chore: release v2.0.3 [skip ci]

Reviewed-on: https://gitea.lille-vemmelund.dk/LilleVemmelund/python-repositories/pulls/46

.dockerignore

@@ -0,0 +1,16 @@
+.git
+.github
+.gitea
+.mypy_cache
+.pytest_cache
+.ruff_cache
+.venv
+__pycache__
+*.pyc
+.coverage
+coverage-unit
+coverage-integration
+coverage.txt
+dist
+build
+*.egg-info

.env.example

@@ -7,3 +7,4 @@ MINIO_ACCESS_KEY=minioadmin
 MINIO_SECRET_KEY=minioadmin
 MINIO_BUCKET=my-bucket
 MINIO_SECURE=false
+MINIO_CREATE_BUCKET_IF_MISSING=true

.gitea/workflows/ci-image.yml

@@ -0,0 +1,52 @@
+# Build and publish the per-repo CI base image to the Gitea container registry.
+
+name: Build CI Image
+
+on:
+  schedule:
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - pyproject.toml
+      - uv.lock
+      - docker/ci/**
+
+env:
+  REGISTRY: gitea.lille-vemmelund.dk
+  REGISTRY_USER: ci-bot
+  IMAGE: gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Log in to Gitea container registry
+        env:
+          CI_RUNNER_TOKEN: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: |
+          echo "$CI_RUNNER_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+
+      - name: Build CI image
+        env:
+          CI_RUNNER_TOKEN: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: |
+          echo "$CI_RUNNER_TOKEN" > /tmp/uv_token
+          docker build --network=host -f docker/ci/Dockerfile \
+            --secret id=uv_token,src=/tmp/uv_token \
+            -t "${IMAGE}:latest" \
+            .
+          rm -f /tmp/uv_token
+
+      - name: Tag and push CI image
+        run: |
+          STAMP="$(date -u +%Y%m%d%H%M)"
+          docker tag "${IMAGE}:latest" "${IMAGE}:${STAMP}"
+          docker push "${IMAGE}:latest"
+          docker push "${IMAGE}:${STAMP}"
+          echo "Pushed ${IMAGE}:latest and ${IMAGE}:${STAMP}"

.gitea/workflows/code-quality.yml

@@ -8,23 +8,17 @@ on:
 
 jobs:
   code-quality:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
+      - name: Sync dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync --all-extras
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Type check with mypy
         run: uv run mypy .

.gitea/workflows/dependency-update-bot.yml

@@ -7,22 +7,17 @@ on:
 
 jobs:
   update-check:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           token: ${{ secrets.CI_RUNNER_TOKEN }}
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
       - name: Upgrade dependencies
+        env:
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
         run: uv lock --upgrade
 
       - name: Commit and push changes

.gitea/workflows/publish.yml

@@ -9,25 +9,24 @@ on:
 
 jobs:
   build-and-publish:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
       - name: Update version in pyproject.toml to match tag
+        env:
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
         run: scripts/ci/bump-version.sh --from-tag "${GITHUB_REF##*/}"
 
       - name: Build package
+        env:
+          UV_LINK_MODE: copy
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
         run: |
-          uv sync --no-dev
+          uv sync --no-dev --frozen
           uv build
 
       - name: Publish to Gitea Package Registry

.gitea/workflows/release.yml

@@ -8,7 +8,7 @@ on:
 jobs:
   release:
     if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -22,19 +22,12 @@ jobs:
           COMMIT_MSG: ${{ github.event.head_commit.message }}
         run: scripts/ci/parse-merge-commit.sh "$COMMIT_MSG"
 
-      - name: Set up Python
-        if: steps.meta.outputs.bump != 'skip'
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        if: steps.meta.outputs.bump != 'skip'
-        run: pip install uv
-
       - name: Bump version
         if: steps.meta.outputs.bump != 'skip'
         id: bump
+        env:
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
         run: scripts/ci/bump-version.sh "${{ steps.meta.outputs.bump }}"
 
       - name: Generate release notes

.gitea/workflows/security-audit.yml

@@ -7,23 +7,17 @@ on:
 
 jobs:
   safety:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
+      - name: Sync dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --frozen
 
       - name: Run safety check
         run: uv run safety check

.gitea/workflows/test.yml

@@ -8,23 +8,17 @@ on:
 
 jobs:
   unit-tests:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
+      - name: Sync dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync --all-extras
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Run unit tests
         run: |
@@ -43,23 +37,17 @@ jobs:
           compression-level: 0
 
   integration-tests:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
+      - name: Sync dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync --all-extras
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Verify Docker
         run: docker info
@@ -83,24 +71,18 @@ jobs:
   coverage-report:
     # Merges unit + integration coverage and enforces fail_under from pyproject.toml.
     needs: [unit-tests, integration-tests]
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     if: github.event_name == 'pull_request' || github.event_name == 'push'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
+      - name: Sync dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync --all-extras
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Download unit coverage
         uses: https://github.com/christopherHX/gitea-download-artifact@v4

README.md

@@ -12,7 +12,7 @@ Subclass an adapter in your own repository to add domain-specific methods while
 | **Adapters**     | Technology-specific base classes (`RedisAdapter`, `MinioAdapter`) |
 | **Your project** | Subclass an adapter and add domain methods                        |
 
-Connection adapters expose `connect()`, `disconnect()`, and `is_connected()`. The latter verifies backend reachability with a cached health probe (default TTL: 1 second). Subclasses may override `health_check_ttl_seconds`.
+Connection adapters expose `connect()`, `disconnect()`, and `is_connected()`. The latter verifies backend reachability with a cached health probe (default TTL: 1 second). Subclasses may override `health_check_ttl_seconds`. `connect()` is idempotent: calling it while already connected and healthy is a no-op.
 
 ## Optional dependencies
 
@@ -34,18 +34,33 @@ Requires Redis with the RedisJSON module (e.g. redis-stack).
 | -------------------- | ---------------------------------------------------- |
 | `REDIS_URI`          | Redis connection URL (e.g. `redis://localhost:6379`) |
 
+For key discovery:
+
+- `list_keys(pattern)` is simple and returns a `list[str]`, but it uses Redis `KEYS` and may block on large datasets.
+- `scan_keys(pattern, *, count=None)` is preferred for production use and yields keys incrementally via Redis `SCAN`.
+
+Example:
+
+```python
+for key in repo.scan_keys("user:*"):
+    print(key)
+```
+
 ### MinIO (`ObjectRepositoryInterface`)
 
-| Environment variable | Description                                 |
-| -------------------- | ------------------------------------------- |
-| `MINIO_ENDPOINT`     | MinIO server endpoint                       |
-| `MINIO_ACCESS_KEY`   | Access key                                  |
-| `MINIO_SECRET_KEY`   | Secret key                                  |
-| `MINIO_BUCKET`       | Bucket name (created on connect if missing) |
-| `MINIO_SECURE`       | Use HTTPS (`true`/`false`; default: `true`) |
+| Environment variable             | Description                                                              |
+| -------------------------------- | ------------------------------------------------------------------------ |
+| `MINIO_ENDPOINT`                 | MinIO server endpoint                                                    |
+| `MINIO_ACCESS_KEY`               | Access key                                                               |
+| `MINIO_SECRET_KEY`               | Secret key                                                               |
+| `MINIO_BUCKET`                   | Bucket name                                                              |
+| `MINIO_SECURE`                   | Use HTTPS (`true`/`false`; default: `true`)                              |
+| `MINIO_CREATE_BUCKET_IF_MISSING` | Auto-create `MINIO_BUCKET` on connect (`true`/`false`; default: `false`) |
 
 Copy [`.env.example`](.env.example) to `.env` for local development. `RedisConfig.from_env()` and `MinioConfig.from_env()` load `.env` automatically when resolving configuration from the environment.
 
+For production, it is recommended to leave `MINIO_CREATE_BUCKET_IF_MISSING` unset so that `connect()` fails fast if the expected bucket is missing. For local development, you will often want `MINIO_SECURE=false` and `MINIO_CREATE_BUCKET_IF_MISSING=true`.
+
 ## Configuration injection
 
 Adapters accept optional `config` and `client` keyword arguments for explicit setup and testing:
@@ -61,6 +76,7 @@ minio = MinioAdapter(
         secret_key="minioadmin",
         bucket="my-bucket",
         secure=False,
+        # create_bucket_if_missing=True,  # convenient for local dev
     )
 )
 ```
@@ -107,16 +123,18 @@ with ArtifactObjectRepository() as repo:
 ### Subclassing in your own project
 
 ```python
+from typing import Any
+
 from python_repositories import RedisAdapter
 
 class UserRepository(RedisAdapter):
     def _key(self, user_id: str) -> str:
         return f"user:{user_id}"
 
-    def get_user(self, user_id: str) -> dict | None:
+    def get_user(self, user_id: str) -> dict[str, Any] | None:
         return self.get(self._key(user_id))
 
-    def save_user(self, user_id: str, user: dict) -> None:
+    def save_user(self, user_id: str, user: dict[str, Any]) -> None:
         self.set(self._key(user_id), user)
 ```
 
@@ -148,7 +166,14 @@ uv run pytest -v                                      # full suite (requires Doc
 
 Integration tests are marked with `@pytest.mark.integration` and require Docker (testcontainers). Run unit tests alone for quick local feedback.
 
-CI runs unit and integration tests in parallel with coverage, then merges `.coverage` artifacts in a follow-up job (via [christopherhx/gitea-\*-artifact@v4](https://github.com/christopherHX/gitea-upload-artifact) for Gitea 1.26 compatibility). Combined coverage must be at least **90%**; the floor is set by [`fail_under` in `pyproject.toml`](pyproject.toml#L45-L48) and enforced after merging unit and integration coverage, not on unit-only runs.
+### CI base image
+
+Gitea Actions jobs use a pre-built image (`python-repositories-ci`) with Python 3.12,
+`uv`, and locked dependencies baked in. The image is rebuilt nightly and when
+`uv.lock` changes; see [`docs/ci-image.md`](docs/ci-image.md) for runner setup and
+bootstrap order.
+
+CI runs unit and integration tests in parallel with coverage, then merges `.coverage` artifacts in a follow-up job (via [christopherhx/gitea-\*-artifact@v4](https://github.com/christopherHX/gitea-upload-artifact) for Gitea 1.26 compatibility). Combined coverage must meet the floor in [`fail_under` in `pyproject.toml`](pyproject.toml#L45-L48); enforcement happens after merging unit and integration coverage, not on unit-only runs.
 
 To check coverage locally (requires Docker for the full suite):
 

docker/ci/Dockerfile

@@ -0,0 +1,29 @@
+# CI job image for Gitea Actions (act_runner requires Node.js in job containers).
+FROM node:20-bookworm
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        git \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=docker:27-cli /usr/local/bin/docker /usr/local/bin/docker
+COPY --from=ghcr.io/astral-sh/uv:0.7.0 /uv /usr/local/bin/uv
+
+ENV UV_PYTHON_INSTALL_DIR=/opt/uv-python \
+    UV_LINK_MODE=copy
+
+COPY .python-version /tmp/.python-version
+RUN uv python install "$(cat /tmp/.python-version)"
+
+WORKDIR /app
+
+COPY pyproject.toml uv.lock .python-version ./
+
+ENV PATH="/app/.venv/bin:${PATH}"
+
+RUN --mount=type=secret,id=uv_token \
+    UV_INDEX_GITEA_USERNAME=ci-bot \
+    UV_INDEX_GITEA_PASSWORD="$(cat /run/secrets/uv_token)" \
+    uv sync --all-extras --frozen --no-install-project

docs/ci-image.md

@@ -0,0 +1,169 @@
+# CI base image
+
+This repository uses a **per-repo Docker image** for Gitea Actions jobs instead of
+installing Python and `uv` on every run. Infrastructure images (redis, minio, etc.)
+are cached cluster-wide via Harbor (see homelab-platform
+[`docs/harbor-registry-mirror.md`](https://gitea.lille-vemmelund.dk/LilleVemmelund/homelab-platform/src/branch/main/docs/harbor-registry-mirror.md)).
+
+## Image contents
+
+Built from [`docker/ci/Dockerfile`](../docker/ci/Dockerfile):
+
+- Node.js 20 (required by act_runner job containers)
+- Python 3.12 (installed via `uv python install` from [`.python-version`](../.python-version)) and pinned `uv` 0.7.0
+- Docker CLI (integration tests via testcontainers)
+- Dev dependencies from `uv.lock` (`uv sync --all-extras --no-install-project`)
+
+Published to the Gitea container registry (owner segment must be lowercase for Docker):
+
+- `gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci:latest`
+- `gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci:YYYYMMDDHHmm` (timestamped rollback tag)
+
+## Rebuild triggers
+
+[`ci-image.yml`](../.gitea/workflows/ci-image.yml) runs on:
+
+- Nightly cron (`0 2 * * *` UTC)
+- Manual `workflow_dispatch`
+- Push to `main` when `pyproject.toml`, `uv.lock`, or `docker/ci/**` change
+
+## Workflow usage
+
+Python jobs use `runs-on: python-repositories-ci` and a fast incremental sync:
+
+```yaml
+runs-on: python-repositories-ci
+steps:
+  - uses: actions/checkout@v4
+  - name: Sync dependencies
+    env:
+      UV_LINK_MODE: copy
+      UV_INDEX_GITEA_USERNAME: ci-bot
+      UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+    run: uv sync --all-extras --frozen
+```
+
+`ci-image.yml` uses `runs-on: ubuntu-latest` so it can bootstrap before the custom
+image exists.
+
+## Registry authentication
+
+act_runner pulls the job image **before any workflow step runs**, so a `docker
+login` step inside a job cannot authenticate that pull. Authentication must be
+configured on the runner (or via a job-level `container.credentials` block — not
+used here).
+
+### k8s Gitea runners (automatic)
+
+The homelab-platform runners mount Gitea registry credentials automatically:
+
+- Secret: `gitea-runners/gitea-registry-dockerconfig` (created by
+  [`scripts/create-gitea-registry-secret.sh`](https://gitea.lille-vemmelund.dk/LilleVemmelund/homelab-platform/src/branch/main/scripts/create-gitea-registry-secret.sh))
+- Mounted at `/root/.docker/config.json` on the **runner** container (not DinD)
+- Configured in
+  [`platform/gitea-runners/values.yaml`](https://gitea.lille-vemmelund.dk/LilleVemmelund/homelab-platform/src/branch/main/platform/gitea-runners/values.yaml)
+
+No manual `docker login` is required on the in-cluster runners once the secret
+exists. To create or rotate credentials:
+
+```bash
+export KUBECONFIG=/path/to/homelab-cluster/talos/_out/kubeconfig
+export GITEA_REGISTRY_USERNAME='ci-bot'
+export GITEA_REGISTRY_PASSWORD='personal-access-token-with-read-package'
+bash scripts/create-gitea-registry-secret.sh
+```
+
+Then restart runner pods so they pick up the updated secret. See homelab-platform
+[`docs/gitea-actions-runners.md`](https://gitea.lille-vemmelund.dk/LilleVemmelund/homelab-platform/src/branch/main/docs/gitea-actions-runners.md)
+for full runner setup.
+
+Verify on a running pod:
+
+```bash
+kubectl -n gitea-runners exec homelab-cluster-gitea-runner-0 -c runner -- \
+  test -f /root/.docker/config.json && echo "registry auth mounted"
+```
+
+### Standalone runners (e.g. Unraid `homelab`)
+
+The 4th runner is outside the k8s cluster and does **not** get the automatic
+mount. Configure registry auth manually on that host:
+
+```bash
+docker login gitea.lille-vemmelund.dk -u ci-bot -p <token>
+```
+
+Also add the `python-repositories-ci` label to that runner's act_runner config.
+
+### `ci-image.yml` push login
+
+The build workflow still runs `docker login` before `docker push`. That step
+authenticates **DinD inside the job** for pushing the image to Gitea — a different
+code path from act_runner pulling the job container.
+
+## Runner label
+
+Jobs use the `python-repositories-ci` act_runner label, configured in
+homelab-platform
+[`platform/gitea-runners/values.yaml`](https://gitea.lille-vemmelund.dk/LilleVemmelund/homelab-platform/src/branch/main/platform/gitea-runners/values.yaml):
+
+```yaml
+python-repositories-ci:docker://gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci:latest
+```
+
+After label changes, roll runner pods so they re-register with Gitea.
+
+## Bootstrap order
+
+1. Ensure homelab-platform runners have `gitea-registry-dockerconfig` and the
+   `python-repositories-ci` label (see homelab-platform docs).
+2. Merge `ci-image.yml`, `docker/ci/Dockerfile`, and workflow migrations to `main`.
+3. Seed the registry with a first image (see below).
+4. Confirm a test workflow job starts on `python-repositories-ci`.
+
+Until step 3 completes, jobs targeting `python-repositories-ci` will fail because
+the image does not exist in the Gitea registry yet.
+
+### Seed the image
+
+**After merge to `main`:** Actions → **Build CI Image** → **Run workflow**.
+
+**Before merge (e.g. PR branch):** the workflow file is not on `main` yet — build
+and push locally with [`scripts/ci/build-ci-image.sh`](../scripts/ci/build-ci-image.sh):
+
+```bash
+export CI_RUNNER_TOKEN='ci-bot-personal-access-token'
+bash scripts/ci/build-ci-image.sh --push
+```
+
+Run from the repo root on the branch you want to test. Runners pull
+`gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci:latest` from the registry;
+they do not care which git branch built it.
+
+Override registry settings if needed:
+
+```bash
+export REGISTRY=gitea.lille-vemmelund.dk
+export REGISTRY_USER=ci-bot
+export CI_RUNNER_TOKEN='...'
+bash scripts/ci/build-ci-image.sh --push
+```
+
+## Local build
+
+Build only (no registry login or push):
+
+```bash
+export CI_RUNNER_TOKEN='ci-bot-personal-access-token'
+bash scripts/ci/build-ci-image.sh --local
+```
+
+Or manually:
+
+```bash
+echo "$CI_RUNNER_TOKEN" > /tmp/uv_token
+docker build -f docker/ci/Dockerfile \
+  --secret id=uv_token,src=/tmp/uv_token \
+  -t python-repositories-ci:local .
+rm -f /tmp/uv_token
+```

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "python-repositories"
-version = "0.5.1"
+version = "2.0.3"
 description = "Various python repository interfaces exposed as a python package."
 authors = [
     { name = "Brian Bjarke Jensen", email = "[email protected]" }

python_repositories/adapters/connection_aware_adapter.py

@@ -22,6 +22,7 @@ class ConnectionAwareAdapter(ConnectionAwareInterface, ContextAwareInterface):
 
     def __init__(self) -> None:
         self.logger = structlog.get_logger(self.__class__.__name__)
+        self._client_injected = False
         self._health_check_at: float | None = None
         self._health_check_ok: bool = False
 
@@ -57,6 +58,27 @@ class ConnectionAwareAdapter(ConnectionAwareInterface, ContextAwareInterface):
     def _probe_connection(self) -> bool:
         """Backend-specific liveness check; called only when client is ready."""
 
+    @abstractmethod
+    def _validate_injected_client(self) -> None:
+        """Verify an injected client is reachable; raise ConnectionError on failure."""
+
+    @abstractmethod
+    def _establish_connection(self) -> None:
+        """Create a backend client and set internal connection state."""
+
+    def connect(self) -> None:
+        """Connect to the backend; idempotent when already connected and healthy."""
+        if self._client_injected:
+            self._validate_injected_client()
+            self._invalidate_health_cache()
+            return
+        if self._is_client_ready() and self.is_connected():
+            self.logger.info("Already connected", connection_name=self.connection_name)
+            return
+        self.disconnect()
+        self._establish_connection()
+        self._invalidate_health_cache()
+
     def is_connected(self) -> bool:
         """Check if connected to the backend."""
         if not self._is_client_ready():

python_repositories/adapters/minio_adapter.py

@@ -26,6 +26,7 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
     secret_key_env_var_name: str = "MINIO_SECRET_KEY"
     bucket_env_var_name: str = "MINIO_BUCKET"
     secure_env_var_name: str = "MINIO_SECURE"
+    create_bucket_if_missing_env_var_name: str = "MINIO_CREATE_BUCKET_IF_MISSING"
     chunk_size: int = 5 * 2**20  # 5 MiB
     connection_name: str = "Minio"
 
@@ -36,15 +37,16 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
         client: minio.Minio | None = None,
     ) -> None:
         super().__init__()
+        if client is not None and config is None:
+            raise ValueError("config is required when client is provided")
         if config is None:
-            if client is not None:
-                raise ValueError("config is required when client is provided")
             config = MinioConfig.from_env(
                 self.endpoint_env_var_name,
                 self.access_key_env_var_name,
                 self.secret_key_env_var_name,
                 self.bucket_env_var_name,
                 self.secure_env_var_name,
+                self.create_bucket_if_missing_env_var_name,
             )
         self._config = config
         self._client_injected = client is not None
@@ -56,23 +58,17 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
     def _is_client_ready(self) -> bool:
         return self._client is not None and self._bucket_name is not None
 
-    def connect(self) -> None:
-        """Connect to the Minio server."""
-        if self._client_injected:
-            if self._client is not None:
-                try:
-                    _ = self._client.list_buckets()
-                except Exception as exc:  # pylint: disable=broad-except
-                    raise ConnectionError(
-                        f"Could not connect to Minio at {self._config.endpoint}"
-                    ) from exc
-            self._invalidate_health_cache()
+    def _validate_injected_client(self) -> None:
+        if self._client is None:
             return
-        if self._client is not None and self.is_connected():
-            self.logger.info("Already connected to Minio")
-            return
-        if self._client is not None:
-            self.disconnect()
+        try:
+            _ = self._client.list_buckets()
+        except Exception as exc:  # pylint: disable=broad-except
+            raise ConnectionError(
+                f"Could not connect to Minio at {self._config.endpoint}"
+            ) from exc
+
+    def _establish_connection(self) -> None:
         endpoint = self._config.endpoint
         access_key = self._config.access_key
         secret_key = self._config.secret_key
@@ -88,11 +84,14 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
         except Exception as exc:  # pylint: disable=broad-except
             raise ConnectionError(f"Could not connect to Minio at {endpoint}") from exc
         if not client.bucket_exists(bucket):
-            self.logger.info(f"Creating bucket '{bucket}'")
+            if not self._config.create_bucket_if_missing:
+                raise ConnectionError(
+                    f"Bucket '{bucket}' does not exist on Minio at {endpoint}"
+                )
+            self.logger.info("Creating bucket", bucket=bucket)
             client.make_bucket(bucket)
         self._client = client
         self._bucket_name = bucket
-        self._invalidate_health_cache()
 
     def disconnect(self) -> None:
         """Disconnect from the Minio server."""
@@ -139,7 +138,7 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
             content_type=content_type,
         )
         self.logger.debug(
-            f"Put object '{object_name}' into bucket '{self._bucket_name}'"
+            "Put object", object_name=object_name, bucket=self._bucket_name
         )
 
     def get(self, object_name: str) -> BytesIO | None:
@@ -164,23 +163,22 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
                 buffer.write(chunk)
             buffer.seek(0)
             self.logger.debug(
-                f"Got object '{object_name}' from bucket '{self._bucket_name}'"
+                "Got object", object_name=object_name, bucket=self._bucket_name
             )
             return buffer
         except minio.S3Error as exc:
             if exc.code == "NoSuchKey":
                 self.logger.warning(
-                    f"Object '{object_name}' not found in bucket '{self._bucket_name}'"
+                    "Object not found",
+                    object_name=object_name,
+                    bucket=self._bucket_name,
                 )
-            else:
-                self.logger.error(repr(exc))
-        except Exception as exc:  # pylint: disable=broad-except
-            self.logger.error(repr(exc))
+                return None
+            raise
         finally:
             if response is not None:
                 response.close()
                 response.release_conn()
-        return None
 
     def delete(self, object_name: str) -> None:
         """Delete an object from the Minio bucket."""
@@ -197,7 +195,7 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
             object_name=object_name,
         )
         self.logger.debug(
-            f"Deleted object '{object_name}' from bucket '{self._bucket_name}'"
+            "Deleted object", object_name=object_name, bucket=self._bucket_name
         )
 
     def list_objects(self, prefix: str = "") -> list[str]:
@@ -219,6 +217,9 @@ class MinioAdapter(ObjectRepositoryInterface, ConnectionAwareAdapter):
             obj.object_name for obj in objects if obj.object_name is not None
         ]
         self.logger.debug(
-            f"Listed {len(object_names)} object(s) in bucket '{self._bucket_name}' with prefix '{prefix}'"
+            "Listed objects",
+            count=len(object_names),
+            bucket=self._bucket_name,
+            prefix=prefix,
         )
         return object_names

python_repositories/adapters/redis_adapter.py

@@ -1,7 +1,8 @@
 """Definition of RedisAdapter class."""
 
 from __future__ import annotations
-from typing import cast
+from collections.abc import Iterator
+from typing import Any, cast
 
 from python_repositories.adapters.connection_aware_adapter import (
     ConnectionAwareAdapter,
@@ -34,9 +35,9 @@ class RedisAdapter(JsonRepositoryInterface, ConnectionAwareAdapter):
         client: redis.Redis | None = None,
     ) -> None:
         super().__init__()
+        if client is not None and config is None:
+            raise ValueError("config is required when client is provided")
         if config is None:
-            if client is not None:
-                raise ValueError("config is required when client is provided")
             config = RedisConfig.from_env(self.uri_env_var_name)
         self._config = config
         self._client_injected = client is not None
@@ -48,25 +49,20 @@ class RedisAdapter(JsonRepositoryInterface, ConnectionAwareAdapter):
     def _is_client_ready(self) -> bool:
         return self._client is not None
 
-    def connect(self) -> None:
-        """Connect to the Redis server."""
-        if self._client_injected:
-            if self._client is not None:
-                try:
-                    if not self._client.ping():
-                        raise ConnectionError(
-                            f"Could not connect to Redis at {self._config.uri}"
-                        )
-                except (redis.ConnectionError, redis.TimeoutError) as exc:
-                    raise ConnectionError(
-                        f"Could not connect to Redis at {self._config.uri}"
-                    ) from exc
-            self._invalidate_health_cache()
+    def _validate_injected_client(self) -> None:
+        if self._client is None:
             return
-        if self._client is not None:
-            self._client.close()
-            self._client = None
-            self._invalidate_health_cache()
+        try:
+            if not self._client.ping():
+                raise ConnectionError(
+                    f"Could not connect to Redis at {self._config.uri}"
+                )
+        except (redis.ConnectionError, redis.TimeoutError) as exc:
+            raise ConnectionError(
+                f"Could not connect to Redis at {self._config.uri}"
+            ) from exc
+
+    def _establish_connection(self) -> None:
         uri = self._config.uri
         try:
             client = redis.Redis.from_url(
@@ -78,7 +74,6 @@ class RedisAdapter(JsonRepositoryInterface, ConnectionAwareAdapter):
         except (redis.ConnectionError, redis.TimeoutError) as exc:
             raise ConnectionError(f"Could not connect to Redis at {uri}") from exc
         self._client = client
-        self._invalidate_health_cache()
 
     def disconnect(self) -> None:
         """Disconnect from the Redis server."""
@@ -94,7 +89,7 @@ class RedisAdapter(JsonRepositoryInterface, ConnectionAwareAdapter):
         except (redis.ConnectionError, redis.TimeoutError):
             return False
 
-    def set(self, key: str, data: dict) -> None:
+    def set(self, key: str, data: dict[str, Any]) -> None:
         """Set a JSON object in Redis."""
         # Check input
         if not isinstance(key, str) or len(key) == 0:
@@ -106,9 +101,9 @@ class RedisAdapter(JsonRepositoryInterface, ConnectionAwareAdapter):
         assert self._client is not None
         # Set data
         self._client.json().set(key, self.path, data)
-        self.logger.debug(f"Set {key} to {data}")
+        self.logger.debug("Set key", key=key, data_keys=list(data.keys()))
 
-    def get(self, key: str) -> dict | None:
+    def get(self, key: str) -> dict[str, Any] | None:
         """Get a JSON object from Redis."""
         # Check input
         if not isinstance(key, str) or len(key) == 0:
@@ -118,10 +113,10 @@ class RedisAdapter(JsonRepositoryInterface, ConnectionAwareAdapter):
         assert self._client is not None
         # Get data
         data = cast(
-            dict | None,
+            dict[str, Any] | None,
             self._client.json().get(key),
         )
-        self.logger.debug(f"Got {data} from {key}")
+        self.logger.debug("Got value", key=key, found=data is not None)
         return data
 
     def delete(self, key: str) -> None:
@@ -134,13 +129,15 @@ class RedisAdapter(JsonRepositoryInterface, ConnectionAwareAdapter):
         assert self._client is not None
         # Delete data
         self._client.json().delete(key)
-        self.logger.debug(f"Deleted {key}")
+        self.logger.debug("Deleted key", key=key)
 
-    def list_keys(self, pattern: str) -> list[str]:
-        """List keys in Redis matching a pattern."""
-        # Check input
+    def _validate_pattern(self, pattern: str) -> None:
         if not isinstance(pattern, str) or len(pattern) == 0:
             raise ValueError("Pattern must be a non-empty string")
+
+    def list_keys(self, pattern: str) -> list[str]:
+        """List keys in Redis using KEYS; may block on large datasets."""
+        self._validate_pattern(pattern)
         # Check connection
         self._require_connected()
         assert self._client is not None
@@ -150,5 +147,31 @@ class RedisAdapter(JsonRepositoryInterface, ConnectionAwareAdapter):
             self._client.keys(pattern),
         )
         keys: list[str] = [key.decode(self.encoding) for key in keys_raw]
-        self.logger.debug(f"Got {keys} matching {pattern}")
+        self.logger.debug("Listed keys", pattern=pattern, count=len(keys))
         return keys
+
+    def scan_keys(
+        self,
+        pattern: str,
+        *,
+        count: int | None = None,
+    ) -> Iterator[str]:
+        """Yield keys in Redis using SCAN to avoid blocking large datasets."""
+        self._validate_pattern(pattern)
+        self._require_connected()
+        assert self._client is not None
+        client = self._client
+
+        def _decode(key: bytes | str) -> str:
+            return key if isinstance(key, str) else key.decode(self.encoding)
+
+        def _iter() -> Iterator[str]:
+            scan_iter = (
+                client.scan_iter(match=pattern, count=count)
+                if count is not None
+                else client.scan_iter(match=pattern)
+            )
+            for key_raw in scan_iter:
+                yield _decode(key_raw)
+
+        return _iter()

python_repositories/config/env_bool.py

@@ -0,0 +1,21 @@
+"""Parse boolean values from environment variables."""
+
+from __future__ import annotations
+
+import os
+
+_TRUTHY = frozenset({"1", "true", "yes", "on"})
+_FALSY = frozenset({"0", "false", "no", "off"})
+
+
+def env_bool(name: str, default: bool) -> bool:
+    """Parse an environment variable as a boolean value."""
+    raw = os.getenv(name)
+    if raw is None:
+        return default
+    normalized = raw.strip().lower()
+    if normalized in _TRUTHY:
+        return True
+    if normalized in _FALSY:
+        return False
+    raise ValueError(f"Invalid boolean value for {name}: {raw!r}")

python_repositories/config/minio_config.py

