OperonDBS 0.8.3__tar.gz → 0.8.4__tar.gz

{operondbs-0.8.3 → operondbs-0.8.4}/.github/workflows/publish.yml

@@ -8,7 +8,46 @@ permissions:
   contents: read
 
 jobs:
+  verify-release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.release.tag_name }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - run: python -m pip install --upgrade pip pyyaml
+      - name: The tagged commit passed its own CI run
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          sha=$(git rev-parse HEAD)
+          conclusion=$(gh api \
+            "repos/${{ github.repository }}/actions/workflows/test.yml/runs?head_sha=$sha&per_page=1" \
+            --jq '.workflow_runs[0].conclusion // "no run"')
+          echo "$RELEASE_TAG -> $sha: test.yml concluded '$conclusion'"
+          if [ "$conclusion" != "success" ]; then
+            echo "::error::test.yml on $sha concluded '$conclusion'; rerun it (gh run rerun) before releasing"
+            exit 1
+          fi
+      - name: Import the maintainer's published GPG key
+        run: |
+          curl -sSL "https://github.com/${{ github.repository_owner }}.gpg" | gpg --import
+          gpg --list-keys --with-colons | grep '^pub' | wc -l
+      - name: Release preflight
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: scripts/release-preflight.sh --ci --tag "$RELEASE_TAG"
+
   source-distribution:
+    needs: verify-release
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -35,6 +74,7 @@ jobs:
           if-no-files-found: error
 
   documentation:
+    needs: verify-release
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -48,6 +88,7 @@ jobs:
           sphinx-build -W --keep-going -b html docs/zh docs/_build/zh/html
 
   wheels:
+    needs: verify-release
     strategy:
       fail-fast: false
       matrix:
@@ -86,7 +127,7 @@ jobs:
           if-no-files-found: error
 
   pypi-publish:
-    needs: [source-distribution, wheels]
+    needs: [verify-release, source-distribution, wheels]
     runs-on: ubuntu-latest
     environment:
       name: pypi

{operondbs-0.8.3 → operondbs-0.8.4}/AGENTS.md

@@ -26,7 +26,7 @@ principle-to-implementation mapping.
 
 Current version markers (must stay consistent across code and docs):
 
-- `operon` 0.8.3 (`pyproject.toml`)
+- `operon` 0.8.4 (`pyproject.toml`)
 - database schema 2.11 (`operon/database.py`, `SCHEMA_VERSION`)
 - metadata schema 1.4 (`operon/schema.py`, `METADATA_SCHEMA_VERSION`)
 
@@ -171,10 +171,11 @@ The project is licensed AGPL-3.0-or-later (`LICENSE` at the repo root).
 - `benchmarks/` — representative entity sets for QC performance diagnostics
   (see `docs/*/operations/qc-performance.md`).
 - `scripts/` — local developer tooling; `setup-test-matrix.sh` and
-  `run-test-matrix.sh` build and drive the uv-managed Python 3.10–3.14
+  `run-test-matrix.sh` build and drive the uv-managed Python 3.10–3.15
   matrix under .matrix/ (see `docs/*/contributor/development-testing.md`);
-  `defects.sh` appends to and queries the defect registry (`defects.yml`,
-  see "Defect reports" below).
+  `release-preflight.sh` is the release gate and the script the publish
+  workflow runs on the tag; `defects.sh` appends to and queries the defect
+  registry (`defects.yml`, see "Defect reports" below).
 
 ## Setup, test, and build
 
@@ -193,7 +194,13 @@ python -m pytest tests/unit         # by category: unit / integration /
 
 python -m pytest --lf -q --no-cov   # iterate: last failures, no coverage
 python -m pytest -n 4 --dist loadfile   # parallel full suite (xdist, in the dev/test extras)
-scripts/run-test-matrix.sh          # whole suite on 3.10-3.15 concurrently
+scripts/setup-test-matrix.sh        # once per machine: uv-managed 3.10-3.15 venvs
+scripts/run-test-matrix.sh          # whole suite on 3.10-3.15, in waves
+                                    # (MATRIX_CONCURRENCY / MATRIX_JOBS override the split)
+scripts/release-preflight.sh        # the release gate: version, full suite, both doc
+                                    # trees, defect registry, matrix evidence for HEAD;
+                                    # --run-matrix runs the matrix inside the gate, and
+                                    # --tag vX.Y.Z asserts the tag's name/signature/target
 
 python setup.py build_ext --inplace # rebuild only the Cython extension
 
@@ -205,14 +212,19 @@ Run the relevant test category after any change; run the full suite before
 considering work done.
 
