quite-admin 0.4.1__tar.gz

quite_admin-0.4.1/.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: ci
+on:
+  push:
+    branches: ['**']
+  pull_request:
+  workflow_dispatch:
+  workflow_call:
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    uses: ./.github/workflows/tests.yml
+  databases:
+    uses: ./.github/workflows/databases.yml
+  compatibility:
+    uses: ./.github/workflows/compatibility.yml
+  security:
+    uses: ./.github/workflows/security.yml
+  ready:
+    name: CI ready
+    if: always()
+    needs: [tests, databases, compatibility, security]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every validation group to succeed
+        env:
+          CI_RESULTS: ${{ toJSON(needs) }}
+        run: |
+          python - <<'PY'
+          import json
+          import os
+          results = json.loads(os.environ['CI_RESULTS'])
+          failures = [name for name, job in results.items() if job['result'] != 'success']
+          if failures:
+              raise SystemExit('Required checks did not pass: ' + ', '.join(failures))
+          PY

quite_admin-0.4.1/.github/workflows/compatibility.yml

@@ -0,0 +1,80 @@
+name: dependency compatibility
+on: [workflow_call, workflow_dispatch]
+permissions:
+  contents: read
+
+jobs:
+  modern:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.11', '3.15']
+        profile: [minimum, latest]
+        include:
+          - python-version: '3.12'
+            profile: starlette-0
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+      - name: Resolve fresh dependency endpoints and run the full suite
+        run: >-
+          uv run --no-project --python ${{ matrix.python-version }} python scripts/test_compatibility.py
+          --profile ${{ matrix.profile }} --python ${{ matrix.python-version }}
+          --report build/compatibility/modern-${{ matrix.profile }}-${{ matrix.python-version }}.json
+      - name: Keep the ordinary lockfile unchanged
+        run: git diff --exit-code -- pyproject.toml uv.lock
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: modern-${{ matrix.profile }}-${{ matrix.python-version }}
+          path: build/compatibility/
+          if-no-files-found: warn
+
+  gino:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.11', '3.15']
+        profile: [minimum, latest]
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_USER: quite_admin
+          POSTGRES_PASSWORD: ci-test-only
+          POSTGRES_DB: quite_admin_gino_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U quite_admin -d quite_admin_gino_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 30
+    env:
+      QUITE_ADMIN_GINO_TEST_DATABASE_URL: postgresql://quite_admin:ci-test-only@127.0.0.1:5432/quite_admin_gino_test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+      - name: Check GINO endpoints separately from SQLAlchemy 2.x
+        run: >-
+          uv run --no-project --python ${{ matrix.python-version }} python scripts/test_compatibility.py --legacy
+          --profile ${{ matrix.profile }} --python ${{ matrix.python-version }}
+          --report build/compatibility/gino-${{ matrix.profile }}-${{ matrix.python-version }}.json
+      - name: Keep the ordinary lockfile unchanged
+        run: git diff --exit-code -- pyproject.toml uv.lock
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: gino-${{ matrix.profile }}-${{ matrix.python-version }}
+          path: build/compatibility/
+          if-no-files-found: warn

quite_admin-0.4.1/.github/workflows/databases.yml

@@ -0,0 +1,81 @@
+name: database contracts
+on: [workflow_call, workflow_dispatch]
+permissions:
+  contents: read
+
+jobs:
+  gino-legacy:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.11', '3.12', '3.13', '3.14', '3.15']
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_USER: quite_admin
+          POSTGRES_PASSWORD: ci-test-only
+          POSTGRES_DB: quite_admin_gino_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U quite_admin -d quite_admin_gino_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 30
+    env:
+      QUITE_ADMIN_GINO_TEST_DATABASE_URL: postgresql://quite_admin:ci-test-only@127.0.0.1:5432/quite_admin_gino_test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+      - run: uv sync --locked --no-dev --extra gino-legacy --group gino-check
+      - run: uv run --no-sync pytest --confcutdir=tests/gino tests/gino -q
+
+  contracts:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - database: postgresql
+            image: postgres:17
+            port: 5432
+            health: pg_isready -U quite_admin -d quite_admin_test
+          - database: mysql
+            image: mysql:8.4
+            port: 3306
+            health: mysqladmin ping -h 127.0.0.1 --silent
+    services:
+      database:
+        image: ${{ matrix.image }}
+        env:
+          POSTGRES_USER: quite_admin
+          POSTGRES_PASSWORD: ci-test-only
+          POSTGRES_DB: quite_admin_test
+          MYSQL_ROOT_PASSWORD: ci-root-test-only
+          MYSQL_USER: quite_admin
+          MYSQL_PASSWORD: ci-test-only
+          MYSQL_DATABASE: quite_admin_test
+        ports:
+          - ${{ matrix.port }}:${{ matrix.port }}
+        options: >-
+          --health-cmd "${{ matrix.health }}"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 30
+    env:
+      QUITE_ADMIN_TEST_DATABASE_URL: ${{ matrix.database }}://quite_admin:ci-test-only@127.0.0.1:${{ matrix.port }}/quite_admin_test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: '3.12'
+          enable-cache: true
+      - run: uv sync --locked --group database-check
+      - run: uv run --group database-check pytest tests/test_adapters.py tests/test_adapter_safety.py tests/test_relations.py tests/test_sql_reflection.py tests/test_concurrency.py tests/test_filters.py tests/test_diagram.py tests/sqlmodel -q

quite_admin-0.4.1/.github/workflows/pages.yml

@@ -0,0 +1,90 @@
+name: pages
+
+on:
+  workflow_run:
+    workflows: [ci]
+    types: [completed]
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: github-pages
+  cancel-in-progress: false
+
+jobs:
+  current:
+    if: >-
+      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master') ||
+      (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
+    runs-on: ubuntu-latest
+    outputs:
+      fresh: ${{ steps.head.outputs.fresh }}
+      sha: ${{ steps.head.outputs.sha }}
+    steps:
+      - uses: actions/github-script@v7
+        id: head
+        with:
+          script: |
+            const {data} = await github.rest.repos.getBranch({...context.repo, branch:'master'});
+            const sha = context.payload.workflow_run?.head_sha || context.sha;
+            const runs = await github.rest.actions.listWorkflowRuns({
+              ...context.repo, workflow_id:'ci.yml', head_sha:sha, per_page:100,
+            });
+            const verified = runs.data.workflow_runs.some(run =>
+              run.head_sha === sha && run.conclusion === 'success');
+            core.setOutput('fresh', String(data.commit.sha === sha && verified));
+            core.setOutput('sha', sha);
+
+  build:
+    needs: current
+    if: needs.current.outputs.fresh == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.current.outputs.sha }}
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: '3.12'
+          enable-cache: true
+      - run: uv sync --locked
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+      - run: npm ci
+      - run: npm run docs:build
+      - run: npm run demo:test
+      - uses: actions/configure-pages@v5
+      - uses: actions/upload-pages-artifact@v4
+        with:
+          path: build/docs
+
+  deploy:
+    needs: [current, build]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/github-script@v7
+        id: head
+        env:
+          TESTED_SHA: ${{ needs.current.outputs.sha }}
+        with:
+          script: |
+            const {data} = await github.rest.repos.getBranch({...context.repo, branch:'master'});
+            core.setOutput('fresh', String(data.commit.sha === process.env.TESTED_SHA));
+      - name: Deploy Diplodoc
+        if: steps.head.outputs.fresh == 'true'
+        id: deployment
+        uses: actions/deploy-pages@v4

quite_admin-0.4.1/.github/workflows/pypi.yml

@@ -0,0 +1,121 @@
+name: publish to PyPI
+on:
+  workflow_run:
+    workflows: [release]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Published and validated version tag to upload to PyPI
+        required: true
+        type: string
+
+permissions:
+  contents: read
+concurrency:
+  group: pypi
+  cancel-in-progress: false
+env:
+  SOURCE_REF: ${{ inputs.tag || github.event.workflow_run.head_sha }}
+  REQUESTED_TAG: ${{ inputs.tag }}
+
+jobs:
+  build:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'release') &&
+       github.event.workflow_run.head_repository.full_name == github.repository)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      version: ${{ steps.metadata.outputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ env.SOURCE_REF }}
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: '3.12'
+      - name: Validate release metadata
+        id: metadata
+        run: |
+          version=$(uv run --no-project python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')
+          tag="v$version"
+          if [ -n "$REQUESTED_TAG" ]; then
+            test "$tag" = "$REQUESTED_TAG"
+          fi
+          uv run --no-project python scripts/check_release.py --tag "$tag"
+          printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"
+          printf 'RELEASE_TAG=%s\n' "$tag" >> "$GITHUB_ENV"
+      - name: Verify the published tag and validation results
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          SOURCE_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          test "$(gh release view "$RELEASE_TAG" --json isDraft --jq '.isDraft')" = false
+          commit=$(git rev-parse HEAD)
+          test "$(gh api "repos/$GH_REPO/commits/$RELEASE_TAG" --jq '.sha')" = "$commit"
+          if [ "$GITHUB_EVENT_NAME" = workflow_run ]; then
+            test "$commit" = "$SOURCE_SHA"
+          else
+            runs=$(gh api "repos/$GH_REPO/actions/workflows/ci.yml/runs?head_sha=$commit&status=success&per_page=1" --jq '.total_count')
+            test "$runs" -gt 0 || { echo 'The tagged commit needs a successful full CI run.'; exit 1; }
+          fi
+      - name: Build one universal wheel and source distribution
+        run: uv build
+      - name: Check metadata and package contents before uploading
+        run: |
+          uvx --from 'twine>=6,<7' twine check --strict dist/*
+          uv run --no-project python scripts/check_distributions.py
+      - uses: actions/upload-artifact@v4
+        with:
+          name: pypi-distributions
+          path: |
+            dist/*.whl
+            dist/*.tar.gz
+          if-no-files-found: error
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/quite-admin
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: pypi-distributions
+          path: dist
+      - name: Publish verified distributions through Trusted Publishing
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true
+
+  verify:
+    needs: [build, publish]
+    runs-on: ubuntu-latest
+    permissions: {}
+    env:
+      PACKAGE_VERSION: ${{ needs.build.outputs.version }}
+    steps:
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: '3.12'
+      - name: Install the released package from PyPI outside the checkout
+        run: |
+          for attempt in 1 2 3 4 5 6; do
+            if uv run --no-project --with "quite-admin==$PACKAGE_VERSION" python -I -c 'import os, quite_admin; from importlib import metadata, resources; assert quite_admin.__version__ == metadata.version("quite-admin") == os.environ["PACKAGE_VERSION"]; assert resources.files("quite_admin").joinpath("static/forms.js").is_file(); print("Installed quite-admin", quite_admin.__version__)'; then
+              exit 0
+            fi
+            sleep 10
+          done
+          exit 1

quite_admin-0.4.1/.github/workflows/release.yml

@@ -0,0 +1,57 @@
+name: release
+on:
+  push:
+    tags: ['v*']
+  release:
+    types: [published]
+permissions:
+  contents: read
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+env:
+  RELEASE_TAG: ${{ github.event.release.tag_name || github.ref_name }}
+
+jobs:
+  metadata:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ env.RELEASE_TAG }}
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: '3.12'
+      - run: uv run --no-project python scripts/check_release.py --tag "$RELEASE_TAG"
+
+  checks:
+    needs: metadata
+    uses: ./.github/workflows/ci.yml
+
+  publish:
+    if: github.event_name == 'push'
+    needs: [metadata, checks]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ env.RELEASE_TAG }}
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: '3.12'
+      - run: uv run --no-project python scripts/check_release.py --tag "$RELEASE_TAG" --notes release-notes.md
+      - name: Publish release with changelog; GitHub supplies source archives
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          if gh release view "$RELEASE_TAG" > /dev/null 2>&1; then
+            gh release edit "$RELEASE_TAG" --title "Quite Admin $RELEASE_TAG" --notes-file release-notes.md
+          else
+            gh release create "$RELEASE_TAG" --verify-tag --draft --title "Quite Admin $RELEASE_TAG" --notes-file release-notes.md
+          fi
+          gh release edit "$RELEASE_TAG" --draft=false --latest

quite_admin-0.4.1/.github/workflows/security.yml

@@ -0,0 +1,50 @@
+name: dependency security
+on:
+  workflow_dispatch:
+  workflow_call:
+  schedule:
+    - cron: '17 6 * * 1'
+permissions:
+  contents: read
+
+jobs:
+  python-audit:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - adapter: modern
+            export-options: --extra all --all-groups
+          - adapter: gino-legacy
+            export-options: --no-dev --extra gino-legacy --group gino-check
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: '3.12'
+          enable-cache: true
+      - run: uv export --locked ${{ matrix.export-options }} --no-emit-project -o requirements-audit.txt
+      - run: uvx --from pip-audit==2.10.1 pip-audit -r requirements-audit.txt --require-hashes --disable-pip --strict
+
+  documentation-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+      - run: npm ci
+      - run: npm audit --audit-level=high
+
+  dependency-review:
+    if: github.event_name == 'pull_request' && !github.event.repository.private
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/dependency-review-action@v5
+        with:
+          fail-on-severity: moderate
+          fail-on-scopes: runtime, development, unknown

quite_admin-0.4.1/.github/workflows/tests.yml

@@ -0,0 +1,98 @@
+name: tests
+on: [workflow_call, workflow_dispatch]
+
+permissions:
+  contents: read
+
+jobs:
+  pytest:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.11', '3.12', '3.13', '3.14', '3.15']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+      - run: uv sync --locked
+      - run: uv run ruff check src tests examples scripts
+      - run: uv run ruff format --check src tests examples scripts
+      - run: uv run python scripts/check_release.py
+      - run: uv run python scripts/check_api.py --profile modern
+      - run: uv run pytest -q
+
+  logging-backends:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: '3.12'
+          enable-cache: true
+      - run: uv sync --locked --group logging-check
+      - run: uv run --group logging-check python -c 'import picologging, structlog, loguru'
+      - run: uv run --group logging-check pytest tests/test_logging.py -q
+
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: '3.12'
+          enable-cache: true
+      - run: uv sync --locked
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+      - run: npm ci
+      - run: npm run docs:build
+      - run: npm run demo:test
+      - uses: actions/upload-artifact@v4
+        with:
+          name: quite-admin-docs
+          path: build/docs
+          if-no-files-found: error
+
+  browser:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - browser: chromium
+            os: ubuntu-latest
+          - browser: firefox
+            os: ubuntu-latest
+          - browser: webkit
+            os: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: '0.13.6'
+          python-version: '3.12'
+          enable-cache: true
+      - run: uv sync --locked
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+      - run: npm ci
+      - run: npx --no-install playwright install --with-deps ${{ matrix.browser }}
+      - run: npm run browser:test -- --project=${{ matrix.browser }}
+      - uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: browser-${{ matrix.browser }}
+          path: |
+            test-results/
+            playwright-report/
+          if-no-files-found: warn

quite_admin-0.4.1/.gitignore

@@ -0,0 +1,17 @@
+.venv/
+.venv-gino/
+.venv-gino-legacy/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+dist/
+*.egg-info/
+*.db
+.env
+artifacts/
+.idea/
+node_modules/
+build/
+test-results/
+playwright-report/

quite_admin-0.4.1/AGENTS.md

@@ -0,0 +1,25 @@
+# quite-admin
+
+- Support Python 3.11–3.15, FastAPI and Litestar. Keep the core ORM-independent; access data through adapters.
+- Preserve authentication, authorization, CSRF, field restrictions and CSP. Never log passwords, tokens or record values.
+- Document user-facing changes in both Diplodoc languages: `docs/en` is primary, `docs/ru` is the translation. Update both navigation files when adding pages.
+- Verify changed behavior with integration tests. Do not suppress dependency warnings.
+- Python checks: `uv run pytest -q`, `uv run ruff check src tests examples scripts`, `uv run ruff format --check src tests examples scripts`.
+- Run `npm run docs:build` after documentation changes.
+
+## Versioning
+
+- Use PEP 440-compatible `MAJOR.MINOR.PATCH` versions.
+- `PATCH`: backward-compatible bug fixes, security fixes and runtime dependency fixes.
+- `MINOR`: new features, options and adapters that preserve existing default behavior.
+- `MAJOR`: incompatible public API or behavior changes, feature removal, or dropping Python / framework / ORM support. Before `1.0`, bump `MINOR` for these changes; moving to `1.0` requires a separate decision about API stability.
+- Reset `MINOR` and `PATCH` when bumping `MAJOR`; reset `PATCH` when bumping `MINOR`.
+- Documentation-only changes, tests, behavior-preserving refactoring and development tooling updates do not require a library version bump. A dependency upgrade alone does not imply `MAJOR`: assess the library's compatibility.
+- Plan the version relative to the latest released version, choosing the highest applicable bump. If there is no release, use the previous recorded version. Bump once per batch of changes; the latest finalized release is `0.4.1` (2026-11-01); subsequent changes must target a higher version using the rules above. Keep the version visible in README and record changes in CHANGELOG.md.
+- The source of truth is `project.version` in `pyproject.toml`. Update `src/quite_admin/__init__.py::__version__` in sync and regenerate `uv.lock` with `uv lock`; check version references in the UI and documentation.
+- Every version-changing commit must update `pyproject.toml`, README, `__version__` and `uv.lock` together. Never change only the displayed README version; verify that all library version references agree before committing.
+- `package.json` and `package-lock.json` belong to documentation tooling and need not match the Python package version. Update lockfiles through their package managers.
+- Document breaking changes and migration steps in EN/RU. Create release tags and publish only when explicitly requested by the user.
+- Preserve the public API baseline in `api/*-0.4.json`; run `python scripts/check_api.py --profile modern`. Keep required adapter methods separate from optional capabilities and preserve template API 1. See `docs/en/api-stability.md` for deprecation and migration rules.
+- Run `python scripts/check_release.py` before a version/release commit; finalize the changelog date before tagging. Tagged releases use `.github/workflows/release.yml`; version updates alone never publish.
+- GitHub releases retain only automatic source archives. After the complete validation gate, a version-tag push publishes the GitHub release with the matching changelog. The separate `pypi.yml` workflow builds one wheel/sdist pair, validates metadata 2.4 and clean installations, and publishes to PyPI through the `pypi` environment and Trusted Publishing. Never build packages in each Python matrix entry or store a PyPI API token in the repository.