`).
+  - **SonarCloud / Codacy findings.** When a PR or commit fails a SonarCloud or Codacy check, look the findings up through their APIs instead of guessing. The keys are in environment variables: `SonarCloudToken` (SonarCloud, e.g. `curl -s -u "$SonarCloudToken:" "https://sonarcloud.io/api/issues/search?componentKeys=<key>&pullRequest=<n>&resolved=false"`) and `CODACY_PROJECT_TOKEN` (a Codacy project token, valid only for its own project: any other repository answers "Bad credentials", so for a public repository query `https://app.codacy.com/api/v3/analysis/organizations/gh/<org>/repositories/<repo>/pull-requests/<n>/issues?status=new` without a key). **Never reveal a key or any personal credential while doing so**: refer to the variables by name only, never echo or print their values, and never put them in files, commit messages, PR or issue text, logs, or any output that leaves the machine.
 - **`progress.md`** (repository root, tracked) holds outstanding work only: no finished items, no history, no rules.
 - **`docs/updates/`** records finished work: one batch file per month (`YYYY-MM.md`), one entry per piece of work headed `## U-YYYYMMDD-NN · date · title · #tags`, and an index with query commands in `docs/updates/README.md`. When a `progress.md` item is done, delete it and add a `#done` entry plus its index row in the same commit.
 - **`architecture.md`** (repository root) is the short architecture overview: layers, entry points, main flows, extension points, cross-project boundaries. Update it in the same commit whenever a change alters any of those.
@@ -224,6 +226,7 @@ Workspace rule shared by every repository under `D:\Codes` (full text: `D:\Codes
 - **Do NOT mention any AI tools, assistants, or co-authors in commit messages**
 - **No `Co-Authored-By` lines referencing AI in commits**
 - Focus on what changed and why, not how it was written
+- Both branches publish to PyPI from CI: a push to `main` releases `je_api_testka` (`publish.yml`), and a push to `dev` that passes the tests and changes what the package ships releases `je_api_testka_dev` (the `publish-dev` job of `ci.yml`, `scripts/dev_release.py`). Never bump a version by hand; the version in `dev.toml` is only a floor
 - Examples:
   - `feat: add HTTP/2 multiplexing support for httpx async backend`
   - `fix: prevent XXE injection in XML report parser`

MANIFEST.in

@@ -0,0 +1,4 @@
+# The source distribution carries no tests. Without this line setuptools adds test/test*.py by default.
+# Keep it last: a later include, recursive-include, global-include or graft could bring the directory back
+# (test/test_utils/test_sdist_manifest.py).
+prune test