Metadata-Version: 2.4
Name: pl_vendor
Version: 0.1.0
Summary: Vendor Git repositories as ordinary files with a reproducible lockfile
Requires-Python: >=3.13
Description-Content-Type: text/markdown

# pl_vendor

`pl_vendor` copies Git repositories into another repository as ordinary files and
records their exact commits in a deterministic YAML lockfile. It supports optional
downstream patches and can verify that checked-in vendor trees still match their
locked upstream commits.

## Requirements

- Python 3.13 or newer
- Git 2.30 or newer
- uv 0.9 or newer by default

The package has no Python runtime dependencies.

Every command runs a preflight check before reading or changing vendored trees. Library
callers that use another environment runner can pass an `ExecutableBackend` to
`VendorProject.discover()`; that executable and its declared minimum version are checked
in place of uv. Git is always checked.

## Configuration

Create `vendor.toml` at the root of the consuming Git repository:

```toml
schema_version = 1

[dependencies.example]
path = "vendor/example"
url = "https://github.com/example/example.git"
branch = "release"
```

The generated `vendor-lock.yaml` records the resolved commit:

```yaml
lockfileVersion: 1

dependencies:
  example: '0123456789abcdef0123456789abcdef01234567'
```

Optional patches live at `.vendor-patches/<dependency-name>.patch` and are applied
after copying the upstream tree.

## Commands

```sh
pl-vendor update
pl-vendor update example
pl-vendor check
pl-vendor verify
```

Each command discovers the consuming repository from the current directory. Pass
`--root PATH` after the command to operate on a different repository.

## Development

```sh
uv sync --dev
uv run pytest
uv run pyright
uv run ruff format --check .
```

The internal test suite is kept in `src/pl_vendor/tests` so the package remains
self-contained while it is developed or embedded elsewhere.
