chooong.datasift 0.1.0__tar.gz

chooong_datasift-0.1.0/.github/RELEASING.md

@@ -0,0 +1,137 @@
+# Releasing
+
+Version `0.1.0` remains unreleased. Publishing requires explicit authorization;
+Pages deployment remains disabled.
+The project version in `pyproject.toml` is authoritative; Cargo and both lockfiles
+must agree. Preparation supports canonical final PEP 440 versions (`X.Y.Z`).
+
+## Prepare and review
+
+From a clean, current `main` with uv, Rust and authenticated GitHub CLI installed:
+
+<!-- check: syntax -->
+
+```bash
+uv run release/prepare.py --version 0.1.0 --dry-run
+uv run release/prepare.py --version 0.1.0
+uv run release/push.py --dry-run
+uv run release/push.py
+```
+
+The changelog retains exactly one `## Unreleased` heading with user-facing notes.
+Preparation checks PyPI, synchronizes version entries and moves Unreleased notes
+into one versioned section. Repeating it does not duplicate notes. Network failures
+block preparation. The push command stages only release files, creates
+`release/vX.Y.Z` and opens or reuses one PR against `main`. Neither command creates
+a tag, merges a PR or publishes a release. Unrelated changes are rejected.
+
+## Validate distributions
+
+CI and **Release dry run** share the five-platform ABI3 build matrix: Linux x86_64
+and ARM64, macOS x86_64 and ARM64, and Windows x86_64. Every wheel and the sdist is
+installed in isolated Python 3.12, 3.13 and 3.14 environments on a matching runner.
+Builds use `uvx` with the Maturin version pinned in `pyproject.toml`, the Rust
+toolchain from `rust-toolchain.toml`, and `--release --locked`. Python 3.12 is
+installed explicitly for the ABI3 build. Linux uses `ziglang==0.15.2` as a
+build-only linker with `--zig --compatibility manylinux_2_28 --auditwheel check`;
+macOS and Windows use their native toolchains. No Maturin GitHub Action is required.
+The gate binds each artifact and JUnit report to one commit/version and checks
+metadata, tags, licenses, inventories and SHA-256 hashes. Missing platforms,
+failed/skipped tests or modified bytes block the complete set. `.gitattributes`
+checks out `LICENSE` with LF endings on every build host, including Windows;
+license comparisons remain byte-for-byte and do not normalize artifact contents.
+
+Run **Release dry run** manually with the committed version and `publish: false`.
+Validation jobs run for both private and public repositories. Record actual
+platform results in the PR. Benchmarks are a separate
+manual workflow; see [Benchmarks](../docs/development/benchmarks.md).
+
+For a local artifact, put exactly one wheel or sdist in `bundle/dist/`:
+
+<!-- check: syntax -->
+
+```bash
+uv run python scripts/artifacts.py plan
+uv run python scripts/artifacts.py test --kind wheel --target macos-arm64
+# For the sdist, use a separate bundle:
+uv run python scripts/artifacts.py test --kind sdist --target sdist --bundle sdist-bundle
+# After collecting all native wheel receipts and the sdist receipt:
+uv run python scripts/artifacts.py gate --bundle bundle --output verified
+```
+
+The checkout must be clean and committed for testing/gating. Synthetic tooling
+fixtures test rejection logic and do not qualify native platforms.
+
+## Authorize publication separately
+
+After the release PR is merged, review and explicitly approve its exact commit.
+Only then create a non-overwriting `vX.Y.Z` tag on that commit. Tag creation and
+push are manual owner actions. The workflow does not run automatically on tags.
+
+Publishing requires `PYPI_PUBLISH_ENABLED=true`, verified PyPI project ownership
+and Trusted Publisher configuration, and a protected `pypi` environment with
+required reviewers. Disable any historical
+GitLab publisher/broker permissions before activation. Do not change repository
+visibility or organization billing settings as part of release preparation.
+
+Once these prerequisites are satisfied, dispatch the release workflow on that tag with the
+matching version, exact `approved-commit` and `publish: true`. It verifies the tag,
+commit and ancestry on `main`, builds/tests once and hands immutable artifact ID
+and authenticated checksums to the environment-gated OIDC publisher. The publisher
+rechecks bytes without rebuilding, refuses `skip-existing`, and verifies the exact
+published file set and downloaded PyPI bytes. GitHub Release creation follows only
+after that verification. A partial upload needs investigation before recovery.
+
+The publishing job directly requires both `release-identity` and `distributions`
+to succeed. Keep this explicit identity gate even when distribution builds also
+depend on it.
+
+## Documentation deployment
+
+Pages deployment remains hard-disabled. The prepared workflow builds the site,
+checks its sources/examples and uploads only `site/`. Enabling deployment needs
+an explicit reviewed change to the literal `false` guards,
+`PAGES_DEPLOY_ENABLED=true` and an authorized GitHub Pages environment. Do not
+change repository visibility, organization settings or budget guards as a shortcut.
+The package Documentation URL stays on GitHub until Pages is reachable and authorized.
+
+## Publisher identity
+
+Configure a pending PyPI Trusted Publisher for distribution `chooong.datasift`
+with owner `chooong-group`, repository `chooong.datasift`, workflow `release.yml`
+and environment `pypi`. The workflow filename is case-sensitive. Configure this
+in the owning PyPI account; a repository setting cannot establish PyPI ownership.
+Use OIDC rather than adding a PyPI API token to GitHub secrets.
+
+Restrict `.github/workflows/release.yml` to the release owner with an active
+[Actions policy](https://docs.github.com/en/actions/how-tos/administer/control-workflow-execution).
+A manual trigger alone allows users with repository write access to start workflows.
+Configure the owner as a required reviewer in the `pypi` environment. For the
+owner to start and approve the same deployment, leave **Prevent self-review** off;
+see [environment protection](https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments).
+Restrict deployments to version tags (`v*`, type `tag`), not branch `main`.
+The workflow independently checks exact version, approved commit and main ancestry;
+the tag pattern alone is not release authorization. Verify the reviewer and tag
+rules through GitHub settings after saving them. If the repository plan cannot
+enforce approval, keep publishing disabled until an approved protection mechanism
+is available. Do not upgrade billing or relax checks to bypass that limitation.
+
+## First public release review
+
+Review all reachable branches, commit messages, authors, PR bodies/comments,
+review attachments and historical workflow logs/artifacts before changing
+visibility. Squash merging a PR removes neither old PR records nor commits still
+reachable through branches or GitHub PR refs. Deleting a working-tree document
+also does not erase its history. Resolve sensitive findings with the owner before
+exposure; secret rotation and GitHub support may be necessary. Never rewrite
+history or delete records as an automatic preparation step.
+
+Keep the changelog as the release-note source. Prepare the versioned section only
+under a separate release authorization; review its text before the publisher
+creates the GitHub Release. Do not add CI logs, process ledgers or local paths to
+user-facing release notes. README installation instructions are version-independent
+and its PyPI badge reads the version dynamically. Release preparation changes only
+package metadata, lockfiles and CHANGELOG.md; README.md must remain byte-identical
+through preparation and subsequent releases. Keep documentation hosting changes
+separate from release version updates; check Pages anonymously before changing
+repository documentation links.

