modernize: add .env support, move to uv/ruff

.github/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-python@v6.2.0
+        with:
+          python-version: "3.14"
+      - uses: astral-sh/setup-uv@v8.1.0
+      - run: uv sync --group dev
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+
+  test:
+    runs-on: ubuntu-latest
+    needs: lint
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: [ "3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14" ]
+    steps:
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-python@v6.2.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - uses: astral-sh/setup-uv@v8.1.0
+      - run: uv sync --group dev
+      - run: uv run pytest

.github/workflows/publish.yml

@@ -2,23 +2,20 @@ name: Publish to PyPI
 
 on:
   release:
-    types: [created]
+    types: [ created ]
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python
-      uses: actions/setup-python@v2
-      with:
-        python-version: "3.8"
-    - name: Install dependencies
-      run: |
-        pip install --upgrade pip==20.2.4 poetry==1.1.4
-        poetry config virtualenvs.create false
-        poetry install
-    - name: Build and publish
-      run: |
-        poetry config pypi-token.pypi ${{ secrets.PYPI_TOKEN }}
-        poetry publish --build
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-python@v6.2.0
+        with:
+          python-version: "3.14"
+      - uses: astral-sh/setup-uv@v8.1.0
+      - run: uv build
+      - run: uv publish
+        env:
+          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}

.gitignore

@@ -31,6 +31,7 @@ pip-delete-this-directory.txt
 
 # dotenv
 .env
+.venv/
 
 # mkdocs documentation
 /site

AGENTS.md

@@ -0,0 +1,19 @@
+# AGENTS.md
+
+## Scope
+
+These instructions apply to the entire repository.
+
+## Project Rules
+
+- Preserve the public API. Do not change the `sec.load(name, fallback=None)` signature or the documented lookup order unless a task explicitly asks for it.
+- Use `uv` for local development, dependency management, and packaging workflows.
+- Keep automation in GitHub Actions only. Do not add Travis, Pipenv, Poetry, or parallel CI tooling back into the repository.
+- Use Ruff for formatting and linting. Do not introduce Black, isort, or Flake8-style tooling.
+- Keep `.env` support dependency-free. It must remain UTF-8 friendly and continue to handle quoted values, comments, and `export KEY=value` entries.
+
+## Validation
+
+- Run `uv run ruff check .`
+- Run `uv run ruff format --check .`
+- Run `uv run pytest`

README.md

@@ -1,6 +1,6 @@
 # Sec - Tiny Python library for using secrets
 
-[![Build Status](https://travis-ci.org/sourcelair/sec.svg?branch=master)](https://travis-ci.org/sourcelair/sec)
+[![CI](https://github.com/withlogicco/sec/actions/workflows/ci.yml/badge.svg)](https://github.com/withlogicco/sec/actions/workflows/ci.yml)
 
 Sec is a tiny Python library for using secrets. Simple to its core, Sec exposes just **one function** and offers **no configurations options**.
 
@@ -14,15 +14,29 @@ All Sec does is provide a single, unique interface for accessing these informati
 
 ## Installation
 
-You can install `sec` with Pipenv:
+You can install `sec` with uv:
 
 ```
-pipenv install sec
+uv add sec
+```
+
+For local development, install the project and dev tools with:
+
+```
+uv sync --group dev
+```
+
+Quality checks use Ruff and pytest:
+
+```
+uv run ruff check .
+uv run ruff format --check .
+uv run pytest
 ```
 
 ## Requirements
 
-Sec requires Python 3.6 (or greater) to work.
+Sec requires Python 3.8 (or greater) to work.
 
 ## API Documentation
 
@@ -33,16 +47,18 @@ The `load` method of Sec attempts to load the contents of a secret, based on a g
 1. Load the contents of `/run/secrets/{name}` (`name` is lowercased here)
 2. Load the contents of the path found in the environment variable `{name}_FILE` (`name` is uppercased here)
 3. Load the content of the environment variable `{name}` (`name` is uppercased here)
-4. Return the value of the `fallback` argument if provided, or `None`
+4. Load the content of the `.env` file in the current working directory
+5. Return the value of the `fallback` argument if provided, or `None`
 
 ## Quick Start Example
 
 First, let's create some secret files
 
 ```shell
-$ echo "mystiko" > /run/secrets/supersecret
-$ export MYSECRET_FILE=/run/secrets/supersecret
+$ echo "supersecret" > /run/secrets/mystiko
+$ export MYSECRET_FILE=/run/secrets/mystiko
 $ export ANOTHER_SECRET=hello
+$ echo "DATABASE_URL=postgresql://user:password@localhost/app" > .env
 ```
 
 Next, let's open up the Python interpreter and load these secrets in our application.
@@ -55,8 +71,14 @@ Next, let's open up the Python interpreter and load these secrets in our applica
 'supersecret'
 >>> sec.load('another_secret')
 'hello'
+>>> sec.load('database_url')
+'postgresql://user:password@localhost/app'
 ```
 
+The `.env` support is intentionally dependency-free and understands simple `.env`
+files, including blank lines, comments, `export KEY=value` entries, quoted
+values, and UTF-8 content such as emoji or accented characters.
+
 ## Use Cases
 
 ### Docker Swarm Secrets