copilot-session-usage 0.7.7__tar.gz → 0.8.1__tar.gz

{copilot_session_usage-0.7.7 → copilot_session_usage-0.8.1}/.github/skills/gh-release-notes/SKILL.md

@@ -41,11 +41,15 @@ Markdown.
 The skill includes `scripts/generate_release_notes.py`, a standalone Python script that:
 
 - verifies the requested Git range and Copilot skill availability;
+- writes the deterministic `## Maintenance` output without invoking Copilot when the
+	requested Git range contains no commits or the caller explicitly requests
+	`--maintenance-only`;
 - precomputes the commit log and complete diff locally so generation also works
 	when the Copilot CLI cannot inspect Git history inside its tool environment;
 - invokes the Copilot CLI with `/gh-release-notes`;
-- writes the requested output file; and
-- verifies only that the requested output file is readable and non-empty. The
+- gives the skill scoped file-writing tools so it writes the final Markdown to the
+	requested output file while the response stream is discarded; and
+- verifies that the requested output file follows the release-note output contract. The
 	script does not normalize Markdown or decide user impact, categorize changes,
 	discover documentation, infer breaking changes, or require examples; those
 	decisions belong to this skill.
@@ -59,6 +63,19 @@ python .github/skills/gh-release-notes/scripts/generate_release_notes.py \
 	--output release-notes.md
 ```
 
+For an intentional maintenance-only release whose range contains internal commits,
+pass `--maintenance-only` to write the deterministic Maintenance section without
+invoking Copilot.
+
+`release-notes.md` is the canonical shared artifact filename. The generator, both
+release workflows, and `gh release --notes-file` use this same file so the release
+body never depends on Copilot's response stream. An explicitly supplied `--output`
+path is honored exactly. For a non-empty range, the generator creates the empty
+handoff file before invoking Copilot so the skill can edit the known
+repository-relative target; the file is accepted only after the skill has replaced
+it with valid Markdown. An empty range produces the valid maintenance output
+directly and does not require Copilot authentication or skill discovery.
+
 The range is Git's two-dot range, `from_ref..to_ref`: `from_ref` itself is excluded
 and `to_ref` is included. Both refs may be tags, branches, or commit IDs.
 
@@ -396,12 +413,12 @@ When this skill is invoked by a CI job with an explicit output-file request:
 
 - Honor the requested tag range and repository path exactly.
 - Treat the requested output file as mandatory. Writing it is the only successful completion condition.
-- Use the `create` file tool when the requested file does not exist, or the `edit` file tool when it already exists.
+- Replace the pre-created handoff file with the final Markdown using the `edit` file tool.
 - After writing, use the `read` file tool to verify that the requested file exists and contains the final release-note Markdown.
 - Do not modify, commit, or push any other repository files.
 - The output file must contain only the final release-note Markdown, without an explanation, title heading, or code fence.
 - The first line must be exactly one of: `## New Features`, `## Enhancements`, `## Bug Fixes`, `## Breaking Changes`, `## Examples`, `## Documentation`, or `## Maintenance`.
-- Do not write a preamble, title, code fence, or explanatory text before the first release-note section.
+- Do not write a preamble, tool-call transcript, title, code fence, or explanatory text before the first release-note section.
 - Never use the Copilot response stream as output. The caller may discard it after the file is written.
 - Do not report the release notes only in the response. If the file cannot be written or verified, the task has failed.
 - Preserve the user-impact categories, concrete examples, evidence-based breaking-change detection, and repository-derived public documentation links described above.

