Skip to content

ci: validate release artifacts and guard GitHub publication - #62

Merged
AlexMarinescu merged 12 commits into
masterfrom
release/phase5b-ci
Oct 10, 2026
Merged

AlexMarinescu merged 12 commits into
masterfrom
release/phase5b-ci

Conversation

@AlexMarinescu

@AlexMarinescu AlexMarinescu commented Oct 10, 2026 •

Copy link
Copy Markdown
Owner

Summary

Prepare GitHub-first gem 1.0.0 release automation with a 15-job CPython 3.10–3.14 Linux, macOS and Windows matrix. Publication remains separately authorized and disabled by default.

Changes

  • Reuse packaging checks through a portable CI harness; verify wheel/sdist contents, installation, metadata and strict Twine validation.
  • Pin Actions, restrict permissions, and run strict documentation checks before Pages deployment.
  • Add manual candidate validation and protected GitHub publication guards that reuse exact verified assets, check source/run provenance and remote tag binding, and refuse overwrites.
  • Add 70 deterministic safeguard tests, including eight artifact-tampering cases, separate from mathematical regressions.
  • Document GitHub installation, protected review, artifact retention, release prerequisites and deferred PyPI authority.

Runtime mathematics, packaging metadata, dependencies and reference assertions are unchanged.

Verification

At implementation commit 0e085b4bfd532935bb1267bb3eae95f04de3ed15, all five Linux and all five macOS jobs passed 4,036 tests each. All five Windows jobs passed 4,035 and failed the same strict showcase JSON comparison: a generated value of 0.8660254037844389 differs from the committed 0.8660254037844387. Zero expected failures and zero skips on every platform. The assertion remains intact; this Windows reference blocker prevents release approval.

All 15 jobs passed wheel and sdist installation, metadata, mathematical smoke tests, 268 API declarations and 43 executable documentation examples: 30 isolated installations. Five local interpreter suites also passed all 4,036 tests. Strict MkDocs/site checks, workflow policy checks and Actionlint passed. Final commit adds the verification report only.

Hosted package results · Documentation results · Verification report

Real protected master dispatch remains unexecuted; server protection configuration requires maintainer verification. PyPI authority remains unverified and blocks PyPI only. No tags, releases, package uploads or Wiki writes were performed.

Assisted by OpenAI Codex.

Alex M added 12 commits October 10, 2026 01:34
Add guarded GitHub-first release preparation and artifact integrity checks. Keep PyPI publication disabled.

Assisted-by: OpenAI Codex
Include prepared release notes in strict documentation navigation.

Assisted-by: OpenAI Codex
Use LF checkouts, POSIX Git paths, byte-exact fixtures and platform CPU identification. Preserve existing assertions and scope fingerprints.

Assisted-by: OpenAI Codex
Mock release mutation while checking exact assets and commit targeting.

Assisted-by: OpenAI Codex
Keep missing benchmark metadata distinct from platforms without affinity support.

Assisted-by: OpenAI Codex
Refuse mismatched remote tags and atomically create missing refs only in authorized publication mode.

Assisted-by: OpenAI Codex
Continue independent artifact checks while keeping failed suites a hard candidate gate.

Assisted-by: OpenAI Codex
Preserve documentation coverage and exact package-content checks across locales.

Assisted-by: OpenAI Codex
Keep isolated Windows documentation checks independent of the console locale.

Assisted-by: OpenAI Codex
@AlexMarinescu AlexMarinescu changed the title ci: validate release candidates and guard GitHub publication ci: validate release artifacts and guard GitHub publication Oct 10, 2026
@AlexMarinescu
AlexMarinescu marked this pull request as ready for review October 10, 2026 02:04
@AlexMarinescu
AlexMarinescu merged commit a21273c into master Oct 10, 2026
11 of 16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant