ragops 2.1.0__tar.gz → 2.2.0__tar.gz

{ragops-2.1.0 → ragops-2.2.0}/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes follow Keep a Changelog. This project uses Semantic Versioni
 
 ## [Unreleased]
 
+## [2.2.0] - 2026-07-13
+
+### Added
+
+- Quota-independent local release fallback with full offline validation,
+  build-once artifacts, reproducible SBOM, checksums, GitHub CLI publication,
+  and fail-closed optional PyPI token promotion.
+
 ## [2.1.0] - 2026-07-13
 
 ### Added

ragops-2.2.0/NEXT_SESSION.md

@@ -0,0 +1,195 @@
+# RAGOps — handoff for 2026-07-14
+
+> Superseded on 2026-07-13 by the staged completion run. RAGOps v1.8.0 and
+> v2.0.0 and v2.1.0 were released and verified on GitHub and PyPI. The live BLOCK
+> publisher path was proven through PR #7, including an idempotent update of the
+> same comment. v2.0.0 adds first-class evaluator gates, unified compare
+> semantics, strict numeric validation, fail-closed API authentication and
+> bounds, synthetic benchmark positioning, Product Design remediation,
+> Python 3.13 CI, build-once promotion, CycloneDX SBOM, checksums, provenance,
+> and complete package metadata. v2.1.0 adds portable Ragas/DeepEval/Langfuse/
+> custom metric evidence plus a downstream publisher recipe. Canonical evidence
+> is in `docs/project/v2.1-acceptance.md`.
+>
+> Remaining items below that require real design partners, account-owner
+> settings, credential rotation, hosted infrastructure, or an independent
+> security assessment remain external owner work. They are not incomplete core
+> implementation. Security testing stays deferred by explicit owner request.
+
+This is a local-only working note. Do not treat unchecked items as shipped or
+as customer evidence.
+
+## Current verified state
+
+- Branch: `main`
+- Latest pushed commit: `deeaf7e` (`docs: record live publisher and partner outreach`)
+- Latest public release: `v1.7.0` on GitHub and PyPI
+- v1.8 scope: complete on `main`, not versioned or released
+- Local quality gate: Ruff clean, 99 tests passing, 10 JSON schemas parsing
+- PR publisher live proof: [PR #4](https://github.com/thangldw/ragops/pull/4)
+  created one PASS comment and updated the same comment for a second head SHA;
+  the PR was closed without merge and the temporary branch was deleted.
+- Design-partner recruitment: [Discussion #5](https://github.com/thangldw/ragops/discussions/5)
+  is public. No reviewed real-partner observations or ROI evidence exist yet.
+- Acceptance record: `docs/project/v1.8-acceptance.md`
+
+## P0 — do before a v1.8 release
+
+### 1. Verify the live BLOCK path
+
+- [ ] Create a temporary PR that changes the reusable smoke candidate from the
+  passing baseline to `benchmark-regressed.json`.
+- [ ] Confirm the release-gate workflow fails with exit `2`.
+- [ ] Confirm the publisher still creates a `BLOCK` comment containing the
+  canonical workflow link and correct head SHA.
+- [ ] Push a second commit and confirm the same bot comment is updated rather
+  than duplicated.
+- [ ] Close without merge and delete the temporary branch.
+- [ ] Record the PR/run/comment links in `docs/project/v1.8-acceptance.md`.
+
+Why: PASS creation/update is proven live; BLOCK publication is covered by unit
+tests but has not yet been exercised end to end on GitHub.
+
+### 2. Decide whether to release v1.8.0
+
+- [ ] Owner explicitly selects or rejects the v1.8.0 release boundary.
+- [ ] If GO, use `skills/ragops-release/SKILL.md`.
+- [ ] Bump `pyproject.toml`, `src/ragops/__init__.py`, workflow examples, tests,
+  README install command, and issue template from 1.7.0 to 1.8.0.
+- [ ] Move Unreleased changelog entries into `1.8.0` and write
+  `docs/releases/v1.8.0.md`.
+- [ ] Run Ruff, full tests on available Python versions, PASS/BLOCK fixtures,
+  pilot CLI, API health/evaluate, all schemas, build, wheel/sdist clean install,
+  and version-consistency checks.
+- [ ] Tag and publish GitHub Release only after owner GO.
+- [ ] Trigger PyPI Trusted Publishing for `v1.8.0`, then verify public wheel,
+  source distribution, clean install, and pilot command.
+- [ ] Update v1.8 acceptance and launch checklist with public artifact evidence.
+
+Important: the package metadata on `main` still says `1.7.0`; do not publish a
+build from `main` until the release version is intentionally bumped.
+
+## P0 — real design-partner work
+
+### 3. Qualify the first design partner
+
+- [ ] Review replies to Discussion #5; do not infer interest from views or stars.
+- [ ] Select a team with an existing RAG/agent pilot, recurring regression pain,
+  a technical owner, and a workflow/business owner.
+- [ ] Hold the 60-minute discovery using
+  `docs/gtm/design-partner-outreach.md`.
+- [ ] Agree on one workflow, eligible cohort, baseline/pilot periods, exclusions,
+  primary targets, critical stop conditions, and decision owner.
+- [ ] Obtain explicit consent for pseudonymous workflow measurement.
+- [ ] Start with synthetic/redacted traces. Do not collect raw customer
+  documents, prompts, names, email addresses, credentials, or secrets.
+
+### 4. Freeze and run the pilot contract
+
+- [ ] Copy the synthetic manifest/observations/economics fixtures into a private,
