mcp-openstack-ops 3.5.4__tar.gz → 3.5.6__tar.gz

{mcp_openstack_ops-3.5.4 → mcp_openstack_ops-3.5.6}/.github/workflows/pypi-publish.yml

@@ -1,7 +1,4 @@
-# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python
-
-name: Publish to PyPI on tag
+name: Publish Packages and GitHub Release on Tag
 
 on:
   push:
@@ -9,7 +6,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write
 
 jobs:
   build:
@@ -22,14 +18,21 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: "3.12.x"
-      - name: Install build tool
-        run: pip install --upgrade build
+      - name: Install build and release test tools
+        run: pip install --upgrade build pytest PyYAML
+      - name: Test release automation
+        run: python -m pytest -q tests/test_publish_release.py tests/test_release.py
       - name: Build distributions
         run: python -m build
+      - name: Verify tag and distribution versions
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: python -m scripts.check_release "$RELEASE_TAG" dist
       - uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/
+          if-no-files-found: error
 
   publish-to-testpypi:
     name: Publish to TestPyPI
@@ -55,8 +58,7 @@ jobs:
     name: Publish to PyPI
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
-    needs: build
-    #needs: publish-to-testpypi
+    needs: publish-to-testpypi
     permissions:
       id-token: write
     environment:
@@ -70,4 +72,28 @@ jobs:
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          repository-url: https://upload.pypi.org/legacy/
+          repository-url: https://upload.pypi.org/legacy/
+
+  release:
+    name: Publish GitHub Release
+    needs: publish-to-pypi
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    concurrency:
+      group: github-release-${{ github.repository }}
+      cancel-in-progress: false
+      queue: max
+    env:
+      GH_TOKEN: ${{ github.token }}
+      RELEASE_TAG: ${{ github.ref_name }}
+    steps:
+      - name: Check Out Tagged Repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Publish Release with Commit Messages
+        run: python3 -m scripts.publish_release "$RELEASE_TAG"

{mcp_openstack_ops-3.5.4/src/mcp_openstack_ops.egg-info → mcp_openstack_ops-3.5.6}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: mcp-openstack-ops
-Version: 3.5.4
+Version: 3.5.6
 Summary: OpenStack operations automation MCP server
 Author-email: JungJungIn <call518@gmail.com>
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: fastmcp>=2.12.3
-Requires-Dist: openstacksdk<=4.20.0,>=4.1.0
+Requires-Dist: openstacksdk<=4.21.0,>=4.1.0
 Requires-Dist: python-dotenv>=1.1.1
 Requires-Dist: setuptools-scm>=10.0.5
 Requires-Dist: pre-commit>=4.6.0
@@ -35,6 +35,19 @@ Dynamic: license-file
 
 [![Ask DeepWiki](https://img.shields.io/badge/Ask-DeepWiki-blue)](https://deepwiki.com/call518/MCP-OpenStack-Ops)
 
+## Package and GitHub Releases
+
+Pushing a release tag runs the GitHub Actions publication workflow: build and
+validate distributions, publish to TestPyPI, publish to PyPI, then create a GitHub
+Release named after the tag. Tags must use `X.Y.Z` or `vX.Y.Z`, optionally followed
+by `aN`, `bN`, or `rcN`; both distribution versions must match the tag.
+
+Release notes include full commit messages since the most recently published
+non-draft GitHub Release, in oldest-first topological order. The first Release
+includes all commit history. Existing published Releases are left unchanged;
+an existing draft or a previous Release outside the tag's ancestry stops release
+creation for manual review. Prereleases are marked as such and are not made latest.
+
 ---
 
 ## Features

mcp_openstack_ops-3.5.4/PKG-INFO → mcp_openstack_ops-3.5.6/README.md

@@ -1,21 +1,3 @@
-Metadata-Version: 2.4
-Name: mcp-openstack-ops
-Version: 3.5.4
-Summary: OpenStack operations automation MCP server
-Author-email: JungJungIn <call518@gmail.com>
-Requires-Python: >=3.12
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: fastmcp>=2.12.3
-Requires-Dist: openstacksdk<=4.20.0,>=4.1.0
-Requires-Dist: python-dotenv>=1.1.1
-Requires-Dist: setuptools-scm>=10.0.5
-Requires-Dist: pre-commit>=4.6.0
-Provides-Extra: dev
-Requires-Dist: pytest>=7.0.0; extra == "dev"
-Requires-Dist: pytest-asyncio>=0.21.0; extra == "dev"
-Dynamic: license-file
-
 # MCP-OpenStack-Ops
 
 > **MCP OpenStack Operations Server**: A comprehensive MCP (Model Context Protocol) server providing OpenStack project management and monitoring capabilities with built-in safety controls and single-project scope.
@@ -35,6 +17,19 @@ Dynamic: license-file
 
 [![Ask DeepWiki](https://img.shields.io/badge/Ask-DeepWiki-blue)](https://deepwiki.com/call518/MCP-OpenStack-Ops)
 
+## Package and GitHub Releases
+
+Pushing a release tag runs the GitHub Actions publication workflow: build and
+validate distributions, publish to TestPyPI, publish to PyPI, then create a GitHub
+Release named after the tag. Tags must use `X.Y.Z` or `vX.Y.Z`, optionally followed
+by `aN`, `bN`, or `rcN`; both distribution versions must match the tag.
+
+Release notes include full commit messages since the most recently published
+non-draft GitHub Release, in oldest-first topological order. The first Release
+includes all commit history. Existing published Releases are left unchanged;
+an existing draft or a previous Release outside the tag's ancestry stops release
+creation for manual review. Prereleases are marked as such and are not made latest.
+
 ---
 
 ## Features

{mcp_openstack_ops-3.5.4 → mcp_openstack_ops-3.5.6}/pyproject.toml

@@ -7,7 +7,7 @@ requires-python = ">=3.12"
 authors = [{ name = "JungJungIn", email = "call518@gmail.com" }]
 dependencies = [
     "fastmcp>=2.12.3",
-    "openstacksdk>=4.1.0,<=4.20.0",
+    "openstacksdk>=4.1.0,<=4.21.0",
     "python-dotenv>=1.1.1",
     "setuptools-scm>=10.0.5",
     "pre-commit>=4.6.0",

mcp_openstack_ops-3.5.6/scripts/check_release.py

@@ -0,0 +1,72 @@
+"""Require both distribution metadata versions to match the release tag."""
+
+import argparse
+import re
+import tarfile
+import zipfile
+from email.parser import BytesParser
+from pathlib import Path
+
+
+def release_version(tag: str) -> str:
+    """Validate a canonical release tag and return its package version."""
+    version = tag.removeprefix("v")
+    number = r"(?:0|[1-9][0-9]*)"
+    if not re.fullmatch(
+        rf"{number}\.{number}\.{number}(?:(?:a|b|rc){number})?", version
+    ):
+        raise ValueError("Use a tag such as 0.5.7, v0.5.7, or 0.5.7rc1")
+    return version
+
+
+def check_release(tag: str, directory: Path) -> None:
+    """Validate a canonical release tag and the wheel/sdist prepared for upload."""
+    version = release_version(tag)
+    wheels = list(directory.glob("*.whl"))
+    sdists = list(directory.glob("*.tar.gz"))
+    if len(wheels) != 1 or len(sdists) != 1:
+        raise ValueError("Expected exactly one wheel and one source distribution")
+
+    with zipfile.ZipFile(wheels[0]) as archive:
+        metadata_files = [
+            name for name in archive.namelist() if name.endswith(".dist-info/METADATA")
+        ]
+        if len(metadata_files) != 1:
+            raise ValueError("Expected one wheel metadata file")
+        wheel_metadata = archive.read(metadata_files[0])
+    with tarfile.open(sdists[0], "r:gz") as archive:
+        metadata_files = [
+            item
+            for item in archive.getmembers()
+            if len(Path(item.name).parts) == 2 and item.name.endswith("/PKG-INFO")
+        ]
+        if len(metadata_files) != 1:
+            raise ValueError("Expected one source distribution metadata file")
+        stream = archive.extractfile(metadata_files[0])
+        if stream is None:
+            raise ValueError("Source distribution metadata is not a file")
+        with stream:
+            sdist_metadata = stream.read()
+
+    for path, raw in zip((wheels[0], sdists[0]), (wheel_metadata, sdist_metadata)):
+        metadata = BytesParser().parsebytes(raw)
+        if metadata.get("Name") != "mcp-openstack-ops" or metadata.get("Version") != version:
+            raise ValueError(f"{path.name}: expected mcp-openstack-ops {version}")
+        print(f"Verified {path.name}: mcp-openstack-ops {version}")
+
+
+def main() -> None:
+    """Check release artifacts without uploading or modifying them."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("tag")
+    parser.add_argument("directory", type=Path)
+    args = parser.parse_args()
+    try:
+        check_release(args.tag, args.directory)
+    except ValueError as exc:
+        parser.exit(1, f"Release validation failed: {exc}\n")
+
+
+if __name__ == "__main__":
+    main()
+

mcp_openstack_ops-3.5.6/scripts/publish_release.py

@@ -0,0 +1,141 @@
+"""Publish a tag's GitHub Release after package publication has succeeded."""
+
+import argparse
+import json
+import os
+import re
+import subprocess
+import tempfile
+from pathlib import Path
+from typing import Any
+from urllib.parse import quote
+
+from scripts.check_release import release_version
+
+
+def command(*args: str) -> str:
+    """Run an argument list without interpreting commit messages as shell code."""
+    return subprocess.run(
+        args, check=True, capture_output=True, text=True
+    ).stdout.strip()
+
+
+def release_notes(repository: str, tag: str, previous: str | None) -> str:
+    """Collect full commit messages in oldest-first topological order."""
+    current = command("git", "rev-parse", "--verify", f"refs/tags/{tag}^{{commit}}")
+    revision = current
+    if previous:
+        base = command(
+            "git", "rev-parse", "--verify", f"refs/tags/{previous}^{{commit}}"
+        )
+        command("git", "merge-base", "--is-ancestor", base, current)
+        revision = f"{base}..{current}"
+    raw = command(
+        "git",
+        "log",
+        "--reverse",
+        "--topo-order",
+        "--format=%H%x00%B%x00",
+        revision,
+        "--",
+    )
+    parts = raw.split("\0")
+    notes = [
+        f"## {tag}",
+        f"Changes since {previous}." if previous else "Initial release.",
+        "",
+    ]
+    for index in range(0, len(parts) - 1, 2):
+        sha, message = parts[index].strip(), parts[index + 1].strip()
+        # A longer fence preserves messages containing Markdown code fences.
+        fence = "`" * max(
+            3, max((len(m) + 1 for m in re.findall(r"`+", message)), default=3)
+        )
+        notes.extend(
+            [
+                f"### [{sha[:7]}](https://github.com/{repository}/commit/{sha})",
+                f"{fence}text",
+                message,
+                fence,
+                "",
+            ]
+        )
+    if previous:
+        notes.append(
+            f"[Full Changelog](https://github.com/{repository}/compare/{quote(previous, safe='')}...{quote(tag, safe='')})"
+        )
+    return "\n".join(notes) + "\n"
+
+
+def publish_release(repository: str, tag: str) -> None:
+    """Create a release once, using the last published release as the baseline."""
+    version = release_version(tag)
+    current = command("git", "rev-parse", "--verify", f"refs/tags/{tag}^{{commit}}")
+    remote = command("gh", "api", f"repos/{repository}/commits/{tag}", "--jq", ".sha")
+    if current != remote or current != command("git", "rev-parse", "HEAD"):
+        raise ValueError(
+            "The remote tag, local tag, and checked-out commit must match."
+        )
+    pages = json.loads(
+        command(
+            "gh",
+            "api",
+            "--paginate",
+            "--slurp",
+            f"repos/{repository}/releases?per_page=100",
+        )
+    )
+    releases: list[dict[str, Any]] = [release for page in pages for release in page]
+    existing = next(
+        (release for release in releases if release["tag_name"] == tag), None
+    )
+    if existing:
+        if existing["draft"]:
+            raise ValueError("A draft already exists for this tag; review it manually.")
+        print(f"Release {tag} already exists; leaving its content unchanged.")
+        return
+    published = [release for release in releases if not release["draft"]]
+    previous = (
+        max(published, key=lambda release: release["published_at"])["tag_name"]
+        if published
+        else None
+    )
+    notes = release_notes(repository, tag, previous)
+    with tempfile.TemporaryDirectory(prefix="openstack-ops-release-") as temporary:
+        path = Path(temporary) / "release-notes.md"
+        path.write_text(notes, encoding="utf-8")
+        args = [
+            "gh",
+            "release",
+            "create",
+            tag,
+            "--repo",
+            repository,
+            "--verify-tag",
+            "--title",
+            tag,
+            "--notes-file",
+            str(path),
+        ]
+        if re.search(r"(?:a|b|rc)\d+$", version):
+            args.extend(["--prerelease", "--latest=false"])
+        command(*args)
+    print(f"Published GitHub Release {tag} (previous release: {previous or 'none'}).")
+
+
+def main() -> None:
+    """Publish only when explicitly called by the final release job."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("tag")
+    args = parser.parse_args()
+    try:
+        publish_release(os.environ["GITHUB_REPOSITORY"], args.tag)
+    except subprocess.CalledProcessError as error:
+        parser.exit(1, f"Release command failed: {error.stderr or error}\n")
+    except (ValueError, KeyError, OSError) as error:
+        parser.exit(1, f"GitHub Release failed: {error}\n")
+
+
+if __name__ == "__main__":
+    main()
+

{mcp_openstack_ops-3.5.4 → mcp_openstack_ops-3.5.6}/src/mcp_openstack_ops/connection.py

@@ -152,10 +152,13 @@ def get_current_project_id() -> str:
     """
     try:
         conn = get_openstack_connection()
-        # Get project ID from the token
+        # Get project ID from the token scope. conn.auth only holds the
+        # configured auth args, so it has no project_id when the connection
+        # is scoped by project name.
         token = conn.identity.get_token()
-        project_id = conn.auth.get('project_id') or conn.auth.get('tenant_id')
-        
+        project_id = conn.current_project_id or \
+                     conn.auth.get('project_id') or conn.auth.get('tenant_id')
+
         if not project_id:
             # Fallback: get from project name
             project_name = os.environ.get("OS_PROJECT_NAME")

mcp_openstack_ops-3.5.4/README.md → mcp_openstack_ops-3.5.6/src/mcp_openstack_ops.egg-info/PKG-INFO

@@ -1,3 +1,21 @@
+Metadata-Version: 2.4
+Name: mcp-openstack-ops
+Version: 3.5.6
+Summary: OpenStack operations automation MCP server
+Author-email: JungJungIn <call518@gmail.com>
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: fastmcp>=2.12.3
+Requires-Dist: openstacksdk<=4.21.0,>=4.1.0
+Requires-Dist: python-dotenv>=1.1.1
+Requires-Dist: setuptools-scm>=10.0.5
+Requires-Dist: pre-commit>=4.6.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0.0; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.21.0; extra == "dev"
+Dynamic: license-file
+
 # MCP-OpenStack-Ops
 
 > **MCP OpenStack Operations Server**: A comprehensive MCP (Model Context Protocol) server providing OpenStack project management and monitoring capabilities with built-in safety controls and single-project scope.
@@ -17,6 +35,19 @@
 
 [![Ask DeepWiki](https://img.shields.io/badge/Ask-DeepWiki-blue)](https://deepwiki.com/call518/MCP-OpenStack-Ops)
 
+## Package and GitHub Releases
+
+Pushing a release tag runs the GitHub Actions publication workflow: build and
+validate distributions, publish to TestPyPI, publish to PyPI, then create a GitHub
+Release named after the tag. Tags must use `X.Y.Z` or `vX.Y.Z`, optionally followed
+by `aN`, `bN`, or `rcN`; both distribution versions must match the tag.
+
+Release notes include full commit messages since the most recently published
+non-draft GitHub Release, in oldest-first topological order. The first Release
+includes all commit history. Existing published Releases are left unchanged;
+an existing draft or a previous Release outside the tag's ancestry stops release
+creation for manual review. Prereleases are marked as such and are not made latest.
+
 ---
 
 ## Features

{mcp_openstack_ops-3.5.4 → mcp_openstack_ops-3.5.6}/src/mcp_openstack_ops.egg-info/SOURCES.txt

@@ -30,7 +30,9 @@ img/screenshot-claude-desktop.png
 img/screenshot-claude-desktop.png:Zone.Identifier
 img/screenshot-example-cluster-status.png
 img/screenshot-openstack-dashboard.png
+scripts/check_release.py
 scripts/mcp-server-docker-cmd.sh
+scripts/publish_release.py
 scripts/run-mcp-inspector-local.sh
 scripts/run-mcp-inspector-pypi.sh
 src/mcp_openstack_ops/__init__.py
@@ -156,4 +158,6 @@ src/mcp_openstack_ops/tools/set_subnets.py
 src/mcp_openstack_ops/tools/set_volume.py
 src/mcp_openstack_ops/tools/set_volume_backups.py
 src/mcp_openstack_ops/tools/set_volume_groups.py
-src/mcp_openstack_ops/tools/set_volume_qos.py
+src/mcp_openstack_ops/tools/set_volume_qos.py
+tests/test_publish_release.py
+tests/test_release.py

