plugin-scanner 3.0.81__tar.gz → 3.0.86__tar.gz

plugin_scanner-3.0.86/.github/workflows/publish.yml

@@ -0,0 +1,1718 @@
+name: Publish to PyPI
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_channel:
+        description: "Release channel"
+        required: true
+        default: alpha
+        type: choice
+        options:
+          - alpha
+      release_train:
+        description: "Authorized release train"
+        required: true
+        type: choice
+        options:
+          - "3.0"
+      release_version:
+        description: "Exact canonical release version"
+        required: true
+        type: string
+      expected_sha:
+        description: "Exact source commit authorized for publication"
+        required: true
+        type: string
+  push:
+    branches: [main, release/3.0]
+  pull_request:
+    branches: [main, release/3.0, release/3.2]
+    types: [opened, synchronize, reopened, labeled]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  # Serialize publish-capable branch events while keeping pull-request
+  # validation isolated by its merge ref.
+  group: hol-guard-publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  authorize-release:
+    name: Authorize release dispatch
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Enforce alpha release authority
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GITHUB_ACTOR_ID: ${{ github.actor_id }}
+          GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
+          GITHUB_REF: ${{ github.ref }}
+          GITHUB_SHA: ${{ github.sha }}
+          RELEASE_CHANNEL: ${{ github.event.inputs.release_channel }}
+          RELEASE_TRAIN: ${{ github.event.inputs.release_train }}
+          EXPECTED_SHA: ${{ github.event.inputs.expected_sha }}
+        run: |
+          if [[ "$GITHUB_RUN_ATTEMPT" != "1" ]]; then
+            echo "Release workflow reruns are denied; create a fresh authorized dispatch" >&2
+            exit 1
+          fi
+          if [[ "$GITHUB_ACTOR_ID" != "6068672" && "$GITHUB_ACTOR_ID" != "301892678" ]]; then
+            echo "Release dispatch actor is not an authorized maintainer" >&2
+            exit 1
+          fi
+          if [[ "$RELEASE_CHANNEL" != "alpha" || "$RELEASE_TRAIN" != "3.0" ]]; then
+            echo "Only the release/3.0 alpha train is authorized" >&2
+            exit 1
+          fi
+          if [[ "$GITHUB_REF" != "refs/heads/release/3.0" ]]; then
+            echo "Alpha releases must run from refs/heads/release/3.0" >&2
+            exit 1
+          fi
+          if [[ "$EXPECTED_SHA" != "$GITHUB_SHA" ]]; then
+            echo "Expected source SHA does not match the dispatch source" >&2
+            exit 1
+          fi
+
+  build:
+    name: Build + Verify
+    if: >-
+      (github.event_name != 'workflow_dispatch' || github.run_attempt == 1) &&
+      (github.event_name != 'push' || github.run_attempt == 1) &&
+      (github.event_name != 'push' || !contains(github.event.head_commit.message || '', '[skip release publish]')) &&
+      (github.event.action != 'labeled' || github.event.label.name == 'publish-testpypi-canary')
+    needs: authorize-release
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      channel: ${{ steps.version.outputs.channel }}
+      release_train: ${{ steps.version.outputs.release_train }}
+      source_sha: ${{ steps.version.outputs.source_sha }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          fetch-depth: 0
+          ref: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.sha) || github.sha }}
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - name: Verify release uv before dependency install
+        env:
+          EXPECTED_UV_VERSION: "0.9.26"
+          SETUP_UV_ACTION_REF: fac544c07dec837d0ccb6301d7b5580bf5edae39
+        run: |
+          python3 scripts/write_release_toolchain_sbom.py \
+            --output "$RUNNER_TEMP/hol-guard-release-toolchain-preflight.cdx.json" \
+            --release-version preflight \
+            --expected-uv-version "$EXPECTED_UV_VERSION" \
+            --setup-action-ref "$SETUP_UV_ACTION_REF"
+      - name: Install dependencies
+        run: uv sync --frozen --extra dev --extra publish --extra cisco
+      - name: Compute publish version
+        id: version
+        env:
+          GITHUB_REF: ${{ github.ref }}
+          GITHUB_SHA: ${{ github.sha }}
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          GITHUB_EVENT_ACTION: ${{ github.event.action }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          GITHUB_RUN_NUMBER: ${{ github.run_number }}
+          GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
+          GITHUB_ACTOR_ID: ${{ github.actor_id }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_CHANNEL: ${{ github.event.inputs.release_channel }}
+          RELEASE_TRAIN: ${{ github.event.inputs.release_train }}
+          RELEASE_VERSION: ${{ github.event.inputs.release_version }}
+          EXPECTED_SHA: ${{ github.event.inputs.expected_sha }}
+          RELEASE_PUBLISHING_ENABLED: ${{ vars.RELEASE_PUBLISHING_ENABLED }}
+        run: |
+          BASE_VERSION=$(uv run --no-sync python scripts/sync_repo_version.py --check)
+          VERSION="$BASE_VERSION"
+          CHANNEL="integration"
+          TRAIN=""
+          SOURCE_SHA=$(git rev-parse 'HEAD^{commit}')
+
+          if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
+            if [[ "$RELEASE_PUBLISHING_ENABLED" != "true" ]]; then
+              echo "Release publishing is disabled until protected environments are verified" >&2
+              exit 1
+            fi
+            if [[ "$GITHUB_RUN_ATTEMPT" != "1" ]]; then
+              echo "Release workflow reruns are denied; create a fresh authorized dispatch" >&2
+              exit 1
+            fi
+            if [[ "$GITHUB_ACTOR_ID" != "6068672" && "$GITHUB_ACTOR_ID" != "301892678" ]]; then
+              echo "Release dispatch actor is not an authorized maintainer" >&2
+              exit 1
+            fi
+            CHANNEL="$RELEASE_CHANNEL"
+            TRAIN="$RELEASE_TRAIN"
+            if [[ "$TRAIN" != "3.0" ]]; then
+              echo "Unsupported release train: ${TRAIN}" >&2
+              exit 1
+            fi
+            TRAIN_REF="refs/heads/release/${TRAIN}"
+
+            if [[ "$CHANNEL" != "alpha" ]]; then
+              echo "The release/3.0 train is alpha-only" >&2
+              exit 1
+            fi
+            if [[ "$GITHUB_REF" != "$TRAIN_REF" ]]; then
+              echo "Alpha releases must run from ${TRAIN_REF}" >&2
+              exit 1
+            fi
+
+            EXISTING_VERSION_FILE=$(mktemp)
+            uv run --no-sync python scripts/verify_release_registry.py \
+              list-versions --registry pypi | jq -r '.[]' > "$EXISTING_VERSION_FILE"
+            uv run --no-sync python scripts/verify_release_registry.py \
+              list-versions --registry testpypi | jq -r '.[]' >> "$EXISTING_VERSION_FILE"
+            git tag --list 'alpha/v*' | sed 's#^alpha/v##' >> "$EXISTING_VERSION_FILE"
+            mapfile -t EXISTING_VERSIONS < <(
+              awk -v candidate="$RELEASE_VERSION" '$0 != candidate' "$EXISTING_VERSION_FILE"
+            )
+            VALIDATOR_ARGS=(
+              --channel "$CHANNEL"
+              --version "$RELEASE_VERSION"
+              --git-ref "$TRAIN_REF"
+              --actual-ref "$GITHUB_REF"
+              --github-sha "$SOURCE_SHA"
+              --expected-sha "$EXPECTED_SHA"
+            )
+            for existing_version in "${EXISTING_VERSIONS[@]}"; do
+              VALIDATOR_ARGS+=(--existing-version "$existing_version")
+            done
+            VERSION=$(uv run --no-sync python scripts/validate_alpha_release.py "${VALIDATOR_ARGS[@]}")
+          elif [[ "$GITHUB_EVENT_NAME" == "push" && "$GITHUB_REF" == "refs/heads/release/3.0" ]]; then
+            if [[ "$RELEASE_PUBLISHING_ENABLED" != "true" ]]; then
+              echo "Release publishing is disabled until protected environments are verified" >&2
+              exit 1
+            fi
+            TRAIN="3.0"
+            TRAIN_REF="refs/heads/release/${TRAIN}"
+            ACTUAL_REF="$GITHUB_REF"
+            EXPECTED_SOURCE="$GITHUB_SHA"
+            if [[ "$SOURCE_SHA" != "$EXPECTED_SOURCE" ]]; then
+              echo "Checked-out source does not match the immutable release source" >&2
+              exit 1
+            fi
+            CHANNEL="alpha"
+            PYPI_VERSIONS=$(uv run --no-sync python scripts/verify_release_registry.py \
+              list-versions --registry pypi)
+            TESTPYPI_VERSIONS=$(uv run --no-sync python scripts/verify_release_registry.py \
+              list-versions --registry testpypi)
+            TAG_VERSIONS=$(git tag --list 'alpha/v*' | sed 's#^alpha/v##' | jq -R -s 'split("\n") | map(select(length > 0))')
+            EXISTING_VERSIONS=$(jq -n \
+              --argjson pypi "$PYPI_VERSIONS" \
+              --argjson testpypi "$TESTPYPI_VERSIONS" \
+              --argjson tags "$TAG_VERSIONS" \
+              '$pypi + $testpypi + $tags | unique')
+            mapfile -t SOURCE_ALPHA_TAGS < <(
+              git tag --points-at "$SOURCE_SHA" --list "alpha/v${TRAIN}.1a*" | sed 's#^alpha/v##'
+            )
+            if [[ "${#SOURCE_ALPHA_TAGS[@]}" -gt 1 ]]; then
+              echo "Source commit has multiple reserved alpha versions" >&2
+              exit 1
+            fi
+            if [[ "${#SOURCE_ALPHA_TAGS[@]}" -eq 1 ]]; then
+              RELEASE_VERSION="${SOURCE_ALPHA_TAGS[0]}"
+              REUSING_RESERVED_ALPHA=true
+              uv run --no-sync python scripts/compute_alpha_release_version.py \
+                --release-train "$TRAIN" --validate-phase-only <<< "$EXISTING_VERSIONS"
+            else
+              RELEASE_VERSION=$(uv run --no-sync python scripts/compute_alpha_release_version.py \
+                --release-train "$TRAIN" <<< "$EXISTING_VERSIONS")
+              REUSING_RESERVED_ALPHA=false
+            fi
+            EXISTING_VERSIONS_ARRAY=()
+            if [[ "$REUSING_RESERVED_ALPHA" != "true" ]]; then
+              mapfile -t EXISTING_VERSIONS_ARRAY < <(jq -r '.[]' <<< "$EXISTING_VERSIONS")
+            fi
+            VALIDATOR_ARGS=(
+              --channel "$CHANNEL"
+              --version "$RELEASE_VERSION"
+              --git-ref "$TRAIN_REF"
+              --actual-ref "$ACTUAL_REF"
+              --github-sha "$SOURCE_SHA"
+              --expected-sha "$SOURCE_SHA"
+            )
+            for existing_version in "${EXISTING_VERSIONS_ARRAY[@]}"; do
+              VALIDATOR_ARGS+=(--existing-version "$existing_version")
+            done
+            VERSION=$(uv run --no-sync python scripts/validate_alpha_release.py "${VALIDATOR_ARGS[@]}")
+          elif [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
+            CHANNEL="canary"
+            VERSION=$(BASE_VERSION="$BASE_VERSION" PR_NUMBER="$PR_NUMBER" GITHUB_RUN_NUMBER="$GITHUB_RUN_NUMBER" GITHUB_RUN_ATTEMPT="$GITHUB_RUN_ATTEMPT" python - <<'PY'
+          import os
+
+          def pair(left: int, right: int) -> int:
+              total = left + right
+              return total * (total + 1) // 2 + right
+
+          print(f"{os.environ['BASE_VERSION']}.dev{pair(pair(int(os.environ['PR_NUMBER']), int(os.environ['GITHUB_RUN_NUMBER'])), int(os.environ['GITHUB_RUN_ATTEMPT']))}")
+          PY
+            )
+          elif [[ "$GITHUB_EVENT_NAME" == "push" && "$GITHUB_REF" == "refs/heads/main" ]]; then
+            CHANNEL="stable"
+            PYPI_VERSIONS=$(uv run --no-sync python scripts/verify_release_registry.py \
+              list-versions --registry pypi)
+            TESTPYPI_VERSIONS=$(uv run --no-sync python scripts/verify_release_registry.py \
+              list-versions --registry testpypi)
+            TAG_VERSIONS=$(git tag --list 'v*' | sed 's/^v//' | jq -R -s \
+              'split("\n") | map(select(length > 0))')
+            VERSIONS=$(jq -n \
+              --argjson pypi "$PYPI_VERSIONS" \
+              --argjson testpypi "$TESTPYPI_VERSIONS" \
+              --argjson tags "$TAG_VERSIONS" \
+              '$pypi + $testpypi + $tags | unique')
+            VERSION=$(uv run --no-sync python scripts/compute_main_release_version.py \
+              --base-version "$BASE_VERSION" <<< "$VERSIONS")
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"
+          echo "release_train=$TRAIN" >> "$GITHUB_OUTPUT"
+          echo "source_sha=$SOURCE_SHA" >> "$GITHUB_OUTPUT"
+          echo "Computed $CHANNEL version: $VERSION"
+      - name: Verify release toolchain and write SBOM
+        env:
+          EXPECTED_UV_VERSION: "0.9.26"
+          RELEASE_VERSION: ${{ steps.version.outputs.version }}
+          SETUP_UV_ACTION_REF: fac544c07dec837d0ccb6301d7b5580bf5edae39
+        run: |
+          python3 scripts/write_release_toolchain_sbom.py \
+            --output "release-metadata/plugin-scanner-v${RELEASE_VERSION}.toolchain.cdx.json" \
+            --release-version "$RELEASE_VERSION" \
+            --expected-uv-version "$EXPECTED_UV_VERSION" \
+            --setup-action-ref "$SETUP_UV_ACTION_REF"
+      - name: Stamp package version when needed
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          CURRENT_VERSION=$(uv run --no-sync python scripts/sync_repo_version.py --check)
+          if [[ "$CURRENT_VERSION" == "$VERSION" ]]; then
+            echo "Package metadata already matches $VERSION"
+            exit 0
+          fi
+          uv run --no-sync python scripts/sync_repo_version.py --version "$VERSION"
+      - name: Build Guard package (hol-guard)
+        run: |
+          cp pyproject.toml pyproject.toml.bak
+          python3 - <<'PY'
+          from pathlib import Path
+
+          path = Path("pyproject.toml")
+          text = path.read_text(encoding="utf-8")
+          text = text.replace('name = "hol-guard"', 'name = "hol-guard"', 1)
+          start = text.index("[project.scripts]")
+          end = text.index("\n\n[project.urls]")
+          scripts = "[project.scripts]\n" \
+              'hol-guard = "codex_plugin_scanner.cli:main"\n' \
+              'plugin-guard = "codex_plugin_scanner.cli:main"'
+          text = text[:start] + scripts + text[end:]
+          path.write_text(text, encoding="utf-8")
+          PY
+          uv run --no-sync python -m build
+          mv pyproject.toml.bak pyproject.toml
+      - name: Build scanner package (plugin-scanner)
+        run: |
+          cp pyproject.toml pyproject.toml.bak
+          python3 - <<'PY'
+          import re
+          from pathlib import Path
+
+          path = Path("pyproject.toml")
+          text = path.read_text(encoding="utf-8")
+          text = text.replace('name = "hol-guard"', 'name = "plugin-scanner"', 1)
+          text, description_count = re.subn(
+              r'^description = ".*"$',
+              'description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."',
+              text,
+              count=1,
+              flags=re.MULTILINE,
+          )
+          if description_count != 1:
+              raise RuntimeError("Expected one project description in pyproject.toml")
+          start = text.index("[project.scripts]")
+          end = text.index("\n\n[project.urls]")
+          scripts = "[project.scripts]\n" \
+              'plugin-scanner = "codex_plugin_scanner.cli:main"\n' \
+              'plugin-ecosystem-scanner = "codex_plugin_scanner.cli:main"'
+          text = text[:start] + scripts + text[end:]
+          path.write_text(text, encoding="utf-8")
+          PY
+          uv run --no-sync python -m build
+          mv pyproject.toml.bak pyproject.toml
+      - name: Verify distributions
+        run: uv run --no-sync twine check dist/*
+      - name: Record immutable distribution hashes
+        run: |
+          find dist -maxdepth 1 -type f -print0 | sort -z | xargs -0 sha256sum > distribution-sha256.txt
+      - name: Bind installed canary subject
+        if: github.event_name == 'pull_request'
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+          SOURCE_SHA: ${{ steps.version.outputs.source_sha }}
+        run: |
+          uv run --no-sync python scripts/installed_canary_proof.py write-subject \
+            --dist-dir dist \
+            --version "$VERSION" \
+            --source-sha "$SOURCE_SHA" \
+            --output installed-canary-subject.json
+      - name: Upload artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: distributions
+          path: dist/
+      - name: Upload distribution hashes
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: distribution-sha256
+          path: distribution-sha256.txt
+      - name: Upload installed canary subject
+        if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: installed-canary-subject
+          path: installed-canary-subject.json
+          if-no-files-found: error
+      - name: Upload release toolchain SBOM
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: release-toolchain-sbom
+          path: release-metadata/*.cdx.json
+          if-no-files-found: error
+
+
+
+  build-native-guard-wheels:
+    name: Build native Guard wheel (${{ matrix.target }})
+    if: >-
+      needs.build.result == 'success' &&
+      (
+        (
+          github.event_name == 'pull_request' &&
+          github.event.pull_request.head.repo.full_name == github.repository &&
+          contains(github.event.pull_request.labels.*.name, 'publish-testpypi-canary') &&
+          needs.build.outputs.channel == 'canary'
+        ) ||
+        (
+          needs.build.outputs.channel == 'alpha' &&
+          (
+            (github.event_name == 'push' && github.ref == 'refs/heads/release/3.0') ||
+            (github.event_name == 'workflow_dispatch' && github.event.inputs.release_train == '3.0')
+          )
+        ) ||
+        (
+          needs.build.outputs.channel == 'stable' &&
+          github.event_name == 'push' &&
+          github.ref == 'refs/heads/main'
+        )
+      )
+    needs: build
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            platform_tag: manylinux_2_17_x86_64
+            target: x86_64-unknown-linux-musl
+            runtime: rust/target/x86_64-unknown-linux-musl/release/hol-guard-runtime
+          - runner: macos-15-intel
+            platform_tag: macosx_13_0_x86_64
+            target: x86_64-apple-darwin
+            runtime: rust/target/x86_64-apple-darwin/release/hol-guard-runtime
+          - runner: macos-15
+            platform_tag: macosx_11_0_arm64
+            target: aarch64-apple-darwin
+            runtime: rust/target/aarch64-apple-darwin/release/hol-guard-runtime
+          - runner: windows-latest
+            platform_tag: win_amd64
+            rustflags: -C link-arg=/Brepro
+            target: x86_64-pc-windows-msvc
+            runtime: rust/target/x86_64-pc-windows-msvc/release/hol-guard-runtime.exe
+    steps:
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: "3.12"
+      - name: Install pinned uv without cache
+        shell: bash
+        run: python -m pip install --disable-pip-version-check --no-cache-dir uv==0.9.26
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
+          ref: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.sha) || github.sha }}
+      - run: uv sync --frozen --extra dev --python 3.12
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distributions
+          path: base-dist/
+      - name: Verify release approval enrollment root pin
+        if: needs.build.outputs.channel != 'canary'
+        env:
+          HOL_GUARD_APPROVAL_ENROLLMENT_ROOT_HEX: ${{ vars.HOL_GUARD_APPROVAL_ENROLLMENT_ROOT_HEX }}
+          HOL_GUARD_APPROVAL_ENROLLMENT_ROOT_FINGERPRINT_HEX: ${{ vars.HOL_GUARD_APPROVAL_ENROLLMENT_ROOT_FINGERPRINT_HEX }}
+        run: uv run --no-sync python scripts/ci/native_approval_contract_gate.py --root . --require-release-root
+      - name: Install pinned Rust target
+        shell: bash
+        env:
+          RUST_TARGET: ${{ matrix.target }}
+        run: |
+          rustup toolchain install 1.88.0 --profile minimal
+          rustup default 1.88.0
+          rustup target add "$RUST_TARGET"
+      - name: Install Linux static toolchain
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends musl-tools
+      - name: Build version-matched runtime
+        shell: bash
+        env:
+          HOL_GUARD_BUILD_SHA: ${{ needs.build.outputs.source_sha }}
+          HOL_GUARD_PACKAGE_VERSION: ${{ needs.build.outputs.version }}
+          HOL_GUARD_APPROVAL_ENROLLMENT_ROOT_HEX: ${{ vars.HOL_GUARD_APPROVAL_ENROLLMENT_ROOT_HEX }}
+          HOL_GUARD_APPROVAL_ENROLLMENT_ROOT_FINGERPRINT_HEX: ${{ vars.HOL_GUARD_APPROVAL_ENROLLMENT_ROOT_FINGERPRINT_HEX }}
+          RUSTFLAGS: ${{ matrix.rustflags }}
+          RUST_TARGET: ${{ matrix.target }}
+          RUNTIME: ${{ matrix.runtime }}
+        run: |
+          cargo build --manifest-path rust/Cargo.toml --locked --release --target "$RUST_TARGET" -p hol-guard-runtime
+          "$RUNTIME" self-test --json
+      - name: Verify Linux runtime is static
+        if: runner.os == 'Linux'
+        shell: bash
+        env:
+          RUNTIME: ${{ matrix.runtime }}
+        run: |
+          LDD_OUTPUT=$(ldd "$RUNTIME" 2>&1 || true)
+          if ! grep -Eq 'not a dynamic executable|statically linked' <<< "$LDD_OUTPUT"; then
+            printf '%s\n' "$LDD_OUTPUT" >&2
+            exit 1
+          fi
+      - name: Assemble native wheel
+        shell: bash
+        env:
+          PLATFORM_TAG: ${{ matrix.platform_tag }}
+          RUNTIME: ${{ matrix.runtime }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          TARGET: ${{ matrix.target }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          RULE_DIGEST=$("$RUNTIME" capabilities --json | python -c 'import json,sys; print(json.load(sys.stdin)["rule_digest"])')
+          uv run --no-sync python scripts/build_native_hol_guard_wheel.py \
+            --wheel "base-dist/hol_guard-${VERSION}-py3-none-any.whl" \
+            --runtime "$RUNTIME" \
+            --output-dir native-dist \
+            --version "$VERSION" \
+            --platform-tag "$PLATFORM_TAG" \
+            --target "$TARGET" \
+            --source-sha "$SOURCE_SHA" \
+            --rule-digest "$RULE_DIGEST"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: native-guard-wheel-${{ matrix.platform_tag }}
+          path: native-dist/*.whl
+          if-no-files-found: error
+
+  assemble-native-guard-distributions:
+    name: Assemble native Guard distributions
+    if: >-
+      needs.build.result == 'success' &&
+      needs.build-native-guard-wheels.result == 'success'
+    needs: [build, build-native-guard-wheels]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
+          ref: ${{ needs.build.outputs.source_sha }}
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --extra publish --python 3.12
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distributions
+          path: dist/
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          pattern: native-guard-wheel-*
+          path: dist/
+          merge-multiple: true
+      - name: Validate exact native artifact set
+        env:
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          uv run --no-sync python scripts/verify_native_runtime_release.py validate-local \
+            --version "$VERSION" \
+            --source-sha "$SOURCE_SHA" \
+            --dist-dir dist
+          uv run --no-sync twine check dist/*
+      - name: Record aggregate immutable hashes
+        run: |
+          find dist -maxdepth 1 -type f -print0 | sort -z | xargs -0 sha256sum > distribution-sha256-native.txt
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: distributions-native
+          path: dist/
+          if-no-files-found: error
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: distribution-sha256-native
+          path: distribution-sha256-native.txt
+          if-no-files-found: error
+
+  publish-testpypi:
+    name: Publish PR canary to TestPyPI
+    if: >-
+      vars.PR_CANARY_PUBLISHING_ENABLED == 'true' &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      contains(github.event.pull_request.labels.*.name, 'publish-testpypi-canary')
+    needs: [build, assemble-native-guard-distributions]
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distributions-native
+          path: dist/
+      - name: Keep only the Guard canary distribution
+        run: rm -f dist/plugin_scanner-* dist/plugin-scanner-*
+      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+        with:
+          repository-url: https://test.pypi.org/legacy/
+      - name: Show canary install command
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          echo "## TestPyPI canary" >> "$GITHUB_STEP_SUMMARY"
+          echo "\`\`\`bash" >> "$GITHUB_STEP_SUMMARY"
+          echo "uv tool install --force --index https://pypi.org/simple --find-links https://test.pypi.org/simple/hol-guard/ 'hol-guard==$VERSION'" >> "$GITHUB_STEP_SUMMARY"
+          echo "\`\`\`" >> "$GITHUB_STEP_SUMMARY"
+
+  pr-installed-canary:
+    name: Installed PR canary (${{ matrix.os }})
+    if: >-
+      vars.PR_CANARY_PUBLISHING_ENABLED == 'true' &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      contains(github.event.pull_request.labels.*.name, 'publish-testpypi-canary')
+    needs: [build, publish-testpypi]
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          ref: ${{ needs.build.outputs.source_sha }}
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+          enable-cache: true
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version: "1.3.14"
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distributions-native
+          path: dist/
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: installed-canary-subject
+          path: installed-canary/
+      - name: Download exact TestPyPI wheel bytes
+        shell: bash
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          mkdir -p verified-testpypi
+          for attempt in {1..60}; do
+            if uv run --no-project --with packaging==25.0 python scripts/verify_release_registry.py \
+              verify-release --registry testpypi --version "$VERSION" \
+              --dist-dir dist --download-dir verified-testpypi > registry-result.json; then
+              STATUS=$(python -c 'import json; print(json.load(open("registry-result.json", encoding="utf-8"))["status"])')
+              if [[ "$STATUS" == "exact" ]]; then
+                break
+              fi
+            fi
+            if [[ "$attempt" == "60" ]]; then
+              echo "Exact TestPyPI canary did not become available" >&2
+              exit 1
+            fi
+            sleep 10
+          done
+      - name: Verify PR head, version, and TestPyPI bytes
+        shell: bash
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+        run: |
+          test "$(git rev-parse 'HEAD^{commit}')" = "$SOURCE_SHA"
+          uv run --no-project --with packaging==25.0 python scripts/installed_canary_proof.py verify-download \
+            --subject installed-canary/installed-canary-subject.json \
+            --version "$VERSION" \
+            --source-sha "$SOURCE_SHA" \
+            --download-dir verified-testpypi > verified-download.json
+      - name: Install only the verified wheel
+        shell: bash
+        run: |
+          WHEEL_REQUIREMENT=$(python -c 'import json; print(json.load(open("verified-download.json", encoding="utf-8"))["requirement"])')
+          python -m venv "$RUNNER_TEMP/hol-guard-canary-venv"
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            CANARY_PYTHON="$RUNNER_TEMP/hol-guard-canary-venv/Scripts/python.exe"
+          else
+            CANARY_PYTHON="$RUNNER_TEMP/hol-guard-canary-venv/bin/python"
+          fi
+          "$CANARY_PYTHON" -m pip install --no-compile --index-url https://pypi.org/simple "$WHEEL_REQUIREMENT"
+          echo "CANARY_PYTHON=$CANARY_PYTHON" >> "$GITHUB_ENV"
+      - name: Prove the harness rejects missing evidence
+        shell: bash
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+        run: |
+          if PYTHONPATH= "$CANARY_PYTHON" -X "pycache_prefix=$RUNNER_TEMP/hol-guard-missing-proof-cache" \
+            -m scripts.run_installed_canary \
+            --subject installed-canary/missing-subject.json \
+            --version "$VERSION" \
+            --source-sha "$SOURCE_SHA" \
+            --repo-root "$GITHUB_WORKSPACE" \
+            --output installed-canary/missing-proof-must-not-exist.json; then
+            echo "Installed canary harness accepted a run without proof" >&2
+            exit 1
+          fi
+          test ! -e installed-canary/missing-proof-must-not-exist.json
+      - name: Run installed 51k corpus and dashboard smoke
+        shell: bash
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+        run: |
+          PYTHONPATH= "$CANARY_PYTHON" -X "pycache_prefix=$RUNNER_TEMP/hol-guard-evidence-cache" \
+            -m scripts.run_installed_canary \
+            --subject installed-canary/installed-canary-subject.json \
+            --version "$VERSION" \
+            --source-sha "$SOURCE_SHA" \
+            --repo-root "$GITHUB_WORKSPACE" \
+            --output installed-canary/evidence.json
+      - name: Run canonical command extension analytics Dockerlab
+        if: runner.os == 'Linux'
+        shell: bash
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          VERIFIED_WHEEL=$(python -c 'import json; print(json.load(open("verified-download.json", encoding="utf-8"))["wheel"])')
+          WHEEL_NAME=$(basename "$VERIFIED_WHEEL")
+          cmp "$VERIFIED_WHEEL" "dist/$WHEEL_NAME"
+          cd dashboard
+          bun install --frozen-lockfile --ignore-scripts
+          bunx playwright install --with-deps chromium
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends apparmor bubblewrap
+          sudo tee /etc/apparmor.d/hol-guard-bwrap >/dev/null <<'EOF'
+          abi <abi/4.0>,
+          include <tunables/global>
+          /usr/bin/bwrap flags=(unconfined) {
+            userns,
+          }
+          EOF
+          sudo apparmor_parser -r /etc/apparmor.d/hol-guard-bwrap
+          cd ../tests/dockerlabs/command-extension-analytics
+          bun run typecheck
+          HOL_GUARD_LAB_EXPECTED_VERSION="$VERSION" \
+            HOL_GUARD_LAB_PYTHON="$CANARY_PYTHON" \
+            HOL_GUARD_WHEEL="$GITHUB_WORKSPACE/dist/$WHEEL_NAME" \
+            bun run guard:test:command-extension-analytics \
+              > "$GITHUB_WORKSPACE/installed-canary/command-extension-analytics.json"
+      - name: Verify installed browser proof
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          proof_dir=.artifacts/command-extension-analytics/playwright-output
+          for screenshot in \
+            installed-command-activity-overview.png \
+            installed-command-activity-filtered.png \
+            installed-command-activity-detail-feedback.png; do
+            count=$(find "$proof_dir" -type f -name "$screenshot" | wc -l)
+            test "$count" -eq 1
+          done
+      - name: Upload installed canary evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: installed-canary-evidence-${{ runner.os }}
+          path: |
+            installed-canary/evidence.json
+            installed-canary/command-extension-analytics.json
+            .artifacts/command-extension-analytics/playwright-output/**/*.png
+          if-no-files-found: error
+          include-hidden-files: true
+
+  reserve-alpha-tag:
+    name: Reserve alpha version
+    if: >-
+      always() &&
+      vars.RELEASE_PUBLISHING_ENABLED == 'true' &&
+      needs.build.result == 'success' && needs.assemble-native-guard-distributions.result == 'success' &&
+      needs.build.outputs.channel == 'alpha' &&
+      (
+        (github.event_name == 'workflow_dispatch' && github.run_attempt == 1) ||
+        (github.event_name == 'push' && github.ref == 'refs/heads/release/3.0')
+      )
+    needs: [build, assemble-native-guard-distributions]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.build.outputs.source_sha }}
+      - name: Reserve exact alpha tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: bash scripts/reserve_alpha_tag.sh
+
+  publish-alpha-testpypi:
+    name: Verify alpha artifact on TestPyPI
+    if: >-
+      always() &&
+      vars.RELEASE_PUBLISHING_ENABLED == 'true' &&
+      vars.ALPHA_TESTPYPI_ENABLED == 'true' &&
+      needs.build.result == 'success' &&
+      needs.assemble-native-guard-distributions.result == 'success' &&
+      needs.reserve-alpha-tag.result == 'success' &&
+      needs.build.outputs.channel == 'alpha' &&
+      (
+        (github.event_name == 'workflow_dispatch' && github.run_attempt == 1) ||
+        (github.event_name == 'push' && github.ref == 'refs/heads/release/3.0')
+      )
+    needs: [build, reserve-alpha-tag, assemble-native-guard-distributions]
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          ref: ${{ needs.build.outputs.source_sha }}
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distributions-native
+          path: dist/
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distribution-sha256-native
+      - name: Verify immutable build artifact
+        run: sha256sum --check distribution-sha256-native.txt
+      - name: Keep only the Guard release distribution
+        run: rm -f dist/plugin_scanner-* dist/plugin-scanner-*
+      - name: Revalidate alpha source before TestPyPI
+        env:
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          TRAIN: ${{ needs.build.outputs.release_train }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          train_ref="refs/heads/release/${TRAIN}"
+          remote_train_sha=$(git ls-remote --exit-code origin "$train_ref" | awk '{print $1}')
+          if [[ "$remote_train_sha" != "$SOURCE_SHA" ]]; then
+            echo "Alpha publication source is no longer the release train head" >&2
+            exit 1
+          fi
+          remote_alpha_tag_sha=$(git ls-remote --exit-code origin "refs/tags/alpha/v${VERSION}" | awk '{print $1}')
+          if [[ "$remote_alpha_tag_sha" != "$SOURCE_SHA" ]]; then
+            echo "Alpha tag targets a different source" >&2
+            exit 1
+          fi
+      - name: Plan TestPyPI release upload
+        id: testpypi
+        env:
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          rm -rf upload-dist
+          result=$(uv run --with packaging==25.0 python scripts/verify_native_runtime_release.py \
+            plan-upload --registry testpypi --version "$VERSION" \
+            --source-sha "$SOURCE_SHA" --dist-dir dist --output-dir upload-dist)
+          file_count=$(jq '.files | length' <<< "$result")
+          if [[ "$file_count" -gt 0 ]]; then