chooong_datasift-0.1.0/.github/actions/tooling/action.yml

@@ -0,0 +1,15 @@
+name: Locked Python and Rust tooling
+description: Install the pinned uv version, locked development dependencies and Rust toolchain
+runs:
+  using: composite
+  steps:
+    - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      with:
+        version: "0.11.21"
+        enable-cache: false
+    - shell: bash
+      run: uv sync --frozen --no-install-project --python 3.13
+    - shell: bash
+      run: uv run --frozen --no-sync python -c 'import sysconfig; print(sysconfig.get_path("scripts"))' >> "$GITHUB_PATH"
+    - shell: bash
+      run: rustup show

chooong_datasift-0.1.0/.github/release-targets.json

@@ -0,0 +1,10 @@
+{
+  "format_version": 1,
+  "wheels": [
+    {"id": "linux-x86_64", "runner": "ubuntu-24.04", "system": "Linux", "machine": "x86_64", "rust_target": "x86_64-unknown-linux-gnu", "platform_tag": "manylinux_2_28_x86_64", "manylinux": "2_28"},
+    {"id": "linux-arm64", "runner": "ubuntu-24.04-arm", "system": "Linux", "machine": "arm64", "rust_target": "aarch64-unknown-linux-gnu", "platform_tag": "manylinux_2_28_aarch64", "manylinux": "2_28"},
+    {"id": "windows-x86_64", "runner": "windows-2022", "system": "Windows", "machine": "x86_64", "rust_target": "x86_64-pc-windows-msvc", "platform_tag": "win_amd64", "manylinux": null},
+    {"id": "macos-x86_64", "runner": "macos-15-intel", "system": "Darwin", "machine": "x86_64", "rust_target": "x86_64-apple-darwin", "platform_tag": "macosx_11_0_x86_64", "manylinux": null},
+    {"id": "macos-arm64", "runner": "macos-15", "system": "Darwin", "machine": "arm64", "rust_target": "aarch64-apple-darwin", "platform_tag": "macosx_11_0_arm64", "manylinux": null}
+  ]
+}

chooong_datasift-0.1.0/.github/workflows/artifacts.yml

@@ -0,0 +1,160 @@
+name: Build and test distributions
+on:
+  workflow_call:
+    inputs:
+      version:
+        type: string
+        required: false
+        default: ""
+    outputs:
+      artifact-id:
+        value: ${{ jobs.gate.outputs.artifact-id }}
+        description: Immutable artifact containing the verified distribution set
+      checksums-sha256:
+        value: ${{ jobs.gate.outputs.checksums-sha256 }}
+        description: Authenticated checksum manifest for the publishing job
+concurrency:
+  group: artifacts-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  plan:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    outputs:
+      matrix: ${{ steps.plan.outputs.matrix }}
+      maturin: ${{ steps.plan.outputs.maturin }}
+      rust: ${{ steps.plan.outputs.rust }}
+      python: ${{ steps.plan.outputs.python }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/tooling
+      - id: plan
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+        run: |
+          args=()
+          if [ -n "$RELEASE_VERSION" ]; then args+=(--version "$RELEASE_VERSION"); fi
+          uv run --frozen --no-sync python scripts/artifacts.py plan --commit "$GITHUB_SHA" --github-output "$GITHUB_OUTPUT" "${args[@]}"
+  wheel:
+    needs: plan
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 40
+    defaults:
+      run:
+        shell: bash
+    env:
+      MACOSX_DEPLOYMENT_TARGET: "11.0"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/tooling
+      - run: mkdir -p bundle/dist bundle/evidence
+      - name: Build the native ABI3 wheel with pinned Maturin
+        env:
+          MATURIN_VERSION: ${{ needs.plan.outputs.maturin }}
+          RUSTUP_TOOLCHAIN: ${{ needs.plan.outputs.rust }}
+          BUILD_PYTHON: ${{ needs.plan.outputs.python }}
+          RUST_TARGET: ${{ matrix.rust_target }}
+          MANYLINUX: ${{ matrix.manylinux }}
+        run: |
+          uv python install "$BUILD_PYTHON"
+          build_python=$(uv python find "$BUILD_PYTHON")
+          rustup target add "$RUST_TARGET" --toolchain "$RUSTUP_TOOLCHAIN"
+          rustc --version
+          tools=()
+          args=()
+          if [ -n "$MANYLINUX" ]; then
+            # Zig supplies the older glibc baseline on the native Ubuntu runners.
+            tools+=(--with ziglang==0.15.2)
+            args+=(--zig --compatibility "manylinux_$MANYLINUX" --auditwheel check)
+          fi
+          uvx --python "$BUILD_PYTHON" --from "maturin==$MATURIN_VERSION" "${tools[@]}" maturin build \
+            --release --locked --target "$RUST_TARGET" --out bundle/dist \
+            --interpreter "$build_python" "${args[@]}"
+      - name: Audit the actual wheel and dependency licenses
+        env:
+          TARGET_ID: ${{ matrix.id }}
+        run: uv run --frozen --no-sync python scripts/licenses.py audit --dist bundle/dist --output "bundle/licenses/$TARGET_ID.json"
+      - name: Preserve license findings even when release is blocked
+        if: ${{ always() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: license-audit-${{ matrix.id }}
+          path: bundle/licenses/
+          if-no-files-found: error
+          retention-days: 7
+      - name: Install the exact wheel and test all supported Python versions natively
+        env:
+          TARGET_ID: ${{ matrix.id }}
+        run: uv run --frozen --no-sync python scripts/artifacts.py test --kind wheel --target "$TARGET_ID" --commit "$GITHUB_SHA"
+      - run: uv run --frozen --no-sync twine check bundle/dist/*
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: candidate-${{ matrix.id }}
+          path: bundle/
+          if-no-files-found: error
+          retention-days: 7
+  sdist:
+    needs: plan
+    runs-on: ubuntu-24.04
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/tooling
+      - run: uv build --sdist --out-dir bundle/dist
+      - name: Audit the actual source distribution and dependency licenses
+        run: uv run --frozen --no-sync python scripts/licenses.py audit --dist bundle/dist --output bundle/licenses/sdist.json
+      - name: Preserve license findings even when release is blocked
+        if: ${{ always() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: license-audit-sdist
+          path: bundle/licenses/
+          if-no-files-found: error
+          retention-days: 7
+      - name: Build and install the exact sdist in clean Python 3.12, 3.13 and 3.14 environments
+        run: uv run --frozen --no-sync python scripts/artifacts.py test --kind sdist --target sdist --commit "$GITHUB_SHA"
+      - run: uv run --frozen --no-sync twine check bundle/dist/*
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: candidate-sdist
+          path: bundle/
+          if-no-files-found: error
+          retention-days: 7
+  gate:
+    needs: [plan, wheel, sdist]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    outputs:
+      artifact-id: ${{ steps.upload.outputs.artifact-id }}
+      checksums-sha256: ${{ steps.gate.outputs.checksums-sha256 }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/tooling
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: candidate-*
+          merge-multiple: true
+          path: bundle
+      - id: gate
+        run: uv run --frozen --no-sync python scripts/artifacts.py gate --commit "$GITHUB_SHA" --github-output "$GITHUB_OUTPUT"
+      - run: uv run --frozen --no-sync twine check verified/dist/*
+      - id: upload
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: verified-candidate
+          path: verified/
+          if-no-files-found: error
+          retention-days: 7