{mcp_openstack_ops-3.5.4 → mcp_openstack_ops-3.5.6}/src/mcp_openstack_ops.egg-info/requires.txt

@@ -1,5 +1,5 @@
 fastmcp>=2.12.3
-openstacksdk<=4.20.0,>=4.1.0
+openstacksdk<=4.21.0,>=4.1.0
 python-dotenv>=1.1.1
 setuptools-scm>=10.0.5
 pre-commit>=4.6.0

{mcp_openstack_ops-3.5.4 → mcp_openstack_ops-3.5.6}/src/mcp_openstack_ops.egg-info/scm_file_list.json

@@ -29,7 +29,9 @@
     "mcp-config.json.multi-project",
     "mcp-config.json.stdio",
     "pyproject.toml",
+    "scripts/check_release.py",
     "scripts/mcp-server-docker-cmd.sh",
+    "scripts/publish_release.py",
     "scripts/run-mcp-inspector-local.sh",
     "scripts/run-mcp-inspector-pypi.sh",
     "src/mcp_openstack_ops/__init__.py",
@@ -150,6 +152,8 @@
     "src/mcp_openstack_ops/tools/set_volume_qos.py",
     "test_compatibility.sh",
     "test_project_isolation.py",
+    "tests/test_publish_release.py",
+    "tests/test_release.py",
     "uv.lock"
   ]
 }

mcp_openstack_ops-3.5.6/src/mcp_openstack_ops.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "3.5.6",
+  "distance": 0,
+  "node": "g41f8358a600a2396e41e6d5b6e4326a6550ab2a0",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-24"
+}

mcp_openstack_ops-3.5.6/tests/test_publish_release.py

@@ -0,0 +1,153 @@
+"""Verify release publication without writing Git state or calling GitHub."""
+
+import json
+import subprocess
+from pathlib import Path
+from typing import Any
+
+import pytest
+import yaml
+
+from scripts import publish_release
+
+REPOSITORY = "example/project"
+CURRENT = "b" * 40
+BASE = "a" * 40
+
+
+@pytest.fixture
+def commands(monkeypatch: pytest.MonkeyPatch) -> dict[str, Any]:
+    state: dict[str, Any] = {"calls": [], "created": [], "releases": [[]]}
+
+    def execute(*args: str) -> str:
+        state["calls"].append(args)
+        if args[:3] == ("gh", "release", "create"):
+            path = Path(args[args.index("--notes-file") + 1])
+            state["created"].append((args, path.read_text()))
+            return "https://github.com/example/project/releases/tag/0.6.6"
+        if args[:2] == ("gh", "api"):
+            if "--paginate" in args:
+                if state.get("api_failure"):
+                    raise subprocess.CalledProcessError(1, args, stderr="API failed")
+                return json.dumps(state["releases"])
+            return state.get("remote", CURRENT)
+        if args == ("git", "rev-parse", "HEAD"):
+            return state.get("head", CURRENT)
+        if args[:3] == ("git", "rev-parse", "--verify"):
+            return (
+                CURRENT
+                if args[-1].endswith("0.6.6^{commit}")
+                or args[-1].endswith("0.6.6rc1^{commit}")
+                else BASE
+            )
+        if args[:3] == ("git", "merge-base", "--is-ancestor"):
+            if state.get("unrelated"):
+                raise subprocess.CalledProcessError(1, args)
+            return ""
+        if args[:2] == ("git", "log"):
+            return (
+                f"{'c' * 40}\0feat: first change\n\nBREAKING CHANGE: use start\n\0\n"
+                f"{CURRENT}\0fix: second change\n\n```sh\n$(touch marker)\n```\n\0"
+            )
+        raise AssertionError(args)
+
+    monkeypatch.setattr(publish_release, "command", execute)
+    return state
+
+
+def release(tag: str, published_at: str, *, draft: bool = False) -> dict[str, Any]:
+    return {"tag_name": tag, "published_at": published_at, "draft": draft}
+
+
+def test_uses_previous_published_release_across_pages(commands) -> None:
+    commands["releases"] = [
+        [release("0.6.5", "2026-10-24T12:00:00Z", draft=True)],
+        [release("0.6.4", "2026-10-23T12:00:00Z")],
+        [release("0.6.3", "2026-10-22T12:00:00Z")],
+    ]
+    publish_release.publish_release(REPOSITORY, "0.6.6")
+    args, notes = commands["created"][0]
+    assert "--verify-tag" in args
+    assert args[args.index("--title") + 1] == "0.6.6"
+    assert "Changes since 0.6.4." in notes
+    assert "0.6.4...0.6.6" in notes
+    assert notes.index("first change") < notes.index("second change")
+    assert "BREAKING CHANGE: use start" in notes
+    assert "$(touch marker)" in notes
+    assert "````text" in notes
+    assert ("git", "merge-base", "--is-ancestor", BASE, CURRENT) in commands["calls"]
+    log = next(call for call in commands["calls"] if call[:2] == ("git", "log"))
+    assert "--reverse" in log and "--topo-order" in log
+    assert f"{BASE}..{CURRENT}" in log
+    assert not Path(args[args.index("--notes-file") + 1]).exists()
+
+
+def test_published_release_is_not_overwritten(commands) -> None:
+    commands["releases"] = [[release("0.6.6", "2026-10-24T12:00:00Z")]]
+    publish_release.publish_release(REPOSITORY, "0.6.6")
+    assert commands["created"] == []
+    assert not any(call[:2] == ("git", "log") for call in commands["calls"])
+
+
+def test_existing_draft_requires_manual_review(commands) -> None:
+    commands["releases"] = [[release("0.6.6", "", draft=True)]]
+    with pytest.raises(ValueError, match="draft already exists"):
+        publish_release.publish_release(REPOSITORY, "0.6.6")
+    assert commands["created"] == []
+
+
+def test_first_release_includes_all_history(commands) -> None:
+    publish_release.publish_release(REPOSITORY, "0.6.6")
+    _, notes = commands["created"][0]
+    assert "Initial release." in notes
+    assert "Full Changelog" not in notes
+    log = next(call for call in commands["calls"] if call[:2] == ("git", "log"))
+    assert log[-2:] == (CURRENT, "--")
+
+
+def test_prerelease_is_not_marked_latest(commands) -> None:
+    publish_release.publish_release(REPOSITORY, "0.6.6rc1")
+    args, _ = commands["created"][0]
+    assert "--prerelease" in args and "--latest=false" in args
+
+
+@pytest.mark.parametrize("field", ["remote", "head"])
+def test_mismatched_commit_blocks_publication(commands, field) -> None:
+    commands[field] = "d" * 40
+    with pytest.raises(ValueError, match="must match"):
+        publish_release.publish_release(REPOSITORY, "0.6.6")
+    assert commands["created"] == []
+
+
+@pytest.mark.parametrize("failure", ["api_failure", "unrelated"])
+def test_api_or_ancestry_failure_does_not_publish(commands, failure) -> None:
+    commands["releases"] = [[release("0.6.4", "2026-10-23T12:00:00Z")]]
+    commands[failure] = True
+    with pytest.raises(subprocess.CalledProcessError):
+        publish_release.publish_release(REPOSITORY, "0.6.6")
+    assert commands["created"] == []
+
+
+def test_invalid_tag_does_not_call_commands(commands) -> None:
+    with pytest.raises(ValueError):
+        publish_release.publish_release(REPOSITORY, "$(touch marker)")
+    assert commands["calls"] == []
+
+
+def test_release_job_is_separate_and_uses_scoped_permissions() -> None:
+    root = Path(__file__).resolve().parents[1]
+    workflow = yaml.safe_load((root / ".github/workflows/pypi-publish.yml").read_text())
+    assert workflow["permissions"] == {"contents": "read"}
+    job = workflow["jobs"]["release"]
+    assert job["needs"] == "publish-to-pypi"
+    assert job["permissions"] == {"contents": "write"}
+    assert job["concurrency"]["cancel-in-progress"] is False
+    assert job["concurrency"]["queue"] == "max"
+    assert job["steps"][0]["with"]["fetch-depth"] == 0
+    assert job["env"]["GH_TOKEN"] == "${{ github.token }}"
+    assert (
+        job["steps"][-1]["run"] == 'python3 -m scripts.publish_release "$RELEASE_TAG"'
+    )
+    for name in ("publish-to-testpypi", "publish-to-pypi"):
+        assert workflow["jobs"][name]["permissions"] == {"id-token": "write"}
+