 CI (`.github/workflows/test.yml`) runs pytest on Python 3.10–3.15 and the strict
-Sphinx build. Releases are published exclusively to PyPI; see `docs/*/contributor/pypi-release.md`.
+Sphinx build. Releases are published exclusively to PyPI, and
+`.github/workflows/publish.yml` builds nothing and uploads nothing until its
+`verify-release` job has seen a `success` conclusion for the tagged commit's `test`
+run *and* a passing `scripts/release-preflight.sh --ci --tag <tag>`; see
+`docs/*/contributor/pypi-release.md`.
 
 The project uses `pytest-xdist` to parallel testing. Avoid sharing state between tests
 to prevent unexpected or random test results.
 
 > Running `python -m pytest` directly takes approx 35 seconds
-> (auto: 24 workers). Running the local test matrix takes 3 minutes
-> (6 jobs × 4 workers), or 4~5min (6 jobs × 2 workers in default).
+> (auto: 24 workers). Running the local test matrix takes about 5 minutes
+> (6 versions, 3 at a time × 7 workers by default; `MATRIX_CONCURRENCY` /
+> `MATRIX_JOBS` override the split).
 > 
 > Measured on Intel Core i7-13700HX (16c24t).
 
@@ -303,7 +315,7 @@ change:
   `docs/<language>/.readthedocs.yaml`, and the registry in
   `tests/unit/test_docs_projects.py`
 
-Version markers in docs (`operon` 0.8.3, database schema 2.11, metadata
+Version markers in docs (`operon` 0.8.4, database schema 2.11, metadata
 schema 1.4) must match `pyproject.toml` and the code. Do not write the
 current values literally in Markdown sources: use the `myst_substitutions`
 references `{{ operon_version }}`, `{{ db_schema }}`, and

{operondbs-0.8.3 → operondbs-0.8.4}/OperonDBS.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: OperonDBS
-Version: 0.8.3
+Version: 0.8.4
 Summary: Operon the Database System: Archive, Quality-Control, Organize, Analyze and Release Your Bio-Data
 Author-email: hyli360 <lihuanyu2003@gmail.com>
 License-Expression: AGPL-3.0-or-later

{operondbs-0.8.3 → operondbs-0.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: OperonDBS
-Version: 0.8.3
+Version: 0.8.4
 Summary: Operon the Database System: Archive, Quality-Control, Organize, Analyze and Release Your Bio-Data
 Author-email: hyli360 <lihuanyu2003@gmail.com>
 License-Expression: AGPL-3.0-or-later

{operondbs-0.8.3 → operondbs-0.8.4}/docs/en/contributor/development-testing.md

@@ -14,7 +14,8 @@ python -m pytest tests/integration
 python -m pytest tests/regression tests/compatibility
 
