ansible-aom 0.102.13__tar.gz

ansible_aom-0.102.13/.agent/hooks/graphify-refresh.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# graphify-refresh: AST-only refresh of the knowledge graph artifacts.
+#
+# The graph is generated from the MAIN aom repo's source, so
+# `graphify update .` / cluster-only / tree / export wiki run at the repo
+# root. graphify writes its artifacts into graphify-out/, which is a git
+# submodule owning its own repository — so the regenerated files live in
+# that submodule repo and never pollute aom's PR diff.
+#
+# Flow:
+#   1. Ensure the graphify-out submodule is checked out.
+#   2. Regenerate artifacts from the main repo root (they land inside the
+#      submodule worktree).
+#   3. Commit + push inside the submodule (best-effort).
+#   4. Stage the updated submodule pointer (gitlink) in the superproject,
+#      so aom's diff stays a single line per regeneration.
+# Skips gracefully if graphify-out/ is not initialized or the CLI is missing.
+set -e
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo ".")"
+cd "$REPO_ROOT"
+
+if [ ! -d graphify-out ] || [ ! -f graphify-out/graph.json ]; then
+  echo "graphify-out/ not initialized, skipping graph refresh"
+  exit 0
+fi
+
+if ! command -v graphify >/dev/null 2>&1; then
+  echo "graphify CLI not found, skipping graph refresh"
+  exit 0
+fi
+
+# Ensure the submodule is populated so graphify-out is a real git repo.
+git submodule update --init graphify-out 2>/dev/null || true
+
+# Raise HTML viz node limit. Default (5000) is too small for this repo's
+# ~12k-node graph. Override locally with `GRAPHIFY_VIZ_NODE_LIMIT=... git commit`.
+export GRAPHIFY_VIZ_NODE_LIMIT="${GRAPHIFY_VIZ_NODE_LIMIT:-20000}"
+
+# NixOS: graphify needs numpy which needs libstdc++.so.6.
+# If it's not on the default LD_LIBRARY_PATH, try to add it.
+if ! python3 -c "import numpy" 2>/dev/null; then
+  _LIBSTDCXX="$(gcc -print-file-name=libstdc++.so.6 2>/dev/null || true)"
+  if [ -n "$_LIBSTDCXX" ] && [ -f "$_LIBSTDCXX" ]; then
+    _LIBDIR="$(dirname "$_LIBSTDCXX")"
+    export LD_LIBRARY_PATH="${_LIBDIR}${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
+  fi
+fi
+
+# Generate against the main repo source. Artifacts land in graphify-out/
+# (the submodule worktree).
+graphify install 2>/dev/null || true
+graphify update . || exit 1
+graphify cluster-only . 2>/dev/null || true
+graphify tree 2>/dev/null || true
+
+if [ -f graphify-out/graph.json ]; then
+  graphify export wiki 2>/dev/null || true
+fi
+
+# Commit + push the refreshed artifacts inside the submodule.
+if git -C graphify-out rev-parse --git-dir >/dev/null 2>&1 \
+  && git -C graphify-out remote >/dev/null 2>&1; then
+  if ! git -C graphify-out diff --quiet; then
+    git -C graphify-out add -u \
+      graph.json \
+      .graphify_labels.json \
+      .graphify_analysis.json \
+      .graphify_semantic_marker \
+      GRAPH_TREE.html \
+      GRAPH_REPORT.md \
+      graph.html \
+      wiki/ 2>/dev/null || true
+    git -C graphify-out commit -m "chore: regenerate graph artifacts" >/dev/null 2>&1 || true
+    # Push is best-effort; a missing/denied remote must not fail the commit.
+    git -C graphify-out push 2>/dev/null \
+      || echo "graphify: submodule push skipped (no reachable remote)"
+  fi
+else
+  echo "graphify: submodule repo/remote not present, artifacts left uncommitted"
+fi
+
+# Stage the updated submodule pointer (gitlink) in the superproject.
+git add graphify-out 2>/dev/null || true

ansible_aom-0.102.13/.agent/hooks/pre-commit-wrapper.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Wrapper to invoke pre-commit from a custom git hooks path.
+# Installed by the shell hook when global core.hooksPath is set to a
+# non-default location; pre-commit itself cannot target a custom path.
+exec pre-commit run --hook-stage pre-commit "$@"

ansible_aom-0.102.13/.ansible-lint

@@ -0,0 +1,24 @@
+---
+# ansible-lint config for AOM test playbooks
+# These playbooks are intentionally minimal test fixtures for a monitoring tool,
+# not production roles. Rules are lenient accordingly.
+
+schema: basic
+
+offline: true
+
+warn_list:
+  - name[missing]
+  - name[casing]
+  - name[template]
+  - var-naming[no-role-prefix]
+
+skip_list:
+  - no-changed-when       # test tasks use debug/command intentionally
+  - no-handler             # test playbooks don't need handler patterns
+  - risky-shell-pipe       # test shell tasks are intentionally simple
+  - command-instead-of-shell  # test tasks favor simplicity over best practice
+  - command-instead-of-module  # test tasks use command for predictability
+
+exclude_paths:
+  - tests/playbooks/32-large-playbook/  # generated playbook

ansible_aom-0.102.13/.claude/settings.json

@@ -0,0 +1,37 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(uv sync:*)",
+      "Bash(uv run:*)",
+      "Bash(uv pip:*)",
+      "Bash(git:*)",
+      "Bash(ansible-galaxy:*)",
+      "Bash(ansible-playbook:*)",
+      "Bash(mkdir:*)",
+      "Bash(rm:*)",
+      "Read",
+      "Write",
+      "Edit",
+      "Glob",
+      "Grep",
+      "WebSearch",
+      "WebFetch"
+    ]
+  },
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "f=$(jq -r '.tool_input.file_path // .tool_response.filePath // empty'); case \"$f\" in *.py) uv run ruff format --check \"$f\" >/dev/null 2>&1 && uv run ruff check \"$f\" >/dev/null 2>&1 ;; esac"
+          }
+        ]
+      }
+    ]
+  },
+  "env": {
+    "ANSIBLE_STDOUT_CALLBACK": "ansible.posix.jsonl"
+  }
+}

ansible_aom-0.102.13/.claude/skills/verify/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: verify
+description: How to verify aom compact-renderer changes end-to-end — run aom on a real playbook under a PTY, capture raw bytes, count DEC-2026 frames and log lines.
+---
+
+# Verifying aom at the terminal surface
+
+The compact renderer's surface is raw stdout bytes on a TTY. Unit tests
+capture strings; real verification needs a PTY with a controlled size
+and a capture of the raw escape-sequence stream.
+
+## Recipe
+
+```bash
+# 1. A storm playbook (loop → rapid v2_runner_item_on_* events):
+cat > /tmp/storm.yml <<'EOF'
+- hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: storm
+      ansible.builtin.debug: {msg: "item {{ item }}"}
+      loop: "{{ range(0, 120) | list }}"
+EOF
+
+# 2. Run under a PTY with forced size, capture raw bytes.
+#    `script` gives a real PTY; stty inside sets the winsize (without it
+#    the size is 0x0 → aom falls into degraded plain-log mode).
+cd /tmp && script -qec "stty rows 40 cols 120; \
+  uv run --project /path/to/ansible-aom aom --no-record -y /tmp/storm.yml" \
+  /tmp/aom_raw.bin >/dev/null 2>&1
+
+# 3. Analyze: frames = count of BSU (\x1b[?2026h); log lines via regex.
+python3 -c "
+data = open('/tmp/aom_raw.bin', 'rb').read().decode(errors='replace')
+print('frames:', data.count('\x1b[?2026h'))
+print('cursor restored:', '\x1b[?25h' in data)
+"
+```
+
+## What to check
+
+- **Frame budget**: log-batching caps repaints at ~30 Hz. A 120-item
+  storm finishing in ~1s should produce **~15–30 frames**, not 120+.
+- **No lost/reordered lines**: every loop item appears exactly once, in
+  order. Items render as `ok: [localhost] => (item=N)`.
+- **Cursor restored** (`\x1b[?25h`) and final status line present after
+  both clean completion and Ctrl-C.
+- **Degraded mode**: `stty rows 10 cols 60` → "terminal too small"
+  warning, zero BSU frames, all log lines still printed plainly.
+
+## Gotchas
+
+- **Ctrl-C probe**: send SIGINT to the *aom python process only*
+  (`ps -ef | grep bin/aom`), never `pkill -f` a pattern matching the
+  `uv run` wrapper — killing the wrapper skips aom's cleanup AND leaks
+  orphaned `ansible-playbook` children that keep running. Expect exit
+  130 + `✖ cancelled by user` + cursor restore.
+- `script` must run with cwd outside the repo or it happily works either
+  way, but the capture file lands wherever you point it; use /tmp.
+- Known pre-existing quirks (don't blame your diff): loop item `0`
+  renders as `(item=)` (falsy-zero formatting), and localhost runs emit
+  a `[WARNING]: Callback dispatch 'v2_runner_on_start' failed for
+  plugin 'aom_connection'` warning.

