holder-kit 0.0.1__tar.gz

holder_kit-0.0.1/.github/actions/core-sdk/action.yml

@@ -0,0 +1,21 @@
+name: Fetch core SDK
+description: Use the run-wide immutable core selection and verify cached SDK archives
+inputs:
+  commit:
+    description: Resolved core commit
+    required: true
+  build-type:
+    description: Core and shim build configuration
+    default: RelWithDebInfo
+runs:
+  using: composite
+  steps:
+    - uses: HolderTeam/holder-core/.github/actions/core-sdk@main
+      with:
+        commit: ${{ inputs.commit }}
+        build-type: ${{ inputs.build-type }}
+    - name: Configure Python build tools
+      shell: bash
+      run: |
+        echo 'CMAKE_GENERATOR=Ninja' >> "$GITHUB_ENV"
+        echo "SKBUILD_CMAKE_BUILD_TYPE=$HOLDER_CORE_BUILD_TYPE" >> "$GITHUB_ENV"

holder_kit-0.0.1/.github/workflows/ci.yml

@@ -0,0 +1,325 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      core_ref:
+        description: Core version tag or full commit SHA (empty selects latest-green)
+        required: false
+        type: string
+  workflow_call:
+    inputs:
+      core_ref:
+        description: Exact published core commit to test
+        required: true
+        type: string
+      kit_ref:
+        description: Holder Kit source revision (resolved once for all jobs)
+        default: main
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  core-sdk:
+    name: Resolve core SDK once
+    runs-on: ubuntu-24.04
+    outputs:
+      commit: ${{ steps.resolve.outputs.commit }}
+      kit_commit: ${{ steps.source.outputs.kit_commit }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          repository: HolderTeam/holder-kit
+          ref: ${{ github.repository == 'HolderTeam/holder-kit' && github.sha || inputs.kit_ref || 'main' }}
+          persist-credentials: false
+      - id: source
+        name: Record Holder Kit source revision
+        shell: bash
+        run: echo "kit_commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - id: resolve
+        uses: HolderTeam/holder-core/.github/actions/core-sdk@main
+        with:
+          command: resolve
+          core-ref: ${{ inputs.core_ref || 'latest-green' }}
+
+  linux:
+    needs: core-sdk
+    name: ${{ matrix.name }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            name: Ubuntu 24.04 / Python 3.12 / compatibility
+            python-version: "3.12"
+            comprehensive: true
+            sanitized: false
+          # Use the canonical SDK's distribution dependency ABI. Native
+          # Ubuntu-series integration belongs to the Debian package builds.
+          - runner: ubuntu-24.04
+            name: Ubuntu 24.04 / Python 3.14 / shim sanitizers
+            python-version: "3.14"
+            comprehensive: false
+            sanitized: true
+
+    steps:
+      - name: Check out Holder Kit
+        uses: actions/checkout@v7
+        with:
+          repository: HolderTeam/holder-kit
+          ref: ${{ needs.core-sdk.outputs.kit_commit }}
+          persist-credentials: false
+
+      - name: Fetch verified core SDK
+        uses: ./.github/actions/core-sdk
+        with:
+          commit: ${{ needs.core-sdk.outputs.commit }}
+
+      - name: Install native build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential \
+            cmake \
+            ninja-build \
+            pkg-config \
+            python3-dev \
+            python3-venv \
+            libssl-dev \
+            nlohmann-json3-dev \
+            libyaml-cpp-dev \
+            libspdlog-dev \
+            libsqlite3-dev \
+            libsodium-dev \
+            libgit2-dev \
+            libmd4c-dev \
+            libsecret-1-dev
+
+      - name: Set up selected Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Create isolated CI environment
+        run: |
+          python3 -m venv "${RUNNER_TEMP}/holder-ci-venv"
+          echo "${RUNNER_TEMP}/holder-ci-venv/bin" >> "${GITHUB_PATH}"
+
+      - name: Install packaging tools
+        run: python3 -m pip install --upgrade pip
+
+      - name: Build and install Holder Kit with complete test dependencies
+        if: ${{ matrix.comprehensive }}
+        run: python3 -m pip install --verbose '.[test]'
+
+      - name: Build instrumented Holder Kit for lifecycle smoke tests
+        if: ${{ matrix.sanitized }}
+        run: python3 -m pip install --verbose --config-settings=cmake.define.HOLDER_KIT_SANITIZE=address,undefined . 'pytest>=8'
+
+      - name: Configure sanitizer runtime
+        if: ${{ matrix.sanitized }}
+        run: |
+          asan_library="$(gcc -print-file-name=libasan.so)"
+          if ! file -L "${asan_library}" | grep -q 'ELF'; then
+            asan_library="$(ldconfig -p | awk '/libasan\.so/{print $NF; exit}')"
+          fi
+          test -f "${asan_library}"
+          echo "LD_PRELOAD=${asan_library}" >> "${GITHUB_ENV}"
+          echo "ASAN_OPTIONS=detect_leaks=0:halt_on_error=1" >> "${GITHUB_ENV}"
+          echo "UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1" >> "${GITHUB_ENV}"
+
+      - name: Show installed build
+        run: |
+          python3 --version
+          python3 -c 'import sys; print(sys.executable)'
+          python3 -m pip show holder-kit
+          python3 -c 'import holderkit; print(holderkit.__file__)'
+
+      - name: Run instrumented Python lifecycle smoke tests
+        if: ${{ matrix.sanitized }}
+        run: |
+          python3 -m pytest --verbose \
+            tests/test_holder.py::test_native_extension_imports \
+            tests/test_holder.py::test_complete_card_lifecycle \
+            tests/test_holder.py::test_context_destruction_releases_native_resources
+
+      - name: Run complete Python tests
+        if: ${{ matrix.comprehensive }}
+        run: python3 -m pytest --verbose
+
+      - name: Run strict type checking
+        if: ${{ matrix.comprehensive }}
+        run: python3 -m mypy
+
+      - name: Run lifecycle example
+        run: python3 examples/card_lifecycle.py
+
+      - name: Run detached-record and pandas examples
+        if: ${{ matrix.comprehensive }}
+        run: |
+          python3 examples/detached_records.py
+          python3 examples/pandas_analysis.py
+
+      - name: Build wheel
+        if: ${{ matrix.comprehensive }}
+        run: |
+          python3 -m pip install build
+          python3 -m build --wheel --outdir dist
+          ls -lh dist
+
+      - name: Install wheel in a fresh base environment
+        if: ${{ matrix.comprehensive }}
+        run: |
+          python3 -m venv "${RUNNER_TEMP}/holder-wheel-venv"
+          "${RUNNER_TEMP}/holder-wheel-venv/bin/python" -m pip install --upgrade pip
+          "${RUNNER_TEMP}/holder-wheel-venv/bin/python" -m pip install --verbose dist/*.whl
+
+      - name: Smoke-test installed wheel without pandas
+        if: ${{ matrix.comprehensive }}
+        run: |
+          "${RUNNER_TEMP}/holder-wheel-venv/bin/python" - <<'PY'
+          import importlib.util
+          import json
+          from importlib.metadata import distribution
+          from importlib.resources import files
+          import sys
+          import tempfile
+          from pathlib import Path
+
+          assert importlib.util.find_spec("pandas") is None
+
+          import holderkit
+          from holderkit import _native
+
+          installed = distribution("holder-kit")
+          assert installed.metadata["Name"] == "holder-kit"
+          assert installed.files is not None
+          assert all(path.parts[0] != "holder" for path in installed.files)
+          assert importlib.util.find_spec("holder") is None
+          assert _native.__name__ == "holderkit._native"
+          assert _native.Context.__module__ == "holderkit._native"
+          assert holderkit.HolderError.__module__ == "holderkit._native"
+          resources = files("holderkit")
+          assert resources.joinpath("py.typed").is_file()
+          assert resources.joinpath("_schema.sql").read_text(encoding="utf-8")
+          assert json.loads(resources.joinpath("_core_build.json").read_text(encoding="utf-8"))
+
+          assert "pandas" not in sys.modules
+          with tempfile.TemporaryDirectory(prefix="holder-wheel-smoke-") as temporary:
+              with holderkit.open(Path(temporary) / "data") as context:
+                  project = context.create_project("Wheel smoke test")
+                  card = context.create_card(
+                      project.project_id, "Installed wheel", "standalone body"
+                  )
+                  assert context.get_card_content(card.card_id) == "standalone body"
+                  assert context.cards.to_records(project.project_id)[0]["card_id"] == card.card_id
+                  try:
+                      context.cards.to_dataframe(project.project_id)
+                  except ModuleNotFoundError as error:
+                      assert "holder-kit[pandas]" in str(error)
+                  else:
+                      raise AssertionError("base wheel unexpectedly provided pandas")
+          PY
+
+  macos:
+    needs: core-sdk
+    name: macOS 15 / Python 3.12
+    runs-on: macos-15
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out Holder Kit
+        uses: actions/checkout@v7
+        with:
+          repository: HolderTeam/holder-kit
+          ref: ${{ needs.core-sdk.outputs.kit_commit }}
+          persist-credentials: false
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Fetch verified core SDK
+        uses: ./.github/actions/core-sdk
+        with:
+          commit: ${{ needs.core-sdk.outputs.commit }}
+
+      - name: Install native build dependencies
+        run: |
+          brew install \
+            cmake \
+            ninja \
+            pkg-config \
+            nlohmann-json \
+            yaml-cpp \
+            spdlog \
+            sqlite \
+            libsodium \
+            libgit2 \
+            md4c \
+            openssl@3
+
+      - name: Build and install Holder Kit
+        run: |
+          python3 -m pip install --upgrade pip
+          CMAKE_ARGS="$CMAKE_ARGS -DCMAKE_PREFIX_PATH=$(brew --prefix);$(brew --prefix openssl@3) -DOPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" \
+            python3 -m pip install --verbose . 'pytest>=8'
+
+      - name: Run base Python tests
+        run: python3 -m pytest --verbose tests/test_holder.py
+
+      - name: Run lifecycle example
+        run: python3 examples/card_lifecycle.py
+
+  windows:
+    needs: core-sdk
+    name: Windows Server 2025 / Python 3.12
+    runs-on: windows-2025
+    timeout-minutes: 45
+
+    steps:
+      - name: Check out Holder Kit
+        uses: actions/checkout@v7
+        with:
+          repository: HolderTeam/holder-kit
+          ref: ${{ needs.core-sdk.outputs.kit_commit }}
+          persist-credentials: false
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Set up MSVC developer environment
+        uses: ilammy/msvc-dev-cmd@v1
+
+      - name: Fetch verified core SDK
+        uses: ./.github/actions/core-sdk
+        with:
+          commit: ${{ needs.core-sdk.outputs.commit }}
+
+      - name: Build and install Holder Kit
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install --verbose . "pytest>=8"
+
+      - name: Verify native extension and bundled runtime dependencies
+        run: python -c "import holderkit; print(holderkit.__file__)"
+
+      - name: Run base Python tests
+        run: python -m pytest --verbose tests/test_holder.py
+
+      - name: Run lifecycle example
+        run: python examples/card_lifecycle.py

holder_kit-0.0.1/.github/workflows/launchpad.yml

@@ -0,0 +1,79 @@
+name: Prepare Holder Kit Launchpad packages
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Expected pyproject.toml version
+        required: true
+        default: '0.0.1'
+      package_revision:
+        description: Debian revision (increment for each replacement upload)
+        required: true
+        default: '1'
+      core_package_version:
+        description: Exact core package version before the Ubuntu suffix
+        required: true
+        default: '0.2.0-1'
+      upload:
+        description: Sign and upload the source candidates to the Holder PPA
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  source:
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        series: [noble, resolute]
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Install source packaging tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends devscripts debhelper dh-python dput gnupg
+      - name: Prepare pinned source candidate
+        env:
+          UPSTREAM_VERSION: ${{ inputs.version }}
+          PACKAGE_REVISION: ${{ inputs.package_revision }}
+          CORE_PACKAGE_VERSION: ${{ inputs.core_package_version }}
+          SERIES: ${{ matrix.series }}
+        run: |
+          python3 scripts/prepare-debian-source.py --version "$UPSTREAM_VERSION" \
+            --package-revision "$PACKAGE_REVISION" --series "$SERIES" \
+            --core-package-version "${CORE_PACKAGE_VERSION}~${SERIES}1"
+          debuild -S -d -us -uc
+      - name: Save source candidate
+        run: |
+          mkdir -p out/source
+          cp ../holder-kit_*.dsc ../holder-kit_*.tar.* \
+            ../holder-kit_*_source.changes ../holder-kit_*_source.buildinfo out/source/
+      - uses: actions/upload-artifact@v7
+        with:
+          name: holder-kit-source-${{ matrix.series }}
+          path: out/source/*
+          if-no-files-found: error
+      - name: Sign source candidate
+        if: inputs.upload
+        env:
+          PPA_GPG_PRIVATE_KEY: ${{ secrets.PPA_GPG_PRIVATE_KEY }}
+        run: |
+          test -n "$PPA_GPG_PRIVATE_KEY"
+          mkdir -p ~/.gnupg
+          chmod 700 ~/.gnupg
+          printf '%s\n' "$PPA_GPG_PRIVATE_KEY" | gpg --batch --import
+          keyid="$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/ {print $5; exit}')"
+          test -n "$keyid"
+          printf 'batch\nyes\npinentry-mode loopback\n' > ~/.gnupg/gpg.conf
+          printf 'allow-loopback-pinentry\n' > ~/.gnupg/gpg-agent.conf
+          gpgconf --kill gpg-agent
+          debsign -k"$keyid" ../holder-kit_*_source.changes
+      - name: Upload source candidate
+        if: inputs.upload
+        run: dput ppa:holderteam/holder ../holder-kit_*_source.changes

holder_kit-0.0.1/.github/workflows/release.yml

@@ -0,0 +1,243 @@
+name: Kit release wheels
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/release.yml
+      - .github/actions/core-sdk/**
+      - release-core.json
+      - pyproject.toml
+      - CMakeLists.txt
+      - src/**
+      - scripts/*wheel*.py
+      - scripts/check-release-distributions.py
+  workflow_dispatch:
+    inputs:
+      destination:
+        description: Build candidates, or publish a version tag after validation
+        type: choice
+        options: [none, testpypi, pypi]
+        default: none
+
+permissions:
+  contents: read
+
+jobs:
+  prepare:
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.config.outputs.version }}
+      core_commit: ${{ steps.config.outputs.core_commit }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+      - id: config
+        env:
+          DESTINATION: ${{ inputs.destination || 'none' }}
+        run: |
+          python - <<'PY'
+          import json, os, re, tomllib
+          from pathlib import Path
+          version = tomllib.loads(Path('pyproject.toml').read_text())['project']['version']
+          pin = json.loads(Path('release-core.json').read_text())
+          assert pin['repository'] == 'HolderTeam/holder-core'
+          assert re.fullmatch(r'[0-9a-f]{40}', pin['commit'])
+          assert pin['build_type'] == 'Release'
+          if os.environ['DESTINATION'] != 'none':
+              assert os.environ['GITHUB_REF'] == f'refs/tags/v{version}', 'Publishing requires the matching version tag'
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              output.write(f'version={version}\ncore_commit={pin["commit"]}\n')
+          PY
+      - uses: HolderTeam/holder-core/.github/actions/core-sdk@main
+        with:
+          command: resolve
+          core-ref: ${{ steps.config.outputs.core_commit }}
+
+  wheels:
+    needs: prepare
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ['3.10', '3.11', '3.12', '3.13', '3.14']
+        runner: [ubuntu-24.04, windows-2025, macos-15]
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python }}
+      - uses: ilammy/msvc-dev-cmd@v1
+        if: runner.os == 'Windows'
+      - uses: ./.github/actions/core-sdk
+        with:
+          commit: ${{ needs.prepare.outputs.core_commit }}
+          build-type: Release
+      - name: Linux native dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends build-essential cmake ninja-build pkg-config \
+            patchelf libssl-dev nlohmann-json3-dev libyaml-cpp-dev libspdlog-dev \
+            libsqlite3-dev libsodium-dev libgit2-dev libmd4c-dev libsecret-1-dev
+      - name: macOS native dependencies
+        if: runner.os == 'macOS'
+        run: |
+          brew install cmake ninja pkg-config nlohmann-json yaml-cpp spdlog sqlite \
+            libsodium libgit2 md4c openssl@3
+          echo 'MACOSX_DEPLOYMENT_TARGET=15.0' >> "$GITHUB_ENV"
+          echo "CMAKE_ARGS=$CMAKE_ARGS -DCMAKE_PREFIX_PATH=$(brew --prefix);$(brew --prefix openssl@3) -DOPENSSL_ROOT_DIR=$(brew --prefix openssl@3) -DCMAKE_OSX_ARCHITECTURES=arm64" >> "$GITHUB_ENV"
+      - name: Build wheel
+        shell: bash
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build wheel twine
+          python -m build --wheel --outdir out/raw
+      - name: Bundle Linux runtime and validate manylinux ABI
+        if: runner.os == 'Linux'
+        run: |
+          python -m pip install 'auditwheel==6.8.2'
+          python scripts/repair-linux-wheel.py --output dist out/raw/*.whl
+      - name: Bundle macOS runtime
+        if: runner.os == 'macOS'
+        run: |
+          python -m pip install delocate
+          python scripts/wheel-notices.py --output out/noticed out/raw/*.whl
+          delocate-wheel --require-archs arm64 -v -w dist out/noticed/*.whl
+      - name: Bundle Windows runtime
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          python -m pip install delvewheel
+          python scripts/wheel-notices.py --output out/noticed out/raw/*.whl
+          python -m delvewheel repair --add-path "$HOLDER_CORE_SDK/bin" -w dist out/noticed/*.whl
+      - name: Check distribution metadata
+        shell: bash
+        run: python -m twine check --strict dist/*.whl
+      - name: Install wheel in a new virtualenv
+        shell: bash
+        env:
+          CORE_COMMIT: ${{ needs.prepare.outputs.core_commit }}
+          KIT_VERSION: ${{ needs.prepare.outputs.version }}
+        run: |
+          python -m venv out/test-venv
+          if [ "$RUNNER_OS" = Windows ]; then
+            test_python=out/test-venv/Scripts/python.exe
+          else
+            test_python=out/test-venv/bin/python
+          fi
+          "$test_python" -m pip install --no-deps dist/*.whl
+          env -u HOLDER_CORE_SDK -u CMAKE_ARGS -u LD_LIBRARY_PATH -u DYLD_LIBRARY_PATH \
+            "$test_python" -I scripts/test-installed-wheel.py --core-commit "$CORE_COMMIT" --version "$KIT_VERSION"
+          "$test_python" -m pip install 'pytest>=8' pandas networkx
+          "$test_python" -I -m pytest -q --import-mode=importlib tests/test_holder.py \
+            tests/test_connections.py tests/test_graph.py tests/test_pandas.py
+      - name: Linux wheel in a clean Debian runtime
+        if: runner.os == 'Linux'
+        env:
+          PYTHON_VERSION: ${{ matrix.python }}
+          CORE_COMMIT: ${{ needs.prepare.outputs.core_commit }}
+          KIT_VERSION: ${{ needs.prepare.outputs.version }}
+        run: |
+          docker run --rm -v "$PWD:/source:ro" \
+            -e CORE_COMMIT -e KIT_VERSION "python:${PYTHON_VERSION}-slim-trixie" \
+            bash -c 'python -m venv /venv && /venv/bin/python -m pip install --no-deps /source/dist/*.whl && cd /tmp && /venv/bin/python -I /source/scripts/test-installed-wheel.py --core-commit "$CORE_COMMIT" --version "$KIT_VERSION"'
+      - uses: actions/upload-artifact@v7
+        with:
+          name: wheel-${{ matrix.runner }}-${{ matrix.python }}
+          path: dist/*.whl
+          if-no-files-found: error
+
+  sdist:
+    needs: prepare
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+      - run: |
+          python -m pip install build twine
+          python -m build --sdist --outdir dist
+          python -m twine check --strict dist/*.tar.gz
+      - uses: ./.github/actions/core-sdk
+        with:
+          commit: ${{ needs.prepare.outputs.core_commit }}
+          build-type: Release
+      - name: Build and install the source archive with the pinned SDK
+        env:
+          CORE_COMMIT: ${{ needs.prepare.outputs.core_commit }}
+          KIT_VERSION: ${{ needs.prepare.outputs.version }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends build-essential cmake ninja-build pkg-config \
+            libssl-dev nlohmann-json3-dev libyaml-cpp-dev libspdlog-dev libsqlite3-dev \
+            libsodium-dev libgit2-dev libmd4c-dev libsecret-1-dev
+          python -m venv out/source-test
+          out/source-test/bin/python -m pip install --no-deps dist/*.tar.gz
+          out/source-test/bin/python -I scripts/test-installed-wheel.py --core-commit "$CORE_COMMIT" --version "$KIT_VERSION"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: source-distribution
+          path: dist/*.tar.gz
+          if-no-files-found: error
+
+  distributions:
+    needs: [prepare, wheels, sdist]
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: wheel-*
+          path: dist
+          merge-multiple: true
+      - uses: actions/download-artifact@v4
+        with:
+          name: source-distribution
+          path: dist
+      - run: python scripts/check-release-distributions.py dist --manifest out/release-manifest.json
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-distributions
+          path: dist/*
+          if-no-files-found: error
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-manifest
+          path: out/release-manifest.json
+
+  publish:
+    if: github.event_name == 'workflow_dispatch' && inputs.destination != 'none'
+    needs: distributions
+    runs-on: ubuntu-24.04
+    environment: ${{ inputs.destination }}
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: release-distributions
+          path: dist
+      - name: Publish to TestPyPI
+        if: inputs.destination == 'testpypi'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+      - name: Publish to PyPI
+        if: inputs.destination == 'pypi'
+        uses: pypa/gh-action-pypi-publish@release/v1