 # build the Sphinx documentation strictly
-sphinx-build -W --keep-going -b html docs docs/_build/html
+sphinx-build -W --keep-going -b html docs/en docs/_build/en/html
+sphinx-build -W --keep-going -b html docs/zh docs/_build/zh/html
 ```
 
 The pytest suite is organized into four categories — `unit`, `integration`, `regression`, `compatibility` — covering:
@@ -67,18 +68,30 @@ The full suite takes about seven minutes serially; the loop below aims to run it
    is assigned to only one worker, which is required for Textual UI testing.
    Coverages are the most resource-intensive: use `--no-cov` during iterations and run the test only once at the end.
 4. **Cross-version matrix in one pass.** `scripts/setup-test-matrix.sh` creates uv-managed CPython 3.10-3.15
-   interpreters plus one venv per version inside `.matrix/`. `scripts/run-test-matrix.sh` runs all six concurrently:
+   interpreters plus one venv per version inside `.matrix/`. `scripts/run-test-matrix.sh` runs them
+   `MATRIX_CONCURRENCY` at a time (three by default, so six versions go out as two waves) with
+   `MATRIX_JOBS` xdist workers each; the defaults split the machine's cores over the concurrent
+   versions and leave one core free:
 
    ```bash
-   scripts/setup-test-matrix.sh                      # once per machine
-   scripts/run-test-matrix.sh                        # whole suite, six versions, 2~3 minutes
-   scripts/run-test-matrix.sh tests/unit -x          # extra pytest arguments are forwarded
-   MATRIX_JOBS=4 scripts/run-test-matrix.sh          # workers per version
+   scripts/setup-test-matrix.sh                        # once per machine
+   scripts/run-test-matrix.sh                          # whole suite, six versions, ~5 min on 24 threads
+   scripts/run-test-matrix.sh tests/unit -x            # extra pytest arguments are forwarded
+   MATRIX_JOBS=4 scripts/run-test-matrix.sh            # xdist workers per version
+   MATRIX_CONCURRENCY=2 scripts/run-test-matrix.sh     # versions running at once
    ```
 
+   The matrix is six times one suite, so waves trade peak load and nothing else: the wall
+   clock follows the cores, not the grouping. What a Linux box cannot run is still CI's
+   half — `.github/workflows/test.yml` runs the same versions on macOS.
+
    Each version logs to `.matrix/logs/<version>.log`, so a failure there can be re-run
-   directly with that interpreter. The scripts work on Linux and macOS. `.matrix/` is
-   git-ignored.
+   directly with that interpreter; the directory is wiped before a run starts, so the
+   leftovers of an earlier one never pass for the current run, and a second run refuses
+   to start (exit 2) while one is in flight rather than wipe the files it is still
+   reporting from. The run also records the commit it tested in `.matrix/logs/head`,
+   which is how `scripts/release-preflight.sh` refuses matrix evidence that belongs to
+   another commit. The scripts work on Linux and macOS. `.matrix/` is git-ignored.
 5. **Platform-specific code cannot be verified by one matrix job alone.** Linux and macOS
    differ in the system utilities the environment probe calls and in `pathlib`/`resource`
    behaviour. Code guarded by `sys.platform`/`os.name`, or shelling out to system tools,
@@ -175,4 +188,4 @@ Software versions, database schema versions, and metadata schema versions stated
 {{ operon_version }}  {{ db_schema }}  {{ metadata_schema }}
 ```
 
-`docs/conf.py` resolves them from `pyproject.toml` and the code constants at build time. Substitutions expand in paragraph text only, not inside code spans or fenced code blocks; examples there use `<version>` placeholders instead. Intentional historical pins stay literal: they either live on the allowlisted era-pinned pages under `docs/*/operations/` or carry an inline `<!-- version-pin -->` marker. `tests/unit/test_docs_versions.py` enforces the rule.
+`docs/conf_common.py` resolves them from `pyproject.toml` and the code constants at build time. Substitutions expand in paragraph text only, not inside code spans or fenced code blocks; examples there use `<version>` placeholders instead. Intentional historical pins stay literal: they either live on the allowlisted era-pinned pages under `docs/*/operations/` or carry an inline `<!-- version-pin -->` marker. `tests/unit/test_docs_versions.py` enforces the rule.

{operondbs-0.8.3 → operondbs-0.8.4}/docs/en/contributor/pypi-release.md

@@ -16,6 +16,14 @@ It validates that the release tag is exactly `v<project.version>`, then builds:
 - CPython 3.10-3.14 macOS Intel wheels; and
 - CPython 3.10-3.14 macOS Apple Silicon wheels.
 
+A `verify-release` job runs before every other job, and they all need it: it
+checks out the release tag and refuses to continue unless the `test` workflow's run
+for that exact commit concluded `success` and `scripts/release-preflight.sh --ci
+--tag <tag>` passes. It imports the maintainer's published GPG key first, so the
+tag's signature is verified rather than merely present; without that key the gate
+reports the check as skipped instead of failed. A tag on a commit whose CI is red — or cancelled before it ran
+— therefore builds and uploads nothing.
+
 Each wheel is installed in an isolated test environment before upload. The
 test imports the compiled parser and invokes the CLI. The source distribution
 is checked with Twine. The final publish job cannot start until all artifacts
@@ -31,13 +39,23 @@ manual approval before the final upload.
 
 1. Update `[project].version`, plus `SCHEMA_VERSION` / `METADATA_SCHEMA_VERSION`
    in the code when they change. Documentation version markers render from
-   these single sources through `myst_substitutions` in `docs/conf.py`, so no
+   these single sources through `myst_substitutions` in `docs/conf_common.py`, so no
    manual sweep is needed; `tests/unit/test_docs_versions.py` rejects
    hardcoded current versions in the Markdown sources.
-2. Run the full pytest suite and strict documentation build.
+2. Run `scripts/release-preflight.sh` — the release gate in one command, one exit
+   code: the full pytest suite, the strict documentation build for both language
+   trees, the version in `pyproject.toml` against the installed metadata, the defect
+   registry (every record shipping in this version is `verified`, names a
+   `fix_commit`, and that commit is in the tree), and the cross-version matrix
+   evidence for the commit you are about to tag (`--run-matrix` runs the matrix as
+   part of the gate; `--tag vX.Y.Z` additionally asserts the created tag is
+   annotated, GPG-signed, named `v<version>`, and pointing at `HEAD`). Nothing about
+   a release depends on remembering the individual commands.
 3. Commit the release state and create tag `v<project.version>` on that exact
    commit. Never reuse a tag that points to older package metadata.
-4. Wait for the `deploy` workflow on the tagged commit to pass.
+4. Wait for the `test` workflow on the tagged commit to pass. The publish
+   workflow refuses to build or upload while that run is missing, cancelled, or red;
+   give such a commit its own run with `gh run rerun <run-id>` and publish again.
 5. Create a GitHub Release from that tag, initially as a draft if release notes
    still need review, then publish it.
 6. Verify the files and metadata on the `OperonDBS` PyPI project page.

{operondbs-0.8.3 → operondbs-0.8.4}/docs/zh/contributor/development-testing.md

@@ -13,7 +13,8 @@ python -m pytest tests/integration
 python -m pytest tests/regression tests/compatibility
 
 # 严格构建 Sphinx 文档
-sphinx-build -W --keep-going -b html docs docs/_build/html
+sphinx-build -W --keep-going -b html docs/en docs/_build/en/html
+sphinx-build -W --keep-going -b html docs/zh docs/_build/zh/html
 ```
 
 pytest 测试按 `unit`、`integration`、`regression`、`compatibility` 四类组织，覆盖：
@@ -61,17 +62,26 @@ F821 检查仍然启用。Markdown 制表符检查允许围栏代码块中的 TS
    可将耗时压到 30～40 秒。`--dist loadfile` 保证同一个测试文件只落在一个
    worker 上，这是 Textual UI 测试所需要的。覆盖率统计最贵：迭代时用 `--no-cov`，最后只测一次。
 4. **一次跑完跨版本矩阵。** `scripts/setup-test-matrix.sh` 用 uv 安装 CPython 3.10–3.15 并在
-   `.matrix/` 下为每个版本建 venv。`scripts/run-test-matrix.sh` 可并发跑完六个版本：
+   `.matrix/` 下为每个版本建 venv。`scripts/run-test-matrix.sh` 每次并发 `MATRIX_CONCURRENCY`
+   个版本（默认 3 个，六个版本分两波），每个版本给 `MATRIX_JOBS` 个 xdist worker；默认值把机器
+   核心数摊到并发版本上，并留出一个核心：
 
    ```bash
-   scripts/setup-test-matrix.sh                      # 每台机器执行一次
-   scripts/run-test-matrix.sh                        # 全量 × 六个版本，约 2～3 分钟
-   scripts/run-test-matrix.sh tests/unit -x          # 其余 pytest 参数原样透传
-   MATRIX_JOBS=4 scripts/run-test-matrix.sh          # 每个版本的 worker 数
+   scripts/setup-test-matrix.sh                        # 每台机器执行一次
+   scripts/run-test-matrix.sh                          # 全量 × 六个版本，24 线程约 5 分钟
+   scripts/run-test-matrix.sh tests/unit -x            # 其余 pytest 参数原样透传
+   MATRIX_JOBS=4 scripts/run-test-matrix.sh            # 每个版本的 worker 数
+   MATRIX_CONCURRENCY=2 scripts/run-test-matrix.sh     # 同时运行的版本数
    ```
 
-   每个版本的日志在 `.matrix/logs/<version>.log`，失败后可直接用对应解释器重跑。脚本在 Linux
-   与 macOS 上均可运行。`.matrix/` 已被 git 忽略。
+   矩阵相当于把全量测试跑六遍，所以分波只影响峰值占用，不改变总耗时——总耗时由核心数决定。
+   Linux 机器跑不到的那一半仍由 CI 覆盖（`.github/workflows/test.yml` 在 macOS 上跑同样版本）。
+
+   每个版本的日志在 `.matrix/logs/<version>.log`，失败后可直接用对应解释器重跑；日志目录在每次
+   运行前清空，因此不会把上一轮的残留误当成本轮结果，且同一时间只允许一个运行——第二个会以退出码 2
+   拒绝启动，而不是清空正在汇报的那一轮的日志。运行还会把被测提交写入
+   `.matrix/logs/head`，`scripts/release-preflight.sh` 据此拒绝把别的提交的矩阵结果当作
+   本次发布的证据。脚本在 Linux 与 macOS 上均可运行，`.matrix/` 已被 git 忽略。
 5. **平台相关代码不能只靠单个矩阵任务验证。** Linux 与 macOS 在环境探测所调用的系统工具、以及
    `pathlib`/`resource` 行为上都不同。凡是用 `sys.platform`/`os.name` 分支或调用系统工具的代码，
    都应带一个能在 Linux 上复现对端平台条件的测试（例如不含 GNU `timeout` 的空 `PATH`），而不是
@@ -157,7 +167,7 @@ CLI 是规范面：新能力先落在 CLI 与核心函数，TUI 只调用同一
 {{ operon_version }}  {{ db_schema }}  {{ metadata_schema }}
 ```
 
