codeplain 0.3.13.dev42__tar.gz → 0.3.13.dev44__tar.gz

{codeplain-0.3.13.dev42 → codeplain-0.3.13.dev44}/.github/dependabot.yml

@@ -4,11 +4,22 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 3
+    # Skip releases younger than two days. Security updates are never delayed.
+    cooldown:
+      default-days: 2
+    open-pull-requests-limit: 5
+    # "chore(deps): ..." — also applies to pip security update PRs.
     commit-message:
-      prefix: "dependabot"
+      prefix: "chore"
+      include: "scope"
     labels:
       - "dependencies"
+    # Routine bumps arrive as one weekly PR; majors stay separate.
+    groups:
+      pip-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
 
   # Keeps the SHA-pinned actions in publish-to-pypi.yml patched.
   - package-ecosystem: "github-actions"

codeplain-0.3.13.dev44/.github/workflows/notify-slack-on-main-merge.yml

@@ -0,0 +1,37 @@
+name: Notify Slack on Merge to Main
+
+# pull_request_target runs this file from main with secrets, so merged PRs from
+# forks post too. Nothing from the PR is checked out or run; the title only
+# reaches the shell through an env var.
+on:
+  pull_request_target:
+    types: [closed]
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  notify:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.merged == true && vars.SLACK_CHANNEL_ID != ''
+    steps:
+      # Slack reads <, > and & as markup: escape them so a PR title cannot
+      # mention @channel or rewrite the link.
+      - name: Escape the PR title for Slack
+        id: pr
+        env:
+          TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          printf 'title=%s\n' "$(printf '%s' "$TITLE" | tr '\r\n' '  ' | sed -e 's/&/\&amp;/g' -e 's/</\&lt;/g' -e 's/>/\&gt;/g')" >> "$GITHUB_OUTPUT"
+
+      - name: Send notification to Slack
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          # toJSON quotes the title, so quotes and colons in it keep the payload valid.
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: ${{ toJSON(format('[Codeplain Client] PR <{0}|#{1}: {2}> was merged to main by `{3}`.', github.event.pull_request.html_url, github.event.pull_request.number, steps.pr.outputs.title, github.actor)) }}

{codeplain-0.3.13.dev42 → codeplain-0.3.13.dev44}/.github/workflows/publish-dev-to-pypi.yml

@@ -110,9 +110,6 @@ jobs:
       # authenticate this run — no long-lived API token needed.
       id-token: write
 
-    env:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-
     steps:
       - name: Download distribution packages
         uses: actions/download-artifact@v8
@@ -127,21 +124,57 @@ jobs:
           # version should be a no-op, not a red build.
           skip-existing: true
 
-      - name: Notify Slack (success)
-        if: ${{ success() && env.SLACK_WEBHOOK_URL != '' }}
-        env:
-          VERSION: ${{ needs.build.outputs.version }}
-        run: |
-          # Spell out the --pre install: a plain "pip install codeplain" will
-          # NOT pick this up, which otherwise reads as a broken publish.
-          TEXT="*Codeplain Client*: dev build \`$VERSION\` published to PyPI :test_tube:. Normal installs are unaffected — try it with \`pip install --pre codeplain==$VERSION\`. Pre-release builds talk to \`api.test.codeplain.ai\` by default."
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H 'Content-type: application/json' \
-            --data "$(jq -n --arg t "$TEXT" '{text:$t}')"
+  # End-of-run notices run in their own job: a failed Slack post fails only this
+  # job, not the publish or its GitHub deployment, and "Re-run failed jobs"
+  # re-posts without publishing again.
+  notify:
+    name: Notify Slack
+    needs: [build, publish-dev]
+    if: ${{ !cancelled() && vars.SLACK_CHANNEL_ID != '' }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Short SHA
+        run: echo "SHORT_SHA=${GITHUB_SHA:0:7}" >> "$GITHUB_ENV"
+
+      - name: Notify Slack (build failure)
+        if: ${{ needs.build.result == 'failure' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: Building the dev build FAILED :x: (commit `${{ env.SHORT_SHA }}`). Nothing was published to PyPI.
+              See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.
 
       - name: Notify Slack (failure)
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
-        run: |
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H 'Content-type: application/json' \
-            --data "{\"text\":\"*Codeplain Client*: Publishing dev build to PyPI FAILED :x: (commit \`${{ github.sha }}\`). See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}"
+        if: ${{ needs.publish-dev.result == 'failure' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: Publishing dev build to PyPI FAILED :x: (commit `${{ env.SHORT_SHA }}`).
+              See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.
+
+      # Spell out the --pre install: a plain "pip install codeplain" will
+      # NOT pick this up, which otherwise reads as a broken publish.
+      - name: Notify Slack (success)
+        if: ${{ needs.publish-dev.result == 'success' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: dev build `${{ needs.build.outputs.version }}` published to PyPI :test_tube:.
+              Normal installs are unaffected — try it with `pip install --pre codeplain==${{ needs.build.outputs.version }}`.
+              Pre-release builds talk to `api.test.codeplain.ai` by default.

{codeplain-0.3.13.dev42 → codeplain-0.3.13.dev44}/.github/workflows/publish-install-script.yml

@@ -14,9 +14,6 @@ jobs:
     name: Upload to Cloudflare R2
     runs-on: ubuntu-latest
 
-    env:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -57,17 +54,43 @@ jobs:
             --content-type "text/plain"
           echo "✓ examples.ps1 uploaded to R2"
 
-      - name: Notify Slack (success)
-        if: ${{ success() && env.SLACK_WEBHOOK_URL != '' }}
-        run: |
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H 'Content-type: application/json' \
-            --data "{\"text\":\"*Codeplain Client*: Install scripts deployed to R2 :white_check_mark: (\`${GITHUB_SHA:0:7}\`, by *${{ github.actor }}*).\"}"
+  # End-of-run notices run in their own job: a failed Slack post fails only this
+  # job, and "Re-run failed jobs" re-posts without uploading again.
+  notify:
+    name: Notify Slack
+    needs: publish
+    if: ${{ !cancelled() && vars.SLACK_CHANNEL_ID != '' }}
+    runs-on: ubuntu-latest
+    permissions: {}
+
+    steps:
+      - name: Short SHA
+        run: echo "SHORT_SHA=${GITHUB_SHA:0:7}" >> "$GITHUB_ENV"
 
       - name: Notify Slack (failure)
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
-        run: |
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H 'Content-type: application/json' \
-            --data "{\"text\":\"*Codeplain Client*: Install script deploy to R2 FAILED :x: (\`${GITHUB_SHA:0:7}\`). Users may be getting a stale installer. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}"
+        if: ${{ needs.publish.result == 'failure' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: Install script deploy to R2 FAILED :x: (`${{ env.SHORT_SHA }}`).
+              Users may be getting a stale installer.
+              See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.
+
+      - name: Notify Slack (success)
+        if: ${{ needs.publish.result == 'success' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: Install scripts deployed to R2 :white_check_mark:
+              (`${{ env.SHORT_SHA }}`, by *${{ github.actor }}*).
 