+  partner-reviewed workspace; do not commit partner data to the public repo.
+- [ ] Replace synthetic identifiers with pseudonymous IDs.
+- [ ] Collect at least two weeks or 50 eligible baseline tasks when feasible.
+- [ ] Freeze targets before pilot exposure.
+- [ ] Collect pilot observations using the same task definition and exclusions.
+- [ ] Run `ragops pilot-report` without economics first.
+- [ ] Add economics only after the partner reviews hourly cost and pilot
+  investment assumptions.
+- [ ] Review SCALE/HOLD/REDESIGN jointly and document owner sign-off.
+- [ ] Publish no adoption or ROI percentage until cohort, period, denominator,
+  exclusions, assumptions, consent, and partner approval are documented.
+
+Runbook: `docs/gtm/design-partner-pilot-runbook.md`
+
+## P1 — repository and adoption cleanup
+
+### 5. Documentation consistency
+
+- [ ] Update `docs/demo/cv-linkedin-copy.md`, which still says 50 automated
+  tests; use 99 only if the statement is meant to describe current `main`.
+- [ ] Review historical v1.7 wording that says PR comments are design-only.
+  Preserve release history, but link readers to the v1.8 implementation where
+  current-state wording could be ambiguous.
+- [ ] Update `docs/project/program-completion-audit.md` after v1.8 is released or
+  a real pilot produces evidence.
+- [ ] Recheck README, Pages, portfolio, screenshots, and social preview after
+  the next version number/test count changes.
+
+### 6. GitHub owner settings
+
+- [ ] Upload `docs/demo/social-preview.png` as the repository social preview if
+  it is still not configured.
+- [ ] Configure branch protection and required checks for `main` under the
+  owner's collaboration policy.
+- [ ] Decide whether the PR comment publisher should be required, optional, or
+  limited to selected paths.
+- [ ] Confirm workflow retention is long enough for audit evidence and short
+  enough for the intended data-retention policy.
+
+### 7. Publisher adopter experience
+
+- [ ] Add a copyable downstream-repository publisher recipe; the current
+  workflow is configured for `RAGOps reusable gate smoke` in this repository.
+- [ ] Document the exact workflow-name allowlist change required by adopters.
+- [ ] Exercise a fork PR. Expected behavior is safe publication when GitHub
+  supplies exactly one PR association, otherwise fail closed without a comment.
+- [ ] Add live or fixture coverage for expired artifacts, more than 100
+  artifacts, more than 1,000 comments, and GitHub API rate-limit responses.
+- [ ] Decide whether artifact/comment retention and deletion need an ADR.
+
+## P1 — pilot measurement improvements after first feedback
+
+- [ ] Confirm whether repeat usage across two ISO weeks is meaningful for the
+  partner's workflow cadence.
+- [ ] Decide whether incomplete tasks belong in success and duration
+  denominators; current success/duration metrics use completed tasks.
+- [ ] Add explicit exclusion reasons if a real pilot needs auditable exclusions.
+- [ ] Consider paired-task or comparison-cohort analysis before making causal
+  claims. Current before/after reporting is observational.
+- [ ] Add uncertainty intervals only when sample size and study design justify
+  them; do not create statistical decoration for a tiny pilot.
+- [ ] Validate willingness-to-pay separately from estimated labor savings.
+
+## P2 — not immediate source-code work
+
+- [ ] Hosted 2.0 requires cloud, SSO/RBAC, encryption, tenant isolation,
+  billing, support, incident response, legal, and operations decisions.
+- [ ] Independent security review is required before processing customer-
+  sensitive traces. The previously requested Codex Security scan was explicitly
+  skipped and should remain deferred unless the owner reauthorizes it.
+- [ ] Provider-backed judges, plugin sandboxing, signed baselines, and production
+  data controls remain future architecture work, not v1.8 release blockers.
+
+## Account hygiene
+
+- [ ] Rotate the PyPI password because it was shared in conversation history.
+- [ ] Regenerate PyPI recovery codes because they were also exposed in the
+  working context; store the replacement set only in a password manager.
+- [ ] Confirm 2FA and the `thangldw/ragops` Trusted Publisher still work after
+  rotation. Do not add a long-lived PyPI token to GitHub secrets.
+
+## Fast start commands
+
+```bash
+cd /Users/thang/Documents/ragops
+git status --short
+git pull --ff-only
+ruff check .
+PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 pytest -q
+
+PYTHONPATH=src python -m ragops.cli pilot-report \
+  --manifest docs/gtm/pilot-fixtures/synthetic-manifest.json \
+  --observations docs/gtm/pilot-fixtures/synthetic-observations.jsonl \
+  --economics docs/gtm/pilot-fixtures/synthetic-economics.json \
+  --output /tmp/ragops-pilot-report.md
+
+diff -u docs/gtm/synthetic-pilot-report.md /tmp/ragops-pilot-report.md
+```
+
+## Recommended order tomorrow
+
+1. Live BLOCK PR publisher test.
+2. Review Discussion #5 and qualify any real respondent.
+3. Decide v1.8.0 release GO/HOLD.
+4. If GO, run the full release workflow.
+5. Finish documentation/settings cleanup while waiting for partner baseline data.

