modwire 4.0.0__tar.gz → 4.0.2__tar.gz

{modwire-4.0.0 → modwire-4.0.2}/.github/modwire-ecosystem.yml

@@ -62,7 +62,9 @@ workflows:
   release_entrypoint: .github/workflows/release.yml
   verify_reusable: .github/workflows/python-package.yml
   release_build_reusable: .github/workflows/python-release-build.yml
-  github_release_reusable: .github/workflows/python-github-release.yml
+  release_assets_reusable: .github/workflows/python-release-assets.yml
+  release_driver: github_release
+  release_event: published
   release_tag_pattern: ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$
   artifact_name: python-package-distributions
   pypi_environment: pypi

{modwire-4.0.0 → modwire-4.0.2}/.github/scripts/reconcile_ecosystem.py

@@ -40,7 +40,7 @@ def workflow_drift(contract: EcosystemContract) -> list[str]:
         contract.workflows.release_entrypoint,
         contract.workflows.verify_reusable,
         contract.workflows.release_build_reusable,
-        contract.workflows.github_release_reusable,
+        contract.workflows.release_assets_reusable,
     )
     contents: dict[str, str] = {}
     for relative_path in workflow_paths:
@@ -74,7 +74,7 @@ def workflow_drift(contract: EcosystemContract) -> list[str]:
     required_references = {
         contract.workflows.release_entrypoint: (
             contract.workflows.release_build_reusable,
-            contract.workflows.github_release_reusable,
+            contract.workflows.release_assets_reusable,
             contract.workflows.actions.download_artifact,
             contract.workflows.actions.publish_pypi,
         ),
@@ -88,7 +88,7 @@ def workflow_drift(contract: EcosystemContract) -> list[str]:
             contract.workflows.actions.setup_python,
             contract.workflows.actions.upload_artifact,
         ),
-        contract.workflows.github_release_reusable: (
+        contract.workflows.release_assets_reusable: (
             contract.workflows.actions.download_artifact,
         ),
     }
@@ -102,19 +102,24 @@ def workflow_drift(contract: EcosystemContract) -> list[str]:
         "python - <<",
         "SETUPTOOLS_SCM_PRETEND_VERSION",
         "softprops/",
-        "types: [published]",
     ):
         if forbidden in release or forbidden in release_build:
             errors.append(f"release workflows contain forbidden pattern {forbidden}")
     if contract.workflows.artifact_name not in release or contract.workflows.artifact_name not in release_build:
         errors.append("release artifact name differs from the workflow contract")
-    github_release = contents.get(contract.workflows.github_release_reusable, "")
+    release_assets = contents.get(contract.workflows.release_assets_reusable, "")
     if (
         "workflow_call:" not in verify
         or "workflow_call:" not in release_build
-        or "workflow_call:" not in github_release
+        or "workflow_call:" not in release_assets
     ):
         errors.append("reusable workflows must use workflow_call")
+    if "release:" not in release or "types: [published]" not in release:
+        errors.append("release.yml must be driven by a published GitHub Release")
+    if "skip-existing: true" not in release:
+        errors.append("release.yml must make PyPI publication idempotent")
+    if '--repo "$GITHUB_REPOSITORY"' not in release_assets:
+        errors.append("release assets must target GITHUB_REPOSITORY explicitly")
     return errors
 
 

modwire-4.0.0/.github/workflows/python-github-release.yml → modwire-4.0.2/.github/workflows/python-release-assets.yml

@@ -1,10 +1,10 @@
-name: Reusable Python GitHub release
+name: Reusable Python release assets
 
 on:
   workflow_call:
     inputs:
       release-tag:
-        description: Existing release tag used to create the GitHub Release.
+        description: Published GitHub Release tag receiving the distributions.
         required: true
         type: string
       artifact-name:
@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   publish:
-    name: Create GitHub release
+    name: Attach distributions to GitHub release
     runs-on: ubuntu-latest
     steps:
       - name: Download release distributions
@@ -27,8 +27,10 @@ jobs:
           name: ${{ inputs.artifact-name }}
           path: dist/
 
-      - name: Create GitHub release
+      - name: Upload GitHub release assets
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ inputs.release-tag }}
-        run: gh release create "$RELEASE_TAG" dist/* --verify-tag --generate-notes
+        run: >-
+          gh release upload "$RELEASE_TAG" dist/* --clobber
+          --repo "$GITHUB_REPOSITORY"

{modwire-4.0.0 → modwire-4.0.2}/.github/workflows/release.yml

@@ -1,9 +1,8 @@
 name: Release
 
 on:
-  push:
-    tags:
-      - "v*"
+  release:
+    types: [published]
 
 permissions:
   contents: read
@@ -13,11 +12,22 @@ jobs:
     name: Build release distributions
     uses: ./.github/workflows/python-release-build.yml
     with:
-      release-tag: ${{ github.ref_name }}
+      release-tag: ${{ github.event.release.tag_name }}
+
+  publish-github-assets:
+    name: Attach distributions to GitHub release
+    needs: build
+    uses: ./.github/workflows/python-release-assets.yml
+    with:
+      release-tag: ${{ github.event.release.tag_name }}
+    permissions:
+      contents: write
 
   publish-pypi:
     name: Publish distributions to PyPI
-    needs: build
+    needs:
+      - build
+      - publish-github-assets
     runs-on: ubuntu-latest
     environment:
       name: pypi
@@ -33,14 +43,5 @@ jobs:
 
       - name: Publish distributions with Trusted Publishing
         uses: pypa/gh-action-pypi-publish@release/v1
-
-  publish-github:
-    name: Publish GitHub release
-    needs:
-      - build
-      - publish-pypi
-    uses: ./.github/workflows/python-github-release.yml
-    with:
-      release-tag: ${{ github.ref_name }}
-    permissions:
-      contents: write
+        with:
+          skip-existing: true

{modwire-4.0.0 → modwire-4.0.2}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 4.0.2 - 2026-07-11
+
+### Fixed
+
+- Release asset uploads now target `GITHUB_REPOSITORY` explicitly when running
+  from a reusable workflow without a repository checkout.
+
+## 4.0.1 - 2026-07-11
+
+### Changed
+
+- GitHub Release publication now drives distribution building, asset
+  attachment, and idempotent PyPI Trusted Publishing.
+
 ## 4.0.0 - 2026-07-11
 
 ### Breaking Changes

{modwire-4.0.0/src/modwire.egg-info → modwire-4.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modwire
-Version: 4.0.0
+Version: 4.0.2
 Summary: Map architecture boundaries and analyze extracted code maps.
 Author: Tomasz Szpak
 License-Expression: MIT

{modwire-4.0.0 → modwire-4.0.2}/docs/governance/github-ecosystem.md

@@ -116,7 +116,7 @@ Every coordinator epic should state:
 ## Workflow contract
 
 The complete [Python workflow contract](python-workflows.md) defines the
-coordinator's reusable CI, release-build, and GitHub-release workflows plus the
+coordinator's reusable CI, release-build, and release-assets workflows plus the
 small repository-local entrypoints. Action versions, filenames, tag syntax,
 artifact naming, and environment naming are part of the ecosystem SSOT.
 Member repositories call a reviewed workflow-contract tag such as
@@ -132,9 +132,10 @@ The reusable workflow must always:
 
 Package release workflows remain local because publishing environments,
 package names, and PyPI Trusted Publisher identities are repository-specific.
-Only the credential-bearing PyPI job is local; build and GitHub Release logic
-come from the coordinator's reusable workflows. Releases must never require a
-pre-existing `.dev` directory.
+Only the credential-bearing PyPI job is local; build and GitHub Release asset
+logic come from the coordinator's reusable workflows. Publishing a GitHub
+Release is the event that drives PyPI publication. Releases must never require
+a pre-existing `.dev` directory.
 
 ## Ecosystem integration gate
 

{modwire-4.0.0 → modwire-4.0.2}/docs/governance/python-workflows.md

@@ -11,29 +11,31 @@ PyPI environment are declared under `workflows` in
 | --- | --- |
 | `ci.yml` | Repository-local triggers and any package-specific supplemental checks. |
 | `python-package.yml` | Reusable Python matrix tests, Ruff, build, Twine check, and optional artifact upload. |
-| `release.yml` | Repository-local stable-tag trigger and PyPI Trusted Publishing job. |
+| `release.yml` | Repository-local GitHub Release trigger and PyPI Trusted Publishing job. |
 | `python-release-build.yml` | Reusable strict tag validation, clean SCM-derived build, Twine check, version check, and artifact upload. |
-| `python-github-release.yml` | Reusable creation of the GitHub Release from the same verified artifacts. |
+| `python-release-assets.yml` | Reusable attachment of verified distributions to the published GitHub Release. |
 
 CI and release entrypoints are consistently named `ci.yml` and `release.yml`.
 Reusable implementations are consistently prefixed with `python-`. Jobs use
-the verbs `verify`, `build`, `publish-pypi`, and `publish-github`.
+the verbs `verify`, `build`, `publish-pypi`, and `publish-github-assets`.
 
 ## Release contract
 
 1. Merge only after `ci.yml` passes.
 2. Create and push a stable `vMAJOR.MINOR.PATCH` tag.
-3. `release.yml` passes that existing tag to the reusable release build.
-4. The build backend derives the version from the tag. Workflows never rewrite
+3. Publish a GitHub Release targeting that existing tag.
+4. The `release.published` event passes the Release tag to the reusable build.
+5. The build backend derives the version from the tag. Workflows never rewrite
    `pyproject.toml`, override setuptools-scm, or inspect wheels with embedded
    Python programs.
-5. The reusable build creates one wheel and one source distribution, runs
+6. The reusable build creates one wheel and one source distribution, runs
    Twine, confirms both filenames contain the tag version, and uploads one
    immutable workflow artifact named `python-package-distributions`.
-6. The repository-local `publish-pypi` job downloads that artifact and uses
-   PyPI Trusted Publishing with only `id-token: write`.
-7. After PyPI succeeds, the reusable GitHub release job creates release notes
-   and attaches the exact same distributions.
+7. The reusable release-assets job attaches those distributions to the GitHub
+   Release.
+8. The repository-local `publish-pypi` job then downloads that artifact and
+   uses PyPI Trusted Publishing with only `id-token: write`. Publication is
+   idempotent so a rerun can recover a partial release without overwriting PyPI.
 
 PyPI currently does not support Trusted Publishing from a reusable workflow.
 Therefore the small `publish-pypi` job must remain directly in each
@@ -79,8 +81,8 @@ and, when necessary, reusable workflow inputs differ.
 name: Release
 
 on:
-  push:
-    tags: ["v*"]
+  release:
+    types: [published]
 
 permissions:
   contents: read
@@ -89,10 +91,18 @@ jobs:
   build:
     uses: 9orky/modwire/.github/workflows/python-release-build.yml@workflows-v1
     with:
-      release-tag: ${{ github.ref_name }}
+      release-tag: ${{ github.event.release.tag_name }}
 
-  publish-pypi:
+  publish-github-assets:
     needs: build
+    uses: 9orky/modwire/.github/workflows/python-release-assets.yml@workflows-v1
+    with:
+      release-tag: ${{ github.event.release.tag_name }}
+    permissions:
+      contents: write
+
+  publish-pypi:
+    needs: [build, publish-github-assets]
     runs-on: ubuntu-latest
     environment:
       name: pypi
@@ -105,14 +115,8 @@ jobs:
           name: python-package-distributions
           path: dist/
       - uses: pypa/gh-action-pypi-publish@release/v1
-
-  publish-github:
-    needs: [build, publish-pypi]
-    uses: 9orky/modwire/.github/workflows/python-github-release.yml@workflows-v1
-    with:
-      release-tag: ${{ github.ref_name }}
-    permissions:
-      contents: write
+        with:
+          skip-existing: true
 ```
 
 ## Updating the standard

{modwire-4.0.0 → modwire-4.0.2}/src/modwire/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '4.0.0'
-__version_tuple__ = version_tuple = (4, 0, 0)
+__version__ = version = '4.0.2'
+__version_tuple__ = version_tuple = (4, 0, 2)
 
-__commit_id__ = commit_id = 'g554ce1251'
+__commit_id__ = commit_id = 'g614b6c4e6'

{modwire-4.0.0 → modwire-4.0.2}/src/modwire/projects/ecosystem.py

@@ -84,7 +84,9 @@ class WorkflowContract(ModwireConfigModel):
     release_entrypoint: str
     verify_reusable: str
     release_build_reusable: str
-    github_release_reusable: str
+    release_assets_reusable: str
+    release_driver: Literal["github_release"]
+    release_event: Literal["published"]
     release_tag_pattern: str
     artifact_name: str
     pypi_environment: str

{modwire-4.0.0 → modwire-4.0.2/src/modwire.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modwire
-Version: 4.0.0
+Version: 4.0.2
 Summary: Map architecture boundaries and analyze extracted code maps.
 Author: Tomasz Szpak
 License-Expression: MIT

{modwire-4.0.0 → modwire-4.0.2}/src/modwire.egg-info/SOURCES.txt

@@ -14,8 +14,8 @@ uv.lock
 .github/ISSUE_TEMPLATE/feature_request.yml
 .github/scripts/reconcile_ecosystem.py
 .github/workflows/ci.yml
-.github/workflows/python-github-release.yml
 .github/workflows/python-package.yml
+.github/workflows/python-release-assets.yml
 .github/workflows/python-release-build.yml
 .github/workflows/release.yml
 .modwire/boundaries.yaml

{modwire-4.0.0 → modwire-4.0.2}/src/modwire.egg-info/scm_file_list.json

@@ -94,7 +94,7 @@
     ".github/ISSUE_TEMPLATE/feature_request.yml",
     ".github/workflows/release.yml",
     ".github/workflows/python-release-build.yml",
-    ".github/workflows/python-github-release.yml",
+    ".github/workflows/python-release-assets.yml",
     ".github/workflows/ci.yml",
     ".github/workflows/python-package.yml"
   ]

{modwire-4.0.0 → modwire-4.0.2}/src/modwire.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "4.0.0",
+  "tag": "4.0.2",
   "distance": 0,
-  "node": "g554ce12515b9f5d9ecbfe823166d52173117328c",
+  "node": "g614b6c4e6c8ae43531abb75c1caa996f7dacc3d6",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-07-11"

{modwire-4.0.0 → modwire-4.0.2}/tests/test_ecosystem_contract.py

@@ -66,3 +66,4 @@ def test_workflow_contract_uses_one_action_set() -> None:
     assert "python - <<" not in contents
     assert "SETUPTOOLS_SCM_PRETEND_VERSION" not in contents
     assert "softprops/" not in contents
+    assert '--repo "$GITHUB_REPOSITORY"' in contents