{copilot_session_usage-0.7.7 → copilot_session_usage-0.8.1}/.github/skills/gh-release-notes/scripts/generate_release_notes.py

@@ -13,6 +13,31 @@ from pathlib import Path
 SKILL_NAME = "gh-release-notes"
 DEFAULT_OUTPUT = Path("release-notes.md")
 MAX_GIT_CONTEXT_LENGTH = 60_000
+PERMITTED_HEADINGS = frozenset(
+    {
+        "## New Features",
+        "## Enhancements",
+        "## Bug Fixes",
+        "## Breaking Changes",
+        "## Examples",
+        "## Documentation",
+        "## Maintenance",
+    }
+)
+TRACE_MARKERS = (
+    "<function_call",
+    "<thinking>",
+    "<system_notification>",
+    "assistant.reasoning",
+    "function_calls",
+    "to=bash.exec",
+    "to=functions.exec",
+)
+MAINTENANCE_NOTES = (
+    "## Maintenance\n\n"
+    "This release contains maintenance and internal improvements. "
+    "No user-facing behavior changed.\n"
+)
 
 
 def build_parser() -> argparse.ArgumentParser:
@@ -40,6 +65,11 @@ def build_parser() -> argparse.ArgumentParser:
         default=DEFAULT_OUTPUT,
         help="Release-note output path (default: release-notes.md).",
     )
+    parser.add_argument(
+        "--maintenance-only",
+        action="store_true",
+        help="Write deterministic maintenance notes without invoking Copilot.",
+    )
     parser.add_argument(
         "--model",
         default=None,
@@ -49,7 +79,7 @@ def build_parser() -> argparse.ArgumentParser:
         "--validate",
         type=Path,
         metavar="FILE",
-        help="Verify that an existing release-note file is readable and non-empty.",
+        help="Verify that an existing release-note file follows the output contract.",
     )
     return parser
 
@@ -87,11 +117,20 @@ def build_prompt(
     git_context: str | None = None,
 ) -> str:
     """Build the small orchestration prompt; the skill owns release-note policy."""
+    try:
+        output_reference = output.relative_to(repo).as_posix()
+    except ValueError:
+        output_reference = str(output)
+
     prompt = (
         f"Use the /{SKILL_NAME} skill. Generate release notes for the exact Git range "
         f"{from_ref}..{to_ref} in {repo}. The skill is authoritative for analysis, "
-        f"classification, wording, documentation, and Markdown format. Write only "
-        f"the final release-note Markdown to {output}; do not summarize it in your response. "
+        f"classification, wording, documentation, and Markdown format. Write the final "
+        f"release-note Markdown directly to the shared repository file "
+        f"{output_reference} using the file-writing tools. Its resolved path is {output}. "
+        "The release workflow reads this exact file as its notes input; the Copilot "
+        "response stream is discarded. Do not put release notes or a summary in your "
+        "response, and do not modify any other files. "
         "Before writing, enforce the skill's final output contract: render every "
         "documentation URL as concise inline Markdown such as "
         "See the [pricing reference for details](https://example.com/pricing), never as a "
@@ -130,6 +169,8 @@ def build_copilot_command(
         "--allow-tool=read",
         "--allow-tool=write",
         "--allow-tool=shell(git:*)",
+        "--allow-url=https://github.com",
+        "--allow-url=https://copilot-session-usage.readthedocs.io",
     ]
     if model:
         command.extend(["--model", model])
@@ -177,6 +218,17 @@ def validate_range(repo: Path, from_ref: str, to_ref: str) -> None:
         raise ValueError(f"Git ref {from_ref!r} is not an ancestor of {to_ref!r}.")
 
 
+def range_has_commits(repo: Path, from_ref: str, to_ref: str) -> bool:
+    """Return whether the requested Git range contains at least one commit."""
+    count = git_output(repo, "commit count", "rev-list", "--count", f"{from_ref}..{to_ref}")
+    return count != "0"
+
+
+def write_maintenance_notes(output: Path) -> None:
+    """Write the deterministic notes required for a maintenance-only release."""
+    output.write_text(MAINTENANCE_NOTES, encoding="utf-8")
+
+
 def run_skill_check(repo: Path) -> None:
     """Ensure the release-note skill is installed in the Copilot CLI."""
     result = subprocess.run(
@@ -204,7 +256,7 @@ def run_copilot(
     prompt: str,
     model: str | None,
 ) -> None:
-    """Run Copilot CLI and fail with its captured diagnostics when needed."""
+    """Run Copilot CLI and leave the generated Markdown in the shared output file."""
     result = subprocess.run(
         build_copilot_command(prompt, model),
         cwd=repo,
@@ -218,13 +270,38 @@ def run_copilot(
 
 
 def validate_output(output: Path) -> None:
-    """Verify that Copilot created a readable, non-empty output file."""
+    """Verify that generated release notes follow the file output contract."""
     try:
         content = output.read_text(encoding="utf-8")
     except OSError as error:
         raise RuntimeError(f"Unable to read release-note output {output}: {error}") from error
     if not content.strip():
         raise RuntimeError(f"Copilot created an empty release-note file: {output}")
+
+    first_line = content.splitlines()[0] if content.splitlines() else ""
+    if first_line not in PERMITTED_HEADINGS:
+        raise RuntimeError(
+            f"Release-note output must start with one of the permitted section headings: {output}"
+        )
+
+    lowered = content.lower()
+    leaked_markers = [marker for marker in TRACE_MARKERS if marker.lower() in lowered]
+    if leaked_markers:
+        markers = ", ".join(leaked_markers)
+        raise RuntimeError(
+            f"Release-note output contains Copilot trace markers ({markers}): {output}"
+        )
+    if "```" in content:
+        raise RuntimeError(f"Release-note output must not contain a code fence: {output}")
+    if any(line.startswith("# ") for line in content.splitlines()):
+        raise RuntimeError(f"Release-note output must not contain a title heading: {output}")
+    headings = [line for line in content.splitlines() if line.startswith("## ")]
+    invalid_headings = [heading for heading in headings if heading not in PERMITTED_HEADINGS]
+    if invalid_headings:
+        raise RuntimeError(
+            f"Release-note output contains an invalid section heading "
+            f"{invalid_headings[0]!r}: {output}"
+        )
     print("Release-note output file verified.")
 
 
@@ -234,16 +311,23 @@ def generate_release_notes(
     to_ref: str,
     output: Path,
     model: str | None,
+    maintenance_only: bool = False,
 ) -> None:
     """Generate release notes, then validate the resulting Markdown file."""
     repo = repo.resolve()
     output = resolve_path(output, repo).resolve()
     validate_range(repo, from_ref, to_ref)
     output.parent.mkdir(parents=True, exist_ok=True)
-    output.unlink(missing_ok=True)
+    output.write_text("", encoding="utf-8")
 
     print(f"Generating release notes from {from_ref} (exclusive) to {to_ref} (inclusive).")
     print(f"Copilot model: {model or 'CLI default'}")
+    if maintenance_only or not range_has_commits(repo, from_ref, to_ref):
+        write_maintenance_notes(output)
+        validate_output(output)
+        print(f"Release notes written to {output}")
+        return
+
     require_copilot_token()
     run_skill_check(repo)
     git_context = build_git_context(repo, from_ref, to_ref)
@@ -285,6 +369,7 @@ def main(argv: Sequence[str] | None = None) -> int:
             to_ref=args.to_ref,
             output=args.output,
             model=args.model or os.environ.get("COPILOT_MODEL"),
+            maintenance_only=args.maintenance_only,
         )
     except (OSError, RuntimeError, ValueError) as error:
         print(f"error: {error}", file=sys.stderr)

{copilot_session_usage-0.7.7 → copilot_session_usage-0.8.1}/.github/workflows/ci.yml

@@ -6,6 +6,11 @@ on:
   pull_request:
     branches: [main, master]
   workflow_call:
+    inputs:
+      ref:
+        description: "Commit to validate"
+        required: false
+        type: string
 
 jobs:
   test:
@@ -17,6 +22,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.sha }}
 
       - name: Install uv
         uses: astral-sh/setup-uv@v5
@@ -49,6 +56,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.sha }}
 
       - name: Install uv
         uses: astral-sh/setup-uv@v5

copilot_session_usage-0.8.1/.github/workflows/publish.yml

@@ -0,0 +1,98 @@
+name: Publish existing tag to PyPI
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing version tag to publish, for example v0.7.1"
+        required: true
+        type: string
+
+concurrency:
+  group: publish-${{ github.ref }}-${{ inputs.tag }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/copilot-session-usage
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Require the default branch
+        env:
+          WORKFLOW_REF: ${{ github.ref }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected_ref="refs/heads/$DEFAULT_BRANCH"
+          if [[ "$WORKFLOW_REF" != "$expected_ref" ]]; then
+            echo "::error::PyPI publication must be dispatched from the default branch ($DEFAULT_BRANCH)."
+            echo "::error::Received workflow ref: $WORKFLOW_REF"
+            exit 1
+          fi
+
+      - name: Check out repository history
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.sha }}
+
+      - name: Validate and check out the requested tag
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          TARGET_TAG: ${{ inputs.tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ ! "$TARGET_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Expected a semantic-version tag such as v0.7.1, got '$TARGET_TAG'."
