active_sanction 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 63d579349c5ed0f731edbb3811cea143c2a1bdf7f591b319fb290ab6fb28c8c6
-  data.tar.gz: e6ad0e3c72fdca696dc2d9e2e1d528a4a43e638054362f1ebf0931def9b309c8
+  metadata.gz: b6c9a31bd72dfdc43d5614499a19aab837b55996b9644ae145b89da18b93bea6
+  data.tar.gz: 40cbea7b7fcf458307171ca953fb61864dce06da7733ece2ac17e4d27a43215d
 SHA512:
-  metadata.gz: '086eb3b75aa22d1cf3b976b269f28f49a0b5a734a22bba52f0a25119125042c40d41a35fc25b694069814d7f3d4e24426e51ef5da15f5d91f24c33519eff97f4'
-  data.tar.gz: d5cf18bc582c46e84b1255328e5a8411bb6e35c5444c8660c2687b7be5621411333f0d3a782fd352ad0963ab96e72ed93f1abd3fb7349bccc073f4f02e2e4452
+  metadata.gz: 892209a20496c2eea1185776a83725cb89ae6c7b40ba2385becf7870b78d8e1a6cf88734e29afec40153418dfa73ac275a3270b0bb16a80e56c3de6605e58652
+  data.tar.gz: e3330620e4c4f6c31c6a7e0c58b53bda9972628e9d6965798d56f666f7301b83ccc2edb42931d15b18b161c9480df96b5147edf0e94b77461e90e0958944ed46

data/CHANGELOG.md

@@ -13,6 +13,71 @@ algorithms or the scorer could move a score. **A change that moves `MATCHER_VERS
 called out here as such**, because it is the one kind of change that alters what a past
 screening decision would come out as today.
 
+## [Unreleased]
+
+Nothing yet.
+
+## [1.0.1] - 2026-09-14
+
+A packaging and release-tooling release. **Nothing about screening changes**: no behaviour
+in `lib/` moved, `MATCHER_VERSION` is unchanged at `1`, and a name scores today exactly what
+it scored under 1.0.0.
+
+### Added
+
+- **Releases publish themselves from a tag**, through
+  [`.github/workflows/release.yml`](.github/workflows/release.yml). Pushing `v1.2.3` re-runs
+  the three gates against the tagged tree, checks that the tag and `VERSION` agree, that the
+  tag is an ancestor of `main` and that the changelog has a section for it, then builds the
+  gem, publishes it and writes the GitHub release from that section. A tag failing any of
+  those publishes nothing.
+
+  **No API key exists to leak.** It authenticates by
+  [trusted publishing](https://guides.rubygems.org/trusted-publishing): a short-lived OIDC
+  token, verified by rubygems.org as naming this repository and this workflow file, exchanged
+  for a credential that expires with the job. The alternative is a long-lived key in a public
+  repository's settings, one leak away from someone else publishing under this gem's name --
+  and unlike a bad deploy, a bad gem is already installed by the time anyone could be warned.
+  Same reasoning that keeps a service-account key out of the documentation deploy.
+
+  The gem pushed is the gem that was verified, carried between the two jobs as an artifact
+  rather than rebuilt -- a second build is a second thing, however identical it looks.
+
+  **The publish is confirmed against rubygems.org** (#136), because `gem push` exiting 0 says
+  the upload was accepted rather than that a `bundle install` will find the version. The job
+  that writes the GitHub release waits on that confirmation, so a version rubygems.org did not
+  end up serving is never announced.
+
+- **A gem badge on the README** (#136), read live from rubygems.org rather than generated into
+  a file. What it states is what is installable, which is a different question from what was
+  last tagged -- and a version written into the repository would be stale the moment the next
+  one published. Same argument as #104, applied to the one fact about this gem that lives
+  somewhere else entirely.
+
+- **A release can be cut from the Actions tab**, without tagging by hand (#139). The
+  workflow's "Run workflow" button takes a tag and a checkbox: ticked, it runs every gate
+  against `main` and writes the tag only once they have all passed. That is the safer order
+  than `git tag && git push`, which makes a tag public before anything has checked the tree
+  under it — and this workflow will not move a tag somebody may already have fetched, so the
+  repair for that is a new version number. A tag it writes is annotated but unsigned; push
+  the tag yourself when you want your own signature on it. See
+  [`CONTRIBUTING.md`](CONTRIBUTING.md#releasing).
+
+### Fixed
+
+- **`rake canary:refresh` regenerates the catalogue page's data as well as the baselines.**
+  `site/src/data/sources.json` is derived from `.github/baselines` (#104), so accepting new
+  numbers without rebuilding it left the two disagreeing and
+  [`spec/site_sources_data_spec.rb`](spec/site_sources_data_spec.rb) red. The rolling
+  baseline pull request the canary opens had failed on this every run since it started
+  opening one, on all six Rubies. Chained onto the task rather than added as a step to each
+  caller: a derived file that callers have to remember to rebuild is stale by the third
+  caller.
+
+- **The canary signs its baseline commit off.** Nothing exempts a bot from
+  [`.github/workflows/dco.yml`](.github/workflows/dco.yml), which skips merge commits and
+  nothing else, so the rolling pull request failed the DCO check as well.
+
 ## [1.0.0] - 2026-09-13
 
 The first release. Everything below is in it.
@@ -535,4 +600,6 @@ summarized here because they are what a reader of a first release most needs:
 - Recall at the default threshold is 0.939 overall on the labeled set, and every record this
   version misses is named in the committed accuracy report.
 
+[Unreleased]: https://github.com/Babystep-Technologies/active_sanction/compare/v1.0.1...main
+[1.0.1]: https://github.com/Babystep-Technologies/active_sanction/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/Babystep-Technologies/active_sanction/releases/tag/v1.0.0

data/CONTRIBUTING.md

@@ -232,11 +232,75 @@ comment restating the name would be noise.
 
 ## Releasing
 
-`bundle exec rake install` installs the gem locally. A release is: bump
-`VERSION` in [`lib/active_sanction/version.rb`](lib/active_sanction/version.rb),
-move the `Unreleased` section of [`CHANGELOG.md`](CHANGELOG.md) under the new
-version with its date, then `bundle exec rake release`, which tags, pushes
-and publishes to [rubygems.org](https://rubygems.org).
+`bundle exec rake install` installs the gem locally.
+
+A release is a tag. Bump `VERSION` in
+[`lib/active_sanction/version.rb`](lib/active_sanction/version.rb), move the
+`Unreleased` section of [`CHANGELOG.md`](CHANGELOG.md) under the new version
+with its date, and merge that.
+
+Then the tag, which you can let the workflow write or write yourself.
+
+**From the Actions tab**, which is the shorter path and the safer order. Open
+[`Release`](https://github.com/Babystep-Technologies/active_sanction/actions/workflows/release.yml),
+press **Run workflow**, enter `v1.2.3`, and tick **Create the tag on main**.
+Every gate runs against `main` first, and the tag is written only once they
+have all passed — so a release that turns out not to be publishable leaves no
+tag behind.
+
+**Or from a terminal**, which is the path to take when you want your own
+signature on the tag:
+
+    $ git tag -s v1.2.3 -m "Release 1.2.3"
+    $ git push origin v1.2.3
+
+The cost of that order is that the tag is public before anything has checked
+the tree under it. If a gate then fails, the tag stays where it is: this
+workflow will not move a tag somebody may already have fetched, so the repair
+is a new version rather than a retagged one.
+
+Either way, [`.github/workflows/release.yml`](.github/workflows/release.yml)
+does the rest. It re-runs the three gates against the tree being released,
+checks that the tag and `VERSION` agree, that the commit is on `main`, and
+that the changelog has a section for it — then builds the gem, publishes it to
+[rubygems.org](https://rubygems.org), confirms rubygems.org is serving that
+version, and writes the GitHub release from that changelog section. A release
+that fails any of those checks publishes nothing, and a push rubygems.org did
+not end up serving is never announced (#136).
+
+**Leave the box unticked to re-run a publish.** A dispatch with `Create the
+tag` unticked publishes a tag that already exists — one pushed before this
+workflow did, or one whose publish failed after the tag was public — and
+nothing in this workflow ever moves or deletes a tag. Ticking the box against
+a tag that already exists is not an error either; it publishes that tag and
+says it created nothing.
+
+**A tag the workflow writes is annotated but not signed.** It has no key of
+yours, and signing with a machine key would say less than saying nothing. The
+tag names the commit every gate ran against, and the provenance that matters
+for what users install is on the other side: the gem is published by [trusted
+publishing](https://guides.rubygems.org/trusted-publishing) from this
+repository and this workflow file. Sign the tag yourself, with the terminal
+path above, when you want the tag to carry it too.
+
+The [gem badge](https://rubygems.org/gems/active_sanction) at the top of the
+README reads from rubygems.org rather than from anything in this repository,
+so it states what is installable rather than what was last tagged.
+
+**Nobody needs a RubyGems API key, including the person tagging.** The
+workflow authenticates by [trusted
+publishing](https://guides.rubygems.org/trusted-publishing): it mints a
+short-lived OIDC token, rubygems.org verifies the token names this repository
+and this workflow file, and hands back a credential that expires with the job.
+There is no publishing secret in this repository's settings, for the same
+reason there is no service-account key for the documentation deploy. It is
+configured once, on rubygems.org, under the gem's **Trusted Publishers**:
+owner `Babystep-Technologies`, repository `active_sanction`, workflow
+`release.yml`, environment `rubygems`.
+
+`bundle exec rake release` — the manual path that tags, pushes and publishes
+in one step — still exists and still works for anyone with push rights to the
+gem. It is not how this gem is released, and using it skips every check above.
 