codeplain-0.3.13.dev44/.github/workflows/publish-to-pypi.yml

@@ -0,0 +1,204 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+
+# Least privilege by default: jobs get no GITHUB_TOKEN scopes unless they
+# opt in below.
+permissions: {}
+
+jobs:
+  build:
+    name: Build distribution
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # hatch-vcs derives the version from git tags, so we need full history.
+          fetch-depth: 0
+
+      # Non-fatal: Slack being down must not block the release.
+      - name: Notify Slack (start)
+        if: ${{ vars.SLACK_CHANNEL_ID != '' }}
+        continue-on-error: true
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: Release `${{ github.ref_name }}` published by *${{ github.actor }}*
+              — building and publishing to PyPI...
+
+      - name: Install uv
+        # uv provisions its own Python (honoring requires-python), so no
+        # separate actions/setup-python step is needed.
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Build package
+        # hatch-vcs reads the version straight from the release tag.
+        run: |
+          uv build
+          echo "Built distributions:"
+          ls -l dist/
+
+      - name: Store the distribution packages
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: python-package-distributions
+          path: dist/
+
+      - name: Upload assets to GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload ${{ github.ref_name }} dist/* --clobber
+
+  publish-to-pypi:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/codeplain
+    permissions:
+      # Mint a short-lived OIDC token so PyPI Trusted Publishing can
+      # authenticate this run — no long-lived API token needed.
+      id-token: write
+
+    steps:
+      - name: Download distribution packages
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-package-distributions
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1
+
+  # End-of-run notices run in their own job: a failed Slack post fails only this
+  # job, not the publish or its GitHub deployment, and "Re-run failed jobs"
+  # re-posts without publishing again.
+  notify:
+    name: Notify Slack
+    needs: [build, publish-to-pypi]
+    if: ${{ !cancelled() && vars.SLACK_CHANNEL_ID != '' }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Notify Slack (build failure)
+        if: ${{ needs.build.result == 'failure' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: Build of `${{ github.ref_name }}` FAILED :x:. Nothing was published to PyPI.
+              See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.
+
+      - name: Notify Slack (failure)
+        if: ${{ needs.publish-to-pypi.result == 'failure' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: Publishing `${{ github.ref_name }}` to PyPI FAILED :x:.
+              See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.
+
+      # The tag (v0.4.0rc1) without its "v", for the install command below.
+      - name: Version from tag
+        id: version
+        if: ${{ needs.publish-to-pypi.result == 'success' }}
+        env:
+          TAG: ${{ github.ref_name }}
+        run: echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+
+      # GitHub marks the release itself as a pre-release; the tag (v0.4.0rc1)
+      # carries the same intent for PEP 440. pip and uv skip pre-releases by
+      # default, so "--upgrade" would NOT pick one up. Tell people the command
+      # that actually works.
+      - name: Notify Slack (pre-release published)
+        if: ${{ needs.publish-to-pypi.result == 'success' && github.event.release.prerelease }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: pre-release `${{ github.ref_name }}` published to PyPI :test_tube:.
+              Normal installs are unaffected — try it with `pip install --pre codeplain==${{ steps.version.outputs.version }}`.
+
+      - name: Notify Slack (release published)
+        if: ${{ needs.publish-to-pypi.result == 'success' && !github.event.release.prerelease }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          errors: true
+          payload: |
+            channel: ${{ vars.SLACK_CHANNEL_ID }}
+            text: >-
+              *Codeplain Client*: `${{ github.ref_name }}` published to PyPI :white_check_mark:.
+              Install with `pip install --upgrade codeplain`.
+
+  # Release pipelines to be turned on only after the rest of the infrastructure
+  # is ready.
+  #
+  # # Runs only after the package is on PyPI. Kept as its own job so the publish job
+  # # keeps its minimal permissions and no checkout.
+  # linear-release:
+  #   name: Record release in Linear
+  #   needs: publish-to-pypi
+  #   runs-on: ubuntu-latest
+  #
+  #   permissions:
+  #     contents: read
+  #
+  #   steps:
+  #     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+  #       with:
+  #         # The scan needs full history.
+  #         fetch-depth: 0
+  #
+  #     # Non-fatal: the package is already published.
+  #     - name: Record release in Linear
+  #       id: linear
+  #       continue-on-error: true
+  #       uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
+  #       with:
+  #         access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
+  #         version: ${{ github.ref_name }}
+  #         # Pin the CLI the action downloads, not just the action.
+  #         cli_version: v0.16.0
+  #
+  #     # continue-on-error keeps the job green, so this checks the step's own
+  #     # outcome — `failure()` would never fire.
+  #     - name: Notify Slack (release not recorded)
+  #       if: ${{ steps.linear.outcome == 'failure' && vars.SLACK_CHANNEL_ID != '' }}
+  #       uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+  #       with:
+  #         method: chat.postMessage
+  #         token: ${{ secrets.SLACK_BOT_TOKEN }}
+  #         errors: true
+  #         payload: |
+  #           channel: ${{ vars.SLACK_CHANNEL_ID }}
+  #           text: >-
+  #             *Codeplain Client*: `${{ github.ref_name }}` is on PyPI, but recording it in Linear FAILED :warning:.
+  #             See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.

{codeplain-0.3.13.dev42 → codeplain-0.3.13.dev44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codeplain
-Version: 0.3.13.dev42
+Version: 0.3.13.dev44
 Summary: Transform plain language specifications into working code
 License-File: LICENSE
 Classifier: Environment :: Console

codeplain-0.3.13.dev42/.github/workflows/nofity-slack-on-main-merge.yml

@@ -1,22 +0,0 @@
-name: Notify Slack on Merge to Main
-
-on:
-  pull_request:
-    types: [closed]
-    branches:
-      - main
-
-jobs:
-  notify:
-    runs-on: ubuntu-latest
-    if: github.event.pull_request.merged == true
-    steps:
-      - name: Send notification to Slack
-        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
-        with:
-          webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
-          webhook-type: incoming-webhook
-          payload: |
-            {
-              "text": ${{ toJSON(format('[Codeplain Client] PR <{0}|#{1}: {2}> was merged to main by `{3}`.', github.event.pull_request.html_url, github.event.pull_request.number, github.event.pull_request.title, github.actor)) }}
-            }