ansible_aom-0.102.13/.envrc

@@ -0,0 +1 @@
+use flake

ansible_aom-0.102.13/.githooks/post-commit

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# post-commit: fold repo-generated artifacts into the just-created commit.
+#
+# The pre-commit framework stashes-then-restores the working tree around
+# its pre-commit hooks, silently rolling back any `git add` (and any
+# nested submodule commit) a pre-commit hook performs — so neither the
+# version bump nor the graphify submodule refresh can run there.
+# post-commit runs after that machinery; each step folds its result into
+# the commit via `git commit --amend` (env-guarded against recursion).
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+if [ -x scripts/bump_version.py ]; then
+  AOM_BUMP_HOOK_RUNNING="${AOM_BUMP_HOOK_RUNNING:-}" uv run scripts/bump_version.py || true
+fi
+
+if [ -x .githooks/post-commit-graphify ]; then
+  .githooks/post-commit-graphify || true
+fi

ansible_aom-0.102.13/.githooks/post-commit-graphify

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# graphify-post-commit: refresh the knowledge graph AFTER a commit lands.
+#
+# Why post-commit + amend and not a pre-commit hook: the pre-commit
+# framework stashes-then-restores the working tree around its pre-commit
+# hooks, which silently rolls back both the graphify-out submodule commit
+# and the gitlink `git add` this script performs. post-commit runs after
+# that machinery is done, so the regeneration can safely commit the
+# submodule and fold the new pointer into the same commit via
+# `git commit --amend`.
+#
+# Only runs when the commit touched graph-relevant files (source, tests,
+# docs, pyproject) so unrelated commits don't trigger a wasteful
+# regeneration. Recursion from the amend is blocked by the
+# AOM_GRAPHIFY_POST_COMMIT env var.
+set -euo pipefail
+
+if [ -n "${AOM_GRAPHIFY_POST_COMMIT:-}" ]; then
+  exit 0
+fi
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || exit 0)"
+cd "$REPO_ROOT"
+
+if [ ! -d graphify-out ] || [ ! -f graphify-out/graph.json ]; then
+  exit 0
+fi
+if ! command -v graphify >/dev/null 2>&1; then
+  exit 0
+fi
+
+# Bail out mid-rebase / mid-merge / mid-cherry-pick — an amend during
+# those would scramble the in-flight sequencing.
+for marker in REBASE_HEAD MERGE_HEAD CHERRY_PICK_HEAD BISECT_LOG; do
+  if [ -f "$REPO_ROOT/.git/$marker" ]; then
+    exit 0
+  fi
+done
+
+# git sets GIT_DIR / GIT_INDEX_FILE when it runs hooks, which makes
+# `git -C graphify-out ...` resolve the superproject's gitdir instead of
+# the submodule's. Unset them so submodule commands address the right
+# repo.
+unset GIT_DIR GIT_INDEX_FILE GIT_WORK_TREE 2>/dev/null || true
+
+# Only regenerate when HEAD touched graph-relevant files.
+GRAPH_RELEVANT='^(src/.*\.py|tests/.*\.py|docs/.*\.md|ARCHITECTURE\.md|SPECIFICATION\.md|pyproject\.toml)$'
+if ! git show --name-only --pretty=format: HEAD | grep -qE "$GRAPH_RELEVANT"; then
+  exit 0
+fi
+
+git submodule update --init graphify-out 2>/dev/null || true
+
+export GRAPHIFY_VIZ_NODE_LIMIT="${GRAPHIFY_VIZ_NODE_LIMIT:-20000}"
+if ! python3 -c "import numpy" 2>/dev/null; then
+  _LIBSTDCXX="$(gcc -print-file-name=libstdc++.so.6 2>/dev/null || true)"
+  if [ -n "$_LIBSTDCXX" ] && [ -f "$_LIBSTDCXX" ]; then
+    export LD_LIBRARY_PATH="$(dirname "$_LIBSTDCXX")${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
+  fi
+fi
+
+graphify install 2>/dev/null || true
+graphify update . 2>/dev/null || true
+graphify cluster-only . 2>/dev/null || true
+graphify tree 2>/dev/null || true
+[ -f graphify-out/graph.json ] && graphify export wiki 2>/dev/null || true
+
+# Commit + push the refreshed artifacts inside the submodule.
+if git -C graphify-out rev-parse --git-dir >/dev/null 2>&1 \
+  && git -C graphify-out remote >/dev/null 2>&1; then
+  if ! git -C graphify-out diff --quiet; then
+    # -u stages modified tracked artifacts; -A also picks up newly
+    # generated wiki pages so the submodule stays clean.
+    git -C graphify-out add -u graph.json .graphify_labels.json \
+      .graphify_analysis.json .graphify_semantic_marker GRAPH_TREE.html \
+      GRAPH_REPORT.md graph.html wiki/ 2>/dev/null || true
+    git -C graphify-out add -A wiki/ 2>/dev/null || true
+    git -C graphify-out commit -m "chore: regenerate graph artifacts" >/dev/null 2>&1 || true
+    # Submodules sit on a detached HEAD, so a bare `git push` pushes
+    # nothing. Push the detached HEAD explicitly to the main branch.
+    git -C graphify-out push origin HEAD:main 2>/dev/null \
+      || echo "graphify: submodule push skipped (no reachable remote)"
+  fi
+fi
+
+# Fold the new submodule pointer into the just-created commit. Guarded so
+# the post-commit fire from the amend itself returns immediately.
+if ! git -C "$REPO_ROOT" diff --quiet HEAD -- graphify-out; then
+  git -C "$REPO_ROOT" add graphify-out
+  AOM_GRAPHIFY_POST_COMMIT=1 \
+    git -C "$REPO_ROOT" commit --amend --no-edit --no-verify >/dev/null 2>&1 \
+    || true
+fi

ansible_aom-0.102.13/.githooks/pre-commit

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# pre-commit hook: delegates to pre-commit framework
+# See .pre-commit-config.yaml for configured hooks
+set -e
+
+echo "[pre-commit] running pre-commit checks..."
+uv run pre-commit run "$@"

ansible_aom-0.102.13/.githooks/pre-push

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# pre-push: run only the tests affected by what's being pushed.
+#
+# Two phases, deliberately asymmetric about the working tree:
+#
+#   1. SELECTION (~2-3s, tree briefly stashed): testmon --collect-only
+#      against the COMMITTED state. Everything — including untracked
+#      files — is stashed so concurrent agent sessions' WIP (red TDD
+#      tests, uncommitted fixes) can't leak into the selection. The
+#      stash is popped before any test runs.
+#
+#   2. EXECUTION (live tree, no stash): the selected node IDs run
+#      against the tree as-is, so a long test run never holds other
+#      sessions' files hostage. testmon stays enabled so .testmondata
+#      keeps draining; it may further deselect tests already proven
+#      green on byte-identical code (testmon always re-selects prior
+#      failures, so a deselect implies a prior pass).
+#
+# pytest intentionally does NOT live in .pre-commit-config.yaml's
+# pre-push stage: the pre-commit framework stashes tracked-but-not-
+# untracked files around the WHOLE hook run, which both races
+# concurrent sessions and produces false failures (a session's
+# untracked red test stays visible while its uncommitted fix is
+# stashed away).
+#
+# --no-cov (not -p no:cov): keeps pytest-cov loaded so addopts'
+# --cov-fail-under still parses, while stopping the coverage
+# measurement that silently breaks testmon's DB updates.
+set -euo pipefail
+cd "$(git rev-parse --show-toplevel)"
+
+PYTEST=(uv run --extra dev --extra integration pytest --testmon --no-cov -q)
+
+# --- phase 1: selection against committed state -----------------------
+stashed=0
+restore_tree() {
+    if (( stashed )); then
+        stashed=0
+        # --index also restores staged-ness; plain pop is the fallback
+        # (content preserved, index state lost).
+        git stash pop --index --quiet 2>/dev/null \
+            || git stash pop --quiet \
+            || {
+                echo "pre-push: FAILED to restore stashed WIP — recover it" \
+                     "from 'git stash list' (pre-push-test-selection)" >&2
+                return 1
+            }
+    fi
+}
+trap restore_tree EXIT
+
+# Git exports GIT_DIR / GIT_INDEX_FILE etc. into hook processes; strip them
+# now that we're in the worktree root so pytest fixtures spawning `git` in
+# temp directories cannot accidentally target the real repository.
+unset "${!GIT_@}"
+
+if [[ -n "$(git status --porcelain)" ]]; then
+    git stash push --include-untracked --quiet -m "pre-push-test-selection"
+    stashed=1
+fi
+
+collect_rc=0
+collected="$("${PYTEST[@]}" tests/ --collect-only -n0 2>&1)" || collect_rc=$?
+restore_tree # pop as soon as selection is done; the trap stays as backstop
+
+# exit 5 = "no tests collected" = nothing affected. Anything else
+# non-zero is a real collection error in the committed state: block.
+if (( collect_rc != 0 && collect_rc != 5 )); then
+    echo "$collected" >&2
+    echo "pre-push: test collection failed against the committed state" >&2
+    exit "$collect_rc"
+fi
+
+mapfile -t selected < <(grep -E '^tests/.*::' <<<"$collected" || true)
+if (( ${#selected[@]} == 0 )); then
+    echo "pre-push: no tests affected by the pushed changes"
+    exit 0
+fi
+
+# --- phase 2: run the selection against the live tree -----------------
+echo "pre-push: running ${#selected[@]} affected test(s) against the live tree"
+run_rc=0
+"${PYTEST[@]}" --tb=short "${selected[@]}" || run_rc=$?
+# exit 5 here means testmon deselected everything we passed in — all of
+# it already passed on identical code. That is a pass.
+if (( run_rc == 5 )); then run_rc=0; fi
+exit "$run_rc"

ansible_aom-0.102.13/.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "nix"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

ansible_aom-0.102.13/.github/workflows/ci.yml

@@ -0,0 +1,80 @@
+# CI workflow for ansible-aom
+# Runs lint (ruff) → type-check (mypy) → test (pytest with xdist)
+# on push to main/master and on every pull_request (incl. stacked PRs
+# whose base is another feature branch).
+#
+# Uses uv for Python dependency management (matching the project's
+# existing tooling). Python 3.14 only — no matrix builds.
+
+name: CI
+
+env:
+  UV_LOCKED: "true"
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
+      - name: Set up Python 3.14
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.14"
+
+      - name: Install dependencies
+        run: uv sync --all-extras --group release
+
+      - name: Check software version bump
+        run: uv run --no-sync python scripts/check_version_bump.py
+
+      - name: Lint (ruff format check)
+        run: uv run --no-sync ruff format --check src/
+
+      - name: Lint (ruff check)
+        run: uv run --no-sync ruff check src/
+
+      - name: Type-check (mypy)
+        run: uv run --no-sync mypy src/ansible_aom
+
+      - name: Test (pytest with xdist)
+        run: uv run --no-sync pytest tests/unit tests/compact tests/tui -q -n auto
+
+      - name: Build distributions
+        run: uv build --no-build-isolation
+
+      - name: Validate distributions
+        run: |
+          uv run --no-sync twine check dist/*
+          python -m venv /tmp/aom-ci-smoke
+          /tmp/aom-ci-smoke/bin/python -m pip install dist/*.whl
+          cd /tmp
+          /tmp/aom-ci-smoke/bin/aom --version
+          /tmp/aom-ci-smoke/bin/aom --help >/dev/null
+          /tmp/aom-ci-smoke/bin/python -c 'from pathlib import Path; import ansible_aom.ansible.runner as r; assert (Path(r.__file__).parent / "callback" / "aom_jsonl.py").is_file()'
+
+  nix:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+      - uses: cachix/install-nix-action@v31
+      - name: Build Nix package
+        run: nix build .#default --no-update-lock-file
+      - name: Validate Nix package
+        run: |
+          ./result/bin/aom --version
+          ./result/bin/aom --help >/dev/null
+      - name: Evaluate development shell
+        run: nix eval --raw .#devShells.x86_64-linux.default.drvPath --no-update-lock-file

ansible_aom-0.102.13/.github/workflows/release.yml

@@ -0,0 +1,135 @@
+name: Release
+
+env:
+  UV_LOCKED: "true"
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+
+jobs:
+  check:
+    runs-on: ubuntu-24.04
+    outputs:
+      should_release: ${{ steps.evaluate.outputs.should_release }}
+      tag: ${{ steps.evaluate.outputs.tag }}
+      version: ${{ steps.evaluate.outputs.version }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.14"
+      - name: Evaluate release trigger
+        id: evaluate
+        run: python scripts/check_version_bump.py --check-release
+
+  build:
+    needs: check
+    if: needs.check.outputs.should_release == 'true'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    outputs:
+      tag: ${{ steps.validate.outputs.tag }}
+      version: ${{ steps.validate.outputs.version }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.14"
+      - uses: astral-sh/setup-uv@v7
+      - name: Validate tag and project version
+        id: validate
+        env:
+          RELEASE_TAG: ${{ needs.check.outputs.tag || github.ref_name }}
+        run: |
+          python - <<'PY'
+          import os
+          import re
+          import tomllib
+          from pathlib import Path
+
+          tag = os.environ["RELEASE_TAG"]
+          if not re.fullmatch(r"v\d+\.\d+\.\d+", tag):
+              raise SystemExit(f"invalid release tag: {tag!r}; expected vX.Y.Z")
+          version = tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"]
+          if tag[1:] != version:
+              raise SystemExit(f"tag {tag} does not match project version {version}")
+          print(f"Releasing ansible-aom {version} ({tag})")
+          if "GITHUB_OUTPUT" in os.environ:
+              with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as f:
+                  f.write(f"tag={tag}\n")
+                  f.write(f"version={version}\n")
+          PY
+      - name: Install locked runtime and release tools
+        run: uv sync --no-default-groups --group release --no-install-project
+      - name: Build Python distributions
+        run: uv build --no-build-isolation
+      - name: Validate Python distributions
+        run: |
+          uv run --no-sync twine check dist/*
+          python -m venv /tmp/aom-wheel-smoke
+          /tmp/aom-wheel-smoke/bin/python -m pip install dist/*.whl
+          cd /tmp
+          /tmp/aom-wheel-smoke/bin/aom --version
+          /tmp/aom-wheel-smoke/bin/aom --help >/dev/null
+          /tmp/aom-wheel-smoke/bin/python -c 'from pathlib import Path; import ansible_aom.ansible.runner as r; assert (Path(r.__file__).parent / "callback" / "aom_jsonl.py").is_file()'
+      - name: Build Linux standalone bundle
+        run: |
+          uv pip install --no-deps dist/*.whl
+          uv run --no-sync pyinstaller --clean --noconfirm --distpath build-dist --workpath build-work packaging/aom.spec
+          test -x build-dist/aom/aom
+          tar -C build-dist -czf dist/aom-linux-x86_64.tar.gz aom
+      - name: Validate standalone bundle
+        run: |
+          test -f build-dist/aom/aom
+          test -f build-dist/aom/_internal/ansible_aom/ansible/callback/aom_jsonl.py
+          test -f build-dist/aom/_internal/ansible_aom/callbacks/aom_connection.py
+          test -f build-dist/aom/_internal/ansible_aom/core/default_config.yaml
+          build-dist/aom/aom --version
+          build-dist/aom/aom --help >/dev/null
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-artifacts
+          path: dist/
+          if-no-files-found: error
+
+  github-release:
+    needs: [check, build]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: release-artifacts
+          path: dist
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: gh release create "${{ needs.build.outputs.tag || needs.check.outputs.tag }}" dist/* --generate-notes --target "${{ github.sha }}"
+
+  pypi:
+    needs: [check, build]
+    runs-on: ubuntu-24.04
+    permissions:
+      id-token: write
+    environment:
+      name: pypi
+      url: https://pypi.org/p/ansible-aom
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: release-artifacts
+          path: dist
+      - name: Keep only Python distributions
+        run: rm dist/aom-linux-x86_64.tar.gz
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist