inkrs 0.2.0__tar.gz

inkrs-0.2.0/.gitattributes

@@ -0,0 +1,7 @@
+# LF in every checkout, Windows included: the PTX tiers are embedded byte for byte (include_str!) and checked
+# against hashes, and the villa patches must apply as written, so CRLF would change what a build ships
+* text=auto eol=lf
+# float fixtures are raw little-endian bytes
+*.f32 binary
+# compiled kernels, embedded byte for byte (include_bytes!)
+*.cubin binary

inkrs-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,148 @@
+# Builds and checks inkrs on Linux and Windows x86_64: formatting, clippy, the CPU tests and the CLI, plus the
+# dependency policy and the Python lints. package.yml builds and tests the Python wheels and sdist. A GitHub runner
+# has no GPU, so nothing here runs a model; the GPU checks are in results/README.md. CUDA loads at run time, so no
+# job installs a CUDA toolkit
+
+name: CI
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+permissions:
+  contents: read
+
+# a new push to a pull request supersedes its running checks
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  rust:
+    name: Rust (${{ matrix.name }})
+    # MSVC links slower
+    timeout-minutes: ${{ matrix.os == 'windows-2025' && 45 || 30 }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Linux x86_64
+            os: ubuntu-24.04
+            rustflags: -D warnings
+          # the C runtime is linked statically, so inkrs.exe runs without the Visual C++ redistributable. RUSTFLAGS
+          # replaces the per-target flags rather than adding to them, so each target spells out its full set
+          - name: Windows x86_64
+            os: windows-2025
+            rustflags: -D warnings -C target-feature=+crt-static
+    runs-on: ${{ matrix.os }}
+    env:
+      RUSTFLAGS: ${{ matrix.rustflags }}
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          toolchain: stable
+          components: rustfmt, clippy
+
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+
+      # the PTX tiers are embedded byte for byte, so a checkout must not change a line ending; .gitattributes keeps
+      # every file LF, and renormalising must find nothing to change
+      - name: Line endings
+        shell: bash
+        run: |
+          set -euo pipefail
+          git add --renormalize .
+          git diff --cached --exit-code
+
+      - name: Format
+        if: runner.os == 'Linux'
+        run: cargo fmt --all -- --check
+
+      # hashes and file lists only; the PTX itself is built with cuda-oxide and the CUDA toolkit
+      - name: Committed PTX matches the kernel sources
+        if: runner.os == 'Linux'
+        run: scripts/check-ptx.sh
+
+      - name: Clippy
+        run: cargo clippy --workspace --all-targets --locked -- -D warnings
+
+      # the tests that need a GPU open one and fail without it, so only the CPU tests run here; the Windows leg also
+      # runs the DLL search's own tests
+      - name: Tests
+        run: cargo test --workspace --exclude inkrs-python --release --locked
+
+      - name: Build the CLI
+        run: cargo build --release --locked --bin inkrs
+
+      # a static C runtime keeps vcruntime140.dll and the UCRT out of the imports, and CUDA must load at run time,
+      # so the binary may import only Windows system DLLs
+      - name: Check the CLI's imports and that it starts
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          set -euo pipefail
+          bin=target/release/inkrs.exe
+          rustup component add llvm-tools
+          readobj="$(cygpath -u "$(rustc --print sysroot)")/lib/rustlib/x86_64-pc-windows-msvc/bin/llvm-readobj.exe"
+          # a Windows tool's output ends lines with CRLF
+          imports="$("$readobj" --coff-imports "$bin" | tr -d '\r' | sed -n 's/^ *Name: //p' | sort -u)"
+          echo "$imports"
+          if grep -Eiv '^(kernel32|ntdll|advapi32|bcrypt|bcryptprimitives|ws2_32|userenv|secur32|crypt32|ole32|oleaut32|shell32|user32|synchronization|api-ms-win-core-[a-z0-9-]+)\.dll$' <<< "$imports"; then
+            echo "the binary imports a DLL outside Windows itself" >&2
+            exit 1
+          fi
+          "$bin" --help
+          # the runner has no NVIDIA driver, so opening the GPU must fail naming the Windows driver, not panic
+          if out="$("$bin" probe 2>&1)"; then
+            echo "probe succeeded without a GPU" >&2
+            exit 1
+          fi
+          echo "$out"
+          grep -q 'nvcuda.dll' <<< "$out"
+
+
+  # advisories, licences and sources (deny.toml): every dependency comes from crates.io
+  deny:
+    name: Dependency policy
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          toolchain: stable
+
+      # a prebuilt binary instead of cargo-deny-action, whose Docker build fails whenever Docker Hub rate-limits the
+      # runner
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
+        with:
+          tool: cargo-deny@0.20.2
+
+      - name: Check dependency policy
+        run: cargo deny --workspace --all-features check
+
+  python-lint:
+    name: Python lints
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+
+      # pinned, because a ruff release that adds lints would otherwise fail an unchanged tree
+      - name: Ruff
+        run: uvx ruff@0.17.4 check python

inkrs-0.2.0/.github/workflows/package.yml

@@ -0,0 +1,471 @@
+# Builds and tests the inkrs Python package, its wheels and sdist, on every push and pull request, and publishes
+# them from a version tag
+#
+# To release:
+#   1. set the version in Cargo.toml and python/Cargo.toml; pyproject.toml takes it from python/Cargo.toml
+#   2. in CHANGELOG.md, give the version's entry its release date ("## [X.Y.Z] - YYYY-MM-DD", replacing
+#      "Unreleased") and its link at the bottom
+#   3. merge, then tag the merge commit and push the tag:
+#        git tag vX.Y.Z
+#        git push origin vX.Y.Z
+#
+# The tag publishes to TestPyPI and installs that release on each platform. The pypi environment then waits for a
+# reviewer, and once approved the workflow publishes to PyPI, then a GitHub release with the tag's CHANGELOG.md
+# entry as its notes and the wheels and sdist attached. A tag whose version or changelog entry is wrong fails
+# before anything is published. PyPI and TestPyPI trust this workflow and its environments through OIDC, so no
+# token is stored. Every publish skips files already uploaded, so "Re-run failed jobs" finishes a partial release.
+# Third-party actions are pinned to commit SHAs, since these jobs build and publish the release files; the trailing
+# comment names the version
+
+name: Package
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches:
+      - master
+    tags:
+      - "v*"
+  pull_request:
+    branches:
+      - master
+
+permissions:
+  contents: read
+
+# a new push to a pull request supersedes its running checks; a tag's run is never cancelled
+concurrency:
+  group: package-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  # one abi3 wheel per platform with the backend that platform runs, installed and tested on the oldest and a
+  # current CPython. The Linux and Windows wheels build without a GPU or CUDA toolkit because CUDA loads at run time
+  # and the kernels ship compiled; the macOS wheel needs no Metal toolchain because the shaders compile when the
+  # engine opens. A runner has no GPU, so nothing here runs a model; the GPU checks are in results/README.md
+  wheels:
+    name: Wheel (${{ matrix.name }})
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Linux x86_64, CUDA
+            os: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+            manylinux: "2_28"
+            rustflags: -D warnings
+          - name: macOS arm64, Metal
+            os: macos-26
+            target: aarch64-apple-darwin
+            manylinux: "off"
+            rustflags: -D warnings
+          # the C runtime is linked statically, so the extension runs without the Visual C++ redistributable whichever
+          # Python loads it. RUSTFLAGS replaces the per-target flags rather than adding to them, so each target spells
+          # out its full set
+          - name: Windows x86_64, CUDA
+            os: windows-2025
+            target: x86_64-pc-windows-msvc
+            manylinux: "off"
+            rustflags: -D warnings -C target-feature=+crt-static
+    runs-on: ${{ matrix.os }}
+    env:
+      RUSTFLAGS: ${{ matrix.rustflags }}
+      # the Metal engine needs macOS 26, but the wheel keeps the arm64 floor so pip installs it on any Apple silicon
+      # Mac, where an older macOS gets the engine's UnsupportedError naming the version instead of a failed sdist
+      # build; other platforms ignore this
+      MACOSX_DEPLOYMENT_TARGET: "11.0"
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      # a Windows checkout without symlink support writes each licence symlink in python/ as a text file holding its
+      # target, which maturin would ship in the wheel as the licence; removing it first keeps cp from writing through
+      # a real symlink onto itself
+      - name: Resolve the licence symlinks
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          set -euo pipefail
+          for f in LICENSE-MIT LICENSE-APACHE THIRD_PARTY_NOTICES; do
+            rm -f "python/$f"
+            cp "$f" "python/$f"
+          done
+
+      - name: Build wheel
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          command: build
+          target: ${{ matrix.target }}
+          manylinux: ${{ matrix.manylinux }}
+          args: --release --locked --out dist -m python/Cargo.toml
+          # tag builds are published, so they never reuse objects from the shared cache
+          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+
+      - name: Check wheel size
+        shell: bash
+        run: |
+          set -euo pipefail
+          # PyPI rejects files over 100 MB unless the project's limit is raised
+          limit=$((90 * 1000 * 1000))
+          for wheel in dist/*.whl; do
+            size="$(wc -c < "$wheel")"
+            echo "$(basename "$wheel"): $size bytes"
+            test "$size" -le "$limit"
+          done
+
+      # pip on macOS before 26 skips a wheel tagged for a newer macOS and tries to build the sdist instead
+      - name: Check the macOS platform tag
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          set -euo pipefail
+          ls dist/*-macosx_11_0_arm64.whl
+
+      # CUDA must load at run time and the C runtime is static, so the extension may import only Python's stable ABI
+      # and Windows system DLLs
+      - name: Check the extension's imports
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          set -euo pipefail
+          unpacked="$RUNNER_TEMP/wheel"
+          mkdir -p "$unpacked"
+          # 7-Zip ships on the runner image, and a wheel is a zip
+          7z x -y dist/*.whl -o"$unpacked" > /dev/null
+          ext="$(find "$unpacked" -name '_inkrs*.pyd' -print -quit)"
+          test -n "$ext"
+          rustup component add llvm-tools
+          readobj="$(cygpath -u "$(rustc --print sysroot)")/lib/rustlib/x86_64-pc-windows-msvc/bin/llvm-readobj.exe"
+          # a Windows tool's output ends lines with CRLF
+          imports="$("$readobj" --coff-imports "$ext" | tr -d '\r' | sed -n 's/^ *Name: //p' | sort -u)"
+          echo "$imports"
+          if grep -Eiv '^(python3|kernel32|ntdll|advapi32|bcrypt|bcryptprimitives|ws2_32|userenv|secur32|crypt32|ole32|oleaut32|shell32|user32|synchronization|api-ms-win-core-[a-z0-9-]+)\.dll$' <<< "$imports"; then
+            echo "the extension imports a DLL outside Python and Windows itself" >&2
+            exit 1
+          fi
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+
+      # the oldest and a current CPython, since the wheel is abi3; the tests need no GPU, cuDNN or checkpoint
+      - name: Install the wheel and run its CPU tests
+        shell: bash
+        run: |
+          set -euo pipefail
+          for python in 3.9 3.13; do
+            venv="$RUNNER_TEMP/venv-$python"
+            uv venv --python "$python" "$venv"
+            # Windows venvs keep the interpreter in Scripts, not bin
+            py="$venv/bin/python"
+            if [ "$RUNNER_OS" = Windows ]; then py="$venv/Scripts/python.exe"; fi
+            uv pip install --python "$py" dist/*.whl pytest tifffile imagecodecs
+            "$py" -c "import inkrs; print(inkrs.__version__, inkrs.build_info())"
+            "$py" -m pytest -q -rs python/tests/test_api.py
+          done
+
+      - name: Upload wheel
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: python-wheel-${{ matrix.target }}
+          path: dist/*.whl
+
+  sdist:
+    name: Sdist
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      RUSTFLAGS: -D warnings
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      # the package takes its version from python/Cargo.toml and release tags are named after the engine's, so a
+      # bindings version that lags behind fails here on the pull request instead of at publish time
+      - name: Check the bindings version matches inkrs
+        run: |
+          set -euo pipefail
+          engine=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)
+          bindings=$(sed -n 's/^version = "\(.*\)"/\1/p' python/Cargo.toml | head -1)
+          if [ "$engine" != "$bindings" ]; then
+            echo "python/Cargo.toml is $bindings but inkrs is $engine; bump python/Cargo.toml"
+            exit 1
+          fi
+
+      - name: Build sdist
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          command: sdist
+          args: --out dist -m python/Cargo.toml
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          toolchain: stable
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+
+      # pip builds the sdist where no wheel fits, so build it the same way, outside the checkout. The engine embeds
+      # the kernels from ptx/ at compile time, so a build that finds them all proves the sdist carries them; the