codeplain-0.3.13.dev42/.github/workflows/publish-to-pypi.yml

@@ -1,159 +0,0 @@
-name: Publish to PyPI
-
-on:
-  release:
-    types: [published]
-
-# Least privilege by default: jobs get no GITHUB_TOKEN scopes unless they
-# opt in below.
-permissions: {}
-
-jobs:
-  build:
-    name: Build distribution
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    env:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # hatch-vcs derives the version from git tags, so we need full history.
-          fetch-depth: 0
-
-      - name: Notify Slack (start)
-        if: ${{ env.SLACK_WEBHOOK_URL != '' }}
-        run: |
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H 'Content-type: application/json' \
-            --data "{\"text\":\"*Codeplain Client*: Release \`${{ github.ref_name }}\` published by *${{ github.actor }}* — building and publishing to PyPI...\"}"
-
-      - name: Install uv
-        # uv provisions its own Python (honoring requires-python), so no
-        # separate actions/setup-python step is needed.
-        run: |
-          curl -LsSf https://astral.sh/uv/install.sh | sh
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-
-      - name: Build package
-        # hatch-vcs reads the version straight from the release tag.
-        run: |
-          uv build
-          echo "Built distributions:"
-          ls -l dist/
-
-      - name: Store the distribution packages
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: python-package-distributions
-          path: dist/
-
-      - name: Upload assets to GitHub Release
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh release upload ${{ github.ref_name }} dist/* --clobber
-
-      - name: Notify Slack (build failure)
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
-        run: |
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H 'Content-type: application/json' \
-            --data "{\"text\":\"*Codeplain Client*: Build of \`${{ github.ref_name }}\` FAILED :x:. Nothing was published to PyPI. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}"
-
-  publish-to-pypi:
-    name: Publish to PyPI
-    needs: build
-    runs-on: ubuntu-latest
-    environment:
-      name: pypi
-      url: https://pypi.org/p/codeplain
-    permissions:
-      # Mint a short-lived OIDC token so PyPI Trusted Publishing can
-      # authenticate this run — no long-lived API token needed.
-      id-token: write
-
-    env:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-
-    steps:
-      - name: Download distribution packages
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: python-package-distributions
-          path: dist/
-
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1
-
-      - name: Notify Slack (success)
-        if: ${{ success() && env.SLACK_WEBHOOK_URL != '' }}
-        env:
-          # GitHub marks the release itself as a pre-release; the tag
-          # (v0.4.0rc1) carries the same intent for PEP 440.
-          IS_PRERELEASE: ${{ github.event.release.prerelease }}
-          TAG: ${{ github.ref_name }}
-        run: |
-          VERSION="${TAG#v}"
-          if [ "$IS_PRERELEASE" = "true" ]; then
-            # pip and uv skip pre-releases by default, so "--upgrade" would
-            # NOT pick this up. Tell people the command that actually works.
-            TEXT="*Codeplain Client*: pre-release \`$TAG\` published to PyPI :test_tube:. Normal installs are unaffected — try it with \`pip install --pre codeplain==$VERSION\`."
-          else
-            TEXT="*Codeplain Client*: \`$TAG\` published to PyPI :white_check_mark:. Install with \`pip install --upgrade codeplain\`."
-          fi
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H 'Content-type: application/json' \
-            --data "$(jq -n --arg t "$TEXT" '{text:$t}')"
-
-      - name: Notify Slack (failure)
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
-        run: |
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H 'Content-type: application/json' \
-            --data "{\"text\":\"*Codeplain Client*: Publishing \`${{ github.ref_name }}\` to PyPI FAILED :x:. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}"
-
-  # Release pipelines to be turned on only after the rest of the infrastructure
-  # is ready.
-  #
-  # # Runs only after the package is on PyPI. Kept as its own job so the publish job
-  # # keeps its minimal permissions and no checkout.
-  # linear-release:
-  #   name: Record release in Linear
-  #   needs: publish-to-pypi
-  #   runs-on: ubuntu-latest
-  #
-  #   permissions:
-  #     contents: read
-  #
-  #   env:
-  #     SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-  #
-  #   steps:
-  #     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-  #       with:
-  #         # The scan needs full history.
-  #         fetch-depth: 0
-  #
-  #     # Non-fatal: the package is already published.
-  #     - name: Record release in Linear
-  #       id: linear
-  #       continue-on-error: true
-  #       uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
-  #       with:
-  #         access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
-  #         version: ${{ github.ref_name }}
-  #         # Pin the CLI the action downloads, not just the action.
-  #         cli_version: v0.16.0
-  #
-  #     # continue-on-error keeps the job green, so this checks the step's own
-  #     # outcome — `failure()` would never fire.
-  #     - name: Notify Slack (release not recorded)
-  #       if: ${{ steps.linear.outcome == 'failure' && env.SLACK_WEBHOOK_URL != '' }}
-  #       run: |
-  #         curl -s -X POST "$SLACK_WEBHOOK_URL" \
-  #           -H 'Content-type: application/json' \
-  #           --data "{\"text\":\"*Codeplain Client*: \`${{ github.ref_name }}\` is on PyPI, but recording it in Linear FAILED :warning:. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}"