+            echo "upload=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "upload=false" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+        if: steps.testpypi.outputs.upload == 'true'
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: upload-dist/
+      - name: Remove generated upload attestations
+        run: rm -f dist/*.publish.attestation upload-dist/*.publish.attestation
+      - name: Download and verify exact TestPyPI artifacts
+        env:
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          for attempt in {1..60}; do
+            if ! result=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+              verify-release --registry testpypi --version "$VERSION" --dist-dir dist \
+              --download-dir verified-testpypi); then
+              exit 1
+            fi
+            status=$(jq -r '.status' <<< "$result")
+            if [[ "$status" == "exact" ]]; then
+              break
+            fi
+            if [[ "$status" != "absent" || "$attempt" == "60" ]]; then
+              echo "TestPyPI did not expose the exact release artifacts" >&2
+              exit 1
+            fi
+            sleep 5
+          done
+          wheel=$(jq -r '.install_paths[] | select(endswith("-py3-none-any.whl"))' <<< "$result")
+          [[ -n "$wheel" ]]
+          [[ "$(uv tool run --from "$wheel" hol-guard --version)" == "hol-guard $VERSION" ]]
+          uv run --with packaging==25.0 python scripts/verify_native_runtime_release.py \
+            verify-published --registry testpypi --version "$VERSION" \
+            --source-sha "$SOURCE_SHA" --dist-dir dist
+
+  publish-alpha-pypi:
+    name: Publish alpha to PyPI
+    if: >-
+      always() &&
+      vars.RELEASE_PUBLISHING_ENABLED == 'true' &&
+      needs.build.result == 'success' &&
+      needs.assemble-native-guard-distributions.result == 'success' &&
+      needs.reserve-alpha-tag.result == 'success' &&
+      needs.build.outputs.channel == 'alpha' &&
+      (
+        (github.event_name == 'workflow_dispatch' && github.run_attempt == 1) ||
+        (github.event_name == 'push' && github.ref == 'refs/heads/release/3.0')
+      )
+    needs: [build, reserve-alpha-tag, assemble-native-guard-distributions]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.build.outputs.source_sha }}
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distributions-native
+          path: dist/
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distribution-sha256-native
+      - name: Verify the TestPyPI-proven artifact
+        run: sha256sum --check distribution-sha256-native.txt
+      - name: Prepare project-specific distributions
+        run: |
+          shopt -s nullglob
+          guard_files=(dist/hol_guard-* dist/hol-guard-*)
+          scanner_files=(dist/plugin_scanner-* dist/plugin-scanner-*)
+          [[ "${#guard_files[@]}" -ge "2" && "${#scanner_files[@]}" == "2" ]]
+          mkdir dist-hol-guard dist-plugin-scanner
+          cp "${guard_files[@]}" dist-hol-guard/
+          cp "${scanner_files[@]}" dist-plugin-scanner/
+      - name: Inspect PyPI release state
+        id: pypi
+        env:
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          rm -rf upload-dist-hol-guard
+          guard_result=$(uv run --with packaging==25.0 python scripts/verify_native_runtime_release.py \
+            plan-upload --registry pypi --version "$VERSION" --source-sha "$SOURCE_SHA" \
+            --dist-dir dist-hol-guard --output-dir upload-dist-hol-guard --artifact-set pure)
+          scanner_result=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+            verify-release --registry pypi --project plugin-scanner --version "$VERSION" --dist-dir dist-plugin-scanner)
+          guard_file_count=$(jq '.files | length' <<< "$guard_result")
+          scanner_status=$(jq -r '.status' <<< "$scanner_result")
+          [[ "$scanner_status" == "absent" || "$scanner_status" == "exact" ]]
+          [[ "$guard_file_count" -gt 0 ]] && echo "hol_guard_upload=true" >> "$GITHUB_OUTPUT" || echo "hol_guard_upload=false" >> "$GITHUB_OUTPUT"
+          [[ "$scanner_status" == "absent" ]] && echo "plugin_scanner_upload=true" >> "$GITHUB_OUTPUT" || echo "plugin_scanner_upload=false" >> "$GITHUB_OUTPUT"
+      - name: Revalidate alpha publication authorization
+        env:
+          ACTUAL_REF: ${{ github.ref }}
+          EXPECTED_SHA: ${{ github.event.inputs.expected_sha || needs.build.outputs.source_sha }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          TRAIN: ${{ needs.build.outputs.release_train }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          train_ref="refs/heads/release/${TRAIN}"
+          remote_train_sha=$(git ls-remote --exit-code origin "$train_ref" | awk '{print $1}')
+          if [[ "$remote_train_sha" != "$SOURCE_SHA" ]]; then
+            echo "Alpha publication source is no longer the release train head" >&2
+            exit 1
+          fi
+          remote_alpha_tag_sha=$(git ls-remote --exit-code origin "refs/tags/alpha/v${VERSION}" | awk '{print $1}')
+          if [[ "$remote_alpha_tag_sha" != "$SOURCE_SHA" ]]; then
+            echo "Alpha tag targets a different source" >&2
+            exit 1
+          fi
+          versions=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+            list-versions --registry pypi)
+          mapfile -t existing_versions < <(jq -r --arg version "$VERSION" '.[] | select(. != $version)' <<< "$versions")
+          mapfile -t alpha_tags < <(
+            git tag --list 'alpha/v*' | sed 's#^alpha/v##' | awk -v candidate="$VERSION" '$0 != candidate'
+          )
+          validator_args=(
+            --channel alpha
+            --version "$VERSION"
+            --git-ref "$train_ref"
+            --actual-ref "$ACTUAL_REF"
+            --github-sha "$SOURCE_SHA"
+            --expected-sha "$EXPECTED_SHA"
+          )
+          for existing_version in "${existing_versions[@]}" "${alpha_tags[@]}"; do
+            [[ -z "$existing_version" ]] || validator_args+=(--existing-version "$existing_version")
+          done
+          uv run --with packaging==25.0 python scripts/validate_alpha_release.py "${validator_args[@]}"
+      - name: Refuse PyPI upload when the project is over quota
+        if: steps.pypi.outputs.hol_guard_upload == 'true'
+        run: uv run --with packaging==25.0 python scripts/pypi_project_storage.py --fail-if-over-limit
+      - name: Publish HOL Guard to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+        if: steps.pypi.outputs.hol_guard_upload == 'true'
+        with:
+          packages-dir: upload-dist-hol-guard/
+      - name: Publish plugin-scanner to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+        if: steps.pypi.outputs.plugin_scanner_upload == 'true'
+        with:
+          packages-dir: dist-plugin-scanner/
+      - name: Remove generated upload attestations
+        run: rm -f upload-dist-hol-guard/*.publish.attestation dist-plugin-scanner/*.publish.attestation
+      - name: Download and verify exact PyPI artifacts
+        env:
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          for attempt in {1..60}; do
+            if ! guard_result=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+              inspect-release --registry pypi --project hol-guard --version "$VERSION"); then
+              exit 1
+            fi
+            if ! scanner_result=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+              verify-release --registry pypi --project plugin-scanner --version "$VERSION" \
+              --dist-dir dist-plugin-scanner --download-dir verified-pypi-plugin-scanner); then
+              exit 1
+            fi
+            guard_status=$(jq -r '.status' <<< "$guard_result")
+            scanner_status=$(jq -r '.status' <<< "$scanner_result")
+            if [[ "$guard_status" == "present" && "$scanner_status" == "exact" ]]; then
+              break
+            fi
+            if [[ "$guard_status" != "absent" && "$guard_status" != "present" && "$guard_status" != "pending" ]] || \
+              [[ "$scanner_status" != "absent" && "$scanner_status" != "exact" ]] || \
+              [[ "$attempt" == "60" ]]; then
+              echo "PyPI did not expose the exact release artifacts" >&2
+              exit 1
+            fi
+            sleep 5
+          done
+          uv run --with packaging==25.0 python scripts/verify_native_runtime_release.py \
+            verify-published --registry pypi --version "$VERSION" \
+            --source-sha "$SOURCE_SHA" --dist-dir dist-hol-guard --artifact-set pure
+          shopt -s nullglob
+          guard_wheels=(dist-hol-guard/*-py3-none-any.whl)
+          [[ "${#guard_wheels[@]}" == "1" ]]
+          guard_wheel="${guard_wheels[0]}"
+          scanner_wheel=$(jq -r '.install_paths[] | select(endswith(".whl"))' <<< "$scanner_result")
+          [[ -n "$guard_wheel" && -n "$scanner_wheel" ]]
+          [[ "$(uv tool run --from "$guard_wheel" hol-guard --version)" == "hol-guard $VERSION" ]]
+          [[ "$(uv tool run --from "$scanner_wheel" plugin-scanner --version)" == "plugin-scanner $VERSION" ]]
+
+  release-unpublished-alpha-reservation:
+    name: Release unpublished alpha reservation
+    if: >-
+      always() &&
+      vars.RELEASE_PUBLISHING_ENABLED == 'true' &&
+      needs.build.outputs.channel == 'alpha' &&
+      needs.reserve-alpha-tag.result == 'success' &&
+      needs.publish-alpha-pypi.result != 'success'
+    needs: [build, reserve-alpha-tag, publish-alpha-pypi]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
+      - name: Delete unpublished reservation tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: bash scripts/release_unpublished_alpha_reservation.sh
+
+  publish-main-testpypi:
+    name: Verify main artifact on TestPyPI
+    if: >-
+      always() &&
+      vars.RELEASE_PUBLISHING_ENABLED == 'true' &&
+      vars.MAIN_TESTPYPI_ENABLED == 'true' &&
+      github.event_name == 'push' &&
+      github.run_attempt == 1 &&
+      github.ref == 'refs/heads/main' &&
+      needs.build.result == 'success' &&
+      needs.assemble-native-guard-distributions.result == 'success' &&
+      needs.build.outputs.channel == 'stable'
+    needs: [build, assemble-native-guard-distributions]
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.build.outputs.source_sha }}
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distributions-native
+          path: dist/
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distribution-sha256-native
+      - name: Verify immutable build artifact
+        run: sha256sum --check distribution-sha256-native.txt
+      - name: Keep only the Guard release distribution
+        run: rm -f dist/plugin_scanner-* dist/plugin-scanner-*
+      - name: Revalidate main source before TestPyPI
+        env:
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+        run: |
+          remote_main_sha=$(git ls-remote --exit-code origin refs/heads/main | awk '{print $1}')
+          if [[ "$remote_main_sha" != "$SOURCE_SHA" ]]; then
+            echo "Main publication source is no longer the branch head" >&2
+            exit 1
+          fi
+      - name: Inspect TestPyPI release state
+        id: testpypi
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          result=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+            verify-release --registry testpypi --version "$VERSION" --dist-dir dist)
+          status=$(jq -r '.status' <<< "$result")
+          if [[ "$status" == "absent" ]]; then
+            echo "upload=true" >> "$GITHUB_OUTPUT"
+          elif [[ "$status" == "exact" ]]; then
+            echo "upload=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Unexpected TestPyPI status: $status" >&2
+            exit 1
+          fi
+      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+        if: steps.testpypi.outputs.upload == 'true'
+        with:
+          repository-url: https://test.pypi.org/legacy/
+      - name: Remove generated upload attestations
+        run: rm -f dist/*.publish.attestation
+      - name: Download and verify exact TestPyPI artifacts
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          for attempt in {1..60}; do
+            if ! result=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+              verify-release --registry testpypi --version "$VERSION" --dist-dir dist \
+              --download-dir verified-testpypi); then
+              exit 1
+            fi
+            status=$(jq -r '.status' <<< "$result")
+            if [[ "$status" == "exact" ]]; then
+              break
+            fi
+            if [[ "$status" != "absent" || "$attempt" == "60" ]]; then
+              echo "TestPyPI did not expose the exact release artifacts" >&2
+              exit 1
+            fi
+            sleep 5
+          done
+          mapfile -t wheels < <(
+            jq -r '.install_paths[] | select(endswith("-py3-none-any.whl"))' <<< "$result"
+          )
+          [[ "${#wheels[@]}" == "1" ]]
+          wheel="${wheels[0]}"
+          [[ "$(uv tool run --from "$wheel" hol-guard --version)" == "hol-guard $VERSION" ]]
+
+  reserve-main-tag:
+    name: Reserve stable tag
+    if: >-
+      always() &&
+      vars.RELEASE_PUBLISHING_ENABLED == 'true' &&
+      github.event_name == 'push' &&
+      github.run_attempt == 1 &&
+      github.ref == 'refs/heads/main' &&
+      needs.build.result == 'success' &&
+      needs.assemble-native-guard-distributions.result == 'success' &&
+      needs.build.outputs.channel == 'stable'
+    needs: [build, assemble-native-guard-distributions]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.build.outputs.source_sha }}
+      - name: Bind stable tag to the exact main source
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          remote_main_sha=$(git ls-remote --exit-code origin refs/heads/main | awk '{print $1}')
+          if [[ "$remote_main_sha" != "$SOURCE_SHA" ]]; then
+            echo "Stable tag source is no longer the main branch head" >&2
+            exit 1
+          fi
+          tag="v${VERSION}"
+          remote_tag_sha=$(git ls-remote origin "refs/tags/${tag}" | awk '{print $1}')
+          if [[ -z "$remote_tag_sha" ]]; then
+            if ! gh api --method POST "repos/${GITHUB_REPOSITORY}/git/refs" \
+              -f ref="refs/tags/${tag}" \
+              -f sha="$SOURCE_SHA" >/dev/null; then
+              echo "Stable tag creation raced or failed; verifying the resulting remote ref" >&2
+            fi
+          fi
+          git fetch --force --no-tags origin "+refs/tags/${tag}:refs/tags/${tag}"
+          remote_tag_sha=$(git rev-parse "${tag}^{commit}")
+          if [[ "$remote_tag_sha" != "$SOURCE_SHA" ]]; then
+            echo "Stable tag does not target the exact main source" >&2
+            exit 1
+          fi
+
+  publish-main-pypi:
+    name: Publish main release to PyPI
+    if: >-
+      always() &&
+      vars.RELEASE_PUBLISHING_ENABLED == 'true' &&
+      github.event_name == 'push' &&
+      github.run_attempt == 1 &&
+      github.ref == 'refs/heads/main' &&
+      needs.build.result == 'success' &&
+      needs.assemble-native-guard-distributions.result == 'success' &&
+      needs.reserve-main-tag.result == 'success' &&
+      needs.build.outputs.channel == 'stable'
+    needs: [build, assemble-native-guard-distributions, reserve-main-tag]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.build.outputs.source_sha }}
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distributions-native
+          path: dist/
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distribution-sha256-native
+      - name: Verify immutable build artifact
+        run: sha256sum --check distribution-sha256-native.txt
+      - name: Prepare project-specific distributions
+        run: |
+          shopt -s nullglob
+          guard_files=(dist/hol_guard-* dist/hol-guard-*)
+          scanner_files=(dist/plugin_scanner-* dist/plugin-scanner-*)
+          [[ "${#guard_files[@]}" -ge "6" && "${#scanner_files[@]}" == "2" ]]
+          mkdir dist-hol-guard dist-plugin-scanner
+          cp "${guard_files[@]}" dist-hol-guard/
+          cp "${scanner_files[@]}" dist-plugin-scanner/
+      - name: Validate native Guard release set
+        env:
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          uv run --with packaging==25.0 python scripts/verify_native_runtime_release.py \
+            validate-local --version "$VERSION" --source-sha "$SOURCE_SHA" --dist-dir dist-hol-guard --artifact-set full
+      - name: Revalidate main publication
+        env:
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          git fetch --no-tags origin "+refs/tags/v${VERSION}:refs/tags/v${VERSION}"
+          reserved_source_sha=$(git rev-parse "v${VERSION}^{commit}")
+          if [[ "$reserved_source_sha" != "$SOURCE_SHA" ]]; then
+            echo "Stable tag does not target the exact publication source" >&2
+            exit 1
+          fi
+          BASE_VERSION=$(uv run --with packaging==25.0 python scripts/sync_repo_version.py --check)
+          PYPI_VERSIONS=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+            list-versions --registry pypi)
+          TESTPYPI_VERSIONS=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+            list-versions --registry testpypi)
+          TAG_VERSIONS=$(git tag --list 'v*' | sed 's/^v//' | jq -R -s \
+            'split("\n") | map(select(length > 0))')
+          RELEASE_VERSIONS=$(jq -n \
+            --arg version "$VERSION" \
+            --argjson pypi "$PYPI_VERSIONS" \
+            --argjson testpypi "$TESTPYPI_VERSIONS" \
+            --argjson tags "$TAG_VERSIONS" \
+            '$pypi + $testpypi + $tags + [$version] | unique')
+          LATEST_RELEASE_VERSION=$(uv run --with packaging==25.0 python scripts/compute_main_release_version.py \
+            --base-version "$BASE_VERSION" --latest-existing <<< "$RELEASE_VERSIONS")
+          if [[ "$LATEST_RELEASE_VERSION" != "$VERSION" ]]; then
+            echo "A newer main release candidate exists before publication" >&2
+            exit 1
+          fi
+          PRIOR_PYPI_VERSIONS=$(jq --arg version "$VERSION" \
+            '[.[] | select(. != $version)]' <<< "$PYPI_VERSIONS")
+          LATEST_VERSION=$(uv run --with packaging==25.0 python scripts/compute_main_release_version.py \
+            --base-version "$BASE_VERSION" --latest-existing <<< "$PRIOR_PYPI_VERSIONS")
+          if [[ -n "$LATEST_VERSION" ]]; then
+            git fetch --no-tags origin "+refs/tags/v${LATEST_VERSION}:refs/tags/v${LATEST_VERSION}"
+            if ! git merge-base --is-ancestor "v${LATEST_VERSION}^{commit}" "$SOURCE_SHA"; then
+              echo "Main release source predates the latest stable release" >&2
+              exit 1
+            fi
+          fi
+      - name: Inspect PyPI release state
+        id: pypi
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          guard_result=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+            verify-release --registry pypi --project hol-guard --version "$VERSION" --dist-dir dist-hol-guard)
+          scanner_result=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+            verify-release --registry pypi --project plugin-scanner --version "$VERSION" --dist-dir dist-plugin-scanner)
+          guard_status=$(jq -r '.status' <<< "$guard_result")
+          scanner_status=$(jq -r '.status' <<< "$scanner_result")
+          [[ "$guard_status" == "absent" || "$guard_status" == "exact" ]]
+          [[ "$scanner_status" == "absent" || "$scanner_status" == "exact" ]]
+          [[ "$guard_status" == "absent" ]] && echo "hol_guard_upload=true" >> "$GITHUB_OUTPUT" || echo "hol_guard_upload=false" >> "$GITHUB_OUTPUT"
+          [[ "$scanner_status" == "absent" ]] && echo "plugin_scanner_upload=true" >> "$GITHUB_OUTPUT" || echo "plugin_scanner_upload=false" >> "$GITHUB_OUTPUT"
+      - name: Refuse PyPI upload when the project is over quota
+        if: steps.pypi.outputs.hol_guard_upload == 'true'
+        run: uv run --with packaging==25.0 python scripts/pypi_project_storage.py --fail-if-over-limit --pending-dir dist-hol-guard
+      - name: Publish HOL Guard to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+        if: steps.pypi.outputs.hol_guard_upload == 'true'
+        with:
+          packages-dir: dist-hol-guard/
+      - name: Publish plugin-scanner to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+        if: steps.pypi.outputs.plugin_scanner_upload == 'true'
+        with:
+          packages-dir: dist-plugin-scanner/
+      - name: Remove generated upload attestations
+        run: rm -f dist-hol-guard/*.publish.attestation dist-plugin-scanner/*.publish.attestation
+      - name: Download and verify exact PyPI artifacts
+        env:
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          for attempt in {1..60}; do
+            if ! guard_result=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+              verify-release --registry pypi --project hol-guard --version "$VERSION" \
+              --dist-dir dist-hol-guard --download-dir verified-pypi-hol-guard); then
+              exit 1
+            fi
+            if ! scanner_result=$(uv run --with packaging==25.0 python scripts/verify_release_registry.py \
+              verify-release --registry pypi --project plugin-scanner --version "$VERSION" \
+              --dist-dir dist-plugin-scanner --download-dir verified-pypi-plugin-scanner); then
+              exit 1
+            fi
+            guard_status=$(jq -r '.status' <<< "$guard_result")
+            scanner_status=$(jq -r '.status' <<< "$scanner_result")
+            if [[ "$guard_status" == "exact" && "$scanner_status" == "exact" ]]; then
+              break
+            fi
+            if [[ "$guard_status" != "absent" && "$guard_status" != "exact" ]] || \
+              [[ "$scanner_status" != "absent" && "$scanner_status" != "exact" ]] || \
+              [[ "$attempt" == "60" ]]; then
+              echo "PyPI did not expose the exact release artifacts" >&2
+              exit 1
+            fi
+            sleep 5
+          done
+          uv run --with packaging==25.0 python scripts/verify_native_runtime_release.py \
+            verify-published --registry pypi --version "$VERSION" \
+            --source-sha "$SOURCE_SHA" --dist-dir dist-hol-guard --artifact-set full
+          mapfile -t guard_wheels < <(
+            jq -r '.install_paths[] | select(endswith("-py3-none-any.whl"))' <<< "$guard_result"
+          )
+          mapfile -t scanner_wheels < <(
+            jq -r '.install_paths[] | select(endswith(".whl"))' <<< "$scanner_result"
+          )
+          [[ "${#guard_wheels[@]}" == "1" && "${#scanner_wheels[@]}" == "1" ]]
+          guard_wheel="${guard_wheels[0]}"
+          scanner_wheel="${scanner_wheels[0]}"
+          [[ "$(uv tool run --from "$guard_wheel" hol-guard --version)" == "hol-guard $VERSION" ]]
+          [[ "$(uv tool run --from "$scanner_wheel" plugin-scanner --version)" == "plugin-scanner $VERSION" ]]
+
+  release-main:
+    name: Create main GitHub release
+    if: >-
+      always() &&
+      vars.RELEASE_PUBLISHING_ENABLED == 'true' &&
+      github.event_name == 'push' &&
+      github.run_attempt == 1 &&
+      github.ref == 'refs/heads/main' &&
+      needs.build.result == 'success' &&
+      needs.assemble-native-guard-distributions.result == 'success' &&
+      needs.publish-main-pypi.result == 'success' &&
+      needs.build.outputs.channel == 'stable'
+    needs: [build, assemble-native-guard-distributions, publish-main-pypi]
+    runs-on: ubuntu-latest
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.build.outputs.source_sha }}
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distributions-native
+          path: dist/
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distribution-sha256-native
+      - name: Download release toolchain SBOM
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: release-toolchain-sbom
+          path: dist/
+      - name: Verify and select release assets
+        run: |
+          sha256sum --check distribution-sha256-native.txt
+          rm -f dist/plugin_scanner-* dist/plugin-scanner-*
+      - name: Attest main release assets
+        id: provenance
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
+        with:
+          subject-path: dist/*
+      - name: Materialize provenance bundle
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: cp "${{ steps.provenance.outputs.bundle-path }}" "dist/hol-guard-v${VERSION}.intoto.jsonl"
+      - name: Generate release notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.build.outputs.version }}
+          CHANNEL: ${{ needs.build.outputs.channel }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+        run: python3 scripts/ci/generate_release_notes.py --version "$VERSION" --channel "$CHANNEL" --repo "$GITHUB_REPOSITORY" --source-sha "$SOURCE_SHA" --output "$RUNNER_TEMP/release-notes.md"
+      - name: Create discoverable main release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          tag="v${VERSION}"
+          git fetch --force --no-tags origin "+refs/tags/${tag}:refs/tags/${tag}"
+          remote_tag_sha=$(git rev-parse "${tag}^{commit}")
+          if [[ "$remote_tag_sha" != "$SOURCE_SHA" ]]; then
+            echo "Stable tag does not target the published source" >&2
+            exit 1
+          fi
+          if release_json=$(gh release view "$tag" --json isDraft,isPrerelease 2>/dev/null); then
+            if ! jq -e '.isDraft == false and .isPrerelease == false' <<< "$release_json" >/dev/null; then
+              echo "Existing stable release is a draft or prerelease" >&2
+              exit 1
+            fi
+            existing_dir=$(mktemp -d)
+            gh release download "$tag" --dir "$existing_dir"
+            mapfile -d '' local_files < <(find dist -maxdepth 1 -type f -print0 | sort -z)
+            [[ "${#local_files[@]}" -gt 0 ]]
+            for local_file in "${local_files[@]}"; do
+              remote_file="$existing_dir/$(basename "$local_file")"
+              [[ -f "$remote_file" ]]
+              if [[ "$remote_file" != *.intoto.jsonl ]]; then
+                cmp --silent "$local_file" "$remote_file"
+              fi
+            done
+            python scripts/ci/verify_release_asset_inventory.py "$existing_dir" dist "$VERSION" stable
+            bundle="$existing_dir/hol-guard-v${VERSION}.intoto.jsonl"
+            [[ -s "$bundle" ]]
+            shopt -s nullglob
+            remote_guard_files=("$existing_dir"/hol_guard-*)
+            [[ "${#remote_guard_files[@]}" -gt 0 ]]
+            for remote_file in "${remote_guard_files[@]}"; do
+              gh attestation verify "$remote_file" --repo "$GITHUB_REPOSITORY" \
+                --bundle "$bundle" --source-digest "$SOURCE_SHA" >/dev/null
+            done
+            exit 0
+          fi
+          body_file="$RUNNER_TEMP/release-notes.md"
+          [[ -s "$body_file" ]]
+          mapfile -d '' ASSET_FILES < <(find dist -maxdepth 1 -type f -print0 | sort -z)
+          gh release create "$tag" \
+            --repo "${{ github.repository }}" \
+            --target "$SOURCE_SHA" \
+            --title "Guard ${VERSION}" \
+            --notes-file "$body_file" \
+            --verify-tag \
+            "${ASSET_FILES[@]}"
+
+  release-alpha:
+    name: Create alpha GitHub prerelease
+    if: >-
+      vars.RELEASE_PUBLISHING_ENABLED == 'true' &&
+      needs.build.outputs.channel == 'alpha' &&
+      (
+        (github.event_name == 'workflow_dispatch' && github.run_attempt == 1) ||
+        (github.event_name == 'push' && github.ref == 'refs/heads/release/3.0')
+      )
+    needs: [build, publish-alpha-pypi]
+    runs-on: ubuntu-latest
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.build.outputs.source_sha }}
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distributions-native
+          path: dist/
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: distribution-sha256-native
+      - name: Download release toolchain SBOM
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: release-toolchain-sbom
+          path: dist/
+      - name: Verify and select release assets
+        run: |
+          sha256sum --check distribution-sha256-native.txt
+          rm -f dist/plugin_scanner-* dist/plugin-scanner-*
+      - name: Attest alpha release assets
+        id: provenance
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
+        with:
+          subject-path: dist/*
+      - name: Materialize provenance bundle
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: cp "${{ steps.provenance.outputs.bundle-path }}" "dist/hol-guard-v${VERSION}.intoto.jsonl"
+      - name: Generate release notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.build.outputs.version }}
+          CHANNEL: ${{ needs.build.outputs.channel }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+        run: python3 scripts/ci/generate_release_notes.py --version "$VERSION" --channel "$CHANNEL" --repo "$GITHUB_REPOSITORY" --source-sha "$SOURCE_SHA" --output "$RUNNER_TEMP/release-notes.md"
+      - name: Create discoverable alpha prerelease
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          tag="alpha/v${VERSION}"
+          remote_tag_sha=$(git ls-remote origin "refs/tags/${tag}" | awk '{print $1}')
+          if [[ -z "$remote_tag_sha" ]]; then
+            gh api --method POST "repos/${GITHUB_REPOSITORY}/git/refs" \
+              -f ref="refs/tags/${tag}" \
+              -f sha="$SOURCE_SHA" >/dev/null
+            remote_tag_sha=$(git ls-remote --exit-code origin "refs/tags/${tag}" | awk '{print $1}')
+          fi
+          if [[ "$remote_tag_sha" != "$SOURCE_SHA" ]]; then
+            echo "Alpha tag does not target the published source" >&2
+            exit 1
+          fi
+          if release_json=$(gh release view "$tag" --json isDraft,isPrerelease 2>/dev/null); then
+            jq -e '.isDraft == false and .isPrerelease == true' <<< "$release_json" >/dev/null
+            existing_dir=$(mktemp -d)
+            gh release download "$tag" --dir "$existing_dir"
+            mapfile -d '' local_files < <(find dist -maxdepth 1 -type f -print0 | sort -z)
+            [[ "${#local_files[@]}" -gt 0 ]]
+            for local_file in "${local_files[@]}"; do
+              remote_file="$existing_dir/$(basename "$local_file")"
+              [[ -f "$remote_file" ]]
+              if [[ "$remote_file" != *.intoto.jsonl ]]; then
+                cmp --silent "$local_file" "$remote_file"
+              fi
+            done
+            python scripts/ci/verify_release_asset_inventory.py "$existing_dir" dist "$VERSION" alpha
+            bundle="$existing_dir/hol-guard-v${VERSION}.intoto.jsonl"
+            [[ -s "$bundle" ]]
+            for remote_file in "$existing_dir"/hol_guard-*; do
+              gh attestation verify "$remote_file" --repo "$GITHUB_REPOSITORY" \
+                --bundle "$bundle" --source-digest "$SOURCE_SHA" >/dev/null
+            done
+            exit 0
+          fi
+          body_file="$RUNNER_TEMP/release-notes.md"
+          [[ -s "$body_file" ]]
+          mapfile -d '' ASSET_FILES < <(find dist -maxdepth 1 -type f -print0 | sort -z)
+          gh release create "$tag" \
+            --repo "${{ github.repository }}" \
+            --target "$SOURCE_SHA" \
+            --title "Guard ${VERSION} alpha" \
+            --notes-file "$body_file" \
+            --prerelease \
+            --verify-tag \
+            "${ASSET_FILES[@]}"
+
+  publish-container:
+    name: Publish container image
+    if: >-
+      always() &&
+      vars.RELEASE_PUBLISHING_ENABLED == 'true' &&
+      needs.build.result == 'success' &&
+      (
+        (
+          (
+            (github.event_name == 'workflow_dispatch' && github.run_attempt == 1) ||
+            (github.event_name == 'push' && github.ref == 'refs/heads/release/3.0')
+          ) &&
+          needs.build.outputs.channel == 'alpha' &&
+          needs.publish-alpha-pypi.result == 'success' &&
+          needs.release-alpha.result == 'success'
+        ) ||
+        (
+          github.event_name == 'push' &&
+          github.run_attempt == 1 &&
+          github.ref == 'refs/heads/main' &&
+          needs.build.outputs.channel == 'stable' &&
+          needs.publish-main-pypi.result == 'success' &&
+          needs.release-main.result == 'success'
+        )
+      )
+    needs: [build, publish-alpha-pypi, publish-main-pypi, release-alpha, release-main]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          ref: ${{ needs.build.outputs.source_sha }}
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          version: "0.9.26"
+      - name: Sync locked release tooling
+        run: |
+          uv sync --frozen
+      - name: Stamp package version
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          uv run --no-sync python scripts/sync_repo_version.py --version "$VERSION"
+      - name: Prepare image tags
+        id: tags
+        env:
+          IMAGE_NAME: ghcr.io/${{ github.repository }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          {
+            echo "value<<EOF"
+            echo "${IMAGE_NAME}:${VERSION}"
+            if [[ "${{ needs.build.outputs.channel }}" == "stable" ]]; then
+              echo "${IMAGE_NAME}:latest"
+            fi
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Inspect existing immutable image
+        id: image
+        env:
+          CHANNEL: ${{ needs.build.outputs.channel }}
+          IMAGE_NAME: ghcr.io/${{ github.repository }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          if [[ "$CHANNEL" != "alpha" ]]; then
+            echo "push=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          image="${IMAGE_NAME}:${VERSION}"
+          pull_output=$(mktemp)
+          if docker pull "$image" >"$pull_output" 2>&1; then
+            revision=$(docker inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' "$image")
+            if [[ "$revision" != "$SOURCE_SHA" ]]; then
+              echo "Existing image tag targets a different source" >&2
+              exit 1
+            fi
+            echo "push=false" >> "$GITHUB_OUTPUT"
+          elif grep -Eqi 'manifest unknown' "$pull_output"; then
+            echo "push=true" >> "$GITHUB_OUTPUT"
+          else
+            cat "$pull_output" >&2
+            echo "Unable to determine whether the image tag already exists" >&2
+            exit 1
+          fi
+      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+        if: steps.image.outputs.push == 'true'
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.tags.outputs.value }}
+          labels: |
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.version=${{ needs.build.outputs.version }}
+            org.opencontainers.image.revision=${{ needs.build.outputs.source_sha }}