mintmark 0.3.1__tar.gz → 0.3.2__tar.gz

{mintmark-0.3.1 → mintmark-0.3.2}/CHANGELOG.md

@@ -11,6 +11,18 @@ output for a fixed set of inputs. A change that alters emitted bytes for a fixed
 seed is a major version event even when no signature changed, because it breaks
 the reproducibility of every published manifest.
 
+## 0.3.2 - 2026-08-23
+
+### Security
+
+- Release checksums and GitHub build-provenance attestations now cover the
+  CycloneDX SBOM alongside the wheel and source distribution.
+- Artifact upload and download steps use immutable, Node 24-compatible action
+  revisions.
+
+Generated record and label files do not change for the same inputs. Manifests
+record the patch engine version.
+
 ## 0.3.1 - 2026-08-23
 
 ### Fixed

{mintmark-0.3.1 → mintmark-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mintmark
-Version: 0.3.1
+Version: 0.3.2
 Summary: Deterministic, fully synthetic, Turkish-first labeled datasets with a provenance manifest.
 Author: Mintmark contributors
 License-Expression: Apache-2.0
@@ -35,7 +35,7 @@ Description-Content-Type: text/markdown
   <a href="https://github.com/lokomotifai/mintmark/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/lokomotifai/mintmark/ci.yml?branch=main&amp;style=flat-square&amp;label=CI"></a>
   <img alt="926 tests" src="https://img.shields.io/badge/tests-926-3C873A?style=flat-square">
   <img alt="18 invariants, each with a named test" src="https://img.shields.io/badge/invariants-18%20tested-3C873A?style=flat-square">
-  <a href="https://github.com/lokomotifai/mintmark/releases/tag/v0.3.1"><img alt="Release v0.3.1" src="https://img.shields.io/badge/release-v0.3.1-3C873A?style=flat-square"></a>
+  <a href="https://github.com/lokomotifai/mintmark/releases/tag/v0.3.2"><img alt="Release v0.3.2" src="https://img.shields.io/badge/release-v0.3.2-3C873A?style=flat-square"></a>
   <a href="https://pypi.org/project/mintmark/"><img alt="On PyPI" src="https://img.shields.io/pypi/v/mintmark?style=flat-square&amp;label=PyPI&amp;color=3C873A"></a>
   <a href="LICENSE"><img alt="Apache-2.0 license" src="https://img.shields.io/badge/license-Apache--2.0-3B3F46?style=flat-square"></a>
 </p>

{mintmark-0.3.1 → mintmark-0.3.2}/README.md

@@ -15,7 +15,7 @@
   <a href="https://github.com/lokomotifai/mintmark/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/lokomotifai/mintmark/ci.yml?branch=main&amp;style=flat-square&amp;label=CI"></a>
   <img alt="926 tests" src="https://img.shields.io/badge/tests-926-3C873A?style=flat-square">
   <img alt="18 invariants, each with a named test" src="https://img.shields.io/badge/invariants-18%20tested-3C873A?style=flat-square">
-  <a href="https://github.com/lokomotifai/mintmark/releases/tag/v0.3.1"><img alt="Release v0.3.1" src="https://img.shields.io/badge/release-v0.3.1-3C873A?style=flat-square"></a>
+  <a href="https://github.com/lokomotifai/mintmark/releases/tag/v0.3.2"><img alt="Release v0.3.2" src="https://img.shields.io/badge/release-v0.3.2-3C873A?style=flat-square"></a>
   <a href="https://pypi.org/project/mintmark/"><img alt="On PyPI" src="https://img.shields.io/pypi/v/mintmark?style=flat-square&amp;label=PyPI&amp;color=3C873A"></a>
   <a href="LICENSE"><img alt="Apache-2.0 license" src="https://img.shields.io/badge/license-Apache--2.0-3B3F46?style=flat-square"></a>
 </p>

{mintmark-0.3.1 → mintmark-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mintmark"
-version = "0.3.1"
+version = "0.3.2"
 description = "Deterministic, fully synthetic, Turkish-first labeled datasets with a provenance manifest."
 readme = "README.md"
 requires-python = ">=3.12,<3.13"

{mintmark-0.3.1 → mintmark-0.3.2}/src/mintmark/engine/version.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-VERSION = "0.3.1"
+VERSION = "0.3.2"

{mintmark-0.3.1 → mintmark-0.3.2}/tests/unit/test_workflows.py

@@ -171,8 +171,14 @@ def test_release_scans_and_seals_the_exact_built_artifacts_before_oidc() -> None
     assert "uv build --no-build-isolation" in build_text
     assert "uv export --locked --no-dev --no-emit-project" in build_text
     assert "tools/canary.py dist/" in build_text
-    assert "sha256sum mintmark-*.whl mintmark-*.tar.gz" in build_text
+    assert "sha256sum mintmark-*.whl mintmark-*.tar.gz sbom.json" in build_text
     assert "sha256sum -c SHA256SUMS" in publish_text
+    attestation = next(
+        step
+        for step in publish_steps
+        if step.get("uses", "").startswith("actions/attest-build-provenance@")
+    )
+    assert "dist/sbom.json" in attestation["with"]["subject-path"]
     publisher = next(
         step
         for step in publish_steps