{ragops-2.1.0 → ragops-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ragops
-Version: 2.1.0
+Version: 2.2.0
 Summary: Evaluation and red-team release gates for RAG and agent systems
 Project-URL: Homepage, https://github.com/thangldw/ragops
 Project-URL: Documentation, https://github.com/thangldw/ragops#readme

ragops-2.2.0/docs/architecture/adr/0019-local-release-fallback.md

@@ -0,0 +1,22 @@
+# ADR 0019: Local release fallback
+
+Status: Accepted for owner review
+
+## Decision
+
+Provide `scripts/local_release.py` with three explicit phases: `verify`,
+`publish-github`, and `publish-pypi`. Verification produces immutable package
+artifacts, an SBOM, checksums, and local evidence. GitHub publication requires
+`--yes`; PyPI additionally requires a project-scoped token supplied only via an
+environment variable and promotes the artifacts downloaded back from GitHub.
+
+Workflows may be disabled through the GitHub UI or `gh workflow disable` while
+quota is exhausted. They remain versioned so the owner can restore the preferred
+OIDC/provenance path later.
+
+## Consequences
+
+The fallback avoids Actions minutes and keeps release gates observable. Local
+PyPI uploads do not receive GitHub Trusted Publisher identity or GitHub build
+provenance, so `LOCAL_RELEASE_EVIDENCE.json` records `trusted_publishing: false`.
+The owner must protect and rotate the temporary project token.

ragops-2.2.0/docs/engineering/local-release.md

@@ -0,0 +1,32 @@
+# Release without GitHub Actions
+
+Use this only while GitHub Actions is unavailable. Run from a clean release
+commit with Python 3.11+ and `gh` authenticated.
+
+```bash
+python -m pip install -e '.[dev]' build cyclonedx-bom==7.3.0 twine
+python scripts/local_release.py verify --tag vX.Y.Z
+python scripts/local_release.py publish-github --tag vX.Y.Z --yes
+```
+
+The first command runs all required local gates and writes `dist/` artifacts,
+`SHA256SUMS`, an SBOM, and `LOCAL_RELEASE_EVIDENCE.json`. The second creates and
+pushes the annotated tag, then creates the GitHub Release directly with `gh`.
+
+PyPI cannot use the repository's GitHub OIDC Trusted Publisher from a local
+machine. If PyPI publication cannot wait, create a project-scoped token, expose
+it only for this command, and rotate/revoke it afterwards:
+
+```bash
+read -s PYPI_API_TOKEN && export PYPI_API_TOKEN
+python scripts/local_release.py publish-pypi --tag vX.Y.Z --yes
+unset PYPI_API_TOKEN
+```
+
+The PyPI phase downloads and verifies the GitHub Release artifacts before
+uploading them; it never rebuilds. Do not paste tokens into chat, shell history,
+configuration files, or repository secrets.
+
+Pause quota-consuming workflows with `gh workflow disable <workflow-file>` and
+restore them later with `gh workflow enable <workflow-file>`. Keep manual notes
+of every disabled workflow.