chooong_datasift-0.1.0/.github/workflows/benchmarks.yml

@@ -0,0 +1,67 @@
+name: Performance measurements
+on:
+  workflow_dispatch:
+    inputs:
+      baseline-tag:
+        description: Optional previously released vX.Y.Z tag; empty creates an initial baseline
+        required: false
+        type: string
+permissions:
+  contents: read
+concurrency:
+  group: benchmarks-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  benchmark:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: ./.github/actions/tooling
+      - name: Build and install the exact release-profile candidate
+        shell: bash
+        run: |
+          uv build --wheel --out-dir candidate-dist
+          uv export --frozen --no-dev --no-emit-project --output-file candidate-dist/runtime-requirements.txt
+          uv venv --python 3.13 candidate-env
+          uv pip install --python candidate-env/bin/python --require-hashes -r candidate-dist/runtime-requirements.txt
+          uv pip install --python candidate-env/bin/python --no-deps candidate-dist/*.whl
+          uv pip check --python candidate-env/bin/python
+      - name: Prepare an optional released baseline on the same runner
+        env:
+          BASELINE_TAG: ${{ inputs.baseline-tag }}
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          if [ -n "$BASELINE_TAG" ]; then
+            [[ "$BASELINE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+            gh release view "$BASELINE_TAG" --json isDraft,isPrerelease --jq 'select(.isDraft == false and .isPrerelease == false)' | grep -q .
+            git worktree add --detach "$RUNNER_TEMP/baseline" "$BASELINE_TAG"
+            uv build --wheel --directory "$RUNNER_TEMP/baseline" --out-dir "$RUNNER_TEMP/baseline-dist"
+            uv venv --python 3.13 baseline-env
+            uv pip install --python baseline-env/bin/python --require-hashes -r candidate-dist/runtime-requirements.txt
+            uv pip install --python baseline-env/bin/python --no-deps "$RUNNER_TEMP"/baseline-dist/*.whl
+            uv pip check --python baseline-env/bin/python
+          fi
+      - name: Alternate baseline and candidate measurements
+        env:
+          BASELINE_TAG: ${{ inputs.baseline-tag }}
+        shell: bash
+        run: |
+          args=()
+          if [ -n "$BASELINE_TAG" ]; then
+            args+=(--benchmark-baseline-python "$GITHUB_WORKSPACE/baseline-env/bin/python" --benchmark-baseline-ref "$BASELINE_TAG")
+          fi
+          uv run --frozen --no-sync pytest tests/benchmarks/ -m benchmark --benchmark-python "$GITHUB_WORKSPACE/candidate-env/bin/python" --benchmark-output "$RUNNER_TEMP/measurements" --benchmark-build-profile release "${args[@]}"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: always()
+        with:
+          name: performance-${{ github.sha }}
+          path: |
+            ${{ runner.temp }}/measurements/results.json
+            ${{ runner.temp }}/measurements/results.md
+          if-no-files-found: error
+          retention-days: 30

chooong_datasift-0.1.0/.github/workflows/checks.yml

@@ -0,0 +1,30 @@
+name: Source checks
+on:
+  workflow_call:
+permissions:
+  contents: read
+jobs:
+  source:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/tooling
+      - run: uv lock --check
+      # Fail fast on editable source; artifact jobs validate exact installed distributions.
+      - run: uv sync --frozen
+      - run: uv run --frozen --no-sync pytest tests/ -m "not benchmark" --cov --cov-report=term-missing
+      - run: uv run --frozen --no-sync ruff check src tests tooling scripts release
+      - run: uv run --frozen --no-sync ruff format --check src tests tooling scripts release
+      - run: uv run --frozen --no-sync mypy src scripts release
+      - run: uv run --frozen --no-sync mypy --strict tests/benchmarks/*.py
+      - run: uv run --frozen --no-sync pytest tooling/tests/
+      - run: uv run --frozen --no-sync python scripts/artifacts.py plan
+      - run: cargo fmt --manifest-path datasift-core/Cargo.toml -- --check
+      - run: cargo clippy --manifest-path datasift-core/Cargo.toml --locked --all-targets -- -D warnings
+      - run: cargo test --manifest-path datasift-core/Cargo.toml --locked
+      - run: uv run --frozen --no-sync python scripts/docs.py
+      - run: uv run --frozen --no-sync mkdocs build --strict
+      - run: git diff --check

chooong_datasift-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,16 @@
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+permissions:
+  contents: read
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  checks:
+    uses: ./.github/workflows/checks.yml
+  distributions:
+    needs: checks
+    uses: ./.github/workflows/artifacts.yml

chooong_datasift-0.1.0/.github/workflows/docs-pages.yml

@@ -0,0 +1,38 @@
+name: Documentation deployment
+on:
+  workflow_dispatch:
+concurrency:
+  group: docs-pages-${{ github.ref }}
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  build:
+    if: ${{ vars.PAGES_DEPLOY_ENABLED == 'true' && github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/tooling
+      - run: uv sync --frozen
+      - run: uv run --frozen --no-sync python scripts/docs.py
+      - run: uv run --frozen --no-sync mkdocs build --strict
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: site
+  deploy:
+    if: ${{ vars.PAGES_DEPLOY_ENABLED == 'true' && github.ref == 'refs/heads/main' }}
+    needs: build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    permissions:
+      pages: write
+      id-token: write
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