+            exit 1
+          fi
+          if ! git ls-remote --exit-code --refs origin "refs/tags/$TARGET_TAG" >/dev/null; then
+            echo "::error::Remote tag $TARGET_TAG does not exist."
+            exit 1
+          fi
+
+          git fetch --force origin "refs/tags/$TARGET_TAG:refs/tags/$TARGET_TAG"
+          git fetch --force origin \
+            "refs/heads/$DEFAULT_BRANCH:refs/remotes/origin/$DEFAULT_BRANCH"
+          target_commit="$(git rev-parse --verify "refs/tags/$TARGET_TAG^{commit}")"
+          if ! git merge-base --is-ancestor "$target_commit" "refs/remotes/origin/$DEFAULT_BRANCH"; then
+            echo "::error::Release tag $TARGET_TAG is not reachable from the default branch."
+            exit 1
+          fi
+          git checkout --detach "$target_commit"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Build package
+        run: uv build
+
+      - name: Verify package version
+        env:
+          TARGET_TAG: ${{ inputs.tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected_version="${TARGET_TAG#v}"
+          shopt -s nullglob
+          artifacts=(
+            dist/copilot_session_usage-"$expected_version"-*.whl
+            dist/copilot_session_usage-"$expected_version".tar.gz
+          )
+          if (( ${#artifacts[@]} != 2 )); then
+            echo "::error::Built package artifacts do not match $TARGET_TAG."
+            printf '%s\n' dist/*
+            exit 1
+          fi
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

{copilot_session_usage-0.7.7 → copilot_session_usage-0.8.1}/.github/workflows/release-notes.yml

@@ -20,11 +20,52 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Check out tagged source
+      - name: Require the default branch
+        env:
+          WORKFLOW_REF: ${{ github.ref }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected_ref="refs/heads/$DEFAULT_BRANCH"
+          if [[ "$WORKFLOW_REF" != "$expected_ref" ]]; then
+            echo "::error::Release-note recovery must be dispatched from the default branch ($DEFAULT_BRANCH)."
+            echo "::error::Received workflow ref: $WORKFLOW_REF"
+            exit 1
+          fi
+
+      - name: Check out repository history
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ inputs.tag || github.ref }}
+          ref: ${{ github.sha }}
+
+      - name: Validate and check out the existing release tag
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          TARGET_TAG: ${{ inputs.tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ ! "$TARGET_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Expected a semantic-version tag such as v0.7.0, got '$TARGET_TAG'."
+            exit 1
+          fi
+          if ! git ls-remote --exit-code --refs origin "refs/tags/$TARGET_TAG" >/dev/null; then
+            echo "::error::Remote tag $TARGET_TAG does not exist."
+            exit 1
+          fi
+
+          git fetch --force origin "refs/tags/$TARGET_TAG:refs/tags/$TARGET_TAG"
+          git fetch --force origin \
+            "refs/heads/$DEFAULT_BRANCH:refs/remotes/origin/$DEFAULT_BRANCH"
+          target_commit="$(git rev-parse --verify "refs/tags/$TARGET_TAG^{commit}")"
+          if ! git merge-base --is-ancestor "$target_commit" "refs/remotes/origin/$DEFAULT_BRANCH"; then
+            echo "::error::Release tag $TARGET_TAG is not reachable from the default branch."
+            exit 1
+          fi
+          git checkout --detach "$target_commit"
 
       - name: Install uv
         uses: astral-sh/setup-uv@v5
@@ -36,15 +77,10 @@ jobs:
         id: range
         shell: bash
         env:
-          TARGET_TAG: ${{ inputs.tag || github.ref_name }}
+          TARGET_TAG: ${{ inputs.tag }}
         run: |
           set -euo pipefail
 
-          if [[ ! "$TARGET_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-].*)?$ ]]; then
-            echo "::error::Expected a semantic-version tag such as v0.7.0, got '$TARGET_TAG'."