{ragops-2.1.0 → ragops-2.2.0}/docs/engineering/pypi-publishing.md

@@ -9,10 +9,10 @@ PyPI API token and publishes only an existing tag whose `vX.Y.Z` value matches
 
 - Project: [ragops on PyPI](https://pypi.org/project/ragops/)
 - First Trusted Publishing release: `1.6.0`
-- Current verified release: `2.0.0`
+- Current verified release: `2.1.0`
 - GitHub environment: `pypi`
 - Publisher: `thangldw/ragops`, workflow `publish-pypi.yml`
-- Verification: 2.0.0 wheel and sdist present; clean install and
+- Verification: 2.1.0 wheel and sdist present; clean install and
   credential-free proposal-review demo pass
 
 ## One-time owner setup
@@ -32,7 +32,7 @@ GitHub's current OIDC guidance is linked from the
 ## Publish an accepted tag
 
 1. Open **Actions → Publish package to PyPI → Run workflow**.
-2. Enter an existing tag such as `v2.0.0`.
+2. Enter an existing tag such as `v2.1.0`.
 3. Approve the `pypi` environment when protection rules require it.
 4. After success, install in a clean environment and compare the installed
    version and wheel hash with the GitHub Release asset.

ragops-2.2.0/docs/product/requirements-v2.2.md

@@ -0,0 +1,24 @@
+# RAGOps v2.2 requirement: quota-independent release fallback
+
+## Contract
+
+When GitHub Actions is unavailable or out of quota, the owner can run the same
+quality gates locally, build artifacts once, and publish those exact artifacts
+without enabling Actions.
+
+Acceptance requires Ruff, the complete offline test suite, PASS and BLOCK
+benchmark checks, package build, reproducible CycloneDX SBOM, SHA-256 manifest,
+and machine-readable local evidence. GitHub publication uses `gh` directly.
+PyPI publication is opt-in and fails closed unless a project-scoped API token is
+provided through `PYPI_API_TOKEN`.
+
+## Compatibility
+
+This is an additive operational path. It does not change public schemas, metric
+meaning, gate thresholds, CLI contracts, or the open-core boundary.
+
+## Non-goals
+
+- Bypassing PyPI authentication or claiming OIDC provenance for a local build.
+- Replacing the normal Trusted Publishing path after Actions capacity returns.
+- Running security tests in this phase.

{ragops-2.1.0 → ragops-2.2.0}/docs/project/program-completion-audit.md

@@ -23,7 +23,7 @@ public presentation assets.
 | v1.7 broader adoption proof | Released | `docs/project/v1.7-acceptance.md` |
 | v1.8 review visibility and measured adoption | Released | `docs/project/v1.8-acceptance.md` |
 | v2.0 trustworthy extensible release gates | Released | `docs/project/v2.0-acceptance.md` |
-| v2.1 portable external evaluator evidence | Release candidate | `docs/project/v2.1-acceptance.md` |
+| v2.1 portable external evaluator evidence | Released | `docs/project/v2.1-acceptance.md` |
 
 ## FDE competency coverage
 
@@ -63,6 +63,6 @@ therefore launch activities rather than missing repository implementation:
 
 ## Final recommendation
 
-Use release 2.0.0 for FDE interviews, OSS feedback, and customer discovery.
+Use release 2.1.0 for FDE interviews, OSS feedback, and customer discovery.
 Proceed to a real offline design-partner pilot; do not market the control-plane
 alpha as production SaaS or claim measured ROI until external evidence exists.

{ragops-2.1.0 → ragops-2.2.0}/docs/project/v2.1-acceptance.md

@@ -2,9 +2,9 @@
 
 ## Decision
 
-**GO for release 2.1.0. The owner authorized continued staged implementation
-and release on 2026-07-13. Public publication remains conditional on release
-validation and green GitHub CI.**
+**RELEASED as 2.1.0. The owner authorized continued staged implementation and
+release on 2026-07-13; release validation, GitHub CI, GitHub publication, and
+PyPI promotion all passed.**
 
 ## Contract impact
 
@@ -25,7 +25,9 @@ the producing framework and reviewed policy.
 | Core boundary | Pass | No Ragas, DeepEval, Langfuse, model SDK, or runtime dependency added |
 | Downstream publisher | Pass | Actionlint clean; commit-pinned trusted checkout, exact allowlist, least privileges, and no PR-code execution |
 | Core quality | Pass | Ruff clean and 138 tests pass locally; feature PR passed Python 3.11, 3.12, and 3.13 |
-| Release supply chain | Pending | v2.1 tag must prove build-once, SBOM, checksums, provenance, and byte-identical PyPI promotion |
+| Release supply chain | Pass | [Run 29221256309](https://github.com/thangldw/ragops/actions/runs/29221256309) built once and published SBOM, checksums, provenance, wheel, and source |
+| PyPI promotion | Pass | [Run 29221291458](https://github.com/thangldw/ragops/actions/runs/29221291458) verified GitHub Release checksums and published the exact wheel/source |
+| Public artifacts | Pass | [v2.1.0](https://github.com/thangldw/ragops/releases/tag/v2.1.0) and PyPI hashes match byte-for-byte; clean simple-index install reports 2.1.0 and external-metric evaluate exits 0 |
 
 ## Limitations
 

ragops-2.2.0/docs/project/v2.2-acceptance.md

@@ -0,0 +1,29 @@
+# v2.2 quota-independent release acceptance
+
+## Decision
+
+**READY FOR LOCAL RELEASE.** Owner authorization was given to implement and
+release without GitHub Actions while the monthly quota is exhausted.
+
+## Contract impact
+
+The fallback is additive and does not change public schemas, metrics, release
+gate meaning, existing CLI/API contracts, or the open-core boundary.
+
+## Acceptance evidence
+
+| Gate | Result | Evidence |
+| --- | --- | --- |
+| Requirement and ADR | Pass | Requirements v2.2 and ADR 0019 |
+| Fail-closed publication | Pass | Explicit `--yes`; PyPI also requires `PYPI_API_TOKEN` |
+| Exact artifact promotion | Pass | PyPI phase downloads and verifies GitHub Release checksums; no rebuild |
+| Core quality | Pass | Ruff clean; 133 passed, 1 skipped locally |
+| GitHub Actions quota | Pass | Triggering workflows disabled manually before repository publication |
+| GitHub Release | Pending | Run local verify on the release commit, then publish with `gh` |
+| PyPI | Pending | Requires a project-scoped API token; GitHub OIDC is unavailable locally |
+
+## Limitations
+
+- Local artifacts do not carry GitHub build-provenance attestation.
+- Python-version matrix coverage is limited to locally installed interpreters.
+- Security testing remains deferred by owner instruction.

ragops-2.2.0/docs/releases/v2.2.0.md

@@ -0,0 +1,27 @@
+# RAGOps v2.2.0 — quota-independent release fallback
+
+RAGOps v2.2.0 adds a fully local release lane for periods when GitHub Actions
+is unavailable or has exhausted its monthly quota.
+
+## Highlights
+
+- Run Ruff, the full offline test suite, and deterministic PASS/BLOCK benchmark
+  checks locally before packaging.
+- Build the wheel and source distribution once, with a reproducible CycloneDX
+  SBOM, SHA-256 manifest, and machine-readable local evidence.
+- Create the annotated tag and GitHub Release directly through the authenticated
+  GitHub CLI without starting an Actions runner.
+- Optionally promote the exact GitHub Release artifacts to PyPI with an explicit
+  project-scoped token; the operation fails closed when the token is absent.
+
+## Compatibility
+
+This additive release changes no schema, evaluator meaning, gate threshold,
+existing CLI command, API contract, or open-core boundary.
+
+## Known limits
+
+Local PyPI publication cannot claim GitHub OIDC Trusted Publisher identity or
+GitHub build provenance. The preferred Trusted Publishing workflow should be
+restored when Actions capacity returns. Security testing remains deferred by
+owner instruction.

{ragops-2.1.0 → ragops-2.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ragops"
-version = "2.1.0"
+version = "2.2.0"
 description = "Evaluation and red-team release gates for RAG and agent systems"
 readme = "README.md"
 requires-python = ">=3.11"

ragops-2.2.0/scripts/local_release.py

@@ -0,0 +1,153 @@
+#!/usr/bin/env python3
+"""Quota-independent release lane for RAGOps.
+
+Build and validate locally, then publish the exact artifacts to GitHub and,
+only with an explicitly supplied project-scoped token, PyPI.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tomllib
+from datetime import UTC, datetime
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+DIST = ROOT / "dist"
+
+
+def run(
+    *args: str,
+    env: dict[str, str] | None = None,
+    cwd: Path = ROOT,
+) -> None:
+    print("+", " ".join(args), flush=True)
+    subprocess.run(args, cwd=cwd, env=env, check=True)
+
+
+def version() -> str:
+    data = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))
+    return str(data["project"]["version"])
+
+
+def assert_tag(tag: str) -> str:
+    expected = f"v{version()}"
+    if tag != expected:
+        raise SystemExit(f"tag {tag!r} does not match package version {expected!r}")
+    if not (ROOT / "docs" / "releases" / f"{tag}.md").is_file():
+        raise SystemExit(f"missing release notes: docs/releases/{tag}.md")
+    return expected
+
+
+def artifacts() -> list[Path]:
+    result = sorted(DIST.glob("ragops-*.whl")) + sorted(DIST.glob("ragops-*.tar.gz"))
+    if len(result) != 2:
+        raise SystemExit("expected exactly one wheel and one source distribution in dist/")
+    return result
+
+
+def checksums(paths: list[Path]) -> Path:
+    manifest = DIST / "SHA256SUMS"
+    lines = [f"{hashlib.sha256(path.read_bytes()).hexdigest()}  {path.name}" for path in paths]
+    manifest.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    return manifest
+
+
+def verify(tag: str) -> None:
+    assert_tag(tag)
+    run("ruff", "check", ".")
+    env = os.environ.copy()
+    env["PYTEST_DISABLE_PLUGIN_AUTOLOAD"] = "1"
+    run(sys.executable, "-m", "pytest", "-q", env=env)
+    run("ragops", "evaluate", "--scenario", "scenarios/japanese_troubleshooting/scenario.json",
+        "--responses", "scenarios/japanese_troubleshooting/sample_responses.json")
+    blocked = subprocess.run(
+        ["ragops", "compare", "--scenario", "scenarios/japanese_troubleshooting/benchmark-v0.2.json",
+         "--baseline", "scenarios/japanese_troubleshooting/benchmark-baseline.json", "--candidate",
+         "scenarios/japanese_troubleshooting/benchmark-regressed.json"], cwd=ROOT
+    )
+    if blocked.returncode != 2:
+        raise SystemExit(f"expected regression gate exit 2, got {blocked.returncode}")
+    shutil.rmtree(DIST, ignore_errors=True)
+    run(sys.executable, "-m", "build")
+    built = artifacts()
+    sbom = DIST / f"ragops-{version()}.cdx.json"
+    if shutil.which("cyclonedx-py"):
+        run("cyclonedx-py", "environment", sys.executable, "--output-reproducible",
+            "--output-file", str(sbom))
+    else:
+        raise SystemExit("cyclonedx-py is required: python -m pip install cyclonedx-bom==7.3.0")
+    manifest = checksums([*built, sbom])
+    evidence = {
+        "schema": "ragops-local-release-evidence-0.1",
+        "tag": tag,
+        "commit": subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=ROOT, text=True).strip(),
+        "created_at": datetime.now(UTC).isoformat(),
+        "validation": "pass",
+        "trusted_publishing": False,
+        "artifacts": [path.name for path in [*built, sbom, manifest]],
+    }
+    (DIST / "LOCAL_RELEASE_EVIDENCE.json").write_text(
+        json.dumps(evidence, indent=2) + "\n", encoding="utf-8"
+    )
+
+
+def github(tag: str, yes: bool) -> None:
+    assert_tag(tag)
+    if not yes:
+        raise SystemExit("publishing requires --yes")
+    paths = [*artifacts(), DIST / f"ragops-{version()}.cdx.json", DIST / "SHA256SUMS",
+             DIST / "LOCAL_RELEASE_EVIDENCE.json"]
+    if any(not path.is_file() for path in paths):
+        raise SystemExit("run verify first; release artifacts are incomplete")
+    run("git", "diff", "--quiet")
+    run("git", "diff", "--cached", "--quiet")
+    run("git", "tag", "-a", tag, "-m", f"RAGOps {tag}")
+    run("git", "push", "origin", tag)
+    run("gh", "release", "create", tag, *(str(path) for path in paths), "--verify-tag",
+        "--title", f"RAGOps {tag}", "--notes-file", f"docs/releases/{tag}.md")
+
+
+def pypi(tag: str, yes: bool) -> None:
+    assert_tag(tag)
+    token = os.environ.get("PYPI_API_TOKEN")
+    if not yes or not token:
+        raise SystemExit("PyPI publish requires --yes and PYPI_API_TOKEN (project-scoped)")
+    release_dir = ROOT / ".local-release" / tag
+    shutil.rmtree(release_dir, ignore_errors=True)
+    release_dir.mkdir(parents=True)
+    run("gh", "release", "download", tag, "--dir", str(release_dir))
+    run("shasum", "-a", "256", "-c", "SHA256SUMS", cwd=release_dir)
+    distributions = sorted(release_dir.glob("ragops-*.whl")) + sorted(release_dir.glob("ragops-*.tar.gz"))
+    if len(distributions) != 2:
+        raise SystemExit("GitHub Release must contain exactly one wheel and one source distribution")
+    env = os.environ.copy()
+    env.update({"TWINE_USERNAME": "__token__", "TWINE_PASSWORD": token})
+    run(sys.executable, "-m", "twine", "upload", *(str(path) for path in distributions), env=env)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    sub = parser.add_subparsers(dest="command", required=True)
+    for name in ("verify", "publish-github", "publish-pypi"):
+        command = sub.add_parser(name)
+        command.add_argument("--tag", required=True)
+        if name != "verify":
+            command.add_argument("--yes", action="store_true")
+    args = parser.parse_args()
+    if args.command == "verify":
+        verify(args.tag)
+    elif args.command == "publish-github":
+        github(args.tag, args.yes)
+    else:
+        pypi(args.tag, args.yes)
+
+
+if __name__ == "__main__":
+    main()

{ragops-2.1.0 → ragops-2.2.0}/src/ragops/__init__.py

@@ -3,7 +3,7 @@
 from ragops.engine import compare, evaluate
 from ragops.loader import load_responses, load_scenario, responses_from_data, scenario_from_dict
 
-__version__ = "2.1.0"
+__version__ = "2.2.0"
 
 __all__ = [
     "compare",

ragops-2.2.0/tests/test_local_release.py

@@ -0,0 +1,31 @@
+import importlib.util
+from pathlib import Path
+
+
+SPEC = importlib.util.spec_from_file_location("local_release", Path("scripts/local_release.py"))
+assert SPEC and SPEC.loader
+local_release = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(local_release)
+
+
+def test_tag_must_match_package_version() -> None:
+    assert local_release.assert_tag(f"v{local_release.version()}") == f"v{local_release.version()}"
+
+
+def test_checksum_manifest_is_deterministic(tmp_path, monkeypatch) -> None:
+    monkeypatch.setattr(local_release, "DIST", tmp_path)
+    artifact = tmp_path / "artifact.whl"
+    artifact.write_bytes(b"ragops")
+    manifest = local_release.checksums([artifact])
+    assert manifest.read_text().endswith("  artifact.whl\n")
+    assert len(manifest.read_text().split()[0]) == 64
+
+
+def test_pypi_requires_explicit_token(monkeypatch) -> None:
+    monkeypatch.delenv("PYPI_API_TOKEN", raising=False)
+    try:
+        local_release.pypi(f"v{local_release.version()}", True)
+    except SystemExit as error:
+        assert "PYPI_API_TOKEN" in str(error)
+    else:
+        raise AssertionError("publish must fail closed without a token")

{ragops-2.1.0 → ragops-2.2.0}/tests/test_public_api.py

@@ -2,7 +2,7 @@ from ragops import __version__, responses_from_data, scenario_from_dict
 
 
 def test_stable_version() -> None:
-    assert __version__ == "2.1.0"
+    assert __version__ == "2.2.0"
 
 
 def test_public_contract_parsers() -> None: