add Python SDK (murk-secrets on PyPI)

.github/workflows/python.yaml

@@ -0,0 +1,121 @@
+name: Python
+
+on:
+  push:
+    tags: ["v*"]
+  pull_request:
+    paths:
+      - "src/python.rs"
+      - "python/**"
+      - "pyproject.toml"
+      - "murk.pyi"
+      - "Cargo.toml"
+
+env:
+  PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6 # v3
+        with:
+          src: python/
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
+
+      - name: Build release binary (for test fixture)
+        run: cargo build --release
+
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
+
+      - name: Install and test
+        run: |
+          uv venv
+          source .venv/bin/activate
+          uv pip install maturin pytest
+          maturin develop --features python
+          pytest python/tests -v
+
+  wheels:
+    name: Build wheels (${{ matrix.os }})
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [lint, test]
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64
+          - os: ubuntu-latest
+            target: aarch64
+          - os: macos-14
+            target: x86_64
+          - os: macos-latest
+            target: aarch64
+          - os: windows-latest
+            target: x64
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.12"
+
+      - name: Build wheels
+        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist --features python
+          manylinux: auto
+
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: wheels-${{ matrix.os }}-${{ matrix.target }}
+          path: dist/
+
+  sdist:
+    name: Build sdist
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [lint, test]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Build sdist
+        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
+        with:
+          command: sdist
+          args: --out dist
+
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: wheels-sdist
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [wheels, sdist]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: wheels-*
+          merge-multiple: true
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
+        with:
+          skip-existing: true

.gitignore

@@ -6,3 +6,7 @@
 AGENTS.md
 CLAUDE.md
 .DS_Store
+.venv/
+__pycache__/
+*.pyc
+.pytest_cache/

Cargo.toml

@@ -37,6 +37,11 @@ constant_time_eq = "0.4"
 tempfile = "3.27.0"
 clap_complete = "4.6.0"
 fs2 = "0.4.3"
+pyo3 = { version = "0.24", features = ["extension-module"], optional = true }
+
+[features]
+default = []
+python = ["pyo3"]
 
 [dev-dependencies]
 assert_cmd = "2"

README.md

@@ -1,6 +1,6 @@
 # murk
 
-[![CI](https://github.com/iicky/murk/actions/workflows/ci.yml/badge.svg)](https://github.com/iicky/murk/actions/workflows/ci.yml)
+[![CI](https://github.com/iicky/murk/actions/workflows/ci.yaml/badge.svg)](https://github.com/iicky/murk/actions/workflows/ci.yaml)
 [![codecov](https://codecov.io/gh/iicky/murk/graph/badge.svg)](https://codecov.io/gh/iicky/murk)
 [![Crates.io](https://img.shields.io/crates/v/murk-cli)](https://crates.io/crates/murk-cli)
 [![License](https://img.shields.io/crates/l/murk-cli)](LICENSE-MIT)

murk.pyi

@@ -0,0 +1,15 @@
+"""Type stubs for the murk Python module."""
+
+class Vault:
+    def get(self, key: str) -> str | None: ...
+    def export(self) -> dict[str, str]: ...
+    def keys(self) -> list[str]: ...
+    def __len__(self) -> int: ...
+    def __getitem__(self, key: str) -> str: ...
+    def __contains__(self, key: str) -> bool: ...
+    def __repr__(self) -> str: ...
+
+def load(vault_path: str = ".murk") -> Vault: ...
+def get(key: str, vault_path: str = ".murk") -> str | None: ...
+def export_all(vault_path: str = ".murk") -> dict[str, str]: ...
+def has_key() -> bool: ...

pyproject.toml

@@ -0,0 +1,45 @@
+[build-system]
+requires = ["maturin>=1.0,<2.0"]
+build-backend = "maturin"
+
+[project]
+name = "murk-secrets"
+dynamic = ["version"]
+description = "Python bindings for murk — encrypted secrets manager"
+readme = "python/README.md"
+license = { text = "MIT OR Apache-2.0" }
+requires-python = ">=3.9"
+classifiers = [
+    "Programming Language :: Rust",
+    "Programming Language :: Python :: Implementation :: CPython",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security :: Cryptography",
+    "License :: OSI Approved :: MIT License",
+    "License :: OSI Approved :: Apache Software License",
+]
+keywords = ["secrets", "encryption", "age", "dotenv", "security"]
+
+[project.urls]
+Homepage = "https://github.com/iicky/murk"
+Repository = "https://github.com/iicky/murk"
+Issues = "https://github.com/iicky/murk/issues"
+
+[tool.maturin]
+features = ["python"]
+module-name = "murk"
+bindings = "pyo3"
+
+[tool.pytest.ini_options]
+testpaths = ["python/tests"]
+
+[tool.ruff]
+target-version = "py39"
+line-length = 100
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "N", "W", "UP"]