-由 `docs/conf.py` 在构建时从 `pyproject.toml` 与代码常量解析。替换只在正文段落中展开，行内代码与代码块内不生效，
+由 `docs/conf_common.py` 在构建时从 `pyproject.toml` 与代码常量解析。替换只在正文段落中展开，行内代码与代码块内不生效，
 这些位置的示例改用 `<version>` 占位符。有意保留的历史版本号保持字面量：要么位于 `docs/*/operations/`
 下 allowlist 中的时代绑定页面，要么在行内附带 `<!-- version-pin -->` 标记。`tests/unit/test_docs_versions.py`
 负责强制此规则。

{operondbs-0.8.3 → operondbs-0.8.4}/docs/zh/contributor/pypi-release.md

@@ -16,6 +16,13 @@ tag 必须严格等于 `v<project.version>`，再构建：
 - CPython 3.10-3.14 的 macOS Intel wheel；
 - CPython 3.10-3.14 的 macOS Apple Silicon wheel。
 
+`verify-release` job 会先于其他所有 job 运行，且它们都依赖它：它检出 release tag，
+   并断言"该提交的 `test` workflow 结论为 `success`"以及
+   `scripts/release-preflight.sh --ci --tag <tag>` 通过。它会先导入维护者公开的 GPG 公钥，
+   因此 tag 的签名是被**真正验证**过，而不只是"存在签名"；若该公钥不可用，这一项报 `skip`
+   而不是 `fail`。因此，tag 落在 CI 为红（或压根
+   被取消、没跑完）的提交上时，什么都不会被构建，更不会被上传。
+
 每个 wheel 都会先安装到隔离测试环境，导入编译后的 parser 并调用 CLI；源码分发包
 通过 Twine 检查。最终发布 job 必须等待全部构建成功，并通过 PyPI Trusted
 Publishing 认证，不保存长期 API token。
@@ -27,13 +34,20 @@ workflow 填 `publish.yml`，environment 填 `pypi`。GitHub environment 名称
 ## 发布步骤
 
