dancerudiments 0.2.0__tar.gz → 0.2.1__tar.gz

dancerudiments-0.2.1/.github/workflows/nuget-verify.yml

@@ -0,0 +1,40 @@
+name: Verify NuGet publication
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Existing DanceRudiments version to verify on NuGet.org
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+      - name: Download the package already attached to its GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          mkdir -p artifacts/nuget
+          gh release download "v$VERSION" --repo "$GITHUB_REPOSITORY" \
+            --pattern "DanceRudiments.$VERSION.nupkg" --dir artifacts/nuget
+      - name: Wait for NuGet.org indexing and verify the published payload
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          python tools/csharp_package.py verify-published \
+            "artifacts/nuget/DanceRudiments.$VERSION.nupkg" --version "$VERSION"

dancerudiments-0.2.1/CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog
+
+## 0.2.1 - 2026-10-08
+
+- Verify delayed NuGet indexing with bounded, authenticated publication evidence rather than treating an immediate index miss as publication failure.
+- Preserve the existing motion catalogue and bindings unchanged.
+- Keep all package manifests aligned with the fresh release version.

{dancerudiments-0.2.0 → dancerudiments-0.2.1}/CMakeLists.txt

@@ -1,5 +1,5 @@
 cmake_minimum_required(VERSION 3.20)
-project(DanceRudiments VERSION 0.2.0
+project(DanceRudiments VERSION 0.2.1
   DESCRIPTION "Rhythmic motion for DanceFlow. Music: https://kieransimkin.co.uk/my-songs/"
   HOMEPAGE_URL "https://kieransimkin.co.uk/my-songs/"
   LANGUAGES CXX)

{dancerudiments-0.2.0 → dancerudiments-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dancerudiments
-Version: 0.2.0
+Version: 0.2.1
 Summary: C++ rhythmic motion with Python bindings for DanceFlow. Music: https://kieransimkin.co.uk/my-songs/
 Author: Kieran Simkin
 License-Expression: MIT AND BSD-3-Clause AND CC0-1.0 AND CC-BY-4.0

{dancerudiments-0.2.0 → dancerudiments-0.2.1}/bindings/csharp/DanceRudiments/DanceRudiments.csproj

@@ -2,7 +2,7 @@
   <!-- Kieran Simkin / DanceFlow: https://kieransimkin.co.uk/my-songs/ -->
   <PropertyGroup>
     <TargetFramework>net8.0</TargetFramework>
-    <Version>0.2.0</Version>
+    <Version>0.2.1</Version>
     <PackageId>DanceRudiments</PackageId>
     <Authors>Kieran Simkin</Authors>
     <Description>C# bindings to the DanceFlow C++ rhythmic motion library. Music: https://kieransimkin.co.uk/my-songs/</Description>

{dancerudiments-0.2.0 → dancerudiments-0.2.1}/docs/csharp.md

@@ -224,7 +224,11 @@ After successful native, managed and installed-package tests:
 - **NuGet.org** receives `DanceRudiments.<version>.nupkg` plus managed symbols. The
   workflow downloads the indexed package and compares payload members, allowing
   NuGet.org's added repository signature rather than assuming ZIP bytes remain
-  identical. Indexing can take time; an upload is not called verified prematurely.
+  identical. Indexing can take several minutes; verification waits for up to about
+  15 minutes of transient CDN/indexing responses before failing. A payload mismatch
+  still fails immediately. If NuGet indexing outlives the release job, run the
+  manual **Verify NuGet publication** workflow for that already-published version;
+  it verifies the release asset without attempting another upload.
 - **GitHub Packages** receives the same nupkg under
   `https://nuget.pkg.github.com/kieransimkin/index.json`. `GITHUB_TOKEN` with
   `packages: write` authenticates; `RepositoryUrl` links the package to this repo.

{dancerudiments-0.2.0 → dancerudiments-0.2.1}/harness/index.html

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
-name: dancerudiments-0.2.0/harness/index.html
+name: dancerudiments-0.2.1/harness/index.html
 size: 36837222 bytes
 sha256: 8b85f3862a4dd3b131eaf5a9225dc421959b1707f7e272c3a22bad10c104173f

{dancerudiments-0.2.0 → dancerudiments-0.2.1}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@kieransimkin/dance-rudiments",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@kieransimkin/dance-rudiments",
-      "version": "0.2.0",
+      "version": "0.2.1",
       "devDependencies": {
         "typescript": "^5.9.0"
       },

