RepoKit for Python
Native organization inspection for Git repositories: discover Components, language and package-tool evidence, then locate the owner of a repository-relative path. Python 3.11+ on macOS/Linux and Git on PATH are required. Organization analysis runs in Python; Git provides version-control facts through batched commands.
Install from the repository checkout:
python -m pip install ./toolkit/python
from repokit import inspect, owner
report = inspect("/path/to/repo", timeout=5)
if not report.complete:
raise RuntimeError(report.diagnostics)
component = owner(report, "server/main.py")
if component is not None:
print(component.name, component.root, component.language)
inspect(..., staged=True) selects the index; inspect(..., head="HEAD") selects a
resolved commit. The default observes the working tree, including non-ignored untracked
paths. timeout is a whole-call budget in seconds; an optional threading.Event passed
as cancel requests cancellation. Git processes are terminated and reaped on timeout,
cancellation or output overflow. Filesystem reads and Python analysis check the budget
between operations. Timeout raises TimeoutError, cancellation raises InterruptedError,
invalid selections/configuration or limits raise ValueError, and filesystem/Git failures
propagate OSError / subprocess.CalledProcessError.
Reports and their nested collections are immutable dataclasses and tuples. Shared
Repository, Component, Product and Forge identities come from harness-common;
ComponentBinding adds checkout layout and tool evidence. owner accepts a repository-relative
path and returns the deepest binding or None, including for deleted paths.
Python properties use snake_case; these objects are not a CLI JSON protocol adapter.
Inspection reads filenames and necessary metadata, not source contents or ASTs. It never
runs project code or installs dependencies. complete concerns observed organization;
concurrent metadata changes return an incomplete report with diagnostics. Consumers own
acceptance, command selection and validation policy. Snapshot, diff and graph analysis
remain available through the Go toolkit / CLI.
Development: uv sync --locked, then make format, make lint, make test, make build.
Tests consume the shared conformance/inspect cases and generated filename probes.
See the inspection contract.
Repository toolkit
工具包提供仓库组织、内容身份与 Git 查询。Python 还提供 worktree、提交、推送、rebase 和 GitHub/GitLab 的 PR/MR 操作;调用方直接导入库,组织自己的开发流程。 分析接口保持只读,操作接口接收明确参数,不隐式执行验证或管理任务状态。
Repository entries
tree lists directories, files, Git entry kinds and known roles independently of
Component discovery, for working-tree, index and commit inputs. Project Manifest
files retain their ecosystem; Component bindings retain manifests as path evidence.
Components provide the granularity for lint, test and packaging operations. Discovery prefers
manifests, then Makefiles with unknown language. Without either, the repository has no
recognized Component; no root Component or tool-specific configuration file is created.
See repository contract and snapshot v2.
Component content identities
from repokit import component_scopes, inspect, snapshot
layout = inspect(repository)
contents = snapshot(repository, scopes=component_scopes(layout))
for component in contents.scopes:
print(component.name, component.digest, component.complete)
Verify layout/content consistency in the calling operation. These scopes follow file ownership, not transitive build dependencies; see Snapshot.
Makefile validation
from repokit import plan_validation, execute_validation
plan = plan_validation(repo, components=("backend",), checks=("lint", "test"))
report = execute_validation(plan, timeout=600)
# Use report.complete and report.passed together, not an isolated command exit code.
Planning never executes Make. Targets and optional LINT_FILES/TEST_FILES filtering follow the shared Makefile contract. Prepare dependencies and run any formatter before planning. Execution freezes the environment, bounds subprocesses, and checks repository contents once before and once after the round. Reports contain execution facts; callers own persistence, reuse and workflow gates.
PR lifecycle queries are native Python: repokit.forge.PullRequestObserver owns durable observations,
terminal-state convergence, retries and optional periodic maintenance. PullRequestContext relates PRs
to live local branches and checkouts without choosing workflow or cleanup policy. See PR contracts.
PR 创建和复用使用 repokit.forge.ensure_pull_request,无需调用方解析目标仓或默认分支。
Git 提交与推送使用 repokit.git.commit / push;提交范围、验证门禁和动作顺序仍由调用方负责。
完整契约见 PR 与 Git。
Metadata
Release files for compforge-repokit 0.17.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| compforge_repokit-0.17.1.tar.gz | 131.2 kB | Without provenance | Details for compforge_repokit-0.17.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| compforge_repokit-0.17.1-py3-none-any.whl | Python 3 | none | any | Details for compforge_repokit-0.17.1-py3-none-any.whl |
Total release size: 218.7 kB
Release files / compforge_repokit-0.17.1.tar.gz
| Download URL | compforge_repokit-0.17.1.tar.gz |
|---|---|
| Size | 131.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
d66092f66d5d7d57a46777f2ead2ae71195e0d7e275d7f8c802aa8d09b659bab
|
|
BLAKE2b-256 checksum How to use checksums |
8ab18d3443fd9af90086bd3d9f1acb9de201778db900e8798e983e7482520acf
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.9.2
|
Release files / compforge_repokit-0.17.1-py3-none-any.whl
| Download URL | compforge_repokit-0.17.1-py3-none-any.whl |
|---|---|
| Size | 87.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
fc12bd3c79fe8f1d9a26faf9b2a1b055ea755b9c079039b79df6e365e1d2e0b1
|
|
BLAKE2b-256 checksum How to use checksums |
c7da527e2a5d670a7427103629f5cb6133b1bde6b4eb8465f86f941c5f2c4b4e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.9.2
|
Security for compforge-repokit 0.17.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.