Install phylum

[maxrake]

Overview

This PR adds the phylum-init script entry point to the phylum package. The package was renamed from phylum-ci to phylum as a result of a successful PEP 541 Request: phylum to acquire the project name in PyPI. The initial goal, as specified in #5, was to replicate the behavior of the existing install-phylum-latest-action GitHub Action within the Python package. This was achieved and then exceeded a bit. It goes further in that phylum-init can be used to install a specified "target triple" and providing a Phylum token is not required. That makes the script usable for both the integrations and just on its own.

Performing the Minisign signature verification was not as easy as using an existing python implementation...mostly b/c one does not readily exist as a package on PyPI. A custom implementation was written and annotated to make it abundantly clear that it's not the best option, has a number of assumptions, and should not be used as a library for any other projects.

Here are some potential features to add to the CLI (pulled from comments in the code):

• Add logging support, a verbosity option to control it, and swap out print statements for logging
• Check for valid versions by using the GitHub API to compare against actual releases
  • If so, also programmatically generate the SUPPORTED_TARGET_TRIPLES
• Use the GitHub API ("https://api.github.com") to more programmatically get the archive URL
• Add a --list option, to show which versions are available
• Add an option to account for pre-releases

EDIT: These have been turned into issues and removed from the code as comments:

• Add logging support to phylum Python package #23
• Check for valid versions programmatically in phylum-init #24
• Programmatically acquire release asset URLs in phylum-init #25
• Add ability to list available release versions for phylum-init #26

Test coverage is just getting off the ground and, while the structure was added during this PR, the numbers are not where they should be:

================================ test session starts ================================
platform darwin -- Python 3.7.13, pytest-7.1.1, pluggy-1.0.0
cachedir: .tox/py37/.pytest_cache
rootdir: /Users/coggins/dev/phylum/phylum-ci
plugins: github-actions-annotate-failures-0.1.6, cov-3.0.0
collected 12 items

tests/functional/test_init.py ..                                             [ 25%]
tests/unit/test_package_metadata.py .....                                    [ 66%]
tests/unit/test_sig.py ....                                                  [100%]

---------- coverage: platform darwin, python 3.7.13-final-0 ----------
Name                                                            Stmts   Miss  Cover
-----------------------------------------------------------------------------------
.tox/py37/lib/python3.7/site-packages/phylum/__init__.py           10      0   100%
.tox/py37/lib/python3.7/site-packages/phylum/__main__.py            2      0   100%
.tox/py37/lib/python3.7/site-packages/phylum/init/__init__.py       1      0   100%
.tox/py37/lib/python3.7/site-packages/phylum/init/__main__.py       2      0   100%
.tox/py37/lib/python3.7/site-packages/phylum/init/cli.py          136     94    31%
.tox/py37/lib/python3.7/site-packages/phylum/init/sig.py           46     37    20%
-----------------------------------------------------------------------------------
TOTAL                                                             197    131    34%


================================== 12 passed in 0.68s ================================
__________________________________________ summary ___________________________________
  py37: commands succeeded
  congratulations :)

Another issue will be used (#11) or created to increase that coverage.

Checklist

• Does this PR have an associated issue?
• Have you ensured that you have met the expected acceptance criteria?
• Have you created sufficient tests?
• Have you updated all affected documentation?
• Have you updated the CHANGELOG?
• Have you applied labels to this PR, to usually include at least one Semver-* label?

Issue

Closes #5