modelaudit 0.2.38__tar.gz → 0.2.40__tar.gz

{modelaudit-0.2.38 → modelaudit-0.2.40}/.github/workflows/release-please.yml

@@ -10,6 +10,15 @@ on:
     branches:
       - main
   workflow_dispatch:
+    inputs:
+      root_version:
+        description: "Publish an already-versioned root modelaudit release, for example 0.2.39"
+        required: false
+        type: string
+      picklescan_version:
+        description: "Publish an already-versioned modelaudit-picklescan release, for example 0.1.2"
+        required: false
+        type: string
 
 jobs:
   release-please:
@@ -18,19 +27,75 @@ jobs:
       contents: write
       pull-requests: write
     outputs:
-      release_created: ${{ steps.release.outputs.release_created }}
-      tag_name: ${{ steps.release.outputs.tag_name }}
-      version: ${{ steps.release.outputs.version }}
-      picklescan_release_created: ${{ steps.release.outputs['packages/modelaudit-picklescan--release_created'] }}
-      picklescan_tag_name: ${{ steps.release.outputs['packages/modelaudit-picklescan--tag_name'] }}
-      picklescan_version: ${{ steps.release.outputs['packages/modelaudit-picklescan--version'] }}
+      release_created: ${{ steps.manual.outputs.manual_release == 'true' && steps.manual.outputs.release_created || steps.release.outputs.release_created }}
+      tag_name: ${{ steps.manual.outputs.manual_release == 'true' && steps.manual.outputs.tag_name || steps.release.outputs.tag_name }}
+      version: ${{ steps.manual.outputs.manual_release == 'true' && steps.manual.outputs.version || steps.release.outputs.version }}
+      picklescan_release_created: ${{ steps.manual.outputs.manual_release == 'true' && steps.manual.outputs.picklescan_release_created || steps.release.outputs['packages/modelaudit-picklescan--release_created'] }}
+      picklescan_tag_name: ${{ steps.manual.outputs.manual_release == 'true' && steps.manual.outputs.picklescan_tag_name || steps.release.outputs['packages/modelaudit-picklescan--tag_name'] }}
+      picklescan_version: ${{ steps.manual.outputs.manual_release == 'true' && steps.manual.outputs.picklescan_version || steps.release.outputs['packages/modelaudit-picklescan--version'] }}
       pr_number: ${{ steps.release.outputs.pr && fromJSON(steps.release.outputs.pr).number || '' }}
     steps:
+      - name: Resolve manual release inputs
+        id: manual
+        env:
+          ROOT_VERSION: ${{ github.event.inputs.root_version || '' }}
+          PICKLESCAN_VERSION: ${{ github.event.inputs.picklescan_version || '' }}
+        run: |
+          {
+            if [[ -n "$ROOT_VERSION" ]]; then
+              echo "release_created=true"
+              echo "version=$ROOT_VERSION"
+              echo "tag_name=v$ROOT_VERSION"
+            else
+              echo "release_created=false"
+            fi
+
+            if [[ -n "$PICKLESCAN_VERSION" ]]; then
+              echo "picklescan_release_created=true"
+              echo "picklescan_version=$PICKLESCAN_VERSION"
+              echo "picklescan_tag_name=modelaudit-picklescan-v$PICKLESCAN_VERSION"
+            else
+              echo "picklescan_release_created=false"
+            fi
+
+            if [[ -n "$ROOT_VERSION" || -n "$PICKLESCAN_VERSION" ]]; then
+              echo "manual_release=true"
+            else
+              echo "manual_release=false"
+            fi
+          } >> "$GITHUB_OUTPUT"
+
       - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
+        if: steps.manual.outputs.manual_release != 'true'
         id: release
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Ensure manual GitHub releases exist
+        if: steps.manual.outputs.manual_release == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ROOT_TAG: ${{ steps.manual.outputs.tag_name }}
+          ROOT_VERSION: ${{ steps.manual.outputs.version }}
+          PICKLESCAN_TAG: ${{ steps.manual.outputs.picklescan_tag_name }}
+          PICKLESCAN_VERSION: ${{ steps.manual.outputs.picklescan_version }}
+        run: |
+          if [[ -n "$ROOT_VERSION" ]] && ! gh release view "$ROOT_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release create "$ROOT_TAG" \
+              --repo "$GITHUB_REPOSITORY" \
+              --target "$GITHUB_SHA" \
+              --title "$ROOT_TAG" \
+              --notes "Manual recovery release for modelaudit $ROOT_VERSION."
+          fi
+
+          if [[ -n "$PICKLESCAN_VERSION" ]] && ! gh release view "$PICKLESCAN_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release create "$PICKLESCAN_TAG" \
+              --repo "$GITHUB_REPOSITORY" \
+              --target "$GITHUB_SHA" \
+              --title "modelaudit-picklescan: v$PICKLESCAN_VERSION" \
+              --notes "Manual recovery release for modelaudit-picklescan $PICKLESCAN_VERSION."
+          fi
+
       # Format changelogs immediately after release-please creates/updates a PR
       # This runs for BOTH new PRs (prs_created) and existing PRs (pr output exists)
       - name: Check if PR exists
@@ -500,24 +565,24 @@ jobs:
       - name: Build standalone package sdist
         if: matrix.build-sdist == 'true'
         run: |
-          uv build --sdist --out-dir /tmp/modelaudit-picklescan-dist
+          uv build --sdist --out-dir dist
 
       - name: Build standalone package manylinux wheel
         if: runner.os == 'Linux'
         uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
         with:
           command: build
-          args: --release --wheel --out /tmp/modelaudit-picklescan-dist --compatibility manylinux_2_28
+          args: --release --out dist
           manylinux: "2_28"
           working-directory: packages/modelaudit-picklescan
 
       - name: Build standalone package wheel
         if: runner.os != 'Linux'
         run: |
-          uv build --wheel --out-dir /tmp/modelaudit-picklescan-dist
+          uv build --wheel --out-dir dist
 
       - name: Validate standalone package metadata
-        run: uvx twine check /tmp/modelaudit-picklescan-dist/*
+        run: uvx twine check dist/*
 
       - name: Verify standalone artifact version consistency
         run: |
@@ -525,10 +590,10 @@ jobs:
           EXPECTED_VERSION="${{ needs.release-please.outputs.picklescan_version }}"
 
           shopt -s nullglob
-          artifacts=(/tmp/modelaudit-picklescan-dist/modelaudit_picklescan-*.whl /tmp/modelaudit-picklescan-dist/modelaudit_picklescan-*.tar.gz)
+          artifacts=(dist/modelaudit_picklescan-*.whl dist/modelaudit_picklescan-*.tar.gz)
           if [[ ${#artifacts[@]} -eq 0 ]]; then
             echo "ERROR: Expected at least one modelaudit_picklescan artifact"
-            ls -la /tmp/modelaudit-picklescan-dist/
+            ls -la dist/
             exit 1
           fi
 
@@ -582,21 +647,26 @@ jobs:
         run: |
           set -euo pipefail
           uv venv /tmp/modelaudit-picklescan-wheel-smoke
+          if [[ -x /tmp/modelaudit-picklescan-wheel-smoke/bin/python ]]; then
+            SMOKE_PYTHON=/tmp/modelaudit-picklescan-wheel-smoke/bin/python
+          else
+            SMOKE_PYTHON=/tmp/modelaudit-picklescan-wheel-smoke/Scripts/python.exe
+          fi
 
           shopt -s nullglob
-          picklescan_wheels=(/tmp/modelaudit-picklescan-dist/modelaudit_picklescan-*.whl)
+          picklescan_wheels=(dist/modelaudit_picklescan-*.whl)
           if [[ ${#picklescan_wheels[@]} -ne 1 ]]; then
             echo "ERROR: Expected exactly 1 modelaudit_picklescan wheel artifact, found ${#picklescan_wheels[@]}"
-            ls -la /tmp/modelaudit-picklescan-dist/
+            ls -la dist/
             exit 1
           fi
 
-          uv pip install --python /tmp/modelaudit-picklescan-wheel-smoke/bin/python "${picklescan_wheels[0]}"
+          uv pip install --python "$SMOKE_PYTHON" "${picklescan_wheels[0]}"
 
           smoke_dir="$(mktemp -d)"
           (
             cd "$smoke_dir"
-            PYTHONPATH='' /tmp/modelaudit-picklescan-wheel-smoke/bin/python -I - <<'PY'
+            PYTHONPATH='' "$SMOKE_PYTHON" -I - <<'PY'
           import importlib.util
 
           import modelaudit_picklescan
@@ -615,7 +685,7 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: modelaudit-picklescan-dist-${{ matrix.artifact-suffix }}
-          path: /tmp/modelaudit-picklescan-dist/
+          path: packages/modelaudit-picklescan/dist/
 
   publish-pypi:
     if: needs.release-please.outputs.release_created == 'true'

modelaudit-0.2.40/.release-please-manifest.json

@@ -0,0 +1,4 @@
+{
+  ".": "0.2.40",
+  "packages/modelaudit-picklescan": "0.1.2"
+}

{modelaudit-0.2.38 → modelaudit-0.2.40}/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.40](https://github.com/promptfoo/modelaudit/compare/v0.2.39...v0.2.40) (2026-04-17)
+
+### Bug Fixes
+
+- add manual release recovery path ([aeea2da](https://github.com/promptfoo/modelaudit/commit/aeea2da68099f42a2fae68a50fff9e64e5e2f86f))
+- avoid duplicate manylinux compatibility tag ([412677f](https://github.com/promptfoo/modelaudit/commit/412677f00e6a24b3471d9f14a36ef2b9405e5067))
+- persist manylinux picklescan artifacts ([346bb3f](https://github.com/promptfoo/modelaudit/commit/346bb3f048b646c69573812a08ffd23342843658))
+
+## [0.2.39](https://github.com/promptfoo/modelaudit/compare/v0.2.38...v0.2.39) (2026-04-17)
+
+### Bug Fixes
+
+- repair picklescan release wheel jobs ([#1051](https://github.com/promptfoo/modelaudit/issues/1051)) ([6c23190](https://github.com/promptfoo/modelaudit/commit/6c23190f9b23686d33d5da0a8b5522a59490084e))
+
 ## [0.2.38](https://github.com/promptfoo/modelaudit/compare/v0.2.37...v0.2.38) (2026-04-17)
 
 ### Features

{modelaudit-0.2.38 → modelaudit-0.2.40}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modelaudit
-Version: 0.2.38
+Version: 0.2.40
 Summary: Static scanning library for detecting malicious code, potential backdoor indicators, and other security risks in ML model files
 Project-URL: Repository, https://github.com/promptfoo/modelaudit
 Project-URL: Homepage, https://github.com/promptfoo/modelaudit

{modelaudit-0.2.38 → modelaudit-0.2.40}/packages/modelaudit-picklescan/CHANGELOG.md

@@ -5,7 +5,13 @@ All notable changes to `modelaudit-picklescan` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## 0.1.0 (2026-04-17)
+## [0.1.2](https://github.com/promptfoo/modelaudit/releases/tag/modelaudit-picklescan-v0.1.2) (2026-04-17)
+
+### Bug Fixes
+
+- repair picklescan release wheel jobs ([#1051](https://github.com/promptfoo/modelaudit/issues/1051)) ([6c23190](https://github.com/promptfoo/modelaudit/commit/6c23190f9b23686d33d5da0a8b5522a59490084e))
+
+## [0.1.1](https://github.com/promptfoo/modelaudit/releases/tag/modelaudit-picklescan-v0.1.1) (2026-04-17)
 
 ### Features
 

{modelaudit-0.2.38 → modelaudit-0.2.40}/packages/modelaudit-picklescan/Cargo.lock

@@ -16,7 +16,7 @@ checksum = "48f5d2a454e16a5ea0f4ced81bd44e4cfc7bd3a507b61887c99fd3538b28e4af"
 
 [[package]]
 name = "modelaudit-picklescan-rust"
-version = "0.1.0"
+version = "0.1.2"
 dependencies = [
  "pyo3",
 ]

{modelaudit-0.2.38 → modelaudit-0.2.40}/packages/modelaudit-picklescan/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "modelaudit-picklescan-rust"
-version = "0.1.0" # x-release-please-version
+version = "0.1.2" # x-release-please-version
 edition = "2021"
 rust-version = "1.83"
 description = "Native pickle security scanner engine for modelaudit-picklescan"

{modelaudit-0.2.38 → modelaudit-0.2.40}/packages/modelaudit-picklescan/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "modelaudit-picklescan"
-version = "0.1.0" # x-release-please-version
+version = "0.1.2" # x-release-please-version
 description = "Standalone pickle security scanner extracted from ModelAudit"
 authors = [
     { name = "Ian Webster", email = "ian@promptfoo.dev" },

{modelaudit-0.2.38 → modelaudit-0.2.40}/packages/modelaudit-picklescan/uv.lock

@@ -4,5 +4,5 @@ requires-python = ">=3.10"
 
 [[package]]
 name = "modelaudit-picklescan"
-version = "0.1.0"
+version = "0.1.2"
 source = { editable = "." }

{modelaudit-0.2.38 → modelaudit-0.2.40}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "modelaudit"
-version = "0.2.38"
+version = "0.2.40"
 description = "Static scanning library for detecting malicious code, potential backdoor indicators, and other security risks in ML model files"
 authors = [
     { name = "Ian Webster", email = "ian@promptfoo.dev" },

{modelaudit-0.2.38 → modelaudit-0.2.40}/uv.lock

@@ -2395,7 +2395,7 @@ wheels = [
 
 [[package]]
 name = "modelaudit"
-version = "0.2.38"
+version = "0.2.40"
 source = { editable = "." }
 dependencies = [
     { name = "click" },
@@ -2648,7 +2648,7 @@ dev = [
 
 [[package]]
 name = "modelaudit-picklescan"
-version = "0.1.0"
+version = "0.1.2"
 source = { editable = "packages/modelaudit-picklescan" }
 
 [[package]]

modelaudit-0.2.38/.release-please-manifest.json

@@ -1,4 +0,0 @@
-{
-  ".": "0.2.38",
-  "packages/modelaudit-picklescan": "0.1.0"
-}