@@ -8,21 +8,7 @@ from dataclasses import dataclass
 from python_utils import check_env
 
 from python_repositories.config.dotenv_loader import load_dotenv
-
-_TRUTHY = frozenset({"1", "true", "yes", "on"})
-_FALSY = frozenset({"0", "false", "no", "off"})
-
-
-def _env_bool(name: str, default: bool) -> bool:
-    raw = os.getenv(name)
-    if raw is None:
-        return default
-    normalized = raw.strip().lower()
-    if normalized in _TRUTHY:
-        return True
-    if normalized in _FALSY:
-        return False
-    raise ValueError(f"Invalid boolean value for {name}: {raw!r}")
+from python_repositories.config.env_bool import env_bool
 
 
 @dataclass(frozen=True)
@@ -34,6 +20,7 @@ class MinioConfig:
     secret_key: str
     bucket: str
     secure: bool = True
+    create_bucket_if_missing: bool = False
 
     @classmethod
     def from_env(
@@ -43,6 +30,7 @@ class MinioConfig:
         secret_key_env_var_name: str = "MINIO_SECRET_KEY",
         bucket_env_var_name: str = "MINIO_BUCKET",
         secure_env_var_name: str = "MINIO_SECURE",
+        create_bucket_if_missing_env_var_name: str = ("MINIO_CREATE_BUCKET_IF_MISSING"),
         *,
         use_dotenv: bool = True,
     ) -> MinioConfig:
@@ -61,5 +49,9 @@ class MinioConfig:
             access_key=str(os.getenv(access_key_env_var_name)),
             secret_key=str(os.getenv(secret_key_env_var_name)),
             bucket=str(os.getenv(bucket_env_var_name)),
-            secure=_env_bool(secure_env_var_name, default=True),
+            secure=env_bool(secure_env_var_name, default=True),
+            create_bucket_if_missing=env_bool(
+                create_bucket_if_missing_env_var_name,
+                default=False,
+            ),
         )

python_repositories/examples/user_json_repository.py

@@ -1,5 +1,7 @@
 """Example domain repository backed by Redis JSON."""
 
+from typing import Any
+
 from python_repositories.adapters.redis_adapter import RedisAdapter
 
 
@@ -9,10 +11,10 @@ class UserJsonRepository(RedisAdapter):
     def _key(self, user_id: str) -> str:
         return f"user:{user_id}"
 
-    def get_user(self, user_id: str) -> dict | None:
+    def get_user(self, user_id: str) -> dict[str, Any] | None:
         return self.get(self._key(user_id))
 
-    def save_user(self, user_id: str, user: dict) -> None:
+    def save_user(self, user_id: str, user: dict[str, Any]) -> None:
         self.set(self._key(user_id), user)
 
     def delete_user(self, user_id: str) -> None:

python_repositories/interfaces/connection_aware_interface.py

@@ -8,7 +8,11 @@ class ConnectionAwareInterface(ABC):
 
     @abstractmethod
     def connect(self) -> None:
-        """Connect to resource."""
+        """Connect to resource.
+
+        Implementations should be idempotent: calling connect while already
+        connected and healthy is a no-op.
+        """
         ...
 
     @abstractmethod

python_repositories/interfaces/json_repository_interface.py

@@ -1,18 +1,20 @@
 """Definition of JsonRepositoryInterface abstract base class."""
 
+from collections.abc import Iterator
 from abc import ABC, abstractmethod
+from typing import Any
 
 
 class JsonRepositoryInterface(ABC):
     """Interface that defines JSON document CRUD methods."""
 
     @abstractmethod
-    def get(self, key: str) -> dict | None:
+    def get(self, key: str) -> dict[str, Any] | None:
         """Get a JSON object by key."""
         ...
 
     @abstractmethod
-    def set(self, key: str, data: dict) -> None:
+    def set(self, key: str, data: dict[str, Any]) -> None:
         """Set a JSON object by key."""
         ...
 
@@ -25,3 +27,13 @@ class JsonRepositoryInterface(ABC):
     def list_keys(self, pattern: str) -> list[str]:
         """List keys matching a glob pattern."""
         ...
+
+    def scan_keys(
+        self,
+        pattern: str,
+        *,
+        count: int | None = None,
+    ) -> Iterator[str]:
+        """Yield keys matching a glob pattern incrementally."""
+        del count
+        yield from self.list_keys(pattern)

python_repositories/interfaces/object_repository_interface.py

@@ -9,7 +9,11 @@ class ObjectRepositoryInterface(ABC):
 
     @abstractmethod
     def get(self, object_name: str) -> BytesIO | None:
-        """Get an object by name."""
+        """Get an object by name.
+
+        Returns None when the object does not exist. Raises ConnectionError when
+        not connected. Other backend errors propagate to the caller.
+        """
         ...
 
     @abstractmethod

scripts/ci/build-ci-image.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Build and optionally push the Gitea Actions CI base image locally.
+#
+# Use when ci-image.yml is not yet on main (e.g. bootstrapping a PR branch) or
+# when you need to rebuild without waiting for the nightly workflow.
+#
+# Build only (smoke test):
+#   export CI_RUNNER_TOKEN='ci-bot-personal-access-token'
+#   bash scripts/ci/build-ci-image.sh --local
+#
+# Build and push to Gitea (unblocks python-repositories-ci jobs):
+#   export CI_RUNNER_TOKEN='ci-bot-personal-access-token'
+#   bash scripts/ci/build-ci-image.sh --push
+#
+# Optional overrides:
+#   REGISTRY=gitea.lille-vemmelund.dk
+#   REGISTRY_USER=ci-bot
+#   IMAGE_OWNER=lillevemmelund
+#   IMAGE_NAME=python-repositories-ci
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+
+REGISTRY="${REGISTRY:-gitea.lille-vemmelund.dk}"
+REGISTRY_USER="${REGISTRY_USER:-ci-bot}"
+IMAGE_OWNER="${IMAGE_OWNER:-lillevemmelund}"
+IMAGE_NAME="${IMAGE_NAME:-python-repositories-ci}"
+IMAGE="${IMAGE:-${REGISTRY}/${IMAGE_OWNER}/${IMAGE_NAME}}"
+
+MODE="push"
+if [[ "${1:-}" == "--local" ]]; then
+  MODE="local"
+elif [[ "${1:-}" == "--push" || -z "${1:-}" ]]; then
+  MODE="push"
+elif [[ -n "${1:-}" ]]; then
+  echo "Usage: build-ci-image.sh [--local | --push]" >&2
+  exit 1
+fi
+
+: "${CI_RUNNER_TOKEN:?CI_RUNNER_TOKEN is required (ci-bot token with read/write package access)}"
+
+TOKEN_FILE="$(mktemp)"
+cleanup() {
+  rm -f "$TOKEN_FILE"
+}
+trap cleanup EXIT
+
+printf '%s' "$CI_RUNNER_TOKEN" >"$TOKEN_FILE"
+
+cd "$REPO_ROOT"
+
+if [[ "$MODE" == "local" ]]; then
+  echo "=== Building local CI image (no push): python-repositories-ci:local ==="
+  docker build --network=host -f docker/ci/Dockerfile \
+    --secret "id=uv_token,src=${TOKEN_FILE}" \
+    -t python-repositories-ci:local \
+    .
+  echo "Built python-repositories-ci:local"
+  exit 0
+fi
+
+echo "=== Logging in to ${REGISTRY} as ${REGISTRY_USER} ==="
+echo "$CI_RUNNER_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+
+echo "=== Building ${IMAGE}:latest ==="
+docker build --network=host -f docker/ci/Dockerfile \
+  --secret "id=uv_token,src=${TOKEN_FILE}" \
+  -t "${IMAGE}:latest" \
+  .
+
+STAMP="$(date -u +%Y%m%d%H%M)"
+echo "=== Pushing ${IMAGE}:latest and ${IMAGE}:${STAMP} ==="
+docker tag "${IMAGE}:latest" "${IMAGE}:${STAMP}"
+docker push "${IMAGE}:latest"
+docker push "${IMAGE}:${STAMP}"
+
+echo "Done. Re-run failing CI jobs — runners pull ${IMAGE}:latest"

tests/integration/conftest.py

@@ -2,23 +2,52 @@
 
 import logging
 from collections.abc import Generator
+from typing import Any, cast
 
 import pytest
 import redis
 import structlog
 from minio import Minio
+from testcontainers.core.container import DockerContainer
+from testcontainers.core.waiting_utils import WaitStrategy, WaitStrategyTarget
 from testcontainers.minio import MinioContainer
 
 from python_repositories.config import MinioConfig, RedisConfig
-from tests.integration.redis_container_test import REDIS_PORT, RedisTestContainer
 
-collect_ignore = ["redis_container_test.py"]
+REDIS_PORT = 6379
 
 MINIO_ACCESS_KEY = "minioadmin"
 MINIO_SECRET_KEY = "minioadmin"
 MINIO_BUCKET = "test-bucket"
 
 
+class _RedisPingWaitStrategy(WaitStrategy):
+    def __init__(self) -> None:
+        super().__init__()
+        self.with_transient_exceptions(redis.exceptions.ConnectionError)
+
+    def wait_until_ready(self, container: WaitStrategyTarget) -> None:
+        redis_container = cast("RedisTestContainer", container)
+        if not self._poll(lambda: redis_container.get_client().ping()):
+            raise redis.exceptions.ConnectionError("Could not connect to Redis")
+
+
+class RedisTestContainer(DockerContainer):
+    """Redis container using wait strategies instead of the deprecated decorator."""
+
+    def __init__(self, image: str, port: int = REDIS_PORT) -> None:
+        super().__init__(image, _wait_strategy=_RedisPingWaitStrategy())
+        self.port = port
+        self.with_exposed_ports(self.port)
+
+    def get_client(self, **kwargs: Any) -> redis.Redis:
+        return redis.Redis(
+            host=self.get_container_host_ip(),
+            port=self.get_exposed_port(self.port),
+            **kwargs,
+        )
+
+
 @pytest.fixture(scope="session", autouse=True)
 def configure_logging() -> None:
     """Configure logging for the test session."""

tests/integration/examples_test.py

@@ -6,6 +6,7 @@ import os
 import random
 
 import pytest
+from minio import Minio
 
 from python_repositories.examples.artifact_object_repository import (
     ArtifactObjectRepository,
@@ -19,8 +20,10 @@ pytestmark = pytest.mark.integration
 def set_example_env(
     redis_container: str,
     minio_container: dict[str, str],
+    raw_minio_client: Minio,
 ) -> Generator[None, None, None]:
     """Set env vars so example repositories can use from_env() defaults."""
+    _ = raw_minio_client
     env_vars = {"REDIS_URI": redis_container, **minio_container}
     for key, value in env_vars.items():
         os.environ[key] = value

tests/integration/minio_adapter_test.py

@@ -1,6 +1,7 @@
 """Integration tests for the MinioAdapter."""
 
 from collections.abc import Generator
+from dataclasses import replace
 import logging
 import random
 from io import BytesIO
@@ -101,7 +102,8 @@ def test_should_log_info_when_already_connected(
     """Test that the MinioAdapter logs info when connect is called while already connected."""
     with caplog.at_level(logging.INFO):
         minio_adapter.connect()
-    assert "Already connected to Minio" in caplog.text
+    assert "Already connected" in caplog.text
+    assert "Minio" in caplog.text
 
 
 def test_should_raise_connection_error_when_unable_to_connect() -> None:
@@ -118,18 +120,39 @@ def test_should_raise_connection_error_when_unable_to_connect() -> None:
     assert not adapter.is_connected()
 
 
-def test_should_log_info_when_creating_expected_bucket(
+def test_connect_raises_when_bucket_missing(
+    raw_minio_client: Minio,
+    minio_config: MinioConfig,
+) -> None:
+    """Test that connect fails when the configured bucket is missing."""
+    bucket_name = minio_config.bucket
+    raw_minio_client.remove_bucket(bucket_name)
+    adapter = MinioAdapter(config=minio_config)
+
+    try:
+        with pytest.raises(ConnectionError, match="does not exist"):
+            adapter.connect()
+        assert not adapter.is_connected()
+    finally:
+        raw_minio_client.make_bucket(bucket_name)
+
+
+def test_connect_creates_bucket_when_create_bucket_if_missing_enabled(
     raw_minio_client: Minio,
     minio_config: MinioConfig,
     caplog: pytest.LogCaptureFixture,
 ) -> None:
-    """Test that the MinioAdapter logs info when creating the expected bucket."""
+    """Test that connect can create the configured bucket when enabled."""
     bucket_name = minio_config.bucket
     raw_minio_client.remove_bucket(bucket_name)
-    adapter = MinioAdapter(config=minio_config)
+    config = replace(minio_config, create_bucket_if_missing=True)
+    adapter = MinioAdapter(config=config)
+
     with caplog.at_level(logging.INFO):
         adapter.connect()
-    assert f"Creating bucket '{bucket_name}'" in caplog.text
+
+    assert "Creating bucket" in caplog.text
+    assert bucket_name in caplog.text
 
 
 def test_should_log_error_on_exception_during_exit(
@@ -212,16 +235,15 @@ def test_should_log_warning_when_getting_nonexistent_object(
     with caplog.at_level("WARNING"):
         result = adapter.get(object_name)
     assert result is None
-    assert (
-        f"Object '{object_name}' not found in bucket '{adapter._bucket_name}'"
-        in caplog.text
-    )
+    assert "Object not found" in caplog.text
+    assert object_name in caplog.text
+    bucket_name = adapter._bucket_name
+    assert bucket_name is not None
+    assert bucket_name in caplog.text
 
 
-def test_should_log_error_when_getting_with_s3error_other_than_no_such_key(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    """Test that the MinioAdapter logs an error for unhandled S3 errors."""
+def test_should_reraise_s3error_other_than_no_such_key() -> None:
+    """Test that the MinioAdapter re-raises unhandled S3 errors."""
     mock_client = MagicMock(spec=Minio)
     mock_client.bucket_exists.return_value = True
     other_s3error = S3Error(
@@ -236,25 +258,20 @@ def test_should_log_error_when_getting_with_s3error_other_than_no_such_key(
     )
     mock_client.get_object.side_effect = other_s3error
     adapter = MinioAdapter(config=TEST_MINIO_CONFIG, client=mock_client)
-    with caplog.at_level("ERROR"):
-        result = adapter.get("missing-object")
-    assert result is None
-    assert repr(other_s3error) in caplog.text
+    with pytest.raises(S3Error) as exc_info:
+        adapter.get("missing-object")
+    assert exc_info.value.code == "UnhandledError"
 
 
-def test_should_log_error_when_getting_with_general_exception(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    """Test that the MinioAdapter logs an error on general exceptions during get."""
+def test_should_reraise_general_exception() -> None:
+    """Test that the MinioAdapter re-raises general exceptions during get."""
     mock_client = MagicMock(spec=Minio)
     mock_client.bucket_exists.return_value = True
     general_exception = Exception("General failure")
     mock_client.get_object.side_effect = general_exception
     adapter = MinioAdapter(config=TEST_MINIO_CONFIG, client=mock_client)
-    with caplog.at_level("ERROR"):
-        result = adapter.get("missing-object")
-    assert result is None
-    assert repr(general_exception) in caplog.text
+    with pytest.raises(Exception, match="General failure"):
+        adapter.get("missing-object")
 
 
 def test_should_put_data(

tests/integration/redis_adapter_test.py

@@ -1,6 +1,7 @@
 """Integration tests for the RedisAdapter."""
 
 from collections.abc import Generator
+import logging
 
 import pytest
 import redis
@@ -48,6 +49,17 @@ def clear_redis(raw_redis_client: redis.Redis) -> None:
     raw_redis_client.flushall()
 
 
+def test_should_log_info_when_already_connected(
+    redis_adapter: RedisAdapter,
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """Test that the RedisAdapter logs info when connect is called while already connected."""
+    with caplog.at_level(logging.INFO):
+        redis_adapter.connect()
+    assert "Already connected" in caplog.text
+    assert "Redis" in caplog.text
+
+
 def test_should_raise_connection_error_when_unable_to_connect() -> None:
     """Test that the RedisAdapter raises ConnectionError when unable to connect."""
     adapter = RedisAdapter(config=RedisConfig(uri="redis://invalid:6379"))
@@ -254,5 +266,34 @@ def test_should_raise_connection_error_on_list_keys_when_not_connected(
         adapter.list_keys("some_pattern")
 
 
+def test_should_scan_keys(
+    redis_adapter: RedisAdapter,
+) -> None:
+    """Test scanning keys matching a pattern returns correct keys."""
+    redis_adapter.set("key1", {"a": 1})
+    redis_adapter.set("key2", {"b": 2})
+    keys = set(redis_adapter.scan_keys("key*"))
+    assert keys == {"key1", "key2"}
+
+
+def test_should_raise_value_error_on_invalid_scan_keys_pattern(
+    redis_adapter: RedisAdapter,
+) -> None:
+    """Test that the RedisAdapter raises ValueError when scanning keys with an invalid pattern."""
+    invalid_patterns = ["", 123, None]
+    for pattern in invalid_patterns:
+        with pytest.raises(ValueError):
+            list(redis_adapter.scan_keys(pattern))  # type: ignore[arg-type]
+
+
+def test_should_raise_connection_error_on_scan_keys_when_not_connected(
+    redis_config: RedisConfig,
+) -> None:
+    """Test that the RedisAdapter raises ConnectionError when scanning keys while not connected."""
+    adapter = RedisAdapter(config=redis_config)
+    with pytest.raises(ConnectionError):
+        list(adapter.scan_keys("some_pattern"))
+
+
 if __name__ == "__main__":
     pytest.main(["-s", "-v", __file__])

tests/integration/redis_container_test.py

@@ -1,36 +0,0 @@
-"""Redis test container without testcontainers' deprecated wait decorator."""
-
-from typing import Any, cast
-
-import redis
-from testcontainers.core.container import DockerContainer
-from testcontainers.core.waiting_utils import WaitStrategy, WaitStrategyTarget
-
-REDIS_PORT = 6379
-
-
-class _RedisPingWaitStrategy(WaitStrategy):
-    def __init__(self) -> None:
-        super().__init__()
-        self.with_transient_exceptions(redis.exceptions.ConnectionError)
-
-    def wait_until_ready(self, container: WaitStrategyTarget) -> None:
-        redis_container = cast("RedisTestContainer", container)
-        if not self._poll(lambda: redis_container.get_client().ping()):
-            raise redis.exceptions.ConnectionError("Could not connect to Redis")
-
-
-class RedisTestContainer(DockerContainer):
-    """Redis container using wait strategies instead of the deprecated decorator."""
-
-    def __init__(self, image: str, port: int = REDIS_PORT) -> None:
-        super().__init__(image, _wait_strategy=_RedisPingWaitStrategy())
-        self.port = port
-        self.with_exposed_ports(self.port)
-
-    def get_client(self, **kwargs: Any) -> redis.Redis:
-        return redis.Redis(
-            host=self.get_container_host_ip(),
-            port=self.get_exposed_port(self.port),
-            **kwargs,
-        )

tests/unit/env_bool_test.py

@@ -0,0 +1,43 @@
+"""Unit tests for env_bool."""
+
+from __future__ import annotations
+
+import pytest
+
+from python_repositories.config.env_bool import env_bool
+
+
+@pytest.mark.parametrize(
+    ("value", "expected"),
+    [
+        ("true", True),
+        ("1", True),
+        ("yes", True),
+        ("on", True),
+        ("false", False),
+        ("0", False),
+        ("no", False),
+        ("off", False),
+    ],
+)
+def test_env_bool_parses_truthy_and_falsy(
+    monkeypatch: pytest.MonkeyPatch,
+    value: str,
+    expected: bool,
+) -> None:
+    monkeypatch.setenv("TEST_BOOL", value)
+    assert env_bool("TEST_BOOL", default=not expected) is expected
+
+
+def test_env_bool_returns_default_when_unset(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv("TEST_BOOL", raising=False)
+    assert env_bool("TEST_BOOL", default=True) is True
+    assert env_bool("TEST_BOOL", default=False) is False
+
+
+def test_env_bool_raises_for_invalid_value(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("TEST_BOOL", "not-a-bool")
+    with pytest.raises(ValueError, match="TEST_BOOL"):
+        env_bool("TEST_BOOL", default=False)

tests/unit/json_repository_interface_test.py

@@ -1,5 +1,7 @@
 """Unit tests for JsonRepositoryInterface."""
 
+from typing import Any
+
 import pytest
 from python_repositories.interfaces.json_repository_interface import (
     JsonRepositoryInterface,
@@ -12,7 +14,7 @@ def test_instantiation_fails_when_get_not_implemented() -> None:
     class Incomplete(JsonRepositoryInterface):
         """A class that does not implement get."""
 
-        def set(self, key: str, data: dict) -> None:
+        def set(self, key: str, data: dict[str, Any]) -> None:
             pass
 
         def delete(self, key: str) -> None:
@@ -31,7 +33,7 @@ def test_instantiation_fails_when_set_not_implemented() -> None:
     class Incomplete(JsonRepositoryInterface):
         """A class that does not implement set."""
 
-        def get(self, key: str) -> dict | None:
+        def get(self, key: str) -> dict[str, Any] | None:
             return None
 
         def delete(self, key: str) -> None:
@@ -50,10 +52,10 @@ def test_instantiation_fails_when_delete_not_implemented() -> None:
     class Incomplete(JsonRepositoryInterface):
         """A class that does not implement delete."""
 
-        def get(self, key: str) -> dict | None:
+        def get(self, key: str) -> dict[str, Any] | None:
             return None
 
-        def set(self, key: str, data: dict) -> None:
+        def set(self, key: str, data: dict[str, Any]) -> None:
             pass
 
         def list_keys(self, pattern: str) -> list[str]:
@@ -69,10 +71,10 @@ def test_instantiation_fails_when_list_keys_not_implemented() -> None:
     class Incomplete(JsonRepositoryInterface):
         """A class that does not implement list_keys."""
 
-        def get(self, key: str) -> dict | None:
+        def get(self, key: str) -> dict[str, Any] | None:
             return None
 
-        def set(self, key: str, data: dict) -> None:
+        def set(self, key: str, data: dict[str, Any]) -> None:
             pass
 
         def delete(self, key: str) -> None:
@@ -80,3 +82,24 @@ def test_instantiation_fails_when_list_keys_not_implemented() -> None:
 
     with pytest.raises(TypeError):
         _ = Incomplete()  # type: ignore
+
+
+def test_scan_keys_defaults_to_list_keys() -> None:
+    """Test that the default scan_keys implementation delegates to list_keys."""
+
+    class Complete(JsonRepositoryInterface):
+        def get(self, key: str) -> dict[str, Any] | None:
+            return None
+
+        def set(self, key: str, data: dict[str, Any]) -> None:
+            pass
+
+        def delete(self, key: str) -> None:
+            pass
+
+        def list_keys(self, pattern: str) -> list[str]:
+            return [f"{pattern}-1", f"{pattern}-2"]
+
+    repository = Complete()
+
+    assert list(repository.scan_keys("user")) == ["user-1", "user-2"]

tests/unit/minio_adapter_test.py

@@ -2,10 +2,12 @@
 
 from __future__ import annotations
 
+from dataclasses import replace
 from unittest.mock import MagicMock
 
 import pytest
-from minio import Minio
+from minio import Minio, S3Error
+from urllib3.response import BaseHTTPResponse
 
 from python_repositories.adapters.minio_adapter import MinioAdapter
 from python_repositories.interfaces import ObjectRepositoryInterface
@@ -73,6 +75,16 @@ def test_connect_with_injected_client_raises_on_failure() -> None:
         adapter.connect()
 
 
+def test_connect_with_injected_client_skips_validation_when_client_cleared() -> None:
+    mock_client = MagicMock(spec=Minio)
+    adapter = MinioAdapter(config=TEST_MINIO_CONFIG, client=mock_client)
+    adapter.disconnect()
+
+    adapter.connect()
+
+    mock_client.list_buckets.assert_not_called()
+
+
 def test_connect_disconnects_before_reconnect(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
@@ -93,6 +105,65 @@ def test_connect_disconnects_before_reconnect(
     new_client.list_buckets.assert_called_once()
 
 
+def test_connect_skips_reconnect_when_already_connected(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    stale_client = MagicMock(spec=Minio)
+    stale_client.bucket_exists.return_value = True
+    adapter = MinioAdapter(config=TEST_MINIO_CONFIG)
+    adapter._client = stale_client
+    adapter._bucket_name = TEST_MINIO_CONFIG.bucket
+
+    minio_ctor = MagicMock()
+    monkeypatch.setattr(
+        "python_repositories.adapters.minio_adapter.minio.Minio",
+        minio_ctor,
+    )
+
+    adapter.connect()
+
+    minio_ctor.assert_not_called()
+    assert adapter._client is stale_client
+
+
+def test_connect_raises_when_bucket_missing(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    mock_client = MagicMock(spec=Minio)
+    mock_client.bucket_exists.return_value = False
+
+    monkeypatch.setattr(
+        "python_repositories.adapters.minio_adapter.minio.Minio",
+        lambda *args, **kwargs: mock_client,
+    )
+
+    adapter = MinioAdapter(config=TEST_MINIO_CONFIG)
+
+    with pytest.raises(ConnectionError, match="does not exist"):
+        adapter.connect()
+
+    mock_client.make_bucket.assert_not_called()
+
+
+def test_connect_creates_bucket_when_create_bucket_if_missing_enabled(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    mock_client = MagicMock(spec=Minio)
+    mock_client.bucket_exists.return_value = False
+    config = replace(TEST_MINIO_CONFIG, create_bucket_if_missing=True)
+
+    monkeypatch.setattr(
+        "python_repositories.adapters.minio_adapter.minio.Minio",
+        lambda *args, **kwargs: mock_client,
+    )
+
+    adapter = MinioAdapter(config=config)
+    adapter.connect()
+
+    mock_client.bucket_exists.assert_called_once_with(config.bucket)
+    mock_client.make_bucket.assert_called_once_with(config.bucket)
+
+
 def test_get_closes_response_on_success() -> None:
     """get() must close and release the get_object HTTP response."""
     mock_client = MagicMock(spec=Minio)
@@ -119,8 +190,63 @@ def test_get_closes_response_when_read_fails() -> None:
     mock_client.get_object.return_value = mock_response
     adapter = MinioAdapter(config=TEST_MINIO_CONFIG, client=mock_client)
 
-    result = adapter.get("some-object")
+    with pytest.raises(OSError, match="connection reset"):
+        adapter.get("some-object")
 
-    assert result is None
     mock_response.close.assert_called_once()
     mock_response.release_conn.assert_called_once()
+
+
+def test_get_returns_none_for_no_such_key() -> None:
+    """get() returns None when the object does not exist."""
+    mock_client = MagicMock(spec=Minio)
+    mock_client.bucket_exists.return_value = True
+    mock_client.get_object.side_effect = S3Error(
+        MagicMock(spec=BaseHTTPResponse),
+        "NoSuchKey",
+        "",
+        "",
+        "",
+        "",
+        bucket_name="test-bucket",
+        object_name="missing-object",
+    )
+    adapter = MinioAdapter(config=TEST_MINIO_CONFIG, client=mock_client)
+
+    result = adapter.get("missing-object")
+
+    assert result is None
+
+
+def test_get_reraises_other_s3_errors() -> None:
+    """get() re-raises S3 errors other than NoSuchKey."""
+    mock_client = MagicMock(spec=Minio)
+    mock_client.bucket_exists.return_value = True
+    other_s3error = S3Error(
+        MagicMock(spec=BaseHTTPResponse),
+        "AccessDenied",
+        "",
+        "",
+        "",
+        "",
+        bucket_name="test-bucket",
+        object_name="some-object",
+    )
+    mock_client.get_object.side_effect = other_s3error
+    adapter = MinioAdapter(config=TEST_MINIO_CONFIG, client=mock_client)
+
+    with pytest.raises(S3Error) as exc_info:
+        adapter.get("some-object")
+
+    assert exc_info.value.code == "AccessDenied"
+
+
+def test_get_reraises_general_exception_from_get_object() -> None:
+    """get() re-raises unexpected exceptions from get_object."""
+    mock_client = MagicMock(spec=Minio)
+    mock_client.bucket_exists.return_value = True
+    mock_client.get_object.side_effect = Exception("General failure")
+    adapter = MinioAdapter(config=TEST_MINIO_CONFIG, client=mock_client)
+
+    with pytest.raises(Exception, match="General failure"):
+        adapter.get("some-object")

tests/unit/minio_config_test.py

@@ -22,6 +22,7 @@ def test_from_env_loads_all_fields(monkeypatch: pytest.MonkeyPatch) -> None:
     assert config.secret_key == "secret"
     assert config.bucket == "my-bucket"
     assert config.secure is True
+    assert config.create_bucket_if_missing is False
 
 
 def test_from_env_defaults_secure_to_true_when_unset(
@@ -33,33 +34,27 @@ def test_from_env_defaults_secure_to_true_when_unset(
     assert config.secure is True
 
 
-@pytest.mark.parametrize(
-    ("value", "expected"),
-    [
-        ("true", True),
-        ("1", True),
-        ("yes", True),
-        ("false", False),
-        ("0", False),
-        ("no", False),
-    ],
-)
-def test_from_env_parses_secure(
+def test_from_env_reads_secure_from_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    _set_required_minio_env(monkeypatch)
+    monkeypatch.setenv("MINIO_SECURE", "false")
+    assert MinioConfig.from_env(use_dotenv=False).secure is False
+
+
+def test_from_env_reads_create_bucket_if_missing_from_env(
     monkeypatch: pytest.MonkeyPatch,
-    value: str,
-    expected: bool,
 ) -> None:
     _set_required_minio_env(monkeypatch)
-    monkeypatch.setenv("MINIO_SECURE", value)
-    config = MinioConfig.from_env(use_dotenv=False)
-    assert config.secure is expected
+    monkeypatch.setenv("MINIO_CREATE_BUCKET_IF_MISSING", "true")
+    assert MinioConfig.from_env(use_dotenv=False).create_bucket_if_missing is True
 
 
-def test_from_env_raises_for_invalid_secure(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_from_env_defaults_create_bucket_if_missing_to_false_when_unset(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
     _set_required_minio_env(monkeypatch)
-    monkeypatch.setenv("MINIO_SECURE", "not-a-bool")
-    with pytest.raises(ValueError, match="MINIO_SECURE"):
-        MinioConfig.from_env(use_dotenv=False)
+    monkeypatch.delenv("MINIO_CREATE_BUCKET_IF_MISSING", raising=False)
+    config = MinioConfig.from_env(use_dotenv=False)
+    assert config.create_bucket_if_missing is False
 
 
 def test_from_env_raises_when_endpoint_missing(

tests/unit/redis_adapter_test.py

@@ -99,10 +99,21 @@ def test_connect_with_injected_client_raises_on_redis_error() -> None:
         adapter.connect()
 
 
-def test_connect_closes_existing_non_injected_client(
+def test_connect_with_injected_client_skips_validation_when_client_cleared() -> None:
+    mock_client = MagicMock(spec=redis.Redis)
+    adapter = RedisAdapter(config=TEST_REDIS_CONFIG, client=mock_client)
+    adapter.disconnect()
+
+    adapter.connect()
+
+    mock_client.ping.assert_not_called()
+
+
+def test_connect_reconnects_when_existing_client_unhealthy(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
     stale_client = MagicMock(spec=redis.Redis)
+    stale_client.ping.side_effect = redis.ConnectionError("connection lost")
     new_client = MagicMock(spec=redis.Redis)
     new_client.ping.return_value = True
     adapter = RedisAdapter(config=TEST_REDIS_CONFIG)
@@ -114,3 +125,71 @@ def test_connect_closes_existing_non_injected_client(
 
     stale_client.close.assert_called_once()
     assert adapter._client is new_client
+
+
+def test_connect_skips_reconnect_when_already_connected(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    stale_client = MagicMock(spec=redis.Redis)
+    stale_client.ping.return_value = True
+    adapter = RedisAdapter(config=TEST_REDIS_CONFIG)
+    adapter._client = stale_client
+
+    from_url = MagicMock()
+    monkeypatch.setattr("redis.Redis.from_url", from_url)
+
+    adapter.connect()
+
+    stale_client.close.assert_not_called()
+    from_url.assert_not_called()
+    assert adapter._client is stale_client
+
+
+def test_scan_keys_yields_decoded_keys() -> None:
+    mock_client = MagicMock(spec=redis.Redis)
+    mock_client.scan_iter.return_value = iter([b"key1", b"key2"])
+    adapter = RedisAdapter(config=TEST_REDIS_CONFIG, client=mock_client)
+
+    keys = list(adapter.scan_keys("key*"))
+
+    assert keys == ["key1", "key2"]
+    mock_client.scan_iter.assert_called_once_with(match="key*")
+    mock_client.keys.assert_not_called()
+
+
+def test_scan_keys_forwards_count() -> None:
+    mock_client = MagicMock(spec=redis.Redis)
+    mock_client.scan_iter.return_value = iter([b"key1"])
+    adapter = RedisAdapter(config=TEST_REDIS_CONFIG, client=mock_client)
+
+    keys = list(adapter.scan_keys("key*", count=50))
+
+    assert keys == ["key1"]
+    mock_client.scan_iter.assert_called_once_with(match="key*", count=50)
+
+
+def test_list_keys_raises_value_error_on_invalid_pattern() -> None:
+    mock_client = MagicMock(spec=redis.Redis)
+    adapter = RedisAdapter(config=TEST_REDIS_CONFIG, client=mock_client)
+
+    invalid_patterns = ["", 123, None]
+    for pattern in invalid_patterns:
+        with pytest.raises(ValueError, match="Pattern must be a non-empty string"):
+            adapter.list_keys(pattern)  # type: ignore[arg-type]
+
+
+def test_scan_keys_raises_value_error_on_invalid_pattern() -> None:
+    mock_client = MagicMock(spec=redis.Redis)
+    adapter = RedisAdapter(config=TEST_REDIS_CONFIG, client=mock_client)
+
+    invalid_patterns = ["", 123, None]
+    for pattern in invalid_patterns:
+        with pytest.raises(ValueError, match="Pattern must be a non-empty string"):
+            list(adapter.scan_keys(pattern))  # type: ignore[arg-type]
+
+
+def test_scan_keys_raises_connection_error_when_not_connected() -> None:
+    adapter = RedisAdapter(config=TEST_REDIS_CONFIG)
+
+    with pytest.raises(ConnectionError):
+        list(adapter.scan_keys("key*"))

uv.lock

@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 2
 requires-python = ">=3.12"
 resolution-markers = [
     "python_full_version >= '3.15'",
@@ -1056,7 +1056,7 @@ wheels = [
 
 [[package]]
 name = "python-repositories"
-version = "0.5.1"
+version = "2.0.3"
 source = { editable = "." }
 dependencies = [
     { name = "python-dotenv" },