jacl4py 0.0.1__tar.gz

jacl4py-0.0.1/.github/CI.md

@@ -0,0 +1,159 @@
+# CI Support and Reference Alignment
+
+These workflows assume this package is its own repository root. GitHub does not
+discover them while nested in the parent workspace. Reference workflow/action
+files in `reference-pookiepy`, not its potentially stale README, define the
+comparison. This note records the original differences, implemented changes
+and intentional deviations.
+
+## Original Differences
+
+- Local `test.yml` covered Python 3.10-3.14 on three desktop runners, with raw
+  unittest discovery, no coverage report, ARM jobs or floating-Python probes.
+  Reference `ci.yml` also has examples, integration and latest-Python jobs.
+- Local `lint.yml` ran Python 3.14 Pylint directly, without a shared action or
+  local rcfile. Development requirements used `pylint>=4,<5` alongside runtime
+  requirements and coverage; reference mandatory lint pins `pylint==3.2.6`.
+- Local jobs repeated setup/install commands and disabled uv caching; reference
+  shares setup, dependency probing and check dispatch with CI caches enabled.
+- Weekly latest-Python checks and actionlint/zizmor audits were absent. Reference
+  additionally has weekly gRPC compatibility and installed CLI skeleton smoke.
+- Local `build.yml` already ran tests, built and Twine-checked wheel/sdist,
+  smoke-tested both installations and uploaded artifacts. Reference has no
+  equivalent build workflow, but does have its framework CLI smoke workflow.
+- Local publishing already separated read-only build validation from OIDC
+  publication, retaining the package environment URL. Originally the workflow
+  used a GitHub Release trigger, without skip-existing, hash controls or
+  post-publish tagging, as its README described. Reference
+  `pypi_publish.yml` uses one privileged job, master pushes and post-publish tags.
+- Checkout, setup-python and setup-uv SHA pins already matched the reference.
+  Standalone artifact upload/download actions were already SHA-pinned; the
+  reference has no artifact handoff. PyPI already used exact release `v1.14.2`.
+- Local publication used fixed Python 3.14; reference publishing uses `3.x`.
+  Release build and tag setup now use `3.x`, without optional-probe failure policy.
+- Dynamic, file-based PDM version metadata already matched the reference model;
+  the standalone package has no framework protobuf build hook to preserve.
+
+## Implemented Configuration and CI Contract
+
+- `test.yml`: push/PR mandatory Python 3.10, 3.11, 3.12, 3.13 and 3.14 on
+  `ubuntu-latest`, `windows-latest`, `macos-latest`, `ubuntu-22.04-arm` and
+  `ubuntu-24.04-arm`. This core OS/Python matrix exactly matches the reference.
+  Nonblocking `3.x` probes use the same five runners. Dependency-resolution
+  failures warn and skip probe checks; actual check failures are reported.
+- Core checks use `coverage run -m unittest discover -s tests -p "test_*.py"`
+  followed by `coverage report -m`, exactly the reference gate, with no minimum.
+  `coverage>=7.10,<8` is development tooling, not runtime metadata.
+- `lint.yml`: Ubuntu / Python 3.14 runs `pylint --jobs=1 jacl4py tests`, using
+  `pylint==4.0.10` from `requirements-dev.txt`, which includes runtime requirements.
+  No diagnostics are disabled; default fail-under is 10, with no custom threshold.
+- The compact `.pylintrc` preserves every effective reference setting, without
+  comments. Only domain-specific entries are removed: the custom integration
+  path in `init-hook`, generated protobuf ignore patterns/modules, grpc ignored
+  classes, and `grpc`/`google` third-party classifications. The root import hook,
+  `source-roots`, `ignore=third_party,interface`, optparse/thread ignored classes,
+  empty settings and all other reference values remain. Configured `jobs=4`
+  remains; the CI command overrides it to 1, just like the reference.
+- `weekly-latest-python.yml`: Monday 12:00 UTC (`0 12 * * 1`) and manual runs,
+  nonblocking `3.x` unit jobs on the same five runners, plus Ubuntu lint with
+  latest Pylint, not the mandatory development pin, matching reference weekly.
+- `verify-workflows.yml`: reference syntax/expression checks with actionlint and
+  security audit with zizmor, on workflow/action/script changes and manual runs.
+- Shared `setup-python`, `install-dependencies` and `python-check` actions use
+  adapted `install_dependencies.py`, `run_checks.py` and `report_probe.py` helpers.
+  Callers own matrices/policy; helpers omit grpc/proto/examples handling. The
+  selected interpreter is passed through `UV_PYTHON`; the local project
+  is installed for distribution-metadata tests. CI uv caches are enabled and
+  keyed by suite, Python, OS and architecture; release caches stay disabled.
+- Action pins follow the reference. PyPI publishing intentionally uses exact
+  `pypa/gh-action-pypi-publish@v1.14.2`, with the same narrow zizmor unpinned-use
+  suppression because its published container is tag-based. No API token is stored.
+
+## Publication and Justified Deviations
+
+`pypi_publish.yml` matches the configured PyPI trusted publisher identity. Pushes
+to `master`, not GitHub Releases, start a read-only build job: preflight unit
+tests, wheel/sdist build, Twine validation, isolated installed-artifact smoke
+checks and validated artifact upload. Only its dependent publish job receives
+OIDC and tag-write permissions, under environment `pypi-release` with URL
+`https://pypi.org/project/jacl4py/`. It downloads the validated artifacts and uses
+`verify-metadata: true`, `skip-existing: true`, `print-hash: false` and
+`attestations: true`. Publication success precedes an annotated `v<version>` tag;
+same-commit tags are no-ops, different-commit tags cause failure and are never moved.
