modelaudit 0.2.49__tar.gz → 0.2.51__tar.gz

{modelaudit-0.2.49 → modelaudit-0.2.51}/.github/workflows/release-please.yml

@@ -9,6 +9,9 @@ on:
   push:
     branches:
       - main
+  repository_dispatch:
+    types:
+      - release-metadata-retry
   workflow_dispatch:
     inputs:
       root_version:
@@ -34,6 +37,7 @@ jobs:
       picklescan_tag_name: ${{ steps.manual.outputs.manual_release == 'true' && steps.manual.outputs.picklescan_tag_name || steps.release.outputs['packages/modelaudit-picklescan--tag_name'] }}
       picklescan_version: ${{ steps.manual.outputs.manual_release == 'true' && steps.manual.outputs.picklescan_version || steps.release.outputs['packages/modelaudit-picklescan--version'] }}
       pr_number: ${{ steps.release.outputs.pr && fromJSON(steps.release.outputs.pr).number || '' }}
+      pr_branch: ${{ steps.check-pr.outputs.pr_branch || '' }}
     steps:
       - name: Resolve manual release inputs
         id: manual
@@ -66,7 +70,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
-        if: steps.manual.outputs.manual_release != 'true'
+        if: steps.manual.outputs.manual_release != 'true' && github.event_name != 'repository_dispatch'
         id: release
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -96,96 +100,162 @@ jobs:
               --notes "Manual recovery release for modelaudit-picklescan $PICKLESCAN_VERSION."
           fi
 
-      # Format changelogs immediately after release-please creates/updates a PR
-      # This runs for BOTH new PRs (prs_created) and existing PRs (pr output exists)
       - name: Check if PR exists
         id: check-pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_OUTPUT: ${{ steps.release.outputs.pr || '' }}
+          RETRY_EVENT: ${{ github.event.action || '' }}
+          RETRY_BRANCH: ${{ github.event.client_payload.pr_branch || '' }}
         run: |
-          PR_OUTPUT='${{ steps.release.outputs.pr }}'
-          if [ -n "$PR_OUTPUT" ] && [ "$PR_OUTPUT" != "null" ]; then
+          if [[ -n "$PR_OUTPUT" && "$PR_OUTPUT" != "null" ]]; then
+            echo "has_pr=true" >> "$GITHUB_OUTPUT"
+            echo "pr_branch=$(jq -r '.headBranchName' <<< "$PR_OUTPUT")" >> "$GITHUB_OUTPUT"
+          elif [[ "$RETRY_EVENT" == "release-metadata-retry" && "$RETRY_BRANCH" == "release-please--branches--main" ]]; then
+            OPEN_BRANCH=$(gh pr view "$RETRY_BRANCH" --repo "$GITHUB_REPOSITORY" --json state,headRefName --jq 'if .state == "OPEN" then .headRefName else "" end')
+            if [[ "$OPEN_BRANCH" != "$RETRY_BRANCH" ]]; then
+              echo "Requested release metadata retry has no matching open release PR."
+              exit 1
+            fi
             echo "has_pr=true" >> "$GITHUB_OUTPUT"
-            echo "pr_branch=$(echo '${{ steps.release.outputs.pr }}' | jq -r '.headBranchName')" >> "$GITHUB_OUTPUT"
+            echo "pr_branch=$OPEN_BRANCH" >> "$GITHUB_OUTPUT"
+          elif [[ "$RETRY_EVENT" == "release-metadata-retry" ]]; then
+            echo "Refusing release metadata retry for an unexpected branch."
+            exit 1
           else
             echo "has_pr=false" >> "$GITHUB_OUTPUT"
           fi
 
+  sync-release-metadata:
+    if: needs.release-please.outputs.pr_branch != ''
+    runs-on: ubuntu-latest
+    needs: release-please
+    permissions:
+      contents: read
+    outputs:
+      source_sha: ${{ steps.source.outputs.sha }}
+    steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        if: steps.check-pr.outputs.has_pr == 'true'
         with:
-          ref: ${{ steps.check-pr.outputs.pr_branch }}
-          # Shallow clone for speed - we only need to format and push
+          ref: ${{ needs.release-please.outputs.pr_branch }}
           fetch-depth: 1
+          persist-credentials: false
+
+      - name: Record release metadata source
+        id: source
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
       - name: Install uv
-        if: steps.check-pr.outputs.has_pr == 'true'
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
 
       - name: Install Rust toolchain for standalone lock refresh
-        if: steps.check-pr.outputs.has_pr == 'true'
         run: |
           rustup toolchain install stable --profile minimal
           rustup default stable
 
       - name: Sync uv.lock with pyproject.toml
-        if: steps.check-pr.outputs.has_pr == 'true'
-        run: |
-          uv lock
-          if git diff --quiet uv.lock; then
-            echo "✓ uv.lock already in sync"
-          else
-            echo "→ uv.lock updated to match pyproject.toml version bump"
-            git config user.name "github-actions[bot]"
-            git config user.email "github-actions[bot]@users.noreply.github.com"
-            git add uv.lock
-            git commit -m "chore: sync uv.lock with pyproject.toml version bump"
-            git push
-            echo "✓ uv.lock committed and pushed"
-          fi
+        run: uv lock
 
       - name: Sync standalone package lock with pyproject.toml
-        if: steps.check-pr.outputs.has_pr == 'true'
         working-directory: packages/modelaudit-picklescan
         run: |
           uv lock
-          if git diff --quiet uv.lock; then
-            echo "✓ packages/modelaudit-picklescan/uv.lock already in sync"
-          else
-            echo "→ packages/modelaudit-picklescan/uv.lock updated to match pyproject.toml"
-            git config user.name "github-actions[bot]"
-            git config user.email "github-actions[bot]@users.noreply.github.com"
-            git add uv.lock
-            git commit -m "chore: sync standalone package lock"
-            git push
-            echo "✓ packages/modelaudit-picklescan/uv.lock committed and pushed"
-          fi
+          cargo update --workspace --manifest-path Cargo.toml
+          cargo metadata --manifest-path Cargo.toml --locked --no-deps --format-version 1 >/dev/null
 
       - name: Setup Node.js
-        if: steps.check-pr.outputs.has_pr == 'true'
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: "24"
 
       - name: Install Node dependencies
-        if: steps.check-pr.outputs.has_pr == 'true'
         run: npm ci --ignore-scripts
 
       - name: Format changelogs with Prettier
-        if: steps.check-pr.outputs.has_pr == 'true'
         run: |
-          echo "Formatting changelogs on branch: ${{ steps.check-pr.outputs.pr_branch }}"
+          echo "Formatting changelogs on branch: ${{ needs.release-please.outputs.pr_branch }}"
           npx prettier --write CHANGELOG.md packages/modelaudit-picklescan/CHANGELOG.md
 
