Repository rules

Dependency boundary

• Keep goopdl exactly pinned to a reviewed PyPI release in pyproject.toml and uv.lock, and record its installed version in provenance.
• Call its CLI through subprocess so implementation can be replaced without rewriting builder.
• Add no provider abstraction until second provider exists in repository.

Artifact trust

Build must stop on missing or mismatched integrity metadata, package identity, version, architecture, or signing certificate. Keep downloaded files temporary and untrusted until every required check passes.

Never commit:

• Google Play auth tokens or caches
• Downloaded APK, split, OBB, or asset-pack files
• Secrets, credentials, or authenticated URLs
• Local files under docs/plan/

Tests

Use Python standard-library unittest. Add one focused regression check for non-trivial branches, parsing, verification, or security behavior.

Required local checks:

uv run python -m unittest discover -s tests
uv lock --check

Conventional Commits

Every new commit must follow Conventional Commits 1.0.0:

<type>[optional scope]: <description>

Examples:

feat(download): support separate ARMv7 output
fix(verify): reject truncated split APK
docs: document Google Play authentication

Use feat for features and fix for bug fixes. Other accepted types: docs, test, refactor, build, ci, chore, perf, and revert.

Breaking change:

feat(cli)!: rename architecture option

BREAKING CHANGE: callers must replace --abi with --arch

Keep description concise and imperative. Prefer separate commits when changes have different purposes.