 `MATCHER_VERSION` in the same file is bumped on a different occasion and for
 a different reason — whenever a change to the normalizer, the index, the

data/README.md

@@ -4,6 +4,7 @@
 
 # ActiveSanction
 
+[![Gem](https://img.shields.io/gem/v/active_sanction?label=gem&color=CC342D)](https://rubygems.org/gems/active_sanction)
 [![CI](https://github.com/Babystep-Technologies/active_sanction/actions/workflows/ci.yml/badge.svg)](https://github.com/Babystep-Technologies/active_sanction/actions/workflows/ci.yml)
 
 **[Full documentation, guides and the source catalogue →](https://babystep.tech/active_sanction/)**

data/lib/active_sanction/storage/meta.rb

@@ -110,6 +110,24 @@ module ActiveSanction
       # per source: a list that failed to refresh keeps its previous snapshot,
       # which is the right call and only safe if the age of what is being
       # screened against is visible.
+      #
+      # **Accurate to a second, and never fewer than the seconds that have
+      # passed.** `fetched_at` is stored to the second -- Snapshot#time!
+      # truncates it, so that a stored snapshot reloads equal to the one that
+      # was written -- so the instant of the fetch is known only to lie
+      # somewhere inside the second this names. What comes back is therefore
+      # the largest age consistent with what was recorded, which is the
+      # direction a staleness measure has to err in: an answer that is at most
+      # a second pessimistic is a report that nobody acts on, and one that is
+      # optimistic is a list being screened against that is older than it
+      # claims.
+      #
+      # The practical consequence, and the reason it is written down: a list
+      # fetched microseconds ago reports 0 or 1, according to whether the run
+      # crossed a second boundary on its way here. Both mean "just fetched" --
+      # see Sync::Result#age_in_words, which is what a summary table shows --
+      # and nothing should assert on the exact number of a fresh sync, because
+      # that is a fact about the clock rather than about this library.
       sig { params(now: Time).returns(Integer) }
       def age(now = Time.now) = now.to_i - fetched_at.to_i
 

data/lib/active_sanction/version.rb

@@ -6,7 +6,7 @@ module ActiveSanction
   # new source adapter, a storage fix or a documentation release -- none of
   # which change what a name scores. MATCHER_VERSION, below, is the one that
   # answers that question.
-  VERSION = "1.0.0"
+  VERSION = "1.0.1"
 
   # Which matching pipeline scored a decision, stamped onto every MatchResult
   # and bumped whenever a change to the normalizer, the index, the similarity

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: active_sanction
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Marshall Shen
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-13 00:00:00.000000000 Z
+date: 2026-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: csv