-          if git diff --quiet CHANGELOG.md packages/modelaudit-picklescan/CHANGELOG.md; then
-            echo "✓ No formatting changes needed"
-          else
-            echo "→ Formatting changes detected, committing..."
-            git config user.name "github-actions[bot]"
-            git config user.email "github-actions[bot]@users.noreply.github.com"
-            git add CHANGELOG.md packages/modelaudit-picklescan/CHANGELOG.md
-            git commit -m "chore: format changelogs with prettier"
-            git push
-            echo "✓ Formatting committed and pushed"
+      - name: Upload release metadata
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: modelaudit-release-metadata-${{ github.run_attempt }}
+          if-no-files-found: error
+          path: |
+            uv.lock
+            CHANGELOG.md
+            packages/modelaudit-picklescan/uv.lock
+            packages/modelaudit-picklescan/Cargo.lock
+            packages/modelaudit-picklescan/CHANGELOG.md
+
+  push-release-metadata:
+    if: needs.release-please.outputs.pr_branch != ''
+    runs-on: ubuntu-latest
+    needs: [release-please, sync-release-metadata]
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: ${{ needs.release-please.outputs.pr_branch }}
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Download release metadata
+        id: download-metadata
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: modelaudit-release-metadata-${{ github.run_attempt }}
+          path: /tmp/modelaudit-release-metadata
+
+      - name: Regenerate missing release metadata
+        if: steps.download-metadata.outcome != 'success'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_BRANCH: ${{ needs.release-please.outputs.pr_branch }}
+          RETRY_EVENT: ${{ github.event.action || '' }}
+        run: |
+          if [[ "$RETRY_EVENT" == "release-metadata-retry" ]]; then
+            echo "Release metadata is still unavailable after a fresh generation run; refusing to dispatch another retry."
+            exit 1
+          fi
+          if [[ "$PR_BRANCH" != "release-please--branches--main" ]]; then
+            echo "Refusing release metadata retry for an unexpected branch."
+            exit 1
           fi
+          echo "Release metadata is unavailable for this retry; starting a fresh read-only generation run."
+          gh api "repos/${GITHUB_REPOSITORY}/dispatches" -f event_type=release-metadata-retry -f "client_payload[pr_branch]=$PR_BRANCH"
+          echo "Follow the new release-please run, or select Re-run all jobs to regenerate metadata."
+          exit 1
+
+      - name: Push release metadata updates
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_BRANCH: ${{ needs.release-please.outputs.pr_branch }}
+          EXPECTED_HEAD: ${{ needs.sync-release-metadata.outputs.source_sha }}
+        run: |
+          if [[ "$(git rev-parse HEAD)" != "$EXPECTED_HEAD" ]]; then
+            echo "Release branch changed while metadata was generated; refusing to overwrite newer changes."
+            exit 1
+          fi
+
+          cp /tmp/modelaudit-release-metadata/uv.lock uv.lock
+          cp /tmp/modelaudit-release-metadata/CHANGELOG.md CHANGELOG.md
+          cp /tmp/modelaudit-release-metadata/packages/modelaudit-picklescan/uv.lock packages/modelaudit-picklescan/uv.lock
+          cp /tmp/modelaudit-release-metadata/packages/modelaudit-picklescan/Cargo.lock packages/modelaudit-picklescan/Cargo.lock
+          cp /tmp/modelaudit-release-metadata/packages/modelaudit-picklescan/CHANGELOG.md packages/modelaudit-picklescan/CHANGELOG.md
+
+          if git diff --quiet uv.lock CHANGELOG.md packages/modelaudit-picklescan/uv.lock packages/modelaudit-picklescan/Cargo.lock packages/modelaudit-picklescan/CHANGELOG.md; then
+            echo "✓ Release metadata already in sync"
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add uv.lock CHANGELOG.md packages/modelaudit-picklescan/uv.lock packages/modelaudit-picklescan/Cargo.lock packages/modelaudit-picklescan/CHANGELOG.md
+          git commit -m "chore: sync release metadata"
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${PR_BRANCH}"
 
   build:
     if: needs.release-please.outputs.release_created == 'true'
@@ -208,8 +278,18 @@ jobs:
           rustup toolchain install stable --profile minimal
           rustup default stable
 
-      - name: Sync dependencies
-        run: uv sync --extra all-ci
+      - name: Type check root package with mypy
+        run: |
+          # Match tool.mypy.python_version so version-gated dependency stubs use valid syntax.
+          uv sync --python 3.10 --locked --extra all-ci
+          uv run --python 3.10 --locked mypy modelaudit/ tests/
+          uv cache prune --ci
+
+      - name: Sync dependencies for root runtime checks
+        run: |
+          # Keep the release security tests and artifact smoke tests on modern Python.
+          uv python pin 3.12
+          uv sync --locked --extra all-ci
 
       - name: Lint root package with Ruff
         run: uv run ruff check modelaudit/ tests/
@@ -217,9 +297,6 @@ jobs:
       - name: Check root package formatting with Ruff
         run: uv run ruff format --check modelaudit/ tests/
 
-      - name: Type check root package with mypy
-        run: uv run mypy modelaudit/ tests/
-
       - name: Run root package tests
         run: |
           uv run pytest tests -n auto -m "not slow and not integration and not performance" --tb=short
@@ -523,7 +600,7 @@ jobs:
           rustup default stable
 
       - name: Cache Cargo dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
             ~/.cargo/registry
@@ -713,6 +790,106 @@ jobs:
           name: dist
           path: dist/
 
+      - name: Verify the root picklescan dependency is available on PyPI
+        run: |
+          python - <<'PY'
+          import json
+          import re
+          import time
+          import urllib.request
+          import zipfile
+          from email.parser import Parser
+          from pathlib import Path
+
+          wheels = list(Path("dist").glob("modelaudit-*.whl"))
+          if len(wheels) != 1:
+              raise SystemExit(f"Expected one modelaudit wheel, found: {wheels}")
+
+          with zipfile.ZipFile(wheels[0]) as archive:
+              metadata_files = [name for name in archive.namelist() if name.endswith(".dist-info/METADATA")]
+              if len(metadata_files) != 1:
+                  raise SystemExit(f"Expected one wheel METADATA file, found: {metadata_files}")
+              metadata = Parser().parsestr(archive.read(metadata_files[0]).decode())
+
+          requirements = metadata.get_all("Requires-Dist") or []
+          picklescan_requirements = [
+              requirement.split(";", 1)[0].strip()
+              for requirement in requirements
+              if re.match(r"^modelaudit[-_]picklescan\b", requirement, re.IGNORECASE)
+          ]
+          if len(picklescan_requirements) != 1:
+              raise SystemExit(f"Expected one modelaudit-picklescan requirement, found: {picklescan_requirements}")
+
+          requirement = picklescan_requirements[0]
+          constraint = re.sub(r"^modelaudit[-_]picklescan", "", requirement, count=1, flags=re.IGNORECASE)
+          constraint = constraint.strip().removeprefix("(").removesuffix(")").replace(" ", "")
+          if not re.fullmatch(r"(?:==|!=|>=|<=|>|<)[0-9]+(?:\.[0-9]+){1,2}(?:,(?:==|!=|>=|<=|>|<)[0-9]+(?:\.[0-9]+){1,2})*", constraint):
+              raise SystemExit(f"Unsupported modelaudit-picklescan requirement: {requirement}")
+          specifiers = re.findall(r"(==|!=|>=|<=|>|<)([0-9]+(?:\.[0-9]+){1,2})", constraint)
+
+          def version_parts(value):
+              parts = tuple(int(part) for part in value.split("."))
+              return parts + (0,) * (3 - len(parts))
+
+          def published_version_parts(value):
+              match = re.fullmatch(r"([0-9]+(?:\.[0-9]+){1,2})(?:\.post([0-9]+))?", value)
+              if match is None:
+                  return None
+              post = int(match[2]) if match[2] is not None else -1
+              return version_parts(match[1]) + (post,)
+
+          def matches(version):
+              comparisons = {
+                  "==": lambda left, right: left == right,
+                  "!=": lambda left, right: left != right,
+                  ">=": lambda left, right: left >= right,
+                  "<=": lambda left, right: left <= right,
+                  ">": lambda left, right: left > right,
+                  "<": lambda left, right: left < right,
+              }
+              for operator, value in specifiers:
+                  target = version_parts(value) + (-1,)
+                  if operator == ">" and version[:3] == target[:3]:
+                      return False
+                  if not comparisons[operator](version, target):
+                      return False
+              return True
+
+          url = "https://pypi.org/pypi/modelaudit-picklescan/json"
+          deadline = time.monotonic() + 600
+          last_status = "not checked"
+
+          while time.monotonic() < deadline:
+              try:
+                  with urllib.request.urlopen(url, timeout=20) as response:
+                      releases = json.load(response).get("releases", {})
+                  compatible = []
+                  for version, files in releases.items():
+                      published_version = published_version_parts(version)
+                      if published_version is None or not matches(published_version):
+                          continue
+                      filenames = {entry["filename"] for entry in files if not entry.get("yanked", False)}
+                      expected_files = {
+                          f"modelaudit_picklescan-{version}-cp310-abi3-macosx_10_12_x86_64.whl",
+                          f"modelaudit_picklescan-{version}-cp310-abi3-macosx_11_0_arm64.whl",
+                          f"modelaudit_picklescan-{version}-cp310-abi3-manylinux_2_28_aarch64.whl",
+                          f"modelaudit_picklescan-{version}-cp310-abi3-manylinux_2_28_x86_64.whl",
+                          f"modelaudit_picklescan-{version}-cp310-abi3-win_amd64.whl",
+                          f"modelaudit_picklescan-{version}.tar.gz",
+                      }
+                      if expected_files <= filenames:
+                          compatible.append(version)
+                  if compatible:
+                      print(f"PyPI has compatible modelaudit-picklescan releases for {requirement}: {compatible}")
+                      break
+                  last_status = f"no complete, non-yanked release satisfies {requirement}"
+              except Exception as exc:
+                  last_status = repr(exc)
+              time.sleep(10)
+          else:
+              raise SystemExit(f"Refusing to publish modelaudit with an unavailable picklescan dependency: {last_status}")
+          PY
+
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
         with:
@@ -755,10 +932,12 @@ jobs:
       - name: Wait for modelaudit-picklescan files on PyPI
         run: |
           python - <<'PY'
+          import gzip
           import json
           import os
           import time
           import urllib.request
+          import zlib
 
           version = os.environ["EXPECTED_VERSION"]
           expected_files = {
@@ -770,6 +949,7 @@ jobs:
               f"modelaudit_picklescan-{version}.tar.gz",
           }
           url = f"https://pypi.org/pypi/modelaudit-picklescan/{version}/json"
+          simple_url = "https://pypi.org/simple/modelaudit-picklescan/"
           deadline = time.monotonic() + 600
           last_status = "not checked"
 
@@ -777,13 +957,35 @@ jobs:
               try:
                   with urllib.request.urlopen(url, timeout=20) as response:
                       payload = json.load(response)
+                  request = urllib.request.Request(
+                      simple_url,
+                      headers={
+                          "Accept": "application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01",
+                          "Accept-Encoding": "gzip, deflate",
+                          "Cache-Control": "max-age=0",
+                      },
+                  )
+                  with urllib.request.urlopen(request, timeout=20) as response:
+                      simple_body = response.read()
+                      content_encoding = response.headers.get("Content-Encoding", "identity").lower()
+                  if content_encoding == "gzip":
+                      simple_body = gzip.decompress(simple_body)
+                  elif content_encoding == "deflate":
+                      simple_body = zlib.decompress(simple_body)
+                  elif content_encoding not in ("", "identity"):
+                      raise ValueError(f"Unsupported Simple API Content-Encoding: {content_encoding!r}")
+                  simple_payload = json.loads(simple_body)
                   filenames = {entry["filename"] for entry in payload.get("urls", [])}
+                  simple_filenames = {
+                      entry["filename"] for entry in simple_payload.get("files", []) if not entry.get("yanked", False)
+                  }
                   missing = sorted(expected_files - filenames)
+                  missing_simple = sorted(expected_files - simple_filenames)
                   info_version = payload.get("info", {}).get("version")
-                  if info_version == version and not missing:
+                  if info_version == version and not missing and not missing_simple:
                       print(f"PyPI has modelaudit-picklescan {version}: {sorted(filenames)}")
                       break
-                  last_status = f"version={info_version!r}, missing={missing}"
+                  last_status = f"version={info_version!r}, missing={missing}, missing_simple={missing_simple}"
               except Exception as exc:
                   last_status = repr(exc)
               time.sleep(10)
@@ -867,10 +1069,12 @@ jobs:
       - name: Wait for modelaudit files on PyPI
         run: |
           python - <<'PY'
+          import gzip
           import json
           import os
           import time
           import urllib.request
+          import zlib
 
           version = os.environ["EXPECTED_VERSION"]
           expected_files = {
@@ -878,6 +1082,7 @@ jobs:
               f"modelaudit-{version}.tar.gz",
           }
           url = f"https://pypi.org/pypi/modelaudit/{version}/json"
+          simple_url = "https://pypi.org/simple/modelaudit/"
           deadline = time.monotonic() + 600
           last_status = "not checked"
 
@@ -885,13 +1090,35 @@ jobs:
               try:
                   with urllib.request.urlopen(url, timeout=20) as response:
                       payload = json.load(response)
+                  request = urllib.request.Request(
+                      simple_url,
+                      headers={
+                          "Accept": "application/vnd.pypi.simple.v1+json, application/vnd.pypi.simple.v1+html; q=0.1, text/html; q=0.01",
+                          "Accept-Encoding": "gzip, deflate",
+                          "Cache-Control": "max-age=0",
+                      },
+                  )
+                  with urllib.request.urlopen(request, timeout=20) as response:
+                      simple_body = response.read()
+                      content_encoding = response.headers.get("Content-Encoding", "identity").lower()
+                  if content_encoding == "gzip":
+                      simple_body = gzip.decompress(simple_body)
+                  elif content_encoding == "deflate":
+                      simple_body = zlib.decompress(simple_body)
+                  elif content_encoding not in ("", "identity"):
+                      raise ValueError(f"Unsupported Simple API Content-Encoding: {content_encoding!r}")
+                  simple_payload = json.loads(simple_body)
                   filenames = {entry["filename"] for entry in payload.get("urls", [])}
+                  simple_filenames = {
+                      entry["filename"] for entry in simple_payload.get("files", []) if not entry.get("yanked", False)
+                  }
                   missing = sorted(expected_files - filenames)
+                  missing_simple = sorted(expected_files - simple_filenames)
                   info_version = payload.get("info", {}).get("version")
-                  if info_version == version and not missing:
+                  if info_version == version and not missing and not missing_simple:
                       print(f"PyPI has modelaudit {version}: {sorted(filenames)}")
                       break
-                  last_status = f"version={info_version!r}, missing={missing}"
+                  last_status = f"version={info_version!r}, missing={missing}, missing_simple={missing_simple}"
               except Exception as exc:
                   last_status = repr(exc)
               time.sleep(10)
@@ -1063,7 +1290,7 @@ jobs:
           path: dist/
 
       - name: Generate artifact attestations
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4
         with:
           subject-path: "dist/*"
 
@@ -1117,7 +1344,7 @@ jobs:
           merge-multiple: true
 
       - name: Generate artifact attestations
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4
         with:
           subject-path: "dist/*"
 

{modelaudit-0.2.49 → modelaudit-0.2.51}/.github/workflows/test.yml

@@ -94,7 +94,7 @@ jobs:
           rustup default stable
 
       - name: Cache Python dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
             .venv
@@ -354,7 +354,9 @@ jobs:
 
       - name: Pin Python version
         run: |
-          uv python pin 3.12
+          # Match tool.mypy.python_version so version-gated dependency stubs use
+          # syntax valid for the minimum supported Python target.
+          uv python pin 3.10
 
       - name: Install Rust toolchain
         run: |
@@ -362,15 +364,15 @@ jobs:
           rustup default stable
 
       - name: Cache Python dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
             .venv
             ~/.cache/pip
             ~/.cache/uv
-          key: ${{ runner.os }}-uv-py3.12-${{ hashFiles('**/uv.lock', '**/pyproject.toml') }}
+          key: ${{ runner.os }}-uv-py3.10-${{ hashFiles('**/uv.lock', '**/pyproject.toml') }}
           restore-keys: |
-            ${{ runner.os }}-uv-py3.12-
+            ${{ runner.os }}-uv-py3.10-
             ${{ runner.os }}-uv-
 
       - name: Sync dependencies
@@ -458,7 +460,7 @@ jobs:
           rustup default stable
 
       - name: Cache Python dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
             .venv
@@ -516,7 +518,7 @@ jobs:
           rustup default stable
 
       - name: Cache Python dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
             .venv
@@ -571,7 +573,7 @@ jobs:
           rustup default stable
 
       - name: Cache Python dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
             .venv
@@ -615,9 +617,10 @@ jobs:
       matrix:
         # Test both NumPy versions with appropriate Python versions:
         # - NumPy 1.x on Python 3.10 (last version supporting NumPy 1.x)
-        # - NumPy 2.x on Python 3.11+ (requires Python >=3.11)
+        # - NumPy 2.4.x on Python 3.11 (NumPy 2.5 requires Python >=3.12)
+        # - NumPy 2.5.x on Python 3.12+
         # Reduced matrix for PRs, full matrix for main and merge_group runs
-        include: ${{ github.event_name == 'pull_request' && fromJSON('[{"python-version":"3.10","numpy-mode":"1.x"},{"python-version":"3.11","numpy-mode":"2.x"}]') || fromJSON('[{"python-version":"3.10","numpy-mode":"1.x"},{"python-version":"3.11","numpy-mode":"2.x"},{"python-version":"3.12","numpy-mode":"2.x"},{"python-version":"3.13","numpy-mode":"2.x"}]') }}
+        include: ${{ github.event_name == 'pull_request' && fromJSON('[{"python-version":"3.10","numpy-mode":"1.x"},{"python-version":"3.11","numpy-mode":"2.x"},{"python-version":"3.12","numpy-mode":"2.x"}]') || fromJSON('[{"python-version":"3.10","numpy-mode":"1.x"},{"python-version":"3.11","numpy-mode":"2.x"},{"python-version":"3.12","numpy-mode":"2.x"},{"python-version":"3.13","numpy-mode":"2.x"}]') }}
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -637,7 +640,7 @@ jobs:
           rustup default stable
 
       - name: Cache Python dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
             .venv
@@ -652,13 +655,28 @@ jobs:
       - name: Install dependencies
         run: |
           # Dependencies are automatically version-matched based on Python version
-          # Python 3.10: NumPy 1.x + TensorFlow 2.13+
-          # Python 3.11+: NumPy 2.x + TensorFlow 2.17+
+          # Python 3.10: NumPy 1.x
+          # Python 3.11: NumPy 2.4.x
+          # Python 3.12+: NumPy 2.5.x
           uv sync --extra all-ci
 
       - name: Check NumPy version
         run: |
-          uv run python -c "import numpy; print(f'NumPy version: {numpy.__version__}')"
+          uv run python - <<'PY'
+          import sys
+
+          import numpy
+
+          version = tuple(int(part) for part in numpy.__version__.split(".")[:2])
+          expected = {
+              (3, 10): (1, 0) <= version < (2, 0),
+              (3, 11): (2, 4) <= version < (2, 5),
+              (3, 12): (2, 5) <= version < (2, 6),
+              (3, 13): (2, 5) <= version < (2, 6),
+          }[sys.version_info[:2]]
+          assert expected, f"unexpected NumPy {numpy.__version__} on Python {sys.version_info[:2]}"
+          print(f"NumPy version: {numpy.__version__}")
+          PY
 
       - name: Test scanner diagnostics
         run: |
@@ -868,7 +886,7 @@ jobs:
           rustup default stable
 
       - name: Cache Python dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
             .venv
@@ -960,7 +978,7 @@ jobs:
           rustup default stable
 
       - name: Cache Cargo dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
             ~/.cargo/registry
@@ -1013,7 +1031,7 @@ jobs:
 
       - name: Run standalone package tests
         run: |
-          uv run --with pytest --with pytest-xdist pytest -n auto tests --tb=short
+          uv run --with pytest --with pytest-xdist --with 'typing-extensions>=4.14' pytest -n auto tests --tb=short
 
       - name: Build standalone package
         run: |

modelaudit-0.2.51/.release-please-manifest.json

@@ -0,0 +1,4 @@
+{
+  ".": "0.2.51",
+  "packages/modelaudit-picklescan": "0.1.9"
+}