+
+- Two publication jobs deliberately retain least privilege and validated
+  artifacts, instead of copying the reference's single privileged job.
+- Pylint is pinned to 4.0.10, not reference 3.2.6, because Python 3.14 support
+  was added in Pylint 4.0. See the [upstream release notes](https://pylint.readthedocs.io/en/latest/whatsnew/4/4.0/index.html).
+  Applicable reference configuration and failure policy remain unchanged;
+  diagnostic results can differ between Pylint major versions.
+- `build.yml` remains an additional Ubuntu / Python 3.14 gate. Reference CLI
+  skeleton smoke covers 3.10/3.14/3.x on three desktop OSes, but tests installed
+  pookiepy skeleton generation, which this package does not provide. Package
+  wheel/sdist smoke checks are retained, not claimed as literal CLI matrix parity.
+- Weekly gRPC, protobuf generation, examples, framework integration and CLI
+  suites/dependencies are excluded because they are absent here. No fake suites
+  or dependencies are added. Core supported-version matrix parity is unchanged.
+- Existing `test.yml`, `lint.yml` and `build.yml` identities remain
+  instead of merging into reference `ci.yml`, reducing branch-protection
+  migration. Check job display names may change; review required status contexts.
+- Publication has no full-matrix CI `needs` barrier, matching the reference;
+  only its own validated build is a dependency. Configure external controls below.
+- `jacl4py/__init__.py` remains the authoritative manually edited version source.
+  PDM dynamic metadata needs no backend change or version bump. Tags are outputs;
+  there is no automatic bump or semantic-version inference from commit messages.
+- Source distributions retain their existing CI-source inclusion policy, now
+  including all of `.github/` and `.pylintrc`, so workflows do not ship without
+  their new helpers. Unlike the reference, CI sources were already included here.
+- Tag extraction uses uv and the selected interpreter, rather than bare Python,
+  consistent with the standalone tooling; version parsing and tag policy match.
+
+## External Settings and Validation
+
+Configure the PyPI publisher with the actual GitHub owner/repository,
+`pypi_publish.yml` and `pypi-release`; verify project availability and use unpublished
+versions. Skipping existing files supports retries, not artifact replacement.
+Protect `master` with mandatory supported-version test, lint and build checks.
+The path-filtered workflow audit should not be universally required unless your
+ruleset handles skipped workflows, or unrelated PRs can wait indefinitely.
+Configure environment reviewers, allowed release branches,
+and tag rules that allow the release bot to create, but not move, release tags.
+Grant repository Actions the tag-write permission required by publication.
+Floating-Python and weekly probes should not be required checks.
+
+Some editor/actionlint versions cannot resolve the reference's `$/...` local
+action syntax, especially in this nested workspace. Paths are relative to each
+standalone repository root. The audit workflow retains the reference's narrow
+actionlint compatibility filter; no security findings are filtered out.
+
+No tests or linters were run for these configuration/documentation changes.
+Reference-setting comparison is not evidence that package code passes Pylint.
+Local verification parsed all nine workflow/action YAML files, Python helpers,
+embedded shell commands, TOML and INI configuration. Reference matrices, release
+options and permissions were compared structurally. `uv build` successfully
+built the sdist and a wheel from it; the sdist includes CI helpers and `.pylintrc`.
+Actual runner behavior, installed-artifact smoke checks, actionlint, zizmor and
+PyPI/OIDC publication still require GitHub Actions validation.
+
+## Patch Summary
+
+| File | Change |
+| --- | --- |
+| `.github/workflows/test.yml` | Add ARM, coverage dispatch and nonblocking latest-Python probes. |
+| `.github/workflows/lint.yml` | Shared pinned-Python lint action and development requirements. |
+| `.github/workflows/build.yml` | Shared setup; preserve preflight, build, metadata and artifact smoke gates. |
+| `.github/workflows/pypi_publish.yml` | Master pushes, latest stable Python, reference publish options, tag after publish. |
+| `.github/workflows/weekly-latest-python.yml` | Add reference weekly/manual latest-Python unit and lint probes. |
+| `.github/workflows/verify-workflows.yml` | Add reference syntax and security audits. |
+| `.github/actions/setup-python/action.yml` | Shared pinned tooling, interpreter output and cache policy. |
+| `.github/actions/install-dependencies/action.yml` | Shared installation and nonblocking dependency probe. |
+| `.github/actions/python-check/action.yml` | Shared setup, local package installation and check dispatch. |
+| `.github/scripts/install_dependencies.py` | One dependency command for installation and dry-run probes. |
+| `.github/scripts/run_checks.py` | Coverage/unit and serial Pylint execution. |
+| `.github/scripts/report_probe.py` | Warnings and job summaries for skipped/failed probes. |
+| `.github/scripts/tag_release.sh` | Annotated version tags; same-commit retry; refuse tag movement. |
+| `.github/CI.md` | Differences, deviations, validation, external setup and this inventory. |
+| `.pylintrc` | Applicable reference lint configuration without framework exclusions. |
+| `requirements-dev.txt` | Supported, fixed Pylint pin; retain coverage and runtime requirements. |
+| `pyproject.toml` | Include complete CI sources and lint configuration in sdists. |
+| `README.md` | Correct release lifecycle, quality checks and version-management instructions. |