{dancerudiments-0.2.0 → dancerudiments-0.2.1}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kieransimkin/dance-rudiments",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "C++/WASM rhythmic motion for DanceFlow, with TypeScript bindings. Music: https://kieransimkin.co.uk/my-songs/",
   "license": "MIT AND BSD-3-Clause AND CC0-1.0 AND CC-BY-4.0",
   "type": "module",

{dancerudiments-0.2.0 → dancerudiments-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "scikit_build_core.build"
 
 [project]
 name = "dancerudiments"
-version = "0.2.0"
+version = "0.2.1"
 description = "C++ rhythmic motion with Python bindings for DanceFlow. Music: https://kieransimkin.co.uk/my-songs/"
 readme = "README.md"
 license = "MIT AND BSD-3-Clause AND CC0-1.0 AND CC-BY-4.0"

dancerudiments-0.2.1/tests/csharp/packaging/test_publish_verification.py

@@ -0,0 +1,33 @@
+"""Regression checks for delayed NuGet.org indexing."""
+import inspect
+import importlib.util
+from pathlib import Path
+import unittest
+
+ROOT = Path(__file__).resolve().parents[3]
+spec = importlib.util.spec_from_file_location("csharp_package", ROOT / "tools/csharp_package.py")
+package = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(package)
+
+
+class PublishVerificationTests(unittest.TestCase):
+    def test_default_indexing_window_is_about_fifteen_minutes(self):
+        signature = inspect.signature(package.verify_published)
+        self.assertEqual(signature.parameters["attempts"].default, 60)
+        self.assertEqual(signature.parameters["delay_seconds"].default, 15)
+
+    def test_invalid_retry_configuration_is_rejected_before_package_access(self):
+        with self.assertRaises(ValueError):
+            package.verify_published(Path("missing.nupkg"), "nuget.org", attempts=0)
+        with self.assertRaises(ValueError):
+            package.verify_published(Path("missing.nupkg"), "nuget.org", delay_seconds=-1)
+
+    def test_manual_verification_accepts_an_explicit_release_version(self):
+        with self.assertRaises(FileNotFoundError):
+            package.verify_published(Path("missing.nupkg"), "nuget.org", "0.2.0", attempts=1, delay_seconds=0)
+        with self.assertRaises(ValueError):
+            package.verify_published(Path("missing.nupkg"), "nuget.org", "v0.2", attempts=1, delay_seconds=0)
+
+
+if __name__ == "__main__":
+    unittest.main()

{dancerudiments-0.2.0 → dancerudiments-0.2.1}/tools/csharp_package.py

@@ -211,12 +211,17 @@ def pack(folder: Path, output: Path, commit: str) -> None:
     (output/'SHA256SUMS-csharp.txt').write_text(''.join(sha256(p.read_bytes()).hexdigest()+'  '+p.name+'\n' for p in files),encoding='utf-8')
 
 
-def verify_published(path: Path, feed: str, attempts: int = 12) -> None:
+def verify_published(path: Path, feed: str, published_version: str | None = None, attempts: int = 60, delay_seconds: int = 15) -> None:
     """NuGet.org adds a repository signature: compare ZIP payloads, not raw ZIP bytes.
     GitHub feed verification uses an isolated dotnet restore in the workflow.
     """
     if feed!='nuget.org':raise ValueError('Only the public NuGet.org feed is supported here')
-    url=f'https://api.nuget.org/v3-flatcontainer/dancerudiments/{version()}/dancerudiments.{version()}.nupkg'
+    if attempts < 1 or delay_seconds < 0:
+        raise ValueError('Verification attempts must be positive and delay must be non-negative')
+    published_version = published_version or version()
+    if not re.fullmatch(r'\d+\.\d+\.\d+', published_version):
+        raise ValueError('Published version must be MAJOR.MINOR.PATCH')
+    url=f'https://api.nuget.org/v3-flatcontainer/dancerudiments/{published_version}/dancerudiments.{published_version}.nupkg'
     with zipfile.ZipFile(path) as local:
         expected={n:sha256(local.read(n)).digest() for n in local.namelist() if n!='.signature.p7s'}
     last=None
@@ -230,8 +235,9 @@ def verify_published(path: Path, feed: str, attempts: int = 12) -> None:
             print('NuGet.org download matches every non-signature package member');return
         except (urllib.error.URLError,zipfile.BadZipFile) as error:
             last=error
-            if attempt+1<attempts:time.sleep(15)
-    raise RuntimeError('Upload/download verification did not complete: '+str(last))
+            if attempt+1<attempts:time.sleep(delay_seconds)
+    waited=max(0, attempts-1)*delay_seconds
+    raise RuntimeError(f'NuGet.org accepted the upload but indexing did not complete after about {waited} seconds: {last}')
 
 
 def main() -> None: