Merge pull request 'fix(ci): twine upload --verbose --skip-existing' (#5) from fix/twine-verbose into main

PyPI answered 429 to every first upload of a new project since the
afternoon of 2026-10-23; without --verbose the log does not say why or
for how long.

.gitea/workflows/driver.yml

@@ -34,6 +34,11 @@ on:
         required: false
 
 env:
+  # The runner's downloads from PyPI time out now and then (2026-10-22 evening:
+  # ReadTimeoutError on files.pythonhosted.org in several jobs). Wait longer and retry.
+  PIP_DEFAULT_TIMEOUT: "60"
+  PIP_RETRIES: "10"
+  UV_HTTP_TIMEOUT: "60"
   STANDARD: "napalm-standard @ git+https://git.netork.io/NAPALM/driver-standard.git@${{ inputs.standard-ref }}"
 
 jobs:
@@ -198,7 +203,9 @@ jobs:
           if [ -z "$TWINE_PASSWORD" ]; then echo "no PYPI_TOKEN secret in this repo"; exit 1; fi
           python -m venv .venv
           .venv/bin/pip install -q twine "$STANDARD"
-          .venv/bin/twine upload --non-interactive dist/*
+          # --verbose: on a refusal PyPI says why (429 on new projects, 2026-10-23/24).
+          # --skip-existing: a re-run after a partly successful upload does not fail.
+          .venv/bin/twine upload --non-interactive --verbose --skip-existing dist/*
       - name: Gitea release
         env:
           GITEA_URL: ${{ github.server_url }}

CHANGELOG.md

@@ -13,6 +13,13 @@ The format follows [Keep a Changelog](https://keepachangelog.com/), versions fol
   device-types pilot).
 
 ### Fixed
+- `publish` uploads with `--verbose`, so a refusal from PyPI shows its reason, and
+  `--skip-existing`, so a re-run after a partly successful upload does not fail.
+- The shared workflow waits 60 s per download and retries ten times, so a slow PyPI
+  response no longer fails a job.
+- `ratchet` refuses a package directory that does not exist. Guessed from the name
+  (napalm-hpe-aruba-procurve ships `napalm_procurve`), it measured nothing and wrote an
+  empty baseline without a word.
 - `security` audited the runner's own pip instead of the package: pip-audit now
   checks a venv holding only the package and its dependencies.
 

napalm_standard/cli.py

@@ -40,7 +40,11 @@ def _check(args: argparse.Namespace) -> int:
 
 
 def _ratchet(args: argparse.Namespace) -> int:
-    code, text = ratchet.run(args.path, _repo(args.path).package, write=args.write)
+    try:
+        code, text = ratchet.run(args.path, _repo(args.path).package, write=args.write)
+    except FileNotFoundError as exc:
+        print(exc, file=sys.stderr)
+        return 2
     print(text)
     return code
 

napalm_standard/ratchet.py

@@ -152,6 +152,10 @@ def _lines(source: str) -> int:
 
 def measure(repo: pathlib.Path, package: str) -> dict[str, Any]:
     """Today's excesses, keyed the way the baseline stores them."""
+    if not (repo / package).is_dir():
+        raise FileNotFoundError(
+            f"no package directory {package}/ to measure; name it in [tool.napalm-standard] package"
+        )
     function_lines: dict[str, int] = {}
     function_complexity: dict[str, int] = {}
     python_file_lines: dict[str, int] = {}

tests/test_cli.py

@@ -135,3 +135,12 @@ def test_package_prints_the_import_package(
 ) -> None:
     assert cli.main(["package", str(make_repo())]) == 0
     assert capsys.readouterr().out == "napalm_example\n"
+
+
+def test_ratchet_names_the_missing_package(
+    make_repo: RepoFactory, capsys: pytest.CaptureFixture[str]
+) -> None:
+    repo = make_repo({"napalm_example/__init__.py": None, "napalm_example/py.typed": None})
+
+    assert cli.main(["ratchet", "--write", str(repo)]) == 2
+    assert "[tool.napalm-standard] package" in capsys.readouterr().err

tests/test_ratchet.py

@@ -308,3 +308,15 @@ def test_check_fails_on_a_problem_and_on_a_stale_entry(tmp_path: pathlib.Path) -
     assert code == 1
     assert "pkg/mod.py::long = 62 (new)" in text
     assert "stale: function_lines: pkg/mod.py::old" in text
+
+
+def test_a_package_that_does_not_exist_is_an_error_not_an_empty_baseline(
+    tmp_path: pathlib.Path,
+) -> None:
+    """procurve's import package is napalm_procurve: guessed from the name, the
+    ratchet measured nothing and wrote an empty baseline without a word."""
+    repo = _repo(tmp_path, LONG)
+
+    with pytest.raises(FileNotFoundError, match="napalm_missing"):
+        qr.run(repo, "napalm_missing", write=True)
+    assert not (repo / qr.BASELINE).exists()