pretensor 0.1.0a3__tar.gz → 0.2.0__tar.gz

pretensor-0.2.0/.github/ISSUE_TEMPLATE/schema_report.yml

@@ -0,0 +1,122 @@
+name: Schema doesn't match my database
+description: The knowledge graph is missing or misrepresenting tables, columns, keys, or relationships from your database.
+title: "schema: <what's missing or wrong>"
+labels:
+  - bug
+  - triage
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form when Pretensor indexed your database but the resulting graph is **wrong or incomplete** — a table or column is missing, a foreign key or inferred join is wrong, or MCP tools return schema context that doesn't match reality. For crashes and errors, use the bug report form instead.
+
+        **Security vulnerabilities must not be filed as public issues.** See [SECURITY.md](https://github.com/pretensor-ai/pretensor/blob/main/SECURITY.md) and report privately via [GitHub Security Advisories](https://github.com/pretensor-ai/pretensor/security/advisories/new).
+
+  - type: input
+    id: pretensor-version
+    attributes:
+      label: Pretensor version
+      description: Output of `pretensor --version`.
+      placeholder: "0.1.0aN"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: backend
+    attributes:
+      label: Database backend
+      options:
+        - PostgreSQL
+        - MySQL
+        - Snowflake
+        - BigQuery
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: backend-version
+    attributes:
+      label: Database version
+      description: e.g. `PostgreSQL 16.3`, `Snowflake 8.x`.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: problem-kind
+    attributes:
+      label: What is wrong in the graph?
+      options:
+        - Table missing
+        - Column missing
+        - Foreign key missing or wrong
+        - Inferred join / relationship wrong
+        - Wrong metadata (types, row counts, comments)
+        - Search / context returns the wrong schema objects
+        - Other
+    validations:
+      required: true
+
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Where do you see it?
+      description: The surface where the wrong output shows up.
+      options:
+        - CLI (`pretensor list` / `validate` / `export`)
+        - MCP tool response (`schema`, `context`, `traverse`, ...)
+        - Both
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What the database actually contains
+      description: |
+        The relevant schema as it exists in your database — a sanitized DDL
+        snippet (`CREATE TABLE ...`), an information-schema query result, or a
+        prose description. Redact table/column names if needed, but keep the
+        structure (keys, references) intact.
+      render: sql
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: What Pretensor produced instead
+      description: The wrong or missing output — CLI output, MCP tool response JSON, or `pretensor export` fragment.
+      render: shell
+    validations:
+      required: true
+
+  - type: dropdown
+    id: reindex
+    attributes:
+      label: Does a fresh index reproduce it?
+      description: Whether the problem survives a full `pretensor index` (not just `reindex`) into a clean state directory.
+      options:
+        - Yes — reproduced after a fresh full index
+        - No — a fresh index fixed it
+        - Not tried
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Index/reindex logs or additional context
+      description: Output of the indexing run (add `--log-level debug` if possible). Redact secrets, DSNs, and personally identifiable data.
+      render: shell
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-submission checks
+      options:
+        - label: I searched existing issues and did not find a duplicate.
+          required: true
+        - label: I redacted credentials and sensitive schema details from all snippets.
+          required: true

pretensor-0.2.0/.github/workflows/bench.yml

@@ -0,0 +1,155 @@
+name: Bench
+
+on:
+  # No paths-ignore: the bench lane runs on every PR (including doc-only)
+  # so the dry-run AC is satisfiable and the lane never silently no-ops.
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      l3_model:
+        description: "L3 model id (defaults to claude-haiku-4-5)"
+        required: false
+        type: string
+        default: "claude-haiku-4-5"
+  # L3 runs weekly (Monday 04:00 UTC) for trend watching, on release-tag
+  # pushes for the release-being-announced snapshot, and on manual dispatch
+  # for ad-hoc runs.
+  schedule:
+    - cron: '0 4 * * 1'
+  push:
+    tags: ['v*.*.*']
+
+concurrency:
+  group: bench-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  pr-bench:
+    name: ${{ matrix.level }} (${{ matrix.dataset }}, ${{ matrix.extras_label }})
+    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        level: [l1, l2]
+        dataset: [pagila, adventureworks, tpch]
+        extras: [dev, dev-embeddings]
+        include:
+          - extras: dev
+            extras_args: "--extra dev"
+            extras_label: "dev"
+          - extras: dev-embeddings
+            extras_args: "--extra dev --extra embeddings"
+            extras_label: "dev,embeddings"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+          python-version: "3.11"
+      - name: Install dependencies
+        run: uv sync --locked ${{ matrix.extras_args }}
+      - name: Cache HuggingFace embedding model
+        if: matrix.extras == 'dev-embeddings'
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/huggingface
+          key: hf-arctic-embed-xs-${{ hashFiles('src/pretensor/intelligence/embeddings.py') }}
+      - name: Pre-warm embedding model (retry on Hub rate limits)
+        if: matrix.extras == 'dev-embeddings'
+        env:
+          # Optional repo secret; anonymous Hub downloads from shared
+          # runner IPs are frequently 429-rate-limited. huggingface_hub
+          # picks the token up from the environment automatically; an
+          # empty value is a no-op.
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+        run: |
+          for attempt in 1 2 3 4 5; do
+            if uv run python -c "from pretensor.intelligence.embeddings import get_default_embedding_client; get_default_embedding_client().embed(['warm'])"; then
+              echo "model ready (attempt $attempt)"
+              exit 0
+            fi
+            sleep $((30 + attempt * 15 + RANDOM % 30))
+          done
+          echo "::error::embedding model download kept failing (HF Hub rate limit?). Add an HF_TOKEN repo secret or retry the run."
+          exit 1
+      - name: Run benchmark
+        # The embeddings lane passes --embeddings and compares against
+        # lane-specific baselines: L2 measures real cosine retrieval for
+        # semantic_search + the hybrid rerank; L1 measures blind join
+        # discovery with the embedding relationship scorer registered at
+        # its documented typical threshold (see L1_EMBEDDING_JOIN_THRESHOLD).
+        env:
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+        run: |
+          BENCH_FLAG=""
+          SUFFIX=""
+          if [ "${{ matrix.extras }}" = "dev-embeddings" ]; then
+            BENCH_FLAG="--embeddings"
+            SUFFIX="-embeddings"
+          fi
+          echo "BASELINE_SUFFIX=$SUFFIX" >> "$GITHUB_ENV"
+          uv run pretensor benchmark ${{ matrix.level }} --dataset ${{ matrix.dataset }} $BENCH_FLAG --out current.json
+      - name: Compare against baseline
+        run: |
+          uv run pretensor benchmark compare \
+            --baseline tests/benchmark/baselines/${{ matrix.dataset }}-${{ matrix.level }}${BASELINE_SUFFIX}.json \
+            --current current.json
+      - name: Upload current result on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.level }}-${{ matrix.dataset }}-${{ matrix.extras }}-current
+          path: current.json
+          retention-days: 14
+          if-no-files-found: warn
+
+  l3:
+    name: L3 (${{ matrix.dataset }}, ${{ matrix.runner }})
+    # L3 is dormant until the per-dataset Postgres fixtures and DSN env
+    # vars are wired into CI. Set the repo variable
+    # `L3_ENV_PROVISIONED=true` once that work lands; until then,
+    # scheduled / tag-push / manual triggers no-op cleanly instead of
+    # producing six failed jobs that drown out the L1+L2 signal.
+    if: vars.L3_ENV_PROVISIONED == 'true' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        dataset: [pagila, adventureworks, tpch]
+        runner: [baseline, pretensor]
+    env:
+      ANTHROPIC_API_KEY: ${{ secrets.BENCH_ANTHROPIC_API_KEY }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+          python-version: "3.11"
+      - name: Install dependencies
+        run: uv sync --locked --extra dev --extra embeddings
+      - name: Run L3
+        run: |
+          model="${{ inputs.l3_model || 'claude-haiku-4-5' }}"
+          uv run pretensor benchmark l3 \
+            --dataset ${{ matrix.dataset }} \
+            --runner ${{ matrix.runner }} \
+            --model "$model" \
+            --out results.json
+      - name: Upload result
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: l3-${{ matrix.dataset }}-${{ matrix.runner }}-${{ github.run_id }}
+          path: results.json
+          retention-days: 90
+          if-no-files-found: warn

{pretensor-0.1.0a3 → pretensor-0.2.0}/.github/workflows/ci.yml

@@ -12,6 +12,17 @@ on:
       - 'docs/**'
       - '**.md'
       - '.github/ISSUE_TEMPLATE/**'
+  schedule:
+    # Nightly slow lane (real-model embedding smoke + future heavy fixtures).
+    # Daily at 03:17 UTC.
+    - cron: '17 3 * * *'
+  workflow_dispatch:
+    inputs:
+      run_slow:
+        description: 'Run the slow opt-in test lane (real model downloads).'
+        type: boolean
+        required: false
+        default: false
 
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -32,10 +43,25 @@ jobs:
           cache-dependency-glob: "uv.lock"
           python-version: "3.12"
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --locked --extra dev
       - name: Ruff check
         run: uv run ruff check src tests
 
+  lockfile:
+    name: Lockfile up to date
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+          python-version: "3.12"
+      - name: Verify uv.lock matches pyproject.toml
+        # Fails if the committed lock would be re-resolved — keeps the reviewed
+        # pins identical to what every other job installs with `uv sync --locked`.
+        run: uv lock --check
+
   typecheck:
     name: Typecheck (pyright)
     runs-on: ubuntu-latest
@@ -47,7 +73,7 @@ jobs:
           cache-dependency-glob: "uv.lock"
           python-version: "3.11"
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --locked --extra dev
       - name: Pyright
         run: uv run pyright
 
@@ -66,7 +92,7 @@ jobs:
           cache-dependency-glob: "uv.lock"
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --locked --extra dev
       - name: Pytest
         env:
           PYTHONPATH: src
@@ -133,3 +159,40 @@ jobs:
             exit 1
           fi
           uvx --from "${wheels[0]}" pretensor --help > /dev/null
+
+  slow-tests:
+    name: Slow tests (opt-in real model)
+    if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.run_slow)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+          python-version: "3.12"
+      - name: Install dependencies (with embeddings extra)
+        run: uv sync --locked --extra dev --extra embeddings
+      - name: Cache HuggingFace embedding model
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/huggingface
+          key: hf-arctic-embed-xs-${{ hashFiles('src/pretensor/intelligence/embeddings.py') }}
+      - name: Pre-warm embedding model (retry on Hub rate limits)
+        env:
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+        run: |
+          for attempt in 1 2 3 4 5; do
+            if uv run python -c "from pretensor.intelligence.embeddings import get_default_embedding_client; get_default_embedding_client().embed(['warm'])"; then
+              echo "model ready (attempt $attempt)"
+              exit 0
+            fi
+            sleep $((30 + attempt * 15 + RANDOM % 30))
+          done
+          echo "::error::embedding model download kept failing (HF Hub rate limit?). Add an HF_TOKEN repo secret or retry the run."
+          exit 1
+      - name: Pytest -m slow
+        env:
+          PYTHONPATH: src
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+        run: uv run pytest -m slow tests/

{pretensor-0.1.0a3 → pretensor-0.2.0}/.github/workflows/e2e.yml

@@ -25,8 +25,8 @@ jobs:
           curl -LsSf https://astral.sh/uv/install.sh | sh
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
-      - name: Install dependencies (make test-e2e uses uv sync --extra dev --extra e2e)
-        run: uv sync --extra dev --extra e2e
+      - name: Install dependencies (E2E needs the postgres driver to connect)
+        run: uv sync --locked --extra dev --extra e2e --extra postgres
 
       - name: Run E2E suite (PRETENSOR_E2E=1 uv run pytest tests/e2e/ ...)
         env:

pretensor-0.2.0/.github/workflows/no-internal-refs.yml

@@ -0,0 +1,41 @@
+name: no-internal-refs
+
+# publish/** is included so the scan also attaches to release-snapshot pushes,
+# whose PRs are opened by GITHUB_TOKEN and therefore never fire pull_request
+# events — without the push trigger, a required "Block internal tracker
+# references" check would wait forever on those PRs.
+on:
+  push:
+    branches: [main, master, 'publish/**']
+  pull_request:
+
+concurrency:
+  group: no-internal-refs-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Block internal tracker references
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Scan tracked files
+        run: |
+          set -euo pipefail
+          git ls-files -z | xargs -0 python3 scripts/check_no_internal_refs.py
+
+      - name: Scan pull-request title and body
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          set -euo pipefail
+          printf 'title: %s\n\nbody:\n%s\n' "${PR_TITLE}" "${PR_BODY}" > pr-metadata.txt
+          python3 scripts/check_no_internal_refs.py pr-metadata.txt

pretensor-0.2.0/.github/workflows/open-publish-pr.yml

@@ -0,0 +1,41 @@
+name: open-publish-pr
+
+# Opens a review PR whenever a publish/<tag> release branch is pushed, using
+# the built-in GITHUB_TOKEN. A GITHUB_TOKEN-opened PR does not trigger
+# pull_request workflows, but that is fine: ci.yml already runs on push for
+# publish/**, so required checks attach to the pushed commit SHA and satisfy
+# branch protection.
+
+on:
+  push:
+    branches:
+      - "publish/**"
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  open-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Open or update the release PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BRANCH: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          version="${BRANCH#publish/}"
+          # Only an OPEN PR should count as "already handled": `gh pr view`
+          # on a branch name also resolves closed and merged PRs, so a
+          # re-pushed release branch whose earlier PR was merged would be
+          # skipped and the release would stall with no PR to review.
+          open_count=$(gh pr list --repo "$REPO" --head "$BRANCH" --state open --json number --jq 'length')
+          if [ "$open_count" -gt 0 ]; then
+            echo "PR already open for ${BRANCH}."
+          else
+            gh pr create --repo "$REPO" --base main --head "$BRANCH" \
+              --title "Release ${version}" \
+              --body "Release snapshot for ${version}. Review the diff and confirm CI is green, then merge."
+          fi

