git-worktrees 0.5.0__tar.gz → 0.5.1__tar.gz

{git_worktrees-0.5.0 → git_worktrees-0.5.1}/.github/workflows/publish.yml

@@ -152,25 +152,23 @@ jobs:
           name: dist
           path: dist/
 
+      # Sign with this job's OIDC identity. uv uploads the attestations with
+      # their distributions.
+      - name: Attest
+        run: uvx pypi-attestations@0.0.30 sign dist/*
+
       - name: Publish
         run: uv publish --trusted-publishing always
 
-  # Uploaded and installable are two claims with two timings, so they are two
-  # jobs. An index serves what it has accepted only after a delay of its own
-  # choosing: 0.2.1 took longer than the script waited, and a release that had
-  # published correctly went red and had to be re-run by hand. This job holds
-  # the second claim, `release` needs only the first, and a red `verify` says
-  # PyPI is slow rather than that the version is not out.
+  # PyPI can take time to serve an accepted upload. Verification runs in a
+  # separate job so that delay does not block the GitHub release.
   verify:
-    name: Verify it installs from PyPI
+    name: Verify PyPI install and attestations
     runs-on: ubuntu-26.04
     needs: publish
     permissions:
       contents: read
     steps:
-      # The script reads the name and version from pyproject.toml through
-      # `uv version`, and installs from the index rather than from the
-      # artifact, so there is nothing to download here.
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
@@ -183,6 +181,21 @@ jobs:
       - name: Verify it installs from PyPI
         run: scripts/verify-publish.bash --prod
 
+      # The filenames identify the distributions to fetch from PyPI.
+      - name: Download distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: dist
+          path: dist/
+
+      # The install check waits for PyPI to serve the files.
+      - name: Verify attestations on PyPI
+        run: |
+          for f in dist/*.whl dist/*.tar.gz; do
+            uvx pypi-attestations@0.0.30 verify pypi \
+              --repository "https://github.com/$GITHUB_REPOSITORY" "pypi:${f#dist/}"
+          done
+
   release:
     name: Release
     runs-on: ubuntu-26.04

{git_worktrees-0.5.0 → git_worktrees-0.5.1}/.github/workflows/testpypi.yml

@@ -59,6 +59,11 @@ jobs:
       - name: Build
         run: uv build
 
+      # Sign with this job's OIDC identity. uv uploads the attestations with
+      # their distributions.
+      - name: Attest
+        run: uvx pypi-attestations@0.0.30 sign dist/*
+
       - name: Publish
         # `always` rather than the default `automatic`: fail loudly if OIDC is
         # unavailable instead of quietly looking for a token.

{git_worktrees-0.5.0 → git_worktrees-0.5.1}/CHANGELOG.md

@@ -17,6 +17,16 @@ not in here, whatever it cost to build.
 A release closes with a `### Choices` section when a decision in it is worth
 the reader's time: what was chosen, and what the alternative failed to do.
 
+## 0.5.1 - 2026-09-29
+
+### Added
+
+The wheel and source distribution on PyPI carry PEP 740 attestations signed
+by the GitHub workflow that built them. PyPI shows the provenance on the
+release's page, and `uvx pypi-attestations verify pypi --repository
+https://github.com/MihaiBojin/worktrees pypi:<file>` checks a file against
+this repository before you install it.
+
 ## 0.5.0 - 2026-09-29
 
 ### Added

{git_worktrees-0.5.0 → git_worktrees-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: git-worktrees
-Version: 0.5.0
+Version: 0.5.1
 Summary: Git worktree commands that refuse to lose work.
 Project-URL: Bug reports, https://github.com/MihaiBojin/worktrees/issues/new
 Project-URL: Source, https://github.com/MihaiBojin/worktrees

{git_worktrees-0.5.0 → git_worktrees-0.5.1}/docs/DEVELOPMENT.md

@@ -241,19 +241,25 @@ back, so the tree the tag names has already proved it uploads to an index and
 installs from one. The merge happens first and the irreversible step is last,
 so everything recoverable is already done by the time anything is published.
 
-`release` needs the upload and nothing else. `verify` installs the version
-from PyPI and runs what it installed, on its own, because an index serves what
-it has accepted after a delay it does not bound: 0.2.1 took longer than the
-script waited and a correct release went red. A red `verify` says PyPI is
-slow, not that the version is missing. It gives up after about 32 minutes.
+`publish` signs each distribution with `uvx pypi-attestations@0.0.30 sign`
+using the job's OIDC identity. `uv publish` uploads the resulting PEP 740
+attestations alongside the distributions.
+
+`release` needs the upload. `verify` installs the version from PyPI and runs
+what it installed, allowing about 32 minutes for the index to serve it. It
+then runs `uvx pypi-attestations@0.0.30 verify pypi` for each wheel and source
+distribution, checking the attestations against this GitHub repository.
+Either check can fail the verification job independently of the release.
 
 `workflow_dispatch` against a tag ref re-runs a release whose publish failed.
 
 ## Snapshots on TestPyPI
 
 `testpypi.yml` runs on every commit to `main`. It numbers the tree
-`<version>.post<epoch>`, builds it, uploads it to TestPyPI and installs it
-back from there.
+`<version>.post<epoch>`, builds it and signs each distribution with
+`uvx pypi-attestations@0.0.30 sign` using the job's OIDC identity. It uploads
+the distributions and their PEP 740 attestations to TestPyPI, then installs
+the snapshot back from there.
 
 `post` rather than `dev` because that is what the build is: made after
 `<version>` shipped. PEP 440 sorts `0.2.3.post1789247568` above `0.2.3` and

{git_worktrees-0.5.0 → git_worktrees-0.5.1}/pyproject.toml

@@ -9,7 +9,7 @@ authors = [
 ]
 # Static, and the single source of truth for the version. Bump it in a pull
 # request and run `uv lock`; the release tag only has to agree with it.
-version = "0.5.0"
+version = "0.5.1"
 # The standard library answers every question this asks. A dependency here
 # would be paid on every invocation, and an invocation is 67 ms of which 25 ms
 # is the interpreter starting.

{git_worktrees-0.5.0 → git_worktrees-0.5.1}/uv.lock

@@ -40,7 +40,7 @@ wheels = [
 
 [[package]]
 name = "git-worktrees"
-version = "0.5.0"
+version = "0.5.1"
 source = { editable = "." }
 
 [package.optional-dependencies]