kryptorious-metaguard 1.0.0

Repo metadata hygiene scanner — catch version drift, stale changelogs, missing PEP 621 fields, broken README links, and leaked secret files before they ship.

MetaGuard

Repo metadata hygiene scanner for Python packages. Catches the boring, shippable-but-broken mistakes that slip past pytest and build:

• Version drift — pyproject.toml version vs src/<pkg>/__init__.__version__ vs the latest git tag. Mismatches are flagged as errors.
• Stale CHANGELOG — top entry doesn't match the declared version.
• Missing PEP 621 fields — description, authors, license, requires-python, readme…
• License declared, file missing — [project].license but no LICENSE at root.
• Committed secret files — .env, *.pem, *.key, credentials*, .pypirc, *.tfstate… (respects .gitignore so intentional secrets don't false-positive).
• Dead README links — optional network probe (--check-links).

Install

pip install kryptorious-metaguard

Usage

# Scan current dir
metaguard check

# Scan a path, emit JSON for CI
metaguard check ./my-package --json

# Also probe README URLs
metaguard check . --check-links

Exit code is 1 if any error-severity issue is found (CI gate), 0 otherwise.

Example output

Metadata Health: 75/100
  Checks run: 6
  Errors: 1   Warnings: 1

ERROR  VERSION_DRIFT   pyproject='1.2.3' but init:demo='9.9.9'
                     /repo
WARN   NO_CHANGELOG   No CHANGELOG file found

CI integration

- name: Metadata hygiene
  run: metaguard check . --check-links

Part of the Kryptorious developer toolkit. Built for the 32-package fleet and shipped so you can use it too.