 1. 更新 `[project].version`；如有变化，同时更新代码中的 `SCHEMA_VERSION` /
-   `METADATA_SCHEMA_VERSION`。文档版本标记通过 `docs/conf.py` 的
+   `METADATA_SCHEMA_VERSION`。文档版本标记通过 `docs/conf_common.py` 的
    `myst_substitutions` 从这些唯一来源渲染，无需手工批量替换；
    `tests/unit/test_docs_versions.py` 会拒绝 Markdown 源文件中硬编码的当前版本。
-2. 运行完整 pytest 套件与严格文档构建。
+2. 运行 `scripts/release-preflight.sh` —— 一条命令、一个退出码，就是发布闸门：
+   全量 pytest 套件、两棵树语言的严格文档构建、`pyproject.toml` 版本与已安装元数据的
+   一致性、缺陷登记库（凡是 `fixed_in` 为本版本的记录都必须 `verified`、带
+   `fix_commit`，且该提交包含在当前树中），以及"你即将打 tag 的那个提交"的跨版本矩阵
+   证据（`--run-matrix` 会把矩阵跑在闸门里；`--tag vX.Y.Z` 还会断言 create 出来的 tag
+   是附注、已 GPG 签名、名为 `v<version>` 且指向 `HEAD`）。发布不再依赖谁记得住这些
+   单个命令。
 3. 提交发布状态，并让 `v<project.version>` tag 指向该提交；不要复用仍指向旧软件包
    元数据的 tag。
-4. 等待该 tag 对应提交的 `deploy` workflow 全部通过。
+4. 等待该 tag 对应提交的 `test` workflow 全部通过。若该 run 缺失、被取消或为红，
+   发布链路会拒绝构建与上传；先用 `gh run rerun <run-id>` 给它补一轮，再发布。
 5. 从该 tag 创建 GitHub Release；如仍需检查发布说明可先保存为 draft，确认后发布。
 6. 在 PyPI 的 `OperonDBS` 项目页核对文件与元数据。
 

{operondbs-0.8.3 → operondbs-0.8.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "OperonDBS"
-version = "0.8.3"
+version = "0.8.4"
 description = "Operon the Database System: Archive, Quality-Control, Organize, Analyze and Release Your Bio-Data"
 authors = [
     { name = "hyli360", email = "lihuanyu2003@gmail.com" }

{operondbs-0.8.3 → operondbs-0.8.4}/tests/unit/test_docs_projects.py

@@ -16,6 +16,7 @@ extra installs no Sphinx, so the documentation must stay verifiable without it.
 from __future__ import annotations
 
 import ast
+import os
 from pathlib import Path
 
 import pytest
@@ -186,3 +187,40 @@ def test_every_workflow_builds_both_language_trees():
             f"{directories or ['docs']} — the pre-split source directory no "
             "longer holds a conf.py"
         )
+
+
+def test_the_publish_workflow_gates_on_the_release_preflight() -> None:
+    """A release builds and uploads only after the tagged commit proved itself.
+
+    The publish workflow used to build whatever the tag pointed at, so a tag on a
+    commit whose CI was red — or cancelled before it ever ran — reached PyPI anyway.
+    The gate is the ``verify-release`` job: it asserts the ``test`` workflow's
+    conclusion for that exact commit and then runs
+    ``scripts/release-preflight.sh``, and every job that builds or uploads waits for
+    it.  A release cannot exercise that path in a test, so this keeps it in place.
+    """
+
+    preflight = REPO_ROOT / "scripts" / "release-preflight.sh"
+    assert preflight.is_file(), "the release preflight script is missing"
+    assert os.access(preflight, os.X_OK), f"{preflight} is not executable"
+
+    publish = yaml.safe_load(
+        (REPO_ROOT / ".github" / "workflows" / "publish.yml").read_text(encoding="utf-8")
+    )
+    jobs = publish["jobs"]
+    verify = jobs["verify-release"]
+    commands = "\n".join(
+        step.get("run", "") for step in verify["steps"] if isinstance(step, dict)
+    )
+    assert "release-preflight.sh" in commands, "verify-release does not run the preflight"
+    assert "test.yml" in commands and "conclusion" in commands, (
+        "verify-release does not assert the test workflow's conclusion for the tagged commit"
+    )
+    assert verify.get("permissions", {}).get("actions") == "read", (
+        "verify-release reads workflow runs, so it needs actions: read"
+    )
+
+    for job in ("source-distribution", "documentation", "wheels", "pypi-publish"):
+        needs = jobs[job]["needs"]
+        needs = [needs] if isinstance(needs, str) else list(needs)
+        assert "verify-release" in needs, f"{job} does not wait for verify-release"

{operondbs-0.8.3 → operondbs-0.8.4}/tests/unit/test_tui_config.py

@@ -137,7 +137,9 @@ async def _click(pilot, selector: str) -> None:
     if isinstance(widget, Button) and widget.has_class("-active"):
         await _wait_until(lambda: not widget.has_class("-active"),
                           f"{selector} to settle")
-    for _ in range(10):
+    loop = asyncio.get_running_loop()
+    deadline = loop.time() + SETTLE_TIMEOUT
+    while True:
         try:
             landed = await pilot.click(selector)
         except OutOfBounds:
@@ -148,9 +150,10 @@ async def _click(pilot, selector: str) -> None:
             widget.press()
             await pilot.pause()
             return
+        if loop.time() > deadline:
+            raise AssertionError(f"click did not land on {selector}")
         await pilot.pause()
         await asyncio.sleep(0.02)
-    raise AssertionError(f"click did not land on {selector}")
 
 
 # ---------------------------------------------------------------------------
@@ -572,6 +575,7 @@ def test_config_screen_profile_save_end_to_end(project: Project) -> None:
     assert sorted(row["profile_version"] for row in rows) == [1, 2]
 
 
+@pytest.mark.bug("ODR-0027")
 def test_profile_editor_scrolls_to_all_rules(project: Project) -> None:
     """The rules editor must scroll: rule containers use height 1fr by default
     (plain Vertical), which clipped the rules to a fixed non-scrolling window."""
@@ -581,8 +585,15 @@ def test_profile_editor_scrolls_to_all_rules(project: Project) -> None:
         async with app.run_test(size=(160, 50)) as pilot:
             panel = await _open_config(app, pilot)
             _select_profile(panel, "assembly_production_v1")
-            await pilot.pause()
+            await _await_form_ready(pilot, panel)
             editor = panel.query_one("#profile-editor", VerticalScroll)
+            # The rows are in the tree before the layout gives the editor its
+            # content height, so wait for the growth the test is about instead
+            # of measuring in the mounting turn (ODR-0027).
+            await _wait_until(
+                lambda: editor.virtual_size.height > editor.scrollable_content_region.height,
+                "the rules editor to grow past its viewport",
+            )
             assert editor.virtual_size.height > editor.scrollable_content_region.height
             assert editor.max_scroll_y > 0
             editor.scroll_end(animate=False)
@@ -705,6 +716,20 @@ def test_config_screen_recipe_save_end_to_end(project: Project) -> None:
 # ---------------------------------------------------------------------------
 
 
+async def _await_notification(pilot, app, needle: str) -> None:
+    """Wait until some raised notification's message contains ``needle``.
+
+    A save runs on a worker and raises its notification a message-loop turn
+    after the modal closes, so reading ``_notifications(app)`` right after a
+    single ``pause()`` sees the list before the text is in it — on a slow
+    runner that turns a correct save into a failure (ODR-0027).
+    """
+    await _wait_until(
+        lambda: any(needle in message for _, message in _notifications(app)),
+        f"the notification {needle!r}",
+    )
+
+
 def _notifications(app) -> list[tuple[str, str]]:
     """(severity, message) of every notification raised on the app so far.
 
@@ -893,8 +918,7 @@ def test_config_screen_profile_unmodeled_keys_survive_save(project: Project) ->
             await _settled(app)
             await pilot.pause()
             assert not isinstance(app.screen, ProfileSaveModal)
-            assert any("saved probe_extras_v1 version 2" in message
-                       for _, message in _notifications(app))
+            await _await_notification(pilot, app, "saved probe_extras_v1 version 2")
 
     _run(scenario())
     loaded = load_profile(project.profiles_dir, "probe_extras_v1", expected_kind="qc")
@@ -1013,10 +1037,8 @@ def test_config_screen_unchanged_profile_save_notifies(project: Project) -> None
             await _settled(app)
             await pilot.pause()
             assert not isinstance(app.screen, ProfileSaveModal)
-            assert any(
-                "assembly_production_v1: unchanged — version 1 kept" in message
-                for _, message in _notifications(app)
-            )
+            await _await_notification(
+                pilot, app, "assembly_production_v1: unchanged — version 1 kept")
 
     _run(scenario())
     assert load_profile(
@@ -1103,8 +1125,7 @@ def test_config_screen_new_profile_is_created_as_version_1(project: Project) ->
             await _settled(app)
             await pilot.pause()
             assert not isinstance(app.screen, ProfileSaveModal)
-            assert any("saved assembly_strict_v1 version 1" in message
-                       for _, message in _notifications(app))
+            await _await_notification(pilot, app, "saved assembly_strict_v1 version 1")
 
     _run(scenario())
     loaded = load_profile(project.profiles_dir, "assembly_strict_v1", expected_kind="qc")
@@ -1136,10 +1157,8 @@ def test_config_screen_new_profile_with_existing_name_opens_it(project: Project)
             assert "reads_qc_v1" in _static_text(panel.query_one("#profile-heading", Static))
             assert panel.query_one("#profile-description", Input).value.startswith("Raw read QC")
             assert len(panel._rule_rows("required")) == 4
-            assert any(
-                "profile 'reads_qc_v1' already exists — opening it instead" in message
-                for _, message in _notifications(app)
-            )
+            await _await_notification(
+                pilot, app, "profile 'reads_qc_v1' already exists — opening it instead")
 
     _run(scenario())
 
@@ -1310,8 +1329,7 @@ def test_config_screen_recipe_unchanged_max_hits_and_cancel(project: Project) ->
             await _settled(app)
             await pilot.pause()
             assert not isinstance(app.screen, RecipeSaveModal)
-            assert any("saved blastn_nt version 2" in message
-                       for _, message in _notifications(app))
+            await _await_notification(pilot, app, "saved blastn_nt version 2")
 
             # A recipe without max_hits_per_query also saves as a no-op.
             panel._load_recipe("busco_autolineage")
@@ -1980,15 +1998,23 @@ async def _await_rows(pilot, root, selector: str, count: int, child: str) -> lis
     """Wait until ``root`` holds ``count`` ``selector`` rows whose ``child`` exists.
 
     Mounting a row subtree takes more than one message-loop turn, so a single
-    ``pilot.pause()`` can observe a row that has not composed yet.
+    ``pilot.pause()`` can observe a row that has not composed yet.  The budget is
+    this file's wall-clock settle timeout rather than a fixed number of cycles: a
+    loaded CI runner needs seconds to deliver the click and mount the row it
+    produces, and a cycle count that is generous on a fast machine runs out there
+    (ODR-0027).
     """
-    for _ in range(60):
-        rows = [row for row in root.query(selector) if len(list(row.query(child))) > 0]
-        if len(rows) >= count:
-            return rows
-        await pilot.pause()
-        await asyncio.sleep(0.02)
-    raise AssertionError(f"{selector} rows with {child} never reached {count}")
+    def composed() -> list:
+        return [row for row in root.query(selector) if len(list(row.query(child))) > 0]
+
+    try:
+        await _wait_until(lambda: len(composed()) >= count,
+                          f"{count} {selector} rows with {child}")
+    except TimeoutError as error:
+        raise AssertionError(
+            f"{selector} rows with {child}: saw {len(composed())}, wanted {count}"
+        ) from error
+    return composed()
 
 
 async def _await_form_ready(pilot, panel) -> None:
@@ -2079,6 +2105,7 @@ def test_save_classification_profile_versions_and_validation(project: Project) -
     assert loaded["rules"][0]["when"][0]["value"] == 1e-05
 
 
+@pytest.mark.bug("ODR-0027")
 def test_config_classification_editor_end_to_end(project: Project) -> None:
     _write_classification_profile(project, "bhlh_tiers", BHLH_PROFILE)
 
@@ -2160,7 +2187,7 @@ def test_config_classification_editor_end_to_end(project: Project) -> None:
             await _settled(app)
             await pilot.pause()
             assert not isinstance(app.screen, ClassificationSaveModal)
-            assert any("saved bhlh_tiers version 2" in message for _, message in _notifications(app))
+            await _await_notification(pilot, app, "saved bhlh_tiers version 2")
             # The editor reloaded from disk: the freshly saved structure renders.
             assert len(list(panel.query(".source-row"))) == 2
             assert len(list(panel.query(".classrule-row"))) == 4
@@ -2183,6 +2210,7 @@ def test_config_classification_editor_end_to_end(project: Project) -> None:
                            "WHERE profile_name='bhlh_tiers'")[-1]["profile_version"] == 2
 
 
+@pytest.mark.bug("ODR-0027")
 def test_config_classification_editor_guards_and_readonly(project: Project) -> None:
     nested = json.loads(json.dumps(BHLH_PROFILE))
     nested["rules"][0]["when"] = [{"any": [{"not": {"field": "x", "operator": "exists"}}]}]