This repository was archived by the owner on Aug 5, 2026. It is now read-only.
Complete the move to eggzec and scope Sonar analysis to source - #46
Merged
Conversation
The repository moved from NULAPACK/NULAPACK to eggzec/NULAPACK. Several
references still pointed at the old organisation, and the partially
renamed ones used lowercase `eggzec/nulapack` while the canonical name
is `eggzec/NULAPACK`.
README Tests / Documentation badges normalised to NULAPACK
codecov badge moved off codecov.io/gh/nulapack/nulapack
SonarCloud badge key NULAPACK_NULAPACK -> eggzec_NULAPACK
clone URL normalised
pyproject.toml homepage + documentation moved from nulapack.github.io
to eggzec.github.io; source/releasenotes/issues normalised
The old SonarCloud key no longer exists (`Component key
'NULAPACK_NULAPACK' not found`), so that badge was a dead link;
eggzec_NULAPACK is live. All replacement URLs verified to return 200.
Also scope analysis via .sonarcloud.properties, matching the other repos.
The quality gate was failing on new_security_rating = C, driven entirely
by findings in .github/workflows - infrastructure that is never shipped.
githubactions:S8541 asks for uv's `--no-build`, which cannot be used by
a project that compiles Fortran from source.
Workflow hardening carried over: pinned pip/numpy/cibuildwheel, and the
version fetch now uses pipefail, retries, enforced HTTPS on redirects and
an explicit empty-list check, so a network blip can no longer be masked
into an empty matrix.
`uv run --locked` was deliberately NOT added here: unlike the other
repos, `uv lock --check` cannot be verified locally for this project, and
an out-of-date lockfile would turn --locked into a CI failure.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Welcome to Codecov 🎉Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests. ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment Thanks for integrating Codecov - We've got you covered ☂️ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The repo moved from
NULAPACK/NULAPACKtoeggzec/NULAPACK, but severalreferences still pointed at the old organisation — and the partially renamed
ones used lowercase
eggzec/nulapackwhere the canonical name iseggzec/NULAPACK.Org move
eggzec/nulapackeggzec/NULAPACKcodecov.io/gh/nulapack/nulapackcodecov.io/gh/eggzec/NULAPACKNULAPACK_NULAPACKeggzec_NULAPACKeggzec/nulapack.giteggzec/NULAPACK.gitnulapack.github.ioeggzec.github.ioeggzec/nulapackeggzec/NULAPACKThe old SonarCloud key is gone (
Component key 'NULAPACK_NULAPACK' not found), so that badge was already a dead link. Every replacement URL waschecked and returns 200.
Sonar quality gate
The gate failed on
new_security_rating = C, driven entirely by findings in.github/workflows— infrastructure never shipped in the wheel.githubactions:S8541asks for uv--no-build, which a project that compilesFortran from source cannot use.
.sonarcloud.propertiesscopes analysis toshipped code, matching the other repos in the org.
Workflow hardening
Pinned
pip/numpy/cibuildwheel, and the version fetch now usesset -euo pipefail, retries,--proto '=https'and an explicit empty-listcheck — without pipefail a curl failure was masked into an empty matrix.
uv run --lockedwas deliberately not added here. Unlike the other repos,uv lock --checkcannot be verified locally for this project, and a stalelockfile would turn
--lockedinto a CI failure.🤖 Generated with Claude Code