-            exit 1
-          fi
-
           previous_tag="$(git tag --sort=-v:refname --merged "$TARGET_TAG" \
             | awk -v current="$TARGET_TAG" '$0 != current { print; exit }')"
 

{copilot_session_usage-0.7.7 → copilot_session_usage-0.8.1}/.github/workflows/release.yml

@@ -32,25 +32,44 @@ permissions:
   contents: write
 
 jobs:
+  validate-trigger:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Require the default branch
+        env:
+          WORKFLOW_REF: ${{ github.ref }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected_ref="refs/heads/$DEFAULT_BRANCH"
+          if [[ "$WORKFLOW_REF" != "$expected_ref" ]]; then
+            echo "::error::Release must be dispatched from the default branch ($DEFAULT_BRANCH)."
+            echo "::error::Received workflow ref: $WORKFLOW_REF"
+            exit 1
+          fi
+
   ci:
+    needs: validate-trigger
     uses: ./.github/workflows/ci.yml
+    with:
+      ref: ${{ github.sha }}
 
   release:
-    needs: ci
+    needs: [validate-trigger, ci]
     runs-on: ubuntu-latest
     env:
-      GH_TOKEN: ${{ github.token }}
-      RELEASE_BRANCH: ${{ github.event.repository.default_branch }}
       INCREMENT: ${{ inputs.increment }}
       DRAFT_RELEASE: ${{ inputs.draft }}
       FORCE_RELEASE: ${{ inputs.force }}
 
     steps:
-      - name: Check out the default branch
+      - name: Check out the validated release commit
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.repository.default_branch }}
+          ref: ${{ github.sha }}
 
       - name: Install uv
         uses: astral-sh/setup-uv@v5
@@ -70,23 +89,36 @@ jobs:
             exit 1
           fi
 
-          git switch --force-create "$RELEASE_BRANCH" "origin/$RELEASE_BRANCH"
-
           previous_tag="$(git describe --tags --abbrev=0 HEAD 2>/dev/null || true)"
           if [[ -z "$previous_tag" ]]; then
             echo "::error::Could not find a previous release tag."
             exit 1
           fi
 
+          maintenance_only=false
           if [[ "$INCREMENT" == "auto" ]]; then
             bump_args=(--get-next --yes)
-            if [[ "$FORCE_RELEASE" == "true" ]]; then
-              bump_args+=(--allow-no-commit)
-            fi
             if ! next_version_output="$(uv run --no-sync cz bump "${bump_args[@]}" 2>&1)"; then
-              echo "::error::No eligible conventional commits were found for an automatic release. You can either wait for a user-impacting feature or bug fix and start a new release, or enable 'Force a patch release when auto finds no eligible commit' when triggering the 'Release' Action."
-              printf '%s\n' "$next_version_output"
-              exit 1
+              if grep -q "NO_COMMITS_TO_BUMP" <<<"$next_version_output"; then
+                if [[ "$FORCE_RELEASE" != "true" ]]; then
+                  echo "::error::No eligible conventional commits were found for an automatic release. You can either wait for a user-impacting feature or bug fix and start a new release, or enable 'Force a patch release when auto finds no eligible commit' when triggering the 'Release' Action."
+                  printf '%s\n' "$next_version_output"
+                  exit 1
+                fi
+
+                echo "No eligible conventional commits found; forcing a maintenance-only patch release."
+                if ! next_version_output="$(uv run --no-sync cz bump --get-next \
+                  --increment PATCH --yes --allow-no-commit 2>&1)"; then
+                  echo "::error::Commitizen could not calculate the forced patch release version."
+                  printf '%s\n' "$next_version_output"
+                  exit 1
+                fi
+                maintenance_only=true
+              else
+                echo "::error::Commitizen could not calculate the requested release version."
+                printf '%s\n' "$next_version_output"
+                exit 1
+              fi
             fi
           else
             echo "Using explicit $INCREMENT bump."
@@ -102,7 +134,7 @@ jobs:
           fi
 
           target_tag="v$next_version"
-          if [[ ! "$target_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-].*)?$ ]]; then
+          if [[ ! "$target_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "::error::The calculated version did not create a semantic-version tag."
             exit 1
           fi
@@ -115,6 +147,8 @@ jobs:
 
           echo "previous_tag=$previous_tag" >> "$GITHUB_OUTPUT"
           echo "target_tag=$target_tag" >> "$GITHUB_OUTPUT"
+          echo "target_sha=$(git rev-parse "$target_tag^{commit}")" >> "$GITHUB_OUTPUT"
+          echo "maintenance_only=$maintenance_only" >> "$GITHUB_OUTPUT"
           echo "Prepared local tag $target_tag from $previous_tag without modifying the default branch."
 
       - name: Generate release notes
@@ -122,12 +156,18 @@ jobs:
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
           PREVIOUS_TAG: ${{ steps.version.outputs.previous_tag }}
           TARGET_TAG: ${{ steps.version.outputs.target_tag }}
+          MAINTENANCE_ONLY: ${{ steps.version.outputs.maintenance_only }}
         run: |
           set -euo pipefail
+          maintenance_args=()
+          if [[ "$MAINTENANCE_ONLY" == "true" ]]; then
+            maintenance_args+=(--maintenance-only)
+          fi
           uv run -- python .github/skills/gh-release-notes/scripts/generate_release_notes.py \
             --from-ref "$PREVIOUS_TAG" \
             --to-ref "$TARGET_TAG" \
-            --output release-notes.md
+            --output release-notes.md \
+            "${maintenance_args[@]}"
 
       - name: Upload generated notes
         uses: actions/upload-artifact@v4
@@ -137,6 +177,7 @@ jobs:
 
       - name: Create GitHub release
         env:
+          GH_TOKEN: ${{ github.token }}
           TARGET_TAG: ${{ steps.version.outputs.target_tag }}
         shell: bash
         run: |
@@ -168,6 +209,7 @@ jobs:
 
     outputs:
       target_tag: ${{ steps.version.outputs.target_tag }}
+      target_sha: ${{ steps.version.outputs.target_sha }}
 
   publish:
     if: ${{ !inputs.draft }}
@@ -185,7 +227,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ needs.release.outputs.target_tag }}
+          ref: ${{ needs.release.outputs.target_sha }}
 
       - name: Install uv
         uses: astral-sh/setup-uv@v5
@@ -193,5 +235,23 @@ jobs:
       - name: Build package
         run: uv build
 
+      - name: Verify package version
+        env:
+          TARGET_TAG: ${{ needs.release.outputs.target_tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected_version="${TARGET_TAG#v}"
+          shopt -s nullglob
+          artifacts=(
+            dist/copilot_session_usage-"$expected_version"-*.whl
+            dist/copilot_session_usage-"$expected_version".tar.gz
+          )
+          if (( ${#artifacts[@]} != 2 )); then
+            echo "::error::Built package artifacts do not match $TARGET_TAG."
+            printf '%s\n' dist/*
+            exit 1
+          fi
+
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1

{copilot_session_usage-0.7.7 → copilot_session_usage-0.8.1}/AGENTS.md

@@ -1,7 +1,7 @@
 # AGENTS.md — copilot-session-usage
 
 `copilot-session-usage` is a PyPI-installable Python package that extracts usage and
-cost analytics from local VS Code Copilot and Copilot CLI session logs.
+cost analytics from local VS Code Copilot, Copilot CLI, and Copilot App session logs.
 
 Read [`CONSTITUTION.md`](CONSTITUTION.md) before changing code, tests, packaging,
 release automation, or knowledge. It contains the durable project rules. This file
@@ -37,7 +37,7 @@ src/copilot_session_usage/
 ├── cli.py                    Click CLI entry point
 ├── _internal/core.py         Session parsing, cost analysis, and shaping
 ├── _internal/vscode.py       VS Code workspace discovery
-├── _internal/copilot_cli.py  Future Copilot CLI provider stub
+├── _internal/copilot_cli.py  Copilot CLI/App discovery and event parsing
 └── data/                     Bundled model and pricing data
 tests/                        Pytest suite
 scripts/                      Maintenance scripts, including pricing refresh

{copilot_session_usage-0.7.7 → copilot_session_usage-0.8.1}/CONSTITUTION.md

@@ -24,8 +24,8 @@ Python package, usable from automation, and honest about unavailable evidence.
 - Public API belongs in `src/copilot_session_usage/api.py`; internal implementation
   belongs under `src/copilot_session_usage/_internal/`.
 - Public API functions retain the optional `agent` parameter used for provider
-  routing. The supported provider values are `vscode` and `cli`; the CLI provider
-  remains explicitly unsupported until implemented.
+  routing. The supported provider values are `vscode`, `cli`, and the explicit
+  combined mode `all`.
 - Keep provider discovery separate from parsing, pricing, shaping, and presentation.
 - Do not expose internal modules as public API merely to avoid a proper API change.