manuscript-guard 0.2.431__tar.gz

manuscript_guard-0.2.431/.claude-plugin/marketplace.json

@@ -0,0 +1,23 @@
+{
+  "name": "manuscript-guard",
+  "owner": {
+    "name": "Basile Chrétien"
+  },
+  "metadata": {
+    "description": "Toolkit for making every number in a scientific manuscript traceable to its source."
+  },
+  "plugins": [
+    {
+      "name": "manuscript-guard",
+      "source": "./plugin",
+      "description": "Make every number in a scientific manuscript traceable to its source. Skills for setting up a paper project, drafting, literature verification, figure review, journal compliance, review panels, the Word round trip and the response to reviewers; hooks that refuse edits to machine-written files and hold a submission to submission standards.",
+      "version": "0.2.431",
+      "author": {
+        "name": "Basile Chrétien"
+      },
+      "category": "productivity",
+      "homepage": "https://github.com/BasileChretien/manuscript-guard",
+      "license": "MIT"
+    }
+  ]
+}

manuscript_guard-0.2.431/.gitattributes

@@ -0,0 +1,25 @@
+# Normalise line endings, and check them out as LF everywhere.
+#
+# This is not cosmetic here. Several of the toolkit's guarantees are byte-level: the
+# .sha256 sidecar beside each results fragment, the analysis digests in methods.lock, the
+# manuscript digest a review record is tied to. With the default behaviour Git stores LF and
+# hands Windows CRLF, so the same commit hashes differently on different machines and every
+# one of those checks reports a change nobody made. CI failed exactly that way on Ubuntu and
+# macOS while passing on the machine the digests were computed on.
+#
+# eol=lf makes the working copy match the repository on every platform, so a digest computed
+# anywhere is valid everywhere.
+* text=auto eol=lf
+
+# Binary: never touch these.
+*.docx binary
+*.pdf  binary
+*.png  binary
+*.jpg  binary
+*.jpeg binary
+*.tif  binary
+*.tiff binary
+*.eps  binary
+*.xlsx binary
+*.zip  binary
+*.RData binary

manuscript_guard-0.2.431/.github/ISSUE_TEMPLATE/design-claim-is-untrue.md

@@ -0,0 +1,12 @@
+---
+name: DESIGN.md says something the code does not do
+about: A claim in the design document that is not true of the code
+labels: documentation
+---
+
+**The claim** — quote it, with the section heading.
+
+**What the code actually does** — a file and line, or a short reproduction.
+
+This is the most valuable kind of report here: several real defects have been found hiding
+behind prose that described an intention rather than the behaviour.

manuscript_guard-0.2.431/.github/ISSUE_TEMPLATE/gate-got-it-wrong.md

@@ -0,0 +1,23 @@
+---
+name: A gate got it wrong
+about: A number it flagged that is fine, or a defect it let through
+labels: gate
+---
+
+**Which direction**
+- [ ] It flagged something that is not a defect
+- [ ] It let a defect through  ← more useful
+
+**The smallest text that shows it**
+
+```markdown
+paste the manuscript source, results fragment, or table cell here
+```
+
+**What manuscript-guard said** — the output of `manuscript-guard check`, or
+`manuscript-guard explain <file>` if it is about how a number was classified.
+
+**What it should have said, and why.** If this is a convention of your field rather than a
+bug, say which field and where the convention is written down.
+
+**Version** — `manuscript-guard --version`, and your OS and Python version.

manuscript_guard-0.2.431/.github/scripts/check_wheel_files.py

@@ -0,0 +1,87 @@
+"""Compare a built wheel's manuscript_guard files with the ones git tracks in the package.
+
+Run by CI's wheel job: `python .github/scripts/check_wheel_files.py <wheel> [<checkout>]`.
+
+Using the wheel notices some missing files and not others, because a fresh project reads only
+part of the package's data. Ten of the 32 data files could be dropped from a wheel and the
+job's `init`, `check` and `build --offline` still passed. The two file lists have to be equal,
+so the check names every file that is tracked and not shipped, and every file that is shipped
+and not tracked (a generated checklist profile is one, and carries text that may not be
+redistributed).
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+import zipfile
+from pathlib import Path
+
+IMPORT_NAME = "manuscript_guard/"
+PACKAGE_DIR = "src/manuscript_guard"
+
+# Tracked outside the package and taken into it when the wheel is built (pyproject.toml,
+# force-include): where git has them, and where the wheel does.
+FORCED = {"plugin/skills/": "manuscript_guard/skills/"}
+
+
+def wheel_files(wheel: Path) -> set[str]:
+    """The package's files in the wheel, as `manuscript_guard/...` (not the dist-info)."""
+    with zipfile.ZipFile(wheel) as archive:
+        return {
+            name
+            for name in archive.namelist()
+            if name.startswith(IMPORT_NAME) and not name.endswith("/")
+        }
+
+
+def tracked_files(root: Path) -> set[str]:
+    """What git tracks under the package, as `manuscript_guard/...` to match the wheel."""
+    listed = subprocess.run(
+        ["git", "ls-files", "-z", "--", PACKAGE_DIR, *(place.rstrip("/") for place in FORCED)],
+        cwd=root,
+        capture_output=True,
+        check=True,
+    ).stdout.decode("utf-8")
+    return {in_the_wheel(name) for name in listed.split("\0") if name}
+
+
+def in_the_wheel(name: str) -> str:
+    """Where a tracked file is expected in the wheel."""
+    for tracked, shipped in FORCED.items():
+        if name.startswith(tracked):
+            return shipped + name[len(tracked) :]
+    return name[len("src/") :]
+
+
+def compare(shipped: set[str], tracked: set[str]) -> tuple[list[str], list[str]]:
+    """(tracked but not shipped, shipped but not tracked), each sorted."""
+    return sorted(tracked - shipped), sorted(shipped - tracked)
+
+
+def report(missing: list[str], unexpected: list[str]) -> int:
+    for name in missing:
+        print(f"missing from the wheel: {name}")
+    for name in unexpected:
+        print(f"in the wheel, not tracked by git: {name}")
+    return 1 if missing or unexpected else 0
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) not in (2, 3):
+        print(__doc__, file=sys.stderr)
+        return 2
+    wheel = Path(argv[1])
+    root = Path(argv[2]) if len(argv) == 3 else Path.cwd()
+    shipped, tracked = wheel_files(wheel), tracked_files(root)
+    if not tracked:
+        print(f"git tracks nothing under {PACKAGE_DIR} in {root}", file=sys.stderr)
+        return 2
+    status = report(*compare(shipped, tracked))
+    if status == 0:
+        print(f"the wheel holds all {len(tracked)} files git tracks in the package, and no others")
+    return status
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))

manuscript_guard-0.2.431/.github/scripts/release_decision.py

@@ -0,0 +1,101 @@
+"""Decide whether a push to main carries a version that has to go to PyPI.
+
+Run by publish.yml: `python .github/scripts/release_decision.py --before <sha>`. It prints
+two lines for the workflow to read, `publish=true` or `publish=false` and `version=<number>`,
+and one sentence on stderr saying why.
+
+Every version on main is released, and a release cannot be taken back: PyPI keeps a version
+for good and refuses the same number twice. So a version is published exactly once, when a
+push changes the number in pyproject.toml to one PyPI does not have. A push that leaves the
+number alone releases nothing, however much else it changes: the code between a merge and
+the bump that follows it carries the old number, and is not that release. Where the answer
+cannot be had, because PyPI did not reply, nothing is published and the run fails.
+"""
+
+from __future__ import annotations
+
+import argparse
+import re
+import subprocess
+import sys
+import urllib.error
+import urllib.request
+from collections.abc import Callable
+from pathlib import Path
+
+PROJECT = "manuscript-guard"
+#: The line of pyproject.toml that gives the version. Read as text, not as TOML, so that the
+#: script runs on every Python the package supports; tests/test_version.py holds the line.
+#: Digits and dots only: the number goes into a tag's name and a line of the workflow's
+#: output, and a release whose number is anything else is not one this project makes.
+VERSION_LINE = re.compile(r'^version\s*=\s*"(\d+(?:\.\d+)+)"\s*$', re.MULTILINE)
+#: What git gives as the commit before the first push of a branch: no commit at all.
+NO_COMMIT = re.compile(r"^0*$")
+
+
+def version_in(pyproject: str) -> str:
+    found = VERSION_LINE.findall(pyproject)
+    if len(found) != 1:
+        raise SystemExit(f"pyproject.toml gives {len(found)} version lines; one is expected")
+    return found[0]
+
+
+def version_at(commit: str, checkout: Path) -> str | None:
+    """The version pyproject.toml gave at a commit, or None where there is none to read."""
+    if NO_COMMIT.match(commit):
+        return None
+    shown = subprocess.run(
+        ["git", "show", f"{commit}:pyproject.toml"],
+        cwd=checkout,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+    )
+    return version_in(shown.stdout) if shown.returncode == 0 else None
+
+
+def status_of(url: str) -> int:
+    try:
+        with urllib.request.urlopen(url, timeout=30) as reply:  # noqa: S310 - a fixed https URL
+            return reply.status
+    except urllib.error.HTTPError as refused:
+        return refused.code
+
+
+def on_pypi(version: str, status: Callable[[str], int] = status_of) -> bool:
+    """Whether PyPI already has this version. Anything but a plain yes or no is an error."""
+    code = status(f"https://pypi.org/pypi/{PROJECT}/{version}/json")
+    if code == 200:
+        return True
+    if code == 404:
+        return False
+    raise SystemExit(f"PyPI answered {code} for {PROJECT} {version}: nothing is published")
+
+
+def decide(now: str, before: str | None, published: Callable[[str], bool]) -> tuple[bool, str]:
+    """Whether to publish `now`, and why. `before` is the version of the commit this push
+    replaced, or None where there is none to compare with (a run started by hand)."""
+    if before == now:
+        return False, f"this push left the version at {now}: nothing to release"
+    if published(now):
+        return False, f"{now} is already on PyPI: nothing to release"
+    moved = f"the version went from {before} to {now}" if before else f"the version is {now}"
+    return True, f"{moved}, which PyPI does not have: releasing it"
+
+
+def main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--before", default="", help="the commit this push replaced")
+    parser.add_argument("--checkout", type=Path, default=Path.cwd())
+    args = parser.parse_args(argv[1:])
+
+    now = version_in((args.checkout / "pyproject.toml").read_text(encoding="utf-8"))
+    publish, why = decide(now, version_at(args.before, args.checkout), on_pypi)
+    print(why, file=sys.stderr)
+    print(f"publish={'true' if publish else 'false'}")
+    print(f"version={now}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))

manuscript_guard-0.2.431/.github/workflows/ci.yml

@@ -0,0 +1,204 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+env:
+  # The build, the import round trip and the checks on what pandoc prints all need pandoc,
+  # and each skips without it: before this was set, no test job had pandoc, and none failed
+  # for want of it. Every job that runs pytest installs this version, and with the variable
+  # set, tests/conftest.py refuses to start unless it is the pandoc on PATH. Set here rather
+  # than per step, so a pytest step added later cannot forget it. Pinned, because those
+  # tests assert on pandoc's output and a release may print it differently: this is the
+  # version they were written against.
+  MANUSCRIPT_GUARD_REQUIRE_PANDOC: "3.9.0.2"
+
+jobs:
+  test:
+    # The gates must hold on the platforms other scientists actually use, and only Windows
+    # is available to the author, so the other two are covered here rather than assumed.
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python: ["3.10", "3.13"]
+    runs-on: ${{ matrix.os }}
+    # A suite that stalls would hold its runner for GitHub's own six hours. The slowest
+    # healthy job, on Windows, takes about 47 minutes, so twice that is a stall.
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - uses: r-lib/actions/setup-pandoc@v2
+        with:
+          pandoc-version: ${{ env.MANUSCRIPT_GUARD_REQUIRE_PANDOC }}
+      - run: pandoc --version
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev]"
+      - run: ruff check src tests
+      # -rs names each test that still skips, and why.
+      - run: pytest -q -rs
+
+  plugin-manifests:
+    # Validation reads JSON only: no model and no credentials are involved. Two versions,
+    # because they disagree: 2.1.119 refuses root keys ($schema, description) that the
+    # latest release accepts, so a manifest checked only against the latest can still fail
+    # for anyone who has not updated. 2.1.119 is the oldest version the plugin was verified
+    # with, and has no --strict; on the latest, --strict turns unknown keys into failures.
+    strategy:
+      fail-fast: false
+      matrix:
+        claude: ["2.1.119", "latest"]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: npm install -g @anthropic-ai/claude-code@${{ matrix.claude }}
+      - run: claude plugin validate ${{ matrix.claude == 'latest' && '--strict' || '' }} .
+      - run: claude plugin validate ${{ matrix.claude == 'latest' && '--strict' || '' }} plugin
+
+  codex-plugin:
+    # Codex installs the plugin from the manifests Claude Code reads, and the README tells a
+    # Codex user to do exactly that. `codex plugin` writes only under CODEX_HOME: no model and
+    # no login are involved. Two versions, as for Claude Code: the release this was first
+    # run against here, and the latest, so that a change in how Codex reads a marketplace
+    # fails here before a user meets it. With the variable set, a missing Codex fails the
+    # run where it would otherwise skip the test.
+    strategy:
+      fail-fast: false
+      matrix:
+        codex: ["0.160.0", "latest"]
+    runs-on: ubuntu-latest
+    env:
+      MANUSCRIPT_GUARD_REQUIRE_CODEX: "1"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: npm install -g @openai/codex@${{ matrix.codex }}
+      - run: codex --version
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      # These tests call no pandoc, but every pytest run here is held to the same requirement.
+      - uses: r-lib/actions/setup-pandoc@v2
+        with:
+          pandoc-version: ${{ env.MANUSCRIPT_GUARD_REQUIRE_PANDOC }}
+      - run: pip install -e ".[dev]"
+      - run: pytest -q -rs tests/test_plugin.py -k "codex or hooks_file"
+
+  r-interop:
+    # The results contract is only a contract if a second language can honour it.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: r-lib/actions/setup-r@v2
+      - uses: r-lib/actions/setup-r-dependencies@v2
+        with:
+          packages: jsonlite, digest
+      # test_r_emitter.py calls no pandoc, but every pytest run here runs under the same
+      # requirement, and setup-r-dependencies leaves apt's older pandoc on PATH, which the
+      # requirement refuses. One rule for every job, rather than an exception to remember.
+      - uses: r-lib/actions/setup-pandoc@v2
+        with:
+          pandoc-version: ${{ env.MANUSCRIPT_GUARD_REQUIRE_PANDOC }}
+      - run: pip install -e ".[dev]"
+      - run: pytest -q tests/test_r_emitter.py
+
+  wheel:
+    # Every other job installs editable, which reads src/ where it stands. A data file, a schema
+    # or a recipe that git ignores or the build leaves out is present there and missing from
+    # `pip install git+https://...`, which is what a user runs. So build the wheel, install it
+    # into a fresh venv, run from a directory that is not the checkout, and use the new project
+    # the way the README does.
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: r-lib/actions/setup-pandoc@v2
+        with:
+          pandoc-version: ${{ env.MANUSCRIPT_GUARD_REQUIRE_PANDOC }}
+      - run: pandoc --version
+      - name: Build the wheel
+        shell: bash
+        run: |
+          python -m pip install --upgrade pip
+          pip wheel . --no-deps --wheel-dir "$RUNNER_TEMP/wheelhouse"
+      - name: The wheel holds every file git tracks in the package, and no others
+        # A fresh project reads only some of the package's data, so using the wheel (next step)
+        # notices some missing files and not others. The lists are compared instead.
+        shell: bash
+        run: |
+          wheel=$(python -c "import glob, os; print(glob.glob(os.path.join(os.environ['RUNNER_TEMP'], 'wheelhouse', '*.whl'))[0])")
+          python .github/scripts/check_wheel_files.py "$wheel" .
+      - name: The wheel has a description, of a kind PyPI accepts
+        # publish.yml makes the same check before an upload. Made here too, a build that lost
+        # its description is found on the pull request that broke it, not at a release. twine
+        # reads the metadata and does not render Markdown: tests/test_docs.py holds the links.
+        shell: bash
+        run: |
+          wheel=$(python -c "import glob, os; print(glob.glob(os.path.join(os.environ['RUNNER_TEMP'], 'wheelhouse', '*.whl'))[0])")
+          python -m pip install twine
+          python -m twine check --strict "$wheel"
+      - name: Install it into a fresh venv and use it
+        shell: bash
+        run: |
+          wheel=$(python -c "import glob, os; print(glob.glob(os.path.join(os.environ['RUNNER_TEMP'], 'wheelhouse', '*.whl'))[0])")
+          expected=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])" | tr -d '\r')
+          python -m venv "$RUNNER_TEMP/wheel-venv"
+          if [ -d "$RUNNER_TEMP/wheel-venv/Scripts" ]; then
+            BIN="$RUNNER_TEMP/wheel-venv/Scripts"
+          else
+            BIN="$RUNNER_TEMP/wheel-venv/bin"
+          fi
+          "$BIN/python" -m pip install "$wheel"
+
+          # Away from the checkout, so nothing can be imported from src/.
+          cd "$RUNNER_TEMP"
+          "$BIN/python" -c "import manuscript_guard as m; assert 'site-packages' in m.__file__, m.__file__"
+          installed=$("$BIN/manuscript-guard" --version | tr -d '\r')
+          [ "$installed" = "$expected" ] || { echo "installed $installed, pyproject says $expected"; exit 1; }
+          "$BIN/manuscript-guard" --help > /dev/null
+
+          "$BIN/manuscript-guard" init smoke --title "Smoke test"
+          cd smoke
+          "$BIN/manuscript-guard" check
+          "$BIN/manuscript-guard" build --offline
+          test -s build/manuscript.docx
+
+          # Package data an editable install never misses: the journal template and the checklist
+          # recipes, asked for directly (`journal --template` refuses a project whose authors
+          # are still the placeholder), and a recipe found by the command that uses it
+          # (transcribe then fails on the missing document, which is after it found the
+          # recipe). The schemas were read by `check` above.
+          "$BIN/python" -c "from manuscript_guard.paths import SHIPPED_JOURNALS as J, SHIPPED_RECIPES as R; assert (J / 'TEMPLATE.yaml').is_file(); assert len(list(R.glob('*.recipe.yaml'))) >= 13"
+
+          # The skills, which are tracked outside the package and taken into the wheel when it
+          # is built. In a checkout `install-skills` reads them from plugin/skills, so only an
+          # installed copy shows whether the wheel has them.
+          "$BIN/manuscript-guard" install-skills --project
+          test -s .agents/skills/project-setup/SKILL.md
+          test -s .agents/skills/.manuscript-guard.json
+          # And they are the plugin's, file for file.
+          "$BIN/python" -c "import filecmp, os, sys; c = filecmp.dircmp(os.path.join(os.environ['GITHUB_WORKSPACE'], 'plugin', 'skills'), os.path.join('.agents', 'skills'), ignore=['.manuscript-guard.json']); bad = [c.left_only, c.right_only, c.diff_files] + [s.left_only + s.right_only + s.diff_files for s in c.subdirs.values()]; sys.exit(1 if any(bad) else 0)"
+          "$BIN/manuscript-guard" check
+          out=$("$BIN/manuscript-guard" transcribe STROBE 2>&1 || true)
+          [[ "$out" == *STROBE.recipe.yaml* ]] || { echo "$out"; exit 1; }
+          hook=$(echo '{}' | "$BIN/manuscript-guard-hook" session-start)
+          [[ "$hook" == *SessionStart* ]] || { echo "hook said: $hook"; exit 1; }

manuscript_guard-0.2.431/.github/workflows/publish.yml

@@ -0,0 +1,137 @@
+name: Publish to PyPI
+
+# Every version on main is released. The maintainer raises the number on main after merges
+# that change the tool (CONTRIBUTING.md), and that push is the release: this workflow tags
+# the commit, makes the GitHub Release, builds, and uploads to PyPI, with nobody's click.
+#
+# A release on PyPI is permanent: a version can be withdrawn, and never replaced or used
+# again. So a push releases only where it changed the version to one PyPI does not have
+# (.github/scripts/release_decision.py). A push that leaves the number alone releases
+# nothing, and neither does a second run for a version already there.
+on:
+  push:
+    branches: [main]
+    paths: [pyproject.toml]
+  # To finish a release that stopped half way: run it by hand, on main.
+  workflow_dispatch:
+
+permissions: {}
+
+# One release at a time, and never a second one cancelling the first mid-upload.
+concurrency:
+  group: publish-to-pypi
+  cancel-in-progress: false
+
+jobs:
+  decide:
+    name: Is there a version to release?
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      publish: ${{ steps.decide.outputs.publish }}
+      version: ${{ steps.decide.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          # The whole history, so that the commit this push replaced can be read.
+          fetch-depth: 0
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - id: decide
+        # The commit reaches the script through the environment, never as part of the
+        # command. It is empty for a run started by hand, which then asks PyPI alone.
+        env:
+          BEFORE: ${{ github.event.before }}
+        run: python .github/scripts/release_decision.py --before "$BEFORE" >> "$GITHUB_OUTPUT"
+
+  build:
+    name: Build the distributions
+    needs: decide
+    if: needs.decide.outputs.publish == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - name: Build a source distribution, and a wheel from it
+        run: |
+          python -m pip install --upgrade pip build twine
+          python -m build
+      - name: The wheel holds every file git tracks in the package, and no others
+        # CI's wheel job makes this comparison on a wheel built from the checkout. The one
+        # uploaded is built from the source distribution, so it is compared too.
+        run: python .github/scripts/check_wheel_files.py dist/*.whl .
+      - name: Each distribution has a description, of a kind PyPI accepts
+        # twine reads the metadata. It does not render Markdown, so this says that a
+        # description and its content type are there, not that the page will look right.
+        run: twine check --strict dist/*
+      - uses: actions/upload-artifact@v5
+        with:
+          name: distributions
+          path: dist/
+          if-no-files-found: error
+
+  release:
+    name: Tag the commit and make the GitHub Release
+    needs: [decide, build]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    # The one job that may write to the repository, and it writes a tag and a release.
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          # With the tags, to see whether this version's is already there.
+          fetch-depth: 0
+      - name: Tag v<version> at this commit, unless it is already there
+        # The description PyPI shows links to files at this tag, so the tag comes before
+        # the upload: a release on GitHub with no upload yet is mended by running again,
+        # an upload whose links lead nowhere is not. A tag of this name on another commit
+        # stops the release: something else made it, and it is not this version.
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: v${{ needs.decide.outputs.version }}
+        run: |
+          if at=$(git rev-parse --quiet --verify "refs/tags/$TAG^{commit}"); then
+            if [ "$at" != "$GITHUB_SHA" ]; then
+              echo "::error::$TAG is already at $at, and this run builds $GITHUB_SHA"
+              exit 1
+            fi
+          fi
+          if ! gh release view "$TAG" > /dev/null 2>&1; then
+            gh release create "$TAG" --target "$GITHUB_SHA" --title "$TAG" --generate-notes
+          fi
+
+  publish:
+    name: Upload to PyPI
+    needs: [decide, build, release]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # PyPI trusts this workflow file, in this repository, in this environment, and nothing
+    # else, so the upload carries no password and no token. The pairing is set on PyPI: as a
+    # pending publisher of the account before the first release, and in the project's
+    # publishing settings after it. It names this file, so renaming it breaks the upload.
+    environment:
+      name: pypi
+      url: https://pypi.org/project/manuscript-guard/${{ needs.decide.outputs.version }}/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v6
+        with:
+          name: distributions
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

manuscript_guard-0.2.431/.gitignore

@@ -0,0 +1,50 @@
+# Python
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+*.egg-info/
+dist/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+
+# setuptools output, at the repository root only. NOT a bare `build/`: that matches any
+# directory of that name at any depth, and it silently excluded the whole of
+# src/manuscript_guard/build/ from the repository. Everything passed locally, where the
+# files exist on disk, and CI failed on every platform with ModuleNotFoundError.
+/build/
+
+# R
+.Rhistory
+.RData
+.Rproj.user/
+renv/library/
+renv/staging/
+
+# Manuscript build artefacts (always regenerated; never a source of truth). Named
+# explicitly for the same reason as above.
+example/build/
+*.docx
+*.pdf
+!profiles/**/*.pdf
+
+# Official guideline documents, downloaded for transcription. Not committed: each carries
+# its own licence, and several are CC BY-NC-SA, which cannot be redistributed from an MIT
+# repository. The transcribed YAML records the source URL and licence so anyone can fetch
+# the original and check the transcription.
+profiles/reporting/sources/
+
+# Generated checklist profiles. Produced locally by `manuscript-guard transcribe` from your
+# own copy of each official document, so everyone gets an identical profile without the
+# repository redistributing text it may not have the right to. The recipes ARE committed.
+profiles/reporting/*.yaml
+
+# OS
+.DS_Store
+Thumbs.db
+
+# pytest-cov output
+.coverage
+.coverage.*
+htmlcov/