ezcompiler 2.3.4__tar.gz → 2.4.0__tar.gz

ezcompiler-2.4.0/.github/workflows/auto-tag.yml

@@ -0,0 +1,110 @@
+name: Auto Tag
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: auto-tag-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  auto-tag:
+    name: Create and Push Tags
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    outputs:
+      tag_action: ${{ steps.create_tags.outputs.tag_action }}
+      version: ${{ steps.version.outputs.version }}
+      tag_name: ${{ steps.create_tags.outputs.tag_name }}
+
+    steps:
+      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
+        with:
+          fetch-depth: 0
+
+      - name: Extract version from pyproject.toml
+        id: version
+        run: |
+          VERSION=$(grep -E '^version\s*=\s*"' pyproject.toml | head -1 | sed 's/.*version\s*=\s*"\([^"]*\)".*/\1/')
+          if [ -z "$VERSION" ]; then
+            echo "::error::No version found in pyproject.toml"
+            exit 1
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Version: $VERSION"
+
+      - name: Create and push tags
+        id: create_tags
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          TAG_NAME="v$VERSION"
+          MAJOR=$(echo "$VERSION" | cut -d. -f1)
+          LATEST_TAG="v${MAJOR}-latest"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          if git rev-parse "$TAG_NAME" >/dev/null 2>&1; then
+            TAG_SHA=$(git rev-parse "$TAG_NAME")
+            HEAD_SHA=$(git rev-parse HEAD)
+            if [ "$TAG_SHA" = "$HEAD_SHA" ]; then
+              echo "tag_action=none" >> $GITHUB_OUTPUT
+              echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
+              echo "Tag $TAG_NAME already points to HEAD — nothing to do"
+            else
+              git tag -f "$TAG_NAME"
+              git tag -f "$LATEST_TAG"
+              git push origin --force "$TAG_NAME"
+              git push origin --force "$LATEST_TAG"
+              echo "tag_action=update" >> $GITHUB_OUTPUT
+              echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
+              echo "🔄 Tags moved to HEAD: $TAG_NAME, $LATEST_TAG (no publish — version unchanged)"
+            fi
+          else
+            git tag "$TAG_NAME"
+            git tag -f "$LATEST_TAG"
+            git push origin "$TAG_NAME"
+            git push origin --force "$LATEST_TAG"
+            echo "tag_action=create" >> $GITHUB_OUTPUT
+            echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
+            echo "✅ Tags pushed: $TAG_NAME, $LATEST_TAG"
+          fi
+
+      - name: Summary
+        if: steps.create_tags.outputs.tag_action != 'none'
+        run: |
+          echo "## 🏷️ Auto-Tagging Summary" >> $GITHUB_STEP_SUMMARY
+          echo "- **Action**: ${{ steps.create_tags.outputs.tag_action }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Version**: ${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Tag**: ${{ steps.create_tags.outputs.tag_name }}" >> $GITHUB_STEP_SUMMARY
+
+  trigger-publish:
+    name: Trigger Publish
+    needs: auto-tag
+    if: needs.auto-tag.outputs.tag_action == 'create'
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/publish-pypi.yml
+    with:
+      version: ${{ needs.auto-tag.outputs.version }}
+      tag: ${{ needs.auto-tag.outputs.tag_name }}
+
+  trigger-deploy-docs:
+    name: Trigger Deploy Docs
+    needs: [auto-tag, trigger-publish]
+    if: |
+      always() &&
+      needs.auto-tag.result == 'success' &&
+      needs.auto-tag.outputs.tag_action != 'none' &&
+      (needs.trigger-publish.result == 'success' || needs.trigger-publish.result == 'skipped')
+    permissions:
+      contents: write
+    uses: ./.github/workflows/docs.yml
+    with:
+      deploy: true

ezcompiler-2.4.0/.github/workflows/ci-usage.md

@@ -0,0 +1,76 @@
+# CI Workflow
+
+`ci.yml` runs on every push (all branches), every pull request, and manually via
+`workflow_dispatch`. It is the primary quality gate — release workflows never run
+if this one is red.
+
+## Triggers
+
+| Event               | Branches |
+| ------------------- | -------- |
+| `push`              | all      |
+| `pull_request`      | all      |
+| `workflow_dispatch` | manual   |
+
+Concurrent runs on the same ref are cancelled automatically (`cancel-in-progress: true`,
+group `ci-$ref`). Deploy jobs are never affected because they live in separate workflows.
+
+## Jobs
+
+```text
+lint ──┐
+       ├──► test (Python 3.13)
+type-check ──┘
+```
+
+`lint` and `type-check` run in parallel; `test` needs both.
+
+### `lint` — Lint & Format Check
+
+Timeout: 15 min. Steps:
+
+1. `uv sync --frozen --extra dev`
+2. `ruff check .` — lint
+3. `ruff format --check .` — format check (read-only, never auto-fixes)
+
+### `type-check` — Type Check & Import Contracts
+
+Timeout: 15 min. Steps:
+
+1. `uv sync --frozen --extra dev`
+2. `uv run ty check` — type check (configured via `[tool.ty]` in `pyproject.toml`)
+3. `uv run pyright` — type check complémentaire (configured via `[tool.pyright]`)
+4. `PYTHONPATH=src uv run lint-imports` — import-linter contracts (couches hexagonales)
+
+### `test` — pytest
+
+Needs: `[lint, type-check]`. Timeout: 25 min. Python **3.13 only** (`fail-fast: false`).
+
+Steps:
+
+1. `uv sync --frozen --extra dev`
+2. `uv run pytest` — reads `pyproject.toml`, applies `--cov-fail-under=70`
+3. Upload `coverage.xml` + `htmlcov/` as artifact — **always** (even on failure), retained 7 days
+
+## Local equivalent
+
+```bash
+# Quality gate
+uv run ruff check .
+uv run ruff format --check .
+uv run ty check
+uv run pyright
+PYTHONPATH=src uv run lint-imports
+
+# Tests
+uv run pytest
+```
+
+## Notes
+
+- The install is always frozen (`uv sync --frozen`). Never mutates `uv.lock`.
+- `ruff check` and `ruff format --check` are read-only — they never auto-fix.
+- Both `ty` and `pyright` are configured in `pyproject.toml` and run in CI.
+- Import contracts are enforced by import-linter against the hexagonal layer
+  contracts defined in `[tool.importlinter]`. Adding a cross-layer import
+  without updating the contracts will fail this job.

ezcompiler-2.4.0/.github/workflows/ci.yml

@@ -0,0 +1,89 @@
+name: CI
+
+# Runs on every push to main and on pull requests.
+# Quality gates (lint, type-check) run first and block the test matrix.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "src/**"
+      - "tests/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/ci.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "src/**"
+      - "tests/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/ci.yml"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint & Format Check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+      - run: uv sync --frozen --extra dev
+      - run: uv run --frozen ruff check .
+      - run: uv run --frozen ruff format --check .
+
+  type-check:
+    name: Type Check & Import Contracts
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+      - run: uv sync --frozen --extra dev
+      - run: uv run --frozen ty check src/ezcompiler/
+      - run: uv run --frozen pyright
+      - run: PYTHONPATH=src uv run --frozen lint-imports
+
+  test:
+    name: Tests (Python ${{ matrix.python }})
+    needs: [lint, type-check]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.13"]
+    steps:
+      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          python-version: ${{ matrix.python }}
+          enable-cache: true
+      - run: uv sync --frozen --extra dev
+      - run: uv run --frozen pytest
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: matrix.python == '3.13' && always()
+        with:
+          name: coverage-report
+          path: |
+            coverage.xml
+            htmlcov/
+          retention-days: 7

ezcompiler-2.4.0/.github/workflows/docs-usage.md

@@ -0,0 +1,91 @@
+# Deploy Documentation Workflow
+
+`docs.yml` builds and deploys the MkDocs Material documentation to GitHub Pages
+(`https://neuraaak.github.io/ezplog/`). It is normally called by `auto-tag.yml`
+after a tag is created or moved, but can also be run manually.
+
+## Triggers
+
+| Event               | How                                                  |
+| ------------------- | ---------------------------------------------------- |
+| `workflow_call`     | Called by `auto-tag.yml` with boolean input `deploy` |
+| `workflow_dispatch` | Manual run from the Actions tab (always deploys)     |
+
+`workflow_call` input `deploy` (boolean, default `false`):
+
+- `true` → full deploy to GitHub Pages (release mode)
+- `false` → build + checks only, no push (preview mode)
+
+## Job: `deploy`
+
+Single job, runs on `ubuntu-24.04`. Steps in order:
+
+| Step               | Command / Action                                                                                           |
+| ------------------ | ---------------------------------------------------------------------------------------------------------- |
+| Checkout           | Full history (`fetch-depth: 0`) required for git-cliff                                                     |
+| Install            | `uv sync --frozen` with `docs` and `test` extras                                                           |
+| Tests              | `uv run pytest --cov=src/ezplog --cov-report=html --cov-report=xml` — produces `htmlcov/` + `coverage.xml` |
+| Import contracts   | `PYTHONPATH=src uv run lint-imports`                                                                       |
+| Architecture graph | Runs `.scripts/dev/generate_architecture_graph.py` if present                                              |
+| Changelog          | `git-cliff` writes `docs/changelog.md` from conventional commits                                           |
+| Resolve version    | Reads `version` from `pyproject.toml`; fails if absent                                                     |
+| Wait for PyPI      | **Deploy mode only** — polls `pypi.org/pypi/ezplog/<version>/json` every 15 s, timeout 900 s               |
+| Git config         | **Deploy mode only** — configures `github-actions[bot]` user for mike                                      |
+| Deploy             | **Deploy mode only** — `mike deploy --push --update-aliases <version> latest` + `mike set-default latest`  |
+| Preview summary    | **Preview mode only** — writes a step summary, no Pages push                                               |
+
+Deploy mode = `inputs.deploy == true` or `github.event_name == 'workflow_dispatch'`.
+
+## Concurrency
+
+Group `docs-$ref` with `cancel-in-progress: true` — a new docs run on the same ref
+cancels the previous one.
+
+## Permissions
+
+`contents: write` is required so mike can push to the `gh-pages` branch.
+
+## GitHub Pages setup
+
+Pages must be configured to serve from the `gh-pages` branch:
+
+```text
+Repository → Settings → Pages → Source: Deploy from a branch → gh-pages / root
+```
+
+`mike` manages versioned aliases (`latest`) and creates/updates this branch automatically.
+
+## Local preview
+
+```bash
+uv sync --extra docs
+uv run mkdocs serve
+# Open http://127.0.0.1:8000
+```
+
+Strict build (fails on warnings):
+
+```bash
+uv run mkdocs build --strict
+```
+
+## Manual trigger
+
+```bash
+gh workflow run docs.yml
+```
+
+## Troubleshooting
+
+**Tests fail** — coverage generation fails if tests are broken. Fix the tests
+and re-run. Do not add `|| true` to mask failures.
+
+**mkdocstrings "Module not found"** — verify the module path in `docs/api/*.md`
+matches the installed package. Run `uv run python -c "import ezplog"` to
+confirm the package is importable.
+
+**Permission denied on gh-pages** — check that `contents: write` is present and
+that no branch-protection rule blocks force-pushes to `gh-pages`.
+
+**Changelog not updating** — ensure `cliff.toml` exists at the repo root and
+that commits follow the conventional commit format.

ezcompiler-2.4.0/.github/workflows/docs.yml

@@ -0,0 +1,84 @@
+name: Deploy Documentation
+
+on:
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      deploy:
+        description: "Deploy docs (true) or preview-only (false)"
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+concurrency:
+  group: docs-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    name: Build and Deploy Docs
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
+        with:
+          fetch-depth: 0
+
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+
+      - run: uv sync --frozen --extra docs --extra test
+
+      - name: Generate coverage report
+        run: uv run --frozen pytest --cov=src/ezcompiler --cov-report=html --cov-report=xml -q
+
+      - name: Enforce import contracts
+        run: PYTHONPATH=src uv run --frozen lint-imports
+
+      - name: Generate architecture graph
+        run: |
+          if [ -f ".scripts/dev/generate_architecture_graph.py" ]; then
+            uv run --frozen python .scripts/dev/generate_architecture_graph.py
+          fi
+
+      - name: Generate changelog
+        uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5 # v4
+        with:
+          config: cliff.toml
+          args: --output docs/changelog.md
+
+      - name: Resolve docs version
+        id: docs_version
+        run: |
+          VERSION=$(grep -E '^version\s*=\s*"' pyproject.toml | head -1 | sed 's/.*version\s*=\s*"\([^"]*\)".*/\1/')
+          if [ -z "$VERSION" ]; then
+            echo "::error::No version found in pyproject.toml"
+            exit 1
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Version: $VERSION"
+
+      - name: Configure git for mike
+        if: inputs.deploy || github.event_name == 'workflow_dispatch'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Deploy documentation with mike
+        if: inputs.deploy || github.event_name == 'workflow_dispatch'
+        env:
+          DOCS_VERSION: ${{ steps.docs_version.outputs.version }}
+        run: |
+          uv run --frozen mike deploy --push --update-aliases "$DOCS_VERSION" latest
+          uv run --frozen mike set-default --push latest
+
+      - name: Preview mode summary
+        if: github.event_name == 'workflow_call' && !inputs.deploy
+        run: |
+          echo "## 🔎 Docs Preview Mode" >> $GITHUB_STEP_SUMMARY
+          echo "- Event: ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Build and checks completed." >> $GITHUB_STEP_SUMMARY
+          echo "- Documentation deploy step is intentionally skipped." >> $GITHUB_STEP_SUMMARY

ezcompiler-2.4.0/.github/workflows/publish-pypi-usage.md

@@ -0,0 +1,97 @@
+# Publish to PyPI Workflow
+
+`publish-pypi.yml` builds the package and publishes it to PyPI. It is normally
+triggered by `auto-tag.yml` after a new version tag is created, but can also
+be run manually.
+
+## Triggers
+
+| Event               | How                                                    |
+| ------------------- | ------------------------------------------------------ |
+| `workflow_call`     | Called by `auto-tag.yml` with `version` + `tag` inputs |
+| `workflow_dispatch` | Manual run from the Actions tab                        |
+
+Manual runs have a `skip_tests` option (default `false`, not recommended).
+
+## Authentication
+
+Publishing uses **OIDC trusted publishing** — no stored secret. The workflow
+mints a short-lived token that PyPI trusts directly via the `id-token: write`
+permission. The trusted publisher must be configured on pypi.org under the
+ezplog project settings:
+
+```text
+pypi.org → Manage project ezplog → Publishing → Add a new publisher
+  Owner:     neuraaak
+  Repo:      ezplog
+  Workflow:  publish-pypi.yml
+  Environment: pypi
+```
+
+## Jobs
+
+```text
+validate (build + test) ──► publish (OIDC deploy)
+```
+
+### `validate` — Validate & Build
+
+1. Resolve version: uses `inputs.version` if provided (workflow_call), otherwise reads from `pyproject.toml`
+2. Preview mode summary — printed if triggered by push/PR or preview tag (no failure, informational only)
+3. `uv sync --frozen --extra dev`
+4. `PYTHONPATH=src uv run lint-imports` — import contracts
+5. `uv run pytest` — full suite (skipped if `skip_tests=true`)
+6. `uv build` — produces `dist/*.whl` and `dist/*.tar.gz`
+7. `uv run twine check dist/*` — validates package metadata
+8. Wheel integrity check: `python -m zipfile -t dist/*.whl` + inline script verifying `ezplog/` is present in the wheel
+9. Upload `dist/` as a job artifact (retained 1 day)
+
+### `publish` — Publish to PyPI (OIDC)
+
+Runs only if `validate` succeeds **and** the event is `workflow_dispatch` or a
+`workflow_call` whose `tag` input does not start with `preview-`. Downloads the
+artifact built upstream (no rebuild). Steps:
+
+1. `actions/download-artifact` — retrieves `dist/`
+2. `pypa/gh-action-pypi-publish@v1.14.0` — publishes via OIDC, no password
+
+> **Note — attestations disabled:** when called as a reusable workflow from
+> `auto-tag.yml`, the OIDC token's Build Config URI reflects the caller
+> (`auto-tag.yml`) rather than `publish-pypi.yml`, causing PyPI Trusted
+> Publisher verification to fail. `attestations: false` works around this.
+
+The job runs in the `pypi` environment. Configure required reviewers there
+in Repository → Settings → Environments if you want a manual gate.
+
+## Concurrency
+
+A `publish` concurrency group with `cancel-in-progress: false` prevents two
+simultaneous publish runs. A run in progress is never interrupted.
+
+## Release workflow
+
+```text
+1. Bump version in pyproject.toml
+2. Commit & push to main
+   → auto-tag.yml detects a new version, creates vX.Y.Z tag
+   → triggers publish-pypi.yml automatically
+3. Verify on https://pypi.org/project/ezplog/
+```
+
+Manual trigger via gh CLI:
+
+```bash
+gh workflow run publish-pypi.yml
+```
+
+## Troubleshooting
+
+**Version mismatch** — the `version` input from auto-tag differs from
+`pyproject.toml`. Bump the version, commit, and push again.
+
+**OIDC failure** — check that the trusted publisher on pypi.org matches
+the repo name, workflow filename (`publish-pypi.yml`), and environment name
+(`pypi`) exactly.
+
+**Tests fail** — run `uv run pytest` locally, fix, push. Do not use
+`skip_tests=true` to work around failures.

ezcompiler-2.4.0/.github/workflows/publish-pypi.yml

@@ -0,0 +1,121 @@
+name: Publish to PyPI
+
+on:
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+      tag:
+        required: true
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  PACKAGE_NAME: ezcompiler
+
+jobs:
+  validate:
+    name: Validate & Build
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+
+    steps:
+      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
+
+      - name: Resolve version
+        id: version
+        env:
+          INPUT_VERSION: ${{ inputs.version || '' }}
+        run: |
+          VERSION="$INPUT_VERSION"
+          if [ -z "$VERSION" ]; then
+            VERSION=$(grep -E '^version\s*=\s*"' pyproject.toml | head -1 | sed 's/.*version\s*=\s*"\([^"]*\)".*/\1/')
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Version: $VERSION"
+
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+
+      - run: uv sync --frozen --extra dev
+
+      - name: Enforce import contracts
+        run: PYTHONPATH=src uv run --frozen lint-imports
+
+      - name: Build package
+        run: uv build
+
+      - name: Check package
+        run: uv run --frozen twine check dist/*
+
+      - name: Verify wheel installation
+        run: |
+          python -m zipfile -t dist/*.whl
+          python - <<'PY'
+          import glob
+          import sys
+          import zipfile
+
+          wheels = glob.glob("dist/*.whl")
+          if not wheels:
+            raise SystemExit("No wheel found in dist/")
+
+          with zipfile.ZipFile(wheels[0]) as zf:
+            names = zf.namelist()
+
+          if not any(name.startswith("ezcompiler/") for name in names):
+            raise SystemExit("Wheel does not contain ezcompiler package")
+
+          print("Wheel integrity check passed")
+          PY
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/
+          retention-days: 1
+
+  publish:
+    name: Publish to PyPI (OIDC)
+    needs: validate
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+    environment:
+      name: pypi
+      url: https://pypi.org/project/${{ env.PACKAGE_NAME }}/${{ needs.validate.outputs.version }}/
+
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@v1.14.0
+        with:
+          verbose: true
+          # Attestations disabled: when called as a reusable workflow from
+          # auto-tag.yml, the OIDC token's Build Config URI reflects the
+          # caller (auto-tag.yml) rather than this workflow, causing PyPI
+          # Trusted Publisher verification to fail.
+          attestations: false
+
+      - name: Summary
+        run: |
+          echo "## 📦 Published to PyPI" >> $GITHUB_STEP_SUMMARY
+          echo "- **Package**: ${{ env.PACKAGE_NAME }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Version**: ${{ needs.validate.outputs.version }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **URL**: https://pypi.org/project/${{ env.PACKAGE_NAME }}/${{ needs.validate.outputs.version }}/" >> $GITHUB_STEP_SUMMARY