+      # runner has no GPU, so the check stops at what the import reports
+      - name: Install sdist into a fresh environment
+        shell: bash
+        working-directory: ${{ runner.temp }}
+        run: |
+          set -euo pipefail
+          uv venv --python 3.12 sdist-venv
+          uv pip install --python sdist-venv "$GITHUB_WORKSPACE"/dist/*.tar.gz
+          version=$(sed -n 's/^version = "\(.*\)"/\1/p' "$GITHUB_WORKSPACE/python/Cargo.toml" | head -1)
+          sdist-venv/bin/python -I - "$version" <<'EOF'
+          import sys
+
+          import inkrs
+
+          info = inkrs.build_info()
+          print(inkrs.__version__, info)
+          assert inkrs.__version__ == info["version"] == sys.argv[1], (inkrs.__version__, sys.argv[1])
+          assert [p["target"] for p in info["ptx"]] == ["sm_75", "sm_80", "sm_120"], info["ptx"]
+          # the sdist must carry the cubins too, or a wheel built from it JITs on every GPU
+          assert len(info["cubins"]) == 7, info["cubins"]
+          EOF
+
+      - name: Upload sdist
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: python-sdist
+          path: dist/*.tar.gz
+
+  # checks a tag before anything is published: both crates' versions must match it, and CHANGELOG.md needs a dated
+  # entry for it, which becomes the GitHub release notes
+  release-check:
+    name: Check the tag
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      # the GitHub release reads its notes with parse-changelog, so the same parser checks the entry here
+      - name: Install parse-changelog
+        uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
+        with:
+          tool: parse-changelog
+
+      - name: Check the version and changelog
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#v}"
+          for manifest in Cargo.toml python/Cargo.toml; do
+            crate=$(sed -n 's/^version = "\(.*\)"/\1/p' "$manifest" | head -1)
+            if [ "$crate" != "$version" ]; then
+              echo "$manifest is $crate but the tag is $GITHUB_REF_NAME"
+              exit 1
+            fi
+          done
+          # an entry still marked "Unreleased" has not been given its date
+          title="$(parse-changelog CHANGELOG.md --title "$version")"
+          if ! [[ "$title" =~ ^\[${version//./\\.}\]\ -\ [0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
+            echo "the CHANGELOG.md heading for $version is \"$title\"; it needs \"[$version] - YYYY-MM-DD\""
+            exit 1
+          fi
+          notes="$(parse-changelog CHANGELOG.md "$version")"
+          if [ -z "$notes" ]; then
+            echo "the CHANGELOG.md entry for $version is empty"
+            exit 1
+          fi
+
+  # a v* tag publishes to TestPyPI, installs that release, and only then publishes to PyPI; each index trusts this
+  # workflow and environment, so no token is stored
+  testpypi-publish:
+    name: Publish to TestPyPI
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [release-check, wheels, sdist]
+    runs-on: ubuntu-24.04
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/inkrs/
+    permissions:
+      id-token: write
+    steps:
+      - name: Download wheels and sdist
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: python-*
+          path: dist
+          merge-multiple: true
+
+      - name: Check files match the tag
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#v}"
+          ls -la dist
+          # the Linux, macOS and Windows wheels and the sdist
+          test "$(find dist -type f | wc -l)" -eq 4
+          for file in dist/*; do
+            case "$(basename "$file")" in
+              "inkrs-${version}"-*.whl | "inkrs-${version}.tar.gz") ;;
+              *) echo "$file does not match tag $GITHUB_REF_NAME"; exit 1 ;;
+            esac
+          done
+
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
+
+  testpypi-install:
+    name: Install from TestPyPI (${{ matrix.name }})
+    needs: testpypi-publish
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Linux x86_64
+            os: ubuntu-24.04
+            backend: cuda
+          - name: macOS arm64
+            os: macos-26
+            backend: metal
+          - name: Windows x86_64
+            os: windows-2025
+            backend: cuda
+    steps:
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+
+      - name: Install the release and import it
+        shell: bash
+        working-directory: ${{ runner.temp }}
+        env:
+          BACKEND: ${{ matrix.backend }}
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#v}"
+          uv venv --python 3.12 venv-release
+          # Windows venvs keep the interpreter in Scripts, not bin
+          py=venv-release/bin/python
+          if [ "$RUNNER_OS" = Windows ]; then py=venv-release/Scripts/python.exe; fi
+          # anyone can upload to TestPyPI, so only inkrs comes from it, as a wheel; numpy comes from PyPI
+          uv pip install --python "$py" "numpy>=1.22"
+          # a new release can take a few minutes to appear in the index
+          for attempt in 1 2 3 4 5 6 7 8 9 10; do
+            if uv pip install --python "$py" --no-cache --no-deps --only-binary inkrs \
+              --index-url https://test.pypi.org/simple/ "inkrs==${version}"; then
+              break
+            fi
+            test "$attempt" -lt 10
+            sleep 30
+          done
+          "$py" -I - "$version" "$BACKEND" <<'EOF'
+          import sys
+
+          import inkrs
+
+          info = inkrs.build_info()
+          print(inkrs.__version__, info)
+          assert inkrs.__version__ == sys.argv[1], (inkrs.__version__, sys.argv[1])
+          assert info["backend"] == sys.argv[2], info
+          EOF
+
+  # the pypi environment's reviewer approves the release here, before anything outside TestPyPI is published
+  pypi-publish:
+    name: Publish to PyPI
+    needs: testpypi-install
+    runs-on: ubuntu-24.04
+    environment:
+      name: pypi
+      url: https://pypi.org/project/inkrs/
+    permissions:
+      id-token: write
+    steps:
+      - name: Download wheels and sdist
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: python-*
+          path: dist
+          merge-multiple: true
+
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          skip-existing: true
+
+  # the release starts as a draft and is published only once its files are attached
+  github-release:
+    name: GitHub release
+    needs: pypi-publish
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+
+      - name: Download wheels and sdist
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: python-*
+          path: dist
+          merge-multiple: true
+
+      # create-gh-release-action deletes a release that already exists, so a rerun leaves a published release alone
+      # and finishes a draft instead of recreating it
+      - name: Check for an existing release
+        id: existing
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if draft="$(gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --json isDraft --jq .isDraft 2> view.err)"; then
+            if [ "$draft" = true ]; then state=draft; else state=published; fi
+          elif grep -q 'release not found' view.err; then
+            state=none
+          else
+            # any other failure could hide a release the next step would delete
+            cat view.err >&2
+            exit 1
+          fi
+          echo "the $GITHUB_REF_NAME release is $state"
+          echo "state=$state" >> "$GITHUB_OUTPUT"
+
+      - name: Create a draft release
+        if: steps.existing.outputs.state == 'none'
+        uses: taiki-e/create-gh-release-action@eba8ea96c86cca8a37f1b56e94b4d13301fba651 # v1.11.0
+        with:
+          draft: true
+          # the tag's CHANGELOG.md entry becomes the release notes
+          changelog: CHANGELOG.md
+
+      # --clobber replaces files a failed run already attached. The release becomes latest only when no published
+      # stable release has a higher version, so a maintenance release of an older line leaves the newest one as latest
+      - name: Attach the wheels and sdist, then publish
+        if: steps.existing.outputs.state != 'published'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          gh release upload "$GITHUB_REF_NAME" dist/* --clobber --repo "$GITHUB_REPOSITORY"
+
+          version="${GITHUB_REF_NAME#v}"
+          latest=false
+          if [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            # a plain assignment, so set -e stops the step when the lookup fails instead of marking this release
+            # latest against an empty list
+            releases="$(gh release list --repo "$GITHUB_REPOSITORY" --exclude-drafts --exclude-pre-releases \
+              --limit 1000 --json tagName --jq '.[].tagName')"
+            newest="$(
+              printf '%s\n' "$releases" "$GITHUB_REF_NAME" \
+                | sed 's/^v//' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -1
+            )"
+            if [ "$newest" = "$version" ]; then latest=true; fi
+          fi
+          echo "marking $GITHUB_REF_NAME latest: $latest"
+          gh release edit "$GITHUB_REF_NAME" --draft=false --latest="$latest" --repo "$GITHUB_REPOSITORY"

inkrs-0.2.0/.gitignore

@@ -0,0 +1,3 @@
+target/
+weights/
+__pycache__/