feat(gen-shacl): translate class-level boolean expressions to SHACL logical constraints

.github/scripts/check_links.py

@@ -52,6 +52,8 @@
     "snomed.info",
     # LinkML metamodel - w3id redirects to linkml.io/linkml-model which may have issues
     "w3id.org",
+    # Certificate expired Sep/24/2026
+    "datashapes.org",
 }
 
 

.github/workflows/check-external-links.yaml

@@ -28,7 +28,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           version: ${{ env.UV_VERSION }}
 

.github/workflows/dependency-audit.yaml

@@ -38,7 +38,7 @@ jobs:
 
       # Pin uv to a known-good, recent release.
       - name: Install uv and setup uv caching
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           version: ${{ env.UV_VERSION }}
           enable-cache: true
@@ -56,7 +56,10 @@ jobs:
       #
       # So gate the audit on whether the change actually altered dependencies,
       # relative to each event's natural base:
-      #   * pull_request -> the PR base
+      #   * pull_request -> the base the checked-out merge commit was built on
+      #     (HEAD^1). Not github.event.pull_request.base.sha: that can be an
+      #     older main commit, so the diff would include main's own uv.lock
+      #     bumps and audit a PR that changed no dependencies.
       #   * push (main)  -> the commit before the push (github.event.before)
       #   * merge_group  -> the queue base
       #   * otherwise (workflow_dispatch, first/force push) -> audit
@@ -78,7 +81,7 @@ jobs:
         run: |
           set -euo pipefail
           case "${{ github.event_name }}" in
-            pull_request) base="${{ github.event.pull_request.base.sha }}" ;;
+            pull_request) base="$(git rev-parse HEAD^1)" ;;
             merge_group)  base="${{ github.event.merge_group.base_sha }}" ;;
             push)         base="${{ github.event.before }}" ;;
             *)            base="" ;;

.github/workflows/doc-pages.yaml

@@ -24,7 +24,7 @@ jobs:
           git fetch upstream --tags
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           version: ${{ env.UV_VERSION }}
           enable-cache: true

.github/workflows/docker-build.yaml

@@ -48,10 +48,10 @@ jobs:
           echo "Ref: ${{ github.ref }}"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@v4.4.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.3.0
+        uses: docker/setup-buildx-action@v4.4.1
 
       - name: Login to DockerHub
         if: startsWith(github.ref, 'refs/tags/v')
@@ -61,7 +61,7 @@ jobs:
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@v7.3.0
+        uses: docker/build-push-action@v7.4.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64/v8

.github/workflows/docs-test.yaml

@@ -36,7 +36,7 @@ jobs:
           git fetch upstream --tags
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           version: ${{ env.UV_VERSION }}
           enable-cache: true

.github/workflows/main.yaml

@@ -24,7 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           version: ${{ env.UV_VERSION }}
 
@@ -76,7 +76,7 @@ jobs:
           git fetch upstream --tags
 
       - name: Install uv and setup uv caching
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           version: ${{ env.UV_VERSION }}
           enable-cache: true
@@ -105,7 +105,7 @@ jobs:
         shell: bash
       - name: Upload linkml coverage report
         if: github.repository == 'linkml/linkml' && github.actor != 'dependabot[bot]'
-        uses: codecov/codecov-action@v7.0.0
+        uses: codecov/codecov-action@v7.1.1
         with:
           name: codecov-linkml-${{ matrix.os }}-${{ matrix.python-version }}
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -114,7 +114,7 @@ jobs:
           fail_ci_if_error: true
       - name: Upload runtime coverage report
         if: github.repository == 'linkml/linkml' && github.actor != 'dependabot[bot]'
-        uses: codecov/codecov-action@v7.0.0
+        uses: codecov/codecov-action@v7.1.1
         with:
           name: codecov-runtime-${{ matrix.os }}-${{ matrix.python-version }}
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -139,7 +139,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v7
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           version: ${{ env.UV_VERSION }}
           enable-cache: true
@@ -160,7 +160,7 @@ jobs:
           uv run coverage report -m
       - name: Upload linkml slow test coverage
         if: github.repository == 'linkml/linkml' && github.actor != 'dependabot[bot]'
-        uses: codecov/codecov-action@v7.0.0
+        uses: codecov/codecov-action@v7.1.1
         with:
           name: codecov-linkml-slow-${{ matrix.os }}-${{ matrix.python-version }}
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -189,7 +189,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v7
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           version: ${{ env.UV_VERSION }}
           enable-cache: true
@@ -207,7 +207,7 @@ jobs:
           uv run pytest tests/linkml/test_notebooks/ -m "not kroki" --cov --cov-report xml:coverage-notebooks.xml --cov-report term-missing
       - name: Upload notebook coverage
         if: github.repository == 'linkml/linkml' && github.actor != 'dependabot[bot]'
-        uses: codecov/codecov-action@v7.0.0
+        uses: codecov/codecov-action@v7.1.1
         with:
           name: codecov-notebooks-${{ matrix.os }}-${{ matrix.python-version }}
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -232,7 +232,7 @@ jobs:
           python-version: 3.13
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           version: ${{ env.UV_VERSION }}
       - name: Build source and wheel archives