chooong_datasift-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,101 @@
+name: Release dry run
+# No release/tag trigger: preparation must not publish anything automatically.
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Exact version already committed in pyproject.toml and Cargo.toml
+        required: true
+        type: string
+      publish:
+        description: Publish only with repository enablement and protected environment approval
+        required: false
+        type: boolean
+        default: false
+      approved-commit:
+        description: Exact reviewed release commit SHA (required for publishing)
+        required: false
+        type: string
+permissions:
+  contents: read
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  checks:
+    uses: ./.github/workflows/checks.yml
+  release-identity:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - name: Validate the explicitly approved tag and commit for publishing
+        if: inputs.publish
+        env:
+          VERSION: ${{ inputs.version }}
+          APPROVED_COMMIT: ${{ inputs.approved-commit }}
+        shell: bash
+        run: |
+          test "$GITHUB_REF" = "refs/tags/v$VERSION"
+          test "$GITHUB_SHA" = "$APPROVED_COMMIT"
+          test "$(git rev-parse "$GITHUB_REF^{commit}")" = "$GITHUB_SHA"
+          git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+  distributions:
+    needs: [checks, release-identity]
+    uses: ./.github/workflows/artifacts.yml
+    with:
+      version: ${{ inputs.version }}
+  publish:
+    needs: [release-identity, distributions]
+    # Publishing also requires the exact approved identity and protected pypi environment.
+    if: ${{ inputs.publish && vars.PYPI_PUBLISH_ENABLED == 'true' && startsWith(github.ref, 'refs/tags/v') }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment:
+      name: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          artifact-ids: ${{ needs.distributions.outputs.artifact-id }}
+          path: verified
+      - name: Recheck gate-authenticated bytes without building or installing project code
+        env:
+          EXPECTED_SHA256: ${{ needs.distributions.outputs.checksums-sha256 }}
+        run: python scripts/verify_publish.py verified "$EXPECTED_SHA256"
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1
+        with:
+          packages-dir: verified/dist/
+          skip-existing: false
+      - name: Verify the published filenames and bytes on PyPI
+        env:
+          EXPECTED_SHA256: ${{ needs.distributions.outputs.checksums-sha256 }}
+          VERSION: ${{ inputs.version }}
+        run: python scripts/verify_publish.py verified "$EXPECTED_SHA256" --pypi-version "$VERSION"
+  github-release:
+    needs: publish
+    if: ${{ needs.publish.result == 'success' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Publish GitHub release only after verified PyPI publication
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        shell: bash
+        run: |
+          python -c 'import os,pathlib; text=pathlib.Path("CHANGELOG.md").read_text(); version=os.environ["VERSION"]; notes=text.split("## "+version+"\n",1)[1].split("\n## ",1)[0]; pathlib.Path("release-notes.md").write_text(notes)'
+          gh release create "v$VERSION" --verify-tag --title "v$VERSION" --notes-file release-notes.md

chooong_datasift-0.1.0/.pymarkdown.json

@@ -0,0 +1,6 @@
+{
+  "plugins": {
+    "md013": {"line_length": 100, "code_blocks": false, "tables": false}
+  },
+  "extensions": {"markdown-tables": {"enabled": true}, "markdown-task-list-items": {"enabled": true}}
+}

chooong_datasift-0.1.0/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+## Unreleased
+
+## 0.1.0
+
+### Added
+
+- Streaming XLSX/XLSM and CSV input with deterministic multi-file/glob ordering.
+- Automatic table discovery, worksheet selection, repeated/normalized headers,
+  adjacent and stacked tables, explicit column bindings and source windows.
+- Composable filters, ordered projection, required/default/type rules and
+  explicit row classification, with exact Decimal, Money and temporal values.
+- Typed Python models, immutable matching rows, closeable batches and ordered
+  matched/rejected records with source metadata, reasons and scan statistics.
+- Native NDJSON/Parquet export and CLI, with staged output, journaled commit and
+  recovery bound to caller destinations and an independently trusted journal hash.
+- CPython 3.12–3.14 support using a native Python 3.12 stable ABI extension.
+
+### Fixed
+
+- Accept equivalent absolute Windows parent paths when validating recovery journals.

chooong_datasift-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,28 @@
+# Contributing
+
+Work on a feature branch and submit one focused pull request. Preserve public
+contracts and use synthetic inputs; never attach personal workbooks or secrets.
+
+Install CPython 3.12–3.14, uv, Rust 1.95.0 and a native linker, then run:
+
+<!-- check: syntax -->
+
+```bash
+uv sync --frozen
+```
+
+The canonical [contributor guide](docs/development/contributing.md) lists exact
+lint, type, test, documentation and build commands. Run those checks before
+submitting changes. It also explains runnable documentation examples and local
+verification against installed wheels.
+
+Update affected guides/API references with behavior changes. Keep
+[CHANGELOG.md](CHANGELOG.md) limited to features, breaking changes, relevant
+bugfixes and security changes. Report observed test failures and validation gaps
+in the PR, not in public usage guides.
+
+See [architecture](docs/development/architecture.md),
+[Rust tests](datasift-core/README.md#test-structure),
+[benchmarks](docs/development/benchmarks.md) and
+[release procedures](.github/RELEASING.md). Version changes, tags and publication
+require a separate explicit release decision. Contributions use [Apache-2.0](LICENSE).