pretensor-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,200 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  release-gate:
+    name: Release gate (L1+L2 vs previous tag)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Required so `git describe --tags HEAD^` can resolve the
+          # previous tag — the release-gate script needs the full
+          # tag history, not just HEAD.
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+          python-version: "3.12"
+      - name: Install pretensor with dev extras
+        # The gate runs L1 + L2 with --no-embeddings, so the heavy
+        # `embeddings` optional extra (onnxruntime, transformers, …) is
+        # not exercised. Skip it to keep the gate job fast. If a future
+        # change starts gating the embeddings legs too, add `--extra
+        # embeddings` here and pass `--embeddings` below.
+        run: uv sync --locked --extra dev
+      - name: Run release gate
+        run: uv run python -m pretensor.benchmark.release_gate
+      - name: Upload candidate-tag results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-gate-results
+          path: tests/benchmark/results/${{ github.ref_name }}/
+          if-no-files-found: warn
+          retention-days: 90
+
+  build:
+    name: Build distributions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+          python-version: "3.12"
+      - name: Verify tag matches pyproject version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          pkg=$(uv run python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          [ "$tag" = "$pkg" ] || { echo "tag $tag != pyproject $pkg"; exit 1; }
+      - name: Build sdist + wheel
+        run: uv build
+      - name: Validate distributions
+        run: uvx twine check --strict dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+          retention-days: 7
+
+  detect:
+    name: Classify tag
+    runs-on: ubuntu-latest
+    outputs:
+      is_prerelease: ${{ steps.check.outputs.is_prerelease }}
+    steps:
+      - id: check
+        run: |
+          if [[ "${{ github.ref_name }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(a|b|rc)[0-9]+$ ]]; then
+            echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  test-pypi:
+    name: Publish to TestPyPI (prereleases only)
+    needs: [build, detect, release-gate]
+    if: needs.detect.outputs.is_prerelease == 'true'
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi-release
+      url: https://test.pypi.org/project/pretensor/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  pypi:
+    name: Publish to PyPI
+    needs: [build, detect, test-pypi, release-gate]
+    if: >-
+      always() &&
+      needs.build.result == 'success' &&
+      needs.release-gate.result == 'success' &&
+      (needs.test-pypi.result == 'success' || needs.test-pypi.result == 'skipped')
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi-release
+      url: https://pypi.org/project/pretensor/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  archive-results:
+    # Opens a PR with the candidate-tag's release-gate JSON so the next
+    # tag cut has a baseline to compare against. Goes through PR review
+    # rather than pushing directly to main — main is the public OSS
+    # branch and integration there is PR-only by repo policy.
+    name: Archive release-gate baselines (open PR)
+    needs: [pypi]
+    # Explicit condition: the default success() check looks at the whole
+    # transitive needs chain, so the skipped TestPyPI job on final (non-pre)
+    # releases silently skipped this job even though pypi succeeded. That is
+    # how the v0.1.0 baseline was never archived.
+    if: always() && needs.pypi.result == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 1
+      - uses: actions/download-artifact@v4
+        with:
+          name: release-gate-results
+          path: tests/benchmark/results/${{ github.ref_name }}/
+      - name: Open baseline-archive PR
+        env:
+          TAG: ${{ github.ref_name }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # The artifact lands as untracked files in a fresh checkout, so
+          # `git diff` never sees it — check the porcelain status (which
+          # includes untracked paths) instead.
+          if [ -z "$(git status --porcelain tests/benchmark/results/)" ]; then
+            echo "No release-gate JSON to archive."
+            exit 0
+          fi
+          branch="auto/release-baselines/${TAG}"
+          git config user.name  "pretensor-vps-agent[bot]"
+          git config user.email "277292434+pretensor-vps-agent[bot]@users.noreply.github.com"
+          git checkout -b "${branch}"
+          git add "tests/benchmark/results/${TAG}/"
+          git commit -m "ci(release): archive release-gate baselines for ${TAG}"
+          git push -u origin "${branch}"
+          gh pr create \
+            --base main \
+            --head "${branch}" \
+            --title "ci(release): archive release-gate baselines for ${TAG}" \
+            --body "Auto-generated by the release workflow after a successful publish of ${TAG}. Carries the L1 + L2 result JSON the next tag cut will compare against; data only, no code change."
+
+  github-release:
+    name: Create GitHub Release
+    needs: [pypi, detect]
+    # Same transitive-skip fix as archive-results: run whenever the publish
+    # itself succeeded, even though TestPyPI was skipped for a final release.
+    if: always() && needs.pypi.result == 'success' && needs.detect.result == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Create release with generated notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+          PRERELEASE: ${{ needs.detect.outputs.is_prerelease }}
+        run: |
+          flags=(--generate-notes --verify-tag --title "${TAG}")
+          [ "${PRERELEASE}" = "true" ] && flags+=(--prerelease)
+          gh release create "${TAG}" "${flags[@]}"