jacl4py-0.0.1/.github/actions/install-dependencies/action.yml

@@ -0,0 +1,46 @@
+name: Install CI dependencies
+description: Probe optional latest-Python jobs before installing dependencies.
+inputs:
+  python-path:
+    description: Interpreter selected by setup-python.
+    required: true
+  requirements:
+    description: Requirement files, one per line.
+    default: requirements.txt
+  packages:
+    description: Additional packages or local project paths, one per line.
+    default: ''
+  probe:
+    description: Skip checks when latest-Python dependencies cannot resolve.
+    default: 'false'
+outputs:
+  ready:
+    description: String true when checks can run; false when the probe was skipped.
+    value: ${{ inputs.probe != 'true' || steps.wheel-check.outcome == 'success' }}
+runs:
+  using: composite
+  steps:
+    - name: Check latest Python dependencies
+      id: wheel-check
+      if: inputs.probe == 'true'
+      continue-on-error: true
+      shell: bash
+      env:
+        UV_PYTHON: ${{ inputs.python-path }}
+        CI_REQUIREMENTS: ${{ inputs.requirements }}
+        CI_PACKAGES: ${{ inputs.packages }}
+      run: uv run --no-project python .github/scripts/install_dependencies.py --dry-run
+    - name: Explain skipped latest Python probe
+      if: inputs.probe == 'true' && steps.wheel-check.outcome != 'success'
+      shell: bash
+      env:
+        UV_PYTHON: ${{ inputs.python-path }}
+      run: uv run --no-project python .github/scripts/report_probe.py skipped
+    - name: Install dependencies
+      if: inputs.probe != 'true' || steps.wheel-check.outcome == 'success'
+      shell: bash
+      env:
+        UV_PYTHON: ${{ inputs.python-path }}
+        CI_REQUIREMENTS: ${{ inputs.requirements }}
+        CI_PACKAGES: ${{ inputs.packages }}
+      run: uv run --no-project python .github/scripts/install_dependencies.py