.github/workflows/metamodel-compat.yaml

@@ -27,7 +27,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           version: ${{ env.UV_VERSION }}
           enable-cache: true

.github/workflows/pypi-publish.yaml

@@ -23,7 +23,7 @@ jobs:
         python-version: 3.13
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.0.1
+      uses: astral-sh/setup-uv@v10.2.0
       with:
         version: ${{ env.UV_VERSION }}
 

.github/workflows/rustgen.yaml

@@ -34,7 +34,7 @@ jobs:
           git fetch upstream --tags
 
       - name: Install uv and setup uv caching
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           version: ${{ env.UV_VERSION }}
           enable-cache: true
@@ -63,7 +63,7 @@ jobs:
 
       - name: Upload coverage report
         if: github.repository == 'linkml/linkml' && github.actor != 'dependabot[bot]'
-        uses: codecov/codecov-action@v7.0.0
+        uses: codecov/codecov-action@v7.1.1
         with:
           name: codecov-results-rustgen
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/typedb-integration.yaml

@@ -31,7 +31,7 @@ jobs:
           --health-start-period 30s
     steps:
       - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
       - uses: actions/setup-python@v7.0.0
         with:
           python-version: "3.12"

.github/workflows/update-feature-dashboard.yaml

@@ -32,7 +32,7 @@ jobs:
           git fetch upstream --tags
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           version: ${{ env.UV_VERSION }}
           enable-cache: true

docs/generators/openapi.rst

@@ -2,8 +2,9 @@ OpenAPI
 =======
 
 `OpenAPI <https://www.openapis.org/>`_ is a specification for describing
-RESTful HTTP APIs. The OpenAPI generator produces an OpenAPI v3.0.3
-specification in YAML from a LinkML schema.
+RESTful HTTP APIs. The OpenAPI generator produces an OpenAPI
+specification in YAML from a LinkML schema. As of now it supports OpenAPI
+specification versions v3.0.3 and v3.1.0.
 
 .. note:: This generator produces a complete OpenAPI spec by combining a
           user-provided *template* (containing the API header, endpoints, and
@@ -15,15 +16,16 @@ Overview
 
 The generator works in two stages:
 
-1. The user provides an **OpenAPI template** — a valid OpenAPI v3.0.3 YAML
+1. The user provides an **OpenAPI template** — a valid OpenAPI YAML
    file that defines the API metadata (title, version, servers), paths
-   (endpoints), and security schemes.
+   (endpoints), and security schemes. It also specifies the version of
+   the OpenAPI specification in its top-level attribute `openapi`.
 2. The generator fills the ``components/schemas`` section with JSON Schema
    definitions generated from the LinkML schema, keeping only those classes
    that are transitively reachable from the endpoints.
 
 Both the input template and the final output are automatically validated
-against the OpenAPI 3.0.3 specification using
+against the corresponding OpenAPI specification version using
 `openapi-spec-validator <https://github.com/p1c2u/openapi-spec-validator>`_.
 
 To run:
@@ -32,6 +34,9 @@ To run:
 
    gen-openapi personinfo.yaml --template api-template.yaml > personinfo.openapi.yaml
 
+The **template's top-level attribute `openapi` MUST specify the supported OpenAPI
+version**.
+
 The ``--template`` / ``-t`` option is required when generating a concrete
 specification. If omitted, the generator prints a generic template that can
 be used as a starting point:
@@ -47,14 +52,8 @@ The generator validates both the input template and the final output against
 the OpenAPI specification using
 `openapi-spec-validator <https://github.com/p1c2u/openapi-spec-validator>`_.
 
-The ``openapi`` field in the template is checked against the expected
-version for the chosen output format (currently ``openapi303`` →
-``3.0.3``). If the versions do not match, the generator raises a
-``ValueError``.
-
-Additionally, the template's ``components/schemas`` section must declare each
-resource that is referenced by an endpoint, using two custom extension
-fields:
+The template's ``components/schemas`` section must declare each resource
+that is referenced by an endpoint, using two custom extension fields:
 
 ``x-linkml-schema``
    The ``id`` of the LinkML schema being used. Must match exactly.

docs/generators/shacl.rst

@@ -84,6 +84,88 @@ Example Output:
         shacl:targetClass <https://w3id.org/linkml/tests/kitchen_sink/Person> .
 
 
+Class Expressions
+^^^^^^^^^^^^^^^^^
+
+Class-level boolean expressions become the SHACL logical constraint components
+their metamodel definitions map to (`SHACL §4.6
+<https://www.w3.org/TR/shacl/#core-components-logical>`__):
+
+==================  =====================================================
+LinkML              SHACL, on the class's ``sh:NodeShape``
+==================  =====================================================
+``any_of``          ``sh:or`` over the member shapes
+``all_of``          ``sh:and`` over the member shapes
+``exactly_one_of``  ``sh:xone`` over the member shapes
+``none_of``         one ``sh:not`` per member
+==================  =====================================================
+
+Each member becomes an anonymous node shape. ``is_a`` gives ``sh:class``, and
+nested expressions recurse. Each entry of ``slot_conditions`` gives an
+``sh:property`` whose path is that of the slot as induced for the class, so
+``slot_usage`` applies:
+
+* ``required``, ``value_presence`` and the cardinalities give ``sh:minCount`` /
+  ``sh:maxCount``;
+* ``minimum_value`` / ``maximum_value`` give ``sh:minInclusive`` /
+  ``sh:maxInclusive``, and ``equals_number`` gives both, so that ``5`` also
+  matches ``5.0``;
+* ``pattern`` gives ``sh:pattern``;
+* ``equals_string`` and ``equals_string_in`` give ``sh:in``; on an enum slot the
+  values are the permissible values as the enum renders them, the IRI of their
+  ``meaning`` where they have one;
+* ``range`` gives the same class, type or enum constraint as a slot's range.
+
+SHACL allows ``sh:minInclusive``, ``sh:maxInclusive``, ``sh:in`` and
+``sh:pattern`` at most once per shape. Where one condition needs one of them
+twice, for example ``minimum_value`` next to ``equals_number``, the second value
+goes into an ``sh:and`` member of the property shape, where it applies to the
+same values.
+
+A slot condition constrains only the values that are present, so it also holds
+when the slot is absent - unless ``required: true``, ``value_presence: PRESENT``
+or a minimum or exact cardinality of at least 1 requires the slot. Inside
+``none_of``, at any depth, a condition that constrains values requires the slot,
+so that an absent slot is not rejected by the negation - unless the condition
+decides presence itself, through ``required``, ``value_presence`` or a maximum
+or exact cardinality of 0. The JSON Schema generator requires the slot in a
+class's own ``none_of`` for every condition that sets neither ``required`` nor
+``value_presence``.
+
+.. code-block:: yaml
+
+  GeodeticReferenceSystem:
+    slots: [code, name]
+    any_of:
+      - slot_conditions:
+          code:
+            required: true
+      - slot_conditions:
+          name:
+            required: true
+
+.. code-block:: turtle
+
+    ex:GeodeticReferenceSystem a sh:NodeShape ;
+        sh:or ( [ sh:property [ sh:path ex:code ; sh:minCount 1 ] ]
+                [ sh:property [ sh:path ex:name ; sh:minCount 1 ] ] ) ;
+        ...
+
+An expression is attached to the shape of the class that declares it. Like
+every ``sh:targetClass``, it reaches instances of subclasses where the data
+graph states the ``rdfs:subClassOf`` (`SHACL §2.1.3.2
+<https://www.w3.org/TR/shacl/#targetClass>`__); the ``sh:class`` that ``is_a``
+gives recognises instances of subclasses the same way, as it does for a slot's
+range.
+
+An operator whose members use anything else is skipped as a whole and logged as
+a warning, because leaving out one member would change what the operator
+admits. That covers, for example, ``has_member`` or a slot-level ``any_of``
+inside a slot condition, a condition on a name that is not a slot, a condition
+on the identifier slot (the node's IRI rather than a property), and
+``equals_string`` on a slot whose range does not hold strings.
+
+
 Command Line
 ^^^^^^^^^^^^
 

examples/tutorial/tutorial01/personinfo.json

@@ -1,7 +1,7 @@
 {
     "$defs": {
         "Person": {
-            "additionalProperties": true,
+            "additionalProperties": false,
             "description": "",
             "properties": {
                 "age": {