groupoid 0.1.0.dev2__tar.gz → 0.1.0.dev5__tar.gz

groupoid-0.1.0.dev5/.github/dependabot.yml

@@ -0,0 +1,87 @@
+# Dependabot configuration.
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+#
+# Opens reviewable update PRs (never auto-merged) so security and version bumps
+# are surfaced proactively, rather than relying on a manual read of the CI
+# dependency-audit output. Complements the CI dependency-vulnerability scan.
+version: 2
+updates:
+  # Python dependencies declared in pyproject.toml.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      # Pin the run to a predictable local hour. With no time/timezone,
+      # Dependabot fires at its default slot in UTC, which lands in the middle
+      # of the night for the maintainer. Adjust `timezone` to your actual IANA
+      # zone if America/New_York is not yours.
+      time: "09:00"
+      timezone: "America/New_York"
+    open-pull-requests-limit: 5
+    # Manage DIRECT dependencies only — the ones declared in pyproject.toml.
+    # GROUPOID ships no committed/compiled lockfile, so this is currently a
+    # no-op (Dependabot already only edits the pyproject declarations). It is
+    # kept for consistency and as a guard: should a compiled lock ever be added,
+    # its transitive pins must advance by recompiling the lock, not by standalone
+    # Dependabot line-edits. Transitive CVEs are NOT lost: Dependabot *security*
+    # updates patch vulnerable dependencies regardless of this allow filter.
+    allow:
+      - dependency-type: "direct"
+    # numpy 2.x is a verified runtime incompatibility, not a routine bump:
+    # geomstats (a required runtime dependency) fails at import under
+    # numpy>=2.0 because `numpy.trapz` was removed, so the tested
+    # numpy>=1.24,<2.0 contract in pyproject.toml cannot widen (see closed
+    # PR #57). Scoped by version, not a blanket numpy ignore: compatible
+    # numpy 1.x version updates and 1.x security updates still flow.
+    ignore:
+      - dependency-name: "numpy"
+        versions: [">=2.0.0"]
+    groups:
+      # Batch updates by area into a single PR per group to limit noise instead
+      # of one PR per package.
+      runtime:
+        patterns:
+          - "torch"
+          - "geomstats"
+          - "pymanopt"
+          - "ripser"
+          - "persim"
+          - "POT"
+          - "networkx"
+          - "einops"
+          - "numpy"
+          - "scipy"
+          - "pydantic"
+          - "loguru"
+      dev:
+        patterns:
+          - "pytest*"
+          - "ruff"
+          - "black"
+          - "mypy"
+          - "hypothesis"
+          - "bandit"
+          - "pip-audit"
+          - "pre-commit"
+      docs:
+        patterns: ["mkdocs*", "mkdocstrings*"]
+      # Fallback batcher. With `allow: direct` and the groups above, this should
+      # stay empty; if a future declared dep is not matched above, this keeps it
+      # to a single PR instead of one-per-package.
+      other:
+        patterns: ["*"]
+
+  # GitHub Actions used in the workflows (keeps action versions current).
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "America/New_York"
+    open-pull-requests-limit: 5
+    groups:
+      # Batch all action bumps into a single weekly PR instead of one each.
+      actions:
+        patterns: ["*"]

groupoid-0.1.0.dev5/.github/scripts/install_torch_cpu.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Installs CPU-only torch from the PyTorch index with retries.
+#
+# That index (download.pytorch.org/whl/cpu, Cloudflare R2-backed as
+# download-r2.pytorch.org) intermittently drops the TLS handshake
+# (SSLV3_ALERT_HANDSHAKE_FAILURE) from GitHub-hosted runners. pip's own
+# built-in retries reuse the same connection pool within one process and
+# do not help here; a fresh `pip install` invocation gets a fresh TLS
+# connection and has in practice succeeded where the retries within a
+# single invocation did not. Five attempts with linear backoff (10s, 20s,
+# 30s, 40s) before giving up.
+set -euo pipefail
+
+max_attempts=5
+attempt=1
+until pip install torch --index-url https://download.pytorch.org/whl/cpu; do
+  if [ "${attempt}" -ge "${max_attempts}" ]; then
+    echo "::error::torch install failed after ${max_attempts} attempts" >&2
+    exit 1
+  fi
+  sleep_seconds=$((attempt * 10))
+  echo "torch install attempt ${attempt}/${max_attempts} failed; retrying in ${sleep_seconds}s" >&2
+  sleep "${sleep_seconds}"
+  attempt=$((attempt + 1))
+done

groupoid-0.1.0.dev5/.github/workflows/auto-tag-release.yml

@@ -0,0 +1,91 @@
+name: Auto Tag Release
+
+# Creates the tag for a release-cut merge to main, then explicitly dispatches
+# release.yml (build, attestations, PyPI publish, signing, GitHub Release)
+# against that tag.
+#
+# The dispatch is explicit, not a tag-push trigger, because GitHub suppresses
+# push-triggered workflow runs caused by a GITHUB_TOKEN-authored push: pushing
+# the tag here does NOT cause release.yml's `on.push.tags` trigger to fire.
+# workflow_dispatch is the documented exception to that suppression, which is
+# why this workflow calls `gh workflow run` instead of relying on the tag
+# push itself. (An earlier version of this workflow assumed the tag push
+# alone would trigger release.yml; it did not, and no release was produced
+# for v0.1.0.dev4 until this was fixed and the release re-run manually.)
+#
+# release.yml's own `push.tags` trigger remains as a fallback/manual path
+# (a human pushing a tag with their own credentials is not subject to this
+# suppression), alongside its `workflow_dispatch` trigger for republishing an
+# existing tag to PyPI only.
+#
+# If a version needs a tag this workflow's format check rejects (see below),
+# tag it manually -- this automation only ever creates a tag when one is
+# missing, so a pre-existing manual tag always takes precedence and this
+# workflow becomes a no-op for that version.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - pyproject.toml
+
+permissions:
+  contents: read
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # push the tag
+      actions: write    # dispatch release.yml via `gh workflow run`
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0   # need full tag history to check for an existing tag
+
+      - name: Create the release tag if this version doesn't have one yet, and dispatch the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          version=$(grep -m1 '^version = "' pyproject.toml | sed -E 's/version = "(.*)"/\1/')
+          if [ -z "${version}" ]; then
+            echo "::error::could not extract a version from pyproject.toml"
+            exit 1
+          fi
+
+          # PEP 440-ish release/pre-release only: X.Y.Z, optionally with
+          # .devN / aN / bN / rcN. No local version segment (+...), no
+          # anything else. A version that doesn't match this is presumably
+          # intentional and unusual enough to want a human tagging it by
+          # hand rather than this automation guessing.
+          if ! echo "${version}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(\.dev[0-9]+|a[0-9]+|b[0-9]+|rc[0-9]+)?$'; then
+            echo "::error::version '${version}' is not a recognized release format (expected X.Y.Z, optionally with .devN/aN/bN/rcN, no local metadata); refusing to tag automatically. Tag it manually if this is intentional."
+            exit 1
+          fi
+
+          tag="v${version}"
+
+          if git rev-parse "refs/tags/${tag}" >/dev/null 2>&1; then
+            echo "Tag ${tag} already exists; nothing to do."
+            exit 0
+          fi
+
+          if ! grep -qF "[${version}]" CHANGELOG.md; then
+            echo "::error::CHANGELOG.md has no [${version}] heading; refusing to tag an undocumented release. Add the changelog section as part of the version-bump PR."
+            exit 1
+          fi
+
+          echo "Version ${version} has no matching tag; creating ${tag}."
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "${tag}" -m "Release ${tag}"
+          git push origin "refs/tags/${tag}"
+
+          echo "Dispatching release.yml for ${tag}."
+          gh workflow run release.yml \
+            --repo "${GITHUB_REPOSITORY}" \
+            --ref "${tag}" \
+            -f "ref=${tag}" \
+            -f "create_github_release=true"

{groupoid-0.1.0.dev2 → groupoid-0.1.0.dev5}/.github/workflows/ci.yml

@@ -13,8 +13,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -25,7 +25,7 @@ jobs:
           # Linting only against `ruff black mypy` left numpy/pydantic uninstalled,
           # so --strict raised disallow_subclassing_any on the BaseModel subclass.
           # Consistent with the test / security / docs jobs. CPU torch keeps it lean.
-          pip install torch --index-url https://download.pytorch.org/whl/cpu
+          .github/scripts/install_torch_cpu.sh
           pip install -e ".[dev]"
       - name: Run ruff
         run: ruff check .
@@ -40,14 +40,14 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install torch --index-url https://download.pytorch.org/whl/cpu
+          .github/scripts/install_torch_cpu.sh
           pip install -e ".[dev]"
       - name: Run tests with coverage gate
         run: >-
@@ -58,8 +58,8 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -69,7 +69,7 @@ jobs:
           # packages GROUPOID actually depends on. The previous `safety` step
           # installed only the tools and never the project, so it audited the
           # wrong environment. CPU torch keeps the install lean.
-          pip install torch --index-url https://download.pytorch.org/whl/cpu
+          .github/scripts/install_torch_cpu.sh
           pip install -e .
           pip install bandit pip-audit
           # Pin setuptools LAST. torch requires setuptools<82 and pulls in a
@@ -83,20 +83,27 @@ jobs:
       - name: Audit dependencies for known vulnerabilities (pip-audit)
         # pip-audit (OSV-backed, maintained) replaces the deprecated `safety check`
         # (deprecated in safety 3.x in favour of the account-gated `safety scan`).
-        # HARD gate: any advisory with a fix version fails the job. The single
-        # documented exception is CVE-2025-3000 (torch): no fixed release exists
-        # upstream, and OSV expresses the affected range (listed versions up to
-        # v2.6.0) as a Git/commit boundary pip-audit cannot version-resolve, so it
-        # conservatively flags the installed torch. Disclosed in SECURITY.md; the
-        # torch.load / JIT deserialization path is not exercised by GROUPOID. Revisit
-        # the ignore once upstream publishes a fixed release.
-        run: pip-audit --ignore-vuln CVE-2025-3000
+        # HARD gate: any advisory with a fix version fails the job. Two documented
+        # exceptions, both disclosed in SECURITY.md:
+        # - CVE-2025-3000 (torch): no fixed release exists upstream, and OSV
+        #   expresses the affected range (listed versions up to v2.6.0) as a
+        #   Git/commit boundary pip-audit cannot version-resolve, so it
+        #   conservatively flags the installed torch. The torch.load / JIT
+        #   deserialization path is not exercised by GROUPOID. Revisit the ignore
+        #   once upstream publishes a fixed release.
+        # - PYSEC-2026-3447 (CVE-2026-59890, setuptools <83): the fix (83.0.0) is
+        #   unreachable while torch requires setuptools<82 (see the install step
+        #   above). The flaw is a macOS-only (APFS/HFS+) Unicode-normalization
+        #   bypass of MANIFEST.in exclude rules when building sdists; all CI and
+        #   release builds run on ubuntu-latest. Drop the ignore once torch
+        #   permits setuptools>=83.
+        run: pip-audit --ignore-vuln CVE-2025-3000 --ignore-vuln PYSEC-2026-3447
 
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install pre-commit
@@ -107,14 +114,14 @@ jobs:
   benchmark:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install torch --index-url https://download.pytorch.org/whl/cpu
+          .github/scripts/install_torch_cpu.sh
           pip install -e ".[dev]"
       # Benchmarks run for information only. There is no regression gate:
       # timing baselines recorded on one machine are not comparable to a
@@ -128,7 +135,7 @@ jobs:
           pytest benchmarks/ -v --benchmark-json=benchmark_results.json || true
       - name: Upload benchmark results
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: benchmark-results
           path: benchmark_results.json
@@ -137,14 +144,14 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install torch --index-url https://download.pytorch.org/whl/cpu
+          .github/scripts/install_torch_cpu.sh
           pip install -e ".[docs]"
       - name: Build docs
         run: mkdocs build --strict

{groupoid-0.1.0.dev2 → groupoid-0.1.0.dev5}/.github/workflows/docs-deploy.yml

@@ -7,8 +7,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: pages
@@ -18,27 +16,30 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install torch --index-url https://download.pytorch.org/whl/cpu
+          .github/scripts/install_torch_cpu.sh
           pip install -e ".[docs]"
       - name: Build docs
         run: mkdocs build --strict
-      - uses: actions/upload-pages-artifact@v5
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: site/
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

groupoid-0.1.0.dev5/.github/workflows/release.yml

@@ -0,0 +1,222 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v[0-9]*"
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Existing tag/ref to build and publish (e.g. v0.1.0.dev1). Leave blank for a normal tag-triggered release."
+        required: false
+        default: ""
+      create_github_release:
+        description: "Also sign with Sigstore and create a GitHub Release (which triggers the Zenodo deposit) for this tag. Default false: PyPI publish only, for republishing an already-released tag without creating a duplicate GitHub Release. auto-tag-release.yml sets this true when it dispatches a new version's first release."
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  # Privilege separation: this job holds the attestation credentials, so it
+  # must never install the built wheel or resolve its runtime dependency
+  # graph. SBOM generation (which does both) runs in the unprivileged `sbom`
+  # job; the SBOM attestation runs in `attest-sbom`, which installs nothing.
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write       # provenance OIDC
+      attestations: write   # actions/attest-build-provenance
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ github.event.inputs.ref || github.ref }}
+          fetch-depth: 0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install build tooling
+        run: python -m pip install --upgrade pip build
+      - name: Build sdist + wheel
+        run: python -m build
+      - name: Assert exactly one release wheel
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          wheels=(dist/*.whl)
+          if (( ${#wheels[@]} != 1 )); then
+            echo "::error::expected exactly one release wheel, found ${#wheels[@]}"
+            exit 1
+          fi
+      - name: Provenance attestation (dist)
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8  # v4.2.2
+        with:
+          subject-path: "dist/*"
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: release-dist
+          path: dist/
+
+  # Unprivileged by design: installing the wheel resolves and executes
+  # third-party package installs, so this job gets no id-token, no
+  # attestations, no write access of any kind.
+  sbom:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ github.event.inputs.ref || github.ref }}
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: pip
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-dist
+          path: dist
+      - name: Generate CycloneDX SBOM from exact release wheel
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          wheels=(dist/*.whl)
+          if (( ${#wheels[@]} != 1 )); then
+            echo "::error::expected exactly one release wheel, found ${#wheels[@]}"
+            exit 1
+          fi
+          wheel="${wheels[0]}"
+
+          python -m pip install --upgrade pip cyclonedx-bom
+
+          # Keep build tooling out of the analyzed environment. pip's --python
+          # option installs the exact wheel and its resolved runtime graph into
+          # a venv that was created without pip.
+          python -m venv --without-pip .sbom-runtime
+          python -m pip --python .sbom-runtime install "$wheel"
+
+          cyclonedx-py environment .sbom-runtime/bin/python \
+            --pyproject pyproject.toml \
+            --mc-type library \
+            --output-reproducible \
+            --output-format JSON \
+            --output-file sbom.cdx.json
+          python scripts/bind_release_sbom.py --sbom sbom.cdx.json --wheel "$wheel"
+      - name: Independently verify SBOM root against exact wheel
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          wheels=(dist/*.whl)
+          if (( ${#wheels[@]} != 1 )); then
+            echo "::error::expected exactly one release wheel, found ${#wheels[@]}"
+            exit 1
+          fi
+          python scripts/bind_release_sbom.py --verify-only --sbom sbom.cdx.json --wheel "${wheels[0]}"
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: release-sbom
+          path: sbom.cdx.json
+
+  # The only privileged SBOM step. It consumes the already-built wheel and the
+  # already-verified SBOM; it installs no packages, resolves no dependencies,
+  # and executes no project code. The SBOM describes the installed wheel's
+  # runtime closure, so it is attested to the wheel subject only — never the
+  # sdist.
+  attest-sbom:
+    needs: [build, sbom]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write       # attestation OIDC
+      attestations: write   # actions/attest-sbom
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-dist
+          path: dist
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-sbom
+          path: .
+      - uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e  # v4.1.0
+        with:
+          subject-path: "dist/*.whl"
+          sbom-path: "sbom.cdx.json"
+
+  publish-pypi:
+    # Publication waits for the full integrity chain: build provenance
+    # (build), SBOM generation + verification (sbom), and the wheel-bound
+    # SBOM attestation (attest-sbom).
+    needs: [build, sbom, attest-sbom]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write       # PyPI Trusted Publishing OIDC
+    environment:
+      name: pypi
+      url: https://pypi.org/project/groupoid/
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-dist
+          path: dist
+      - name: Publish to PyPI (Trusted Publishing, OIDC)
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # release/v1
+        with:
+          packages-dir: dist
+          print-hash: true
+          # Idempotent: a re-dispatch or an out-of-band manual republish of a
+          # version already on PyPI should not fail the job.
+          skip-existing: true
+
+  sign-and-release:
+    needs: [build, sbom, attest-sbom]
+    # On a real tag push, or an explicit request via create_github_release=true
+    # (see auto-tag-release.yml, which dispatches this workflow with that flag
+    # set for a version's first release, since GitHub suppresses push-triggered
+    # workflow runs caused by its own GITHUB_TOKEN). A plain workflow_dispatch
+    # republish (create_github_release left at its false default) must NOT
+    # create a duplicate GitHub Release or trigger a second Zenodo deposit.
+    if: github.event_name == 'push' || github.event.inputs.create_github_release == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write       # create GitHub Release
+      id-token: write       # Sigstore signing OIDC
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-dist
+          path: dist
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-sbom
+          path: .
+      - name: Sign artifacts with Sigstore
+        uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9  # v3.5.0
+        with:
+          inputs: |
+            dist/*.tar.gz
+            dist/*.whl
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
+        with:
+          # Explicit rather than relying on ref inference: on a tag push
+          # github.ref_name is already the tag, but being explicit keeps this
+          # correct regardless of trigger type.
+          tag_name: ${{ github.event.inputs.ref || github.ref_name }}
+          generate_release_notes: true
+          files: |
+            dist/*
+            sbom.cdx.json
+            *.sigstore.json

groupoid-0.1.0.dev5/.zenodo.json

@@ -0,0 +1,39 @@
+{
+  "upload_type": "software",
+  "title": "GROUPOID: Groupoid-based aggregation for federated learning on Riemannian manifolds",
+  "version": "0.1.0.dev5",
+  "description": "<p>Pre-alpha research prototype exploring groupoid-based aggregation for federated learning on Riemannian manifolds. The supported point-valued aggregation path uses explicit invertible point actions, a cycle-basis holonomy defect diagnostic, the cellular sheaf Laplacian, and Karcher mean aggregation via geomstats. Tangent-vector parallel transport is provided separately through Schild and pole ladder utilities.</p><p><strong>Scientific correction in v0.1.0.dev5:</strong> earlier releases described the cycle-basis holonomy statistic as a first-cohomology (H^1) norm. The implementation actually computes the maximum Frobenius deviation of holonomy from identity over the particular NetworkX cycle basis. Exact zero has a flatness interpretation under explicit connectedness, completeness, invertibility, reciprocal opposite-edge registration when both directions are supplied, and complete evaluation of every cycle emitted by the NetworkX cycle-basis routine (an argument specific to the NetworkX Paton implementation exercised here, not to arbitrary cycle bases), but the nonzero magnitude is basis-dependent and is not invariant under arbitrary invertible changes of frame. The stored preregistered benchmark values are unchanged; the historical H2 rho and permutation p-value are reinterpreted as statistics for this fixed cycle-basis defect, not for a canonical H^1 norm. This version also withdraws register_transport_from_points from the supported point-valued aggregation path: its ambient square operator is assembled from transported tangent vectors and does not generally define the invertible manifold point action that aggregation requires. Tangent-vector ladder validation remains supported. The ambient tangent-matrix helper is restricted to vector-shaped point representations. Direct registered matrices are supported only under the explicit point-action contract documented in the repository, including reciprocal opposite arrows when both orientations are stored. See CORRECTION_NOTICE.md for the full correction record.</p><p>The earlier v0.1.0.dev0 version DOI 10.5281/zenodo.20563975 remains superseded and must not be cited for results. Exact historical versions should be cited by their version-specific DOI; project-level DOI metadata is maintained through the Zenodo version family.</p>",
+  "creators": [
+    {
+      "name": "Maniches, Santiago",
+      "affiliation": "TOPOLOGICA LLC",
+      "orcid": "0009-0005-6480-1987"
+    }
+  ],
+  "license": "Apache-2.0",
+  "keywords": [
+    "federated learning",
+    "Riemannian geometry",
+    "groupoid",
+    "sheaf theory",
+    "holonomy",
+    "topological data analysis"
+  ],
+  "related_identifiers": [
+    {
+      "identifier": "10.5281/zenodo.20563974",
+      "relation": "isVersionOf",
+      "scheme": "doi"
+    },
+    {
+      "identifier": "10.5281/zenodo.21230068",
+      "relation": "isNewVersionOf",
+      "scheme": "doi"
+    },
+    {
+      "identifier": "https://github.com/smaniches/GROUPOID",
+      "relation": "isSupplementTo",
+      "scheme": "url"
+    }
+  ]
+}