jacl4py-0.0.1/.github/actions/python-check/action.yml

@@ -0,0 +1,49 @@
+name: Python check
+description: Set up Python, install dependencies, and run one suite.
+inputs:
+  python-version:
+    description: Python version; floating 3.x enables the optional dependency probe.
+    required: true
+  suite:
+    description: Check suite (unit or lint).
+    required: true
+  requirements:
+    description: Core requirement file.
+    default: requirements.txt
+  extra-requirements:
+    description: Optional additional requirement file.
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Set up Python and uv
+      id: setup
+      uses: $/.github/actions/setup-python
+      with:
+        python-version: ${{ inputs.python-version }}
+        cache-suffix: ${{ inputs.suite }}-py${{ inputs.python-version }}-${{ runner.os }}-${{ runner.arch }}
+    - name: Prepare dependencies
+      id: dependencies
+      uses: $/.github/actions/install-dependencies
+      with:
+        python-path: ${{ steps.setup.outputs.python-path }}
+        probe: ${{ inputs.python-version == '3.x' }}
+        requirements: |
+          ${{ inputs.requirements }}
+          ${{ inputs.extra-requirements }}
+        packages: |
+          .
+          ${{ inputs.suite == 'unit' && 'coverage' || 'pylint' }}
+    - name: Run checks
+      if: steps.dependencies.outputs.ready == 'true'
+      shell: bash
+      env:
+        UV_PYTHON: ${{ steps.setup.outputs.python-path }}
+        CHECK_SUITE: ${{ inputs.suite }}
+      run: uv run --no-project python .github/scripts/run_checks.py "$CHECK_SUITE"
+    - name: Report latest Python probe failure
+      if: failure() && inputs.python-version == '3.x'
+      shell: bash
+      env:
+        UV_PYTHON: ${{ steps.setup.outputs.python-path }}
+      run: uv run --no-project python .github/scripts/report_probe.py failed

jacl4py-0.0.1/.github/actions/setup-python/action.yml

@@ -0,0 +1,29 @@
+name: Set up Python and uv
+description: Install pinned CI tooling and expose the selected Python interpreter.
+inputs:
+  python-version:
+    description: Python version requested from actions/setup-python.
+    required: true
+  cache-suffix:
+    description: Cache namespace for this job.
+    default: ${{ github.job }}
+  enable-cache:
+    description: Whether uv should cache dependencies.
+    default: 'true'
+outputs:
+  python-path:
+    description: Absolute path to the selected Python interpreter.
+    value: ${{ steps.python.outputs.python-path }}
+runs:
+  using: composite
+  steps:
+    - name: Set up Python
+      id: python
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      with:
+        python-version: ${{ inputs.python-version }}
+    - name: Set up uv
+      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      with:
+        enable-cache: ${{ inputs.enable-cache }}
+        cache-suffix: ${{ inputs.cache-suffix }}

jacl4py-0.0.1/.github/scripts/install_dependencies.py

@@ -0,0 +1,31 @@
+"""Install CI dependencies, or probe resolution without changing the environment."""
+
+from __future__ import annotations
+
+import argparse
+import os
+import subprocess
+import sys
+
+
+def main() -> None:
+    """Resolve the same requirements for probes and actual installations."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--dry-run", action="store_true")
+    args = parser.parse_args()
+    command = ["uv", "pip", "install", "--python", sys.executable]
+    if args.dry_run:
+        command.append("--dry-run")
+    for requirement in os.environ.get("CI_REQUIREMENTS", "").splitlines():
+        if requirement.strip():
+            command.extend(["-r", requirement.strip()])
+    command.extend(
+        package.strip()
+        for package in os.environ.get("CI_PACKAGES", "").splitlines()
+        if package.strip()
+    )
+    subprocess.run(command, check=True)
+
+
+if __name__ == "__main__":
+    main()

jacl4py-0.0.1/.github/scripts/report_probe.py

@@ -0,0 +1,34 @@
+"""Report non-blocking latest-Python probe outcomes consistently on all runners."""
+
+from __future__ import annotations
+
+import argparse
+import os
+from pathlib import Path
+
+
+def main() -> None:
+    """Emit a workflow warning and append an actionable job summary."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("status", choices=("skipped", "failed"))
+    args = parser.parse_args()
+    title = f"Latest Python probe {args.status}"
+    details = (
+        "Required dependencies unavailable; checks skipped."
+        if args.status == "skipped"
+        else "Check job logs for Python compatibility issues or missing dependencies."
+    )
+    message = (
+        f"{os.environ.get('GITHUB_JOB', 'probe')} on "
+        f"{os.environ.get('RUNNER_OS', 'local')}: {details} "
+        "This probe is non-blocking; pinned Python checks remain mandatory."
+    )
+    print(f"::warning title={title}::{message}")
+    summary = os.environ.get("GITHUB_STEP_SUMMARY")
+    if summary:
+        with Path(summary).open("a", encoding="utf-8") as output:
+            output.write(f"### {title}\n{message}\n")
+
+
+if __name__ == "__main__":
+    main()

jacl4py-0.0.1/.github/scripts/run_checks.py

@@ -0,0 +1,31 @@
+"""Run one CI check suite using the selected interpreter."""
+
+from __future__ import annotations
+
+import argparse
+import subprocess
+import sys
+
+
+def run_module(*arguments: str) -> None:
+    """Run a Python module and propagate failures to the CI job."""
+    subprocess.run([sys.executable, "-m", *arguments], check=True)
+
+
+def main() -> None:
+    """Dispatch a named suite without duplicating commands in workflow YAML."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("suite", choices=("unit", "lint"))
+    args = parser.parse_args()
+    if args.suite == "unit":
+        run_module(
+            "coverage", "run", "-m", "unittest", "discover",
+            "-s", "tests", "-p", "test_*.py",
+        )
+        run_module("coverage", "report", "-m")
+    else:
+        run_module("pylint", "--jobs=1", "jacl4py", "tests")
+
+
+if __name__ == "__main__":
+    main()

jacl4py-0.0.1/.github/scripts/tag_release.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+PACKAGE_INIT="${SCRIPT_DIR}/../../jacl4py/__init__.py"
+
+VERSION="$(uv run --no-project python - "$PACKAGE_INIT" <<'PY'
+import pathlib
+import re
+import sys
+
+version_file = pathlib.Path(sys.argv[1])
+text = version_file.read_text(encoding='utf-8')
+match = re.search(r'^__version__\s*=\s*["\']([^"\']+)["\']\s*$', text, re.MULTILINE)
+if not match:
+    raise SystemExit(f'Could not find __version__ in {version_file}')
+print(match.group(1))
+PY
+)"
+
+TAG="v${VERSION}"
+
+git fetch --tags
+
+if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null; then
+  TAG_SHA="$(git rev-list -n 1 "refs/tags/${TAG}")"
+  HEAD_SHA="$(git rev-parse HEAD)"
+
+  if [ "$TAG_SHA" = "$HEAD_SHA" ]; then
+    echo "Tag ${TAG} already points to this commit; nothing to do."
+    exit 0
+  fi
+
+  echo "Tag ${TAG} already exists on a different commit (${TAG_SHA}); refusing to move it."
+  exit 1
+fi
+
+git config user.name "github-actions[bot]"
+git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+git tag -a "$TAG" -m "Release $TAG"
+git push origin "$TAG"

jacl4py-0.0.1/.github/workflows/build.yml

@@ -0,0 +1,70 @@
+name: Build
+
+on:
+  push:
+  pull_request:
+  workflow_call:
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - id: python
+        uses: $/.github/actions/setup-python
+        with:
+          python-version: "3.14"
+          enable-cache: 'false'
+      - name: Run release preflight tests
+        env:
+          UV_PYTHON: ${{ steps.python.outputs.python-path }}
+        run: uv run --with-requirements requirements.txt python -m unittest discover -s tests -p "test_*.py"
+      - name: Build source distribution and wheel
+        env:
+          UV_PYTHON: ${{ steps.python.outputs.python-path }}
+        run: uv build
+      - name: Validate distribution metadata
+        env:
+          UV_PYTHON: ${{ steps.python.outputs.python-path }}
+        run: uvx twine check dist/*
+      - name: Install and smoke-test each distribution
+        env:
+          UV_PYTHON: ${{ steps.python.outputs.python-path }}
+        run: |
+          for artifact in dist/*.whl dist/*.tar.gz; do
+            uv run --isolated --no-project --with "$artifact" python -I -c '
+          import io
+          import logging
+          import sys
+          from importlib.metadata import version
+          from jacl4py import __version__
+          from jacl4py.logger import JacLogger, get_logger
+          assert version("jacl4py") == __version__
+          assert "pookiepy" not in sys.modules
+          logger = get_logger("artifact_smoke", console_log_level=None, file_log_level=None)
+          assert isinstance(logger, JacLogger)
+          output = io.StringIO()
+          handler = logging.StreamHandler(output)
+          logger.addHandler(handler)
+          logger.idebug("debug")
+          logger.iinfo("info")
+          assert output.getvalue() == "debug\ninfo\n"
+          handler.close()
+          logger.removeHandler(handler)
+          '
+          done
+      - name: Upload validated distributions
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: python-distributions
+          path: dist/*
+          if-no-files-found: error

jacl4py-0.0.1/.github/workflows/lint.yml

@@ -0,0 +1,25 @@
+name: Lint
+
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  pylint:
+    name: Pylint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - name: Run Pylint
+        uses: $/.github/actions/python-check
+        with:
+          python-version: "3.14"
+          suite: lint
+          extra-requirements: requirements-dev.txt

jacl4py-0.0.1/.github/workflows/pypi_publish.yml

@@ -0,0 +1,115 @@
+name: Publish to PyPI
+
+on:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - id: python
+        uses: $/.github/actions/setup-python
+        with:
+          python-version: "3.x"
+          enable-cache: 'false'
+      - name: Run release preflight tests
+        env:
+          UV_PYTHON: ${{ steps.python.outputs.python-path }}
+        run: uv run --with-requirements requirements.txt python -m unittest discover -s tests -p "test_*.py"
+      - name: Build source distribution and wheel
+        env:
+          UV_PYTHON: ${{ steps.python.outputs.python-path }}
+        run: uv build
+      - name: Validate distribution metadata
+        env:
+          UV_PYTHON: ${{ steps.python.outputs.python-path }}
+        run: uvx twine check dist/*
+      - name: Install and smoke-test each distribution
+        shell: bash
+        env:
+          UV_PYTHON: ${{ steps.python.outputs.python-path }}
+        run: |
+          for artifact in dist/*.whl dist/*.tar.gz; do
+            uv run --isolated --no-project --with "$artifact" python -I -c '
+          import io
+          import logging
+          import sys
+          from importlib.metadata import version
+          from jacl4py import __version__
+          from jacl4py.logger import JacLogger, get_logger
+          assert version("jacl4py") == __version__
+          assert "pookiepy" not in sys.modules
+          logger = get_logger("artifact_smoke", console_log_level=None, file_log_level=None)
+          assert isinstance(logger, JacLogger)
+          output = io.StringIO()
+          handler = logging.StreamHandler(output)
+          logger.addHandler(handler)
+          logger.idebug("debug")
+          logger.iinfo("info")
+          assert output.getvalue() == "debug\ninfo\n"
+          handler.close()
+          logger.removeHandler(handler)
+          '
+          done
+      - name: Upload validated distributions
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: python-distributions
+          path: dist/*
+          if-no-files-found: error
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi-release
+      url: https://pypi.org/project/jacl4py/
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - name: Checkout release commit for tagging
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: true # zizmor: ignore[artipacked] required for release tag push
+      - name: Set up Python
+        id: python
+        uses: $/.github/actions/setup-python
+        with:
+          python-version: "3.x"
+          enable-cache: 'false'
+      - name: Download validated distributions
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: python-distributions
+          path: dist
+      - name: Publish using PyPI Trusted Publishing
+        uses: pypa/gh-action-pypi-publish@v1.14.2 # zizmor: ignore[unpinned-uses] exact release tag intentionally used
+        with:
+          repository-url: https://upload.pypi.org/legacy/
+          # repository-url: https://test.pypi.org/legacy/
+          packages-dir: dist
+          verify-metadata: true
+          skip-existing: true
+          print-hash: false
+          attestations: true
+
+      - name: Create and push release tag
+        if: success() && github.ref_name == 'master'
+        shell: bash
+        env:
+          UV_PYTHON: ${{ steps.python.outputs.python-path }}
+        run: bash .github/scripts/tag_release.sh