release-kit 0.1.0__tar.gz

release_kit-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Lint
+        run: uv run ruff check .
+
+      - name: Format
+        run: uv run ruff format --check .
+
+      - name: Type check
+        run: uv run basedpyright
+
+      - name: Test
+        run: uv run pytest
+
+  publish:
+    needs: check
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v5
+
+      # Workaround: fetch-tags is broken with shallow clones
+      - run: git fetch --tags origin
+
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Publish
+        run: uv run publish-packages --config publish-config.json

release_kit-0.1.0/.gitignore

@@ -0,0 +1,12 @@
+**/__pycache__
+**/*.pyc
+**/*.pyo
+**/*.pyd
+**/.venv/
+**/*.egg-info
+**/build/
+dist/
+.pytest_cache
+.ruff_cache
+.env
+bookmark.md

release_kit-0.1.0/AGENTS.md

@@ -0,0 +1,59 @@
+# release-kit
+
+## What this is
+
+The publication machinery for outernet-foundation repos: the publish pipeline, the per-package tag ledger and path-diff change detection, ephemeral version patching, release orchestration, and the OCI mirror scan. A standalone repo (sibling of `unity-buildkit` / `stack-toolkit` / `bashrun`), published to PyPI and consumed **uvx-isolated** — release workflows invoke `uvx --from release-kit==<version> <command>`; it is a project dependency of nothing. The reason is structural: every tool repo it publishes sits inside its own dependency graph (bashrun, stack-toolkit, unity-buildkit are release-kit's runtime deps), so a project-level release-kit edge in those repos is a resolver cycle plus a root-version conflict against the `0.0.0.dev0` sentinel. Consumers outside that graph (placeframe) use uvx for the same shape, keeping one consumption model.
+
+The consumer owns everything declarative: package identities, paths, tag prefixes, registry mappings, compose files, and the CI workflow name live in a consumer-authored `publish-config.json`; every command here reads that file. Per-repo copies of this machinery are refused, as are per-ecosystem splits — the seam is internal: one `Feed` adapter per registry over the shared ledger/diff/versioning core.
+
+The package is `release-kit` (src-layout under `src/release_kit/`; import `release_kit`), renamed from `pubpkg` before its first publish — PyPI's registrar rejects names merely similar to existing ones, so `pubpkg` was unclaimable and nothing on PyPI ever carried it. Runtime dependencies: `bashrun` (all shell-outs), `stack-toolkit` (`compute_service_shas`, `collect_repo_references`), `unity-buildkit` (`ci_step`, runner setup), `pydantic`/`pydantic-settings` (config + CI env), `typer` (CLIs) — all from PyPI.
+
+## Self-publication
+
+release-kit publishes itself from its own checkout: `ci.yml`'s `publish` job (main-push, gated on the check job) runs `uv run publish-packages --config publish-config.json` — the repo *is* release-kit, so no uvx bootstrap and no self-reference. Its dependencies must all exist on PyPI before its first publish (they did: it converted last, leaves-first ordering). The committed `pyproject.toml` version is permanently the `0.0.0.dev0` sentinel; the `release-kit-v*` tags are the version ledger. API-breaking changes ship with a manually bumped version — patch-auto assumes additive changes.
+
+## Commands
+
+All are `uv run <name> --config <path>` from the consuming repo's root (config defaults to `build/publish-config.json` where optional).
+
+| Command | Role |
+|---|---|
+| `publish-packages` | Compute the publish plan from the tag ledger + path-diff, publish every changed package to its feeds, bump and tag app versions, push per-package tags. `--dry-run` prints the plan only. |
+| `publish-dev` | Dev-channel mode: publish immutable `-dev.<run-id>` prereleases of every path-diff-changed package to its feeds. `--run-id` defaults to `GITHUB_RUN_ID`; never creates git tags, never touches app versions. |
+| `create-release` | Assemble release notes (service SHAs from the configured compose files, package versions with registry links, app versions), package CI artifacts, and cut the dated GitHub Release. |
+| `ensure-release-pr` | Maintain the standing `dev` → `main` "Next release" gate PR. |
+| `fetch-ci-artifacts` | Locate the successful CI run for the release SHA (via the merge commit's second parent) and download its artifacts, pruning non-release ones per the config's skip rules. |
+| `mirror-images` | Populate the org-level ghcr mirror namespace with every mirror-prefixed image reference the repo scan finds, via `crane copy`. |
+
+## The CI-commit-free invariants
+
+CI and release workflows must not create commits on any branch — `dev` → `main` merges are always true fast-forwards. The machinery that makes that possible lives here:
+
+- **Version tracking**: per-package git tags (`{name}-v{semver}`, e.g. `placeframe-api-client-v0.1.8`, `capture-tool-v0.2.0`), never committed state files.
+- **Change detection**: `git diff --quiet <last-tag> HEAD -- <path>`, never content hashing. `depends_on` cascades trigger dependents even when their own paths are unchanged.
+- **Version scheme**: first release `0.1.0`, then patch bumps from the tag ledger. Per-package numbers are independent within one release event — no lockstep.
+- **Unity `package.json` versions**: permanently `0.0.0-local` in the repo; patched ephemerally during `npm publish` and restored immediately — never committed.
+- **Python `pyproject.toml` versions**: permanently `0.0.0.dev0` in the repo (`0.0.0-local` is not valid PEP 440); patched ephemerally around `uv build` and restored immediately — never committed. The sdist/wheel carries the real version; the committed file never does.
+
+## Release units
+
+The repo is the release unit: repos release independently; one release event publishes every changed package in the repo together; a package unchanged since its last tag is skipped (registries are immutable — there is nothing to publish), and dependency pins absorb sibling bumps without republishing dependents.
+
+## Dev channel
+
+`publish-dev` publishes immutable prereleases of every path-diff-changed package; it creates no git tags, bumps no app versions, and opens no release. Versions are keyed by the CI run id and spelled per feed — `{base}-dev.{run_id}` where semver allows it (nuget, npm), `{base}.dev{run_id}` on PyPI — because no single string is both valid semver and valid PEP 440. The base is `next_version(last stable tag)`, so a package's dev versions share one base until the stable flow tags it. npm prereleases ride the single inert `dev` dist-tag so `latest` never moves. The job prints the exact published versions; that print is the consumption interface — consumers pin by hand, there is no discovery tooling.
+
+## The Feed seam
+
+`feeds.Feed` is the registry adapter protocol (`publish(request: PublishRequest)`); `NuGetFeed`, `NpmFeed`, and `PyPIFeed` implement it. A feed's registry identity (nuget package id, npm name, PyPI distribution name) is config data, not code — the same package can publish to several feeds at one version. Config-declared feed names are validated against `feeds.KNOWN_FEEDS` at load time.
+
+`PyPIFeed` shells out to `uv build` + `uv publish` and authenticates via trusted publishing (OIDC): it takes no credential, so the consuming workflow needs `id-token: write` and the PyPI project needs a configured (or pending) publisher for that repo/workflow. Idempotent re-publishing is handled by `uv publish --check-url` against the simple index. PyPI dependency pins are refused (`dependency_versions` must be empty) until a concrete in-repo consumer exists. npm authenticates the same way — trusted publishing via `--provenance`, no token plumbing — and npm allows one trusted publisher per package, bound to a single workflow filename: every workflow that publishes a given package to npm must be the same file.
+
+## Config
+
+`config.PublishConfig` (pydantic, loaded by `load_config`) validates the consumer's `publish-config.json`, including dependency-graph sanity: `depends_on` entries must reference packages declared **earlier** in the list (the plan walks dependencies-first), and `dependency_pins` must reference known packages. `dependency_pins` map a manifest dependency name to a package name; the pin is applied only when both the pinning package and the pinned package publish in the same event.
+
+## See also
+
+- `README.md` — human-facing usage and consumption wiring.
+- [`bashrun`](https://github.com/outernet-foundation/bashrun) — the subprocess wrapper every shell-out goes through.

release_kit-0.1.0/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

release_kit-0.1.0/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1.  Definitions.
+
+    "License" shall mean the terms and conditions for use, reproduction,
+    and distribution as defined by Sections 1 through 9 of this document.
+
+    "Licensor" shall mean the copyright owner or entity authorized by
+    the copyright owner that is granting the License.
+
+    "Legal Entity" shall mean the union of the acting entity and all
+    other entities that control, are controlled by, or are under common
+    control with that entity. For the purposes of this definition,
+    "control" means (i) the power, direct or indirect, to cause the
+    direction or management of such entity, whether by contract or
+    otherwise, or (ii) ownership of fifty percent (50%) or more of the
+    outstanding shares, or (iii) beneficial ownership of such entity.
+
+    "You" (or "Your") shall mean an individual or Legal Entity
+    exercising permissions granted by this License.
+
+    "Source" form shall mean the preferred form for making modifications,
+    including but not limited to software source code, documentation
+    source, and configuration files.
+
+    "Object" form shall mean any form resulting from mechanical
+    transformation or translation of a Source form, including but
+    not limited to compiled object code, generated documentation,
+    and conversions to other media types.
+
+    "Work" shall mean the work of authorship, whether in Source or
+    Object form, made available under the License, as indicated by a
+    copyright notice that is included in or attached to the work
+    (an example is provided in the Appendix below).
+
+    "Derivative Works" shall mean any work, whether in Source or Object
+    form, that is based on (or derived from) the Work and for which the
+    editorial revisions, annotations, elaborations, or other modifications
+    represent, as a whole, an original work of authorship. For the purposes
+    of this License, Derivative Works shall not include works that remain
+    separable from, or merely link (or bind by name) to the interfaces of,
+    the Work and Derivative Works thereof.
+
+    "Contribution" shall mean any work of authorship, including
+    the original version of the Work and any modifications or additions
+    to that Work or Derivative Works thereof, that is intentionally
+    submitted to Licensor for inclusion in the Work by the copyright owner
+    or by an individual or Legal Entity authorized to submit on behalf of
+    the copyright owner. For the purposes of this definition, "submitted"
+    means any form of electronic, verbal, or written communication sent
+    to the Licensor or its representatives, including but not limited to
+    communication on electronic mailing lists, source code control systems,
+    and issue tracking systems that are managed by, or on behalf of, the
+    Licensor for the purpose of discussing and improving the Work, but
+    excluding communication that is conspicuously marked or otherwise
+    designated in writing by the copyright owner as "Not a Contribution."
+
+    "Contributor" shall mean Licensor and any individual or Legal Entity
+    on behalf of whom a Contribution has been received by Licensor and
+    subsequently incorporated within the Work.
+
+2.  Grant of Copyright License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    copyright license to reproduce, prepare Derivative Works of,
+    publicly display, publicly perform, sublicense, and distribute the
+    Work and such Derivative Works in Source or Object form.
+
+3.  Grant of Patent License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    (except as stated in this section) patent license to make, have made,
+    use, offer to sell, sell, import, and otherwise transfer the Work,
+    where such license applies only to those patent claims licensable
+    by such Contributor that are necessarily infringed by their
+    Contribution(s) alone or by combination of their Contribution(s)
+    with the Work to which such Contribution(s) was submitted. If You
+    institute patent litigation against any entity (including a
+    cross-claim or counterclaim in a lawsuit) alleging that the Work
+    or a Contribution incorporated within the Work constitutes direct
+    or contributory patent infringement, then any patent licenses
+    granted to You under this License for that Work shall terminate
+    as of the date such litigation is filed.
+
+4.  Redistribution. You may reproduce and distribute copies of the
+    Work or Derivative Works thereof in any medium, with or without
+    modifications, and in Source or Object form, provided that You
+    meet the following conditions:
+
+    (a) You must give any other recipients of the Work or
+    Derivative Works a copy of this License; and
+
+    (b) You must cause any modified files to carry prominent notices
+    stating that You changed the files; and
+
+    (c) You must retain, in the Source form of any Derivative Works
+    that You distribute, all copyright, patent, trademark, and
+    attribution notices from the Source form of the Work,
+    excluding those notices that do not pertain to any part of
+    the Derivative Works; and
+
+    (d) If the Work includes a "NOTICE" text file as part of its
+    distribution, then any Derivative Works that You distribute must
+    include a readable copy of the attribution notices contained
+    within such NOTICE file, excluding those notices that do not
+    pertain to any part of the Derivative Works, in at least one
+    of the following places: within a NOTICE text file distributed
+    as part of the Derivative Works; within the Source form or
+    documentation, if provided along with the Derivative Works; or,
+    within a display generated by the Derivative Works, if and
+    wherever such third-party notices normally appear. The contents
+    of the NOTICE file are for informational purposes only and
+    do not modify the License. You may add Your own attribution
+    notices within Derivative Works that You distribute, alongside
+    or as an addendum to the NOTICE text from the Work, provided
+    that such additional attribution notices cannot be construed
+    as modifying the License.
+
+    You may add Your own copyright statement to Your modifications and
+    may provide additional or different license terms and conditions
+    for use, reproduction, or distribution of Your modifications, or
+    for any such Derivative Works as a whole, provided Your use,
+    reproduction, and distribution of the Work otherwise complies with
+    the conditions stated in this License.
+
+5.  Submission of Contributions. Unless You explicitly state otherwise,
+    any Contribution intentionally submitted for inclusion in the Work
+    by You to the Licensor shall be under the terms and conditions of
+    this License, without any additional terms or conditions.
+    Notwithstanding the above, nothing herein shall supersede or modify
+    the terms of any separate license agreement you may have executed
+    with Licensor regarding such Contributions.
+
+6.  Trademarks. This License does not grant permission to use the trade
+    names, trademarks, service marks, or product names of the Licensor,
+    except as required for reasonable and customary use in describing the
+    origin of the Work and reproducing the content of the NOTICE file.
+
+7.  Disclaimer of Warranty. Unless required by applicable law or
+    agreed to in writing, Licensor provides the Work (and each
+    Contributor provides its Contributions) on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+    implied, including, without limitation, any warranties or conditions
+    of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+    PARTICULAR PURPOSE. You are solely responsible for determining the
+    appropriateness of using or redistributing the Work and assume any
+    risks associated with Your exercise of permissions under this License.
+
+8.  Limitation of Liability. In no event and under no legal theory,
+    whether in tort (including negligence), contract, or otherwise,
+    unless required by applicable law (such as deliberate and grossly
+    negligent acts) or agreed to in writing, shall any Contributor be
+    liable to You for damages, including any direct, indirect, special,
+    incidental, or consequential damages of any character arising as a
+    result of this License or out of the use or inability to use the
+    Work (including but not limited to damages for loss of goodwill,
+    work stoppage, computer failure or malfunction, or any and all
+    other commercial damages or losses), even if such Contributor
+    has been advised of the possibility of such damages.
+
+9.  Accepting Warranty or Additional Liability. While redistributing
+    the Work or Derivative Works thereof, You may choose to offer,
+    and charge a fee for, acceptance of support, warranty, indemnity,
+    or other liability obligations and/or rights consistent with this
+    License. However, in accepting such obligations, You may act only
+    on Your own behalf and on Your sole responsibility, not on behalf
+    of any other Contributor, and only if You agree to indemnify,
+    defend, and hold each Contributor harmless for any liability
+    incurred by, or claims asserted against, such Contributor by reason
+    of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

release_kit-0.1.0/NOTICE

@@ -0,0 +1 @@
+Copyright 2026 Tyler Hatch

release_kit-0.1.0/PKG-INFO

@@ -0,0 +1,13 @@
+Metadata-Version: 2.5
+Name: release-kit
+Version: 0.1.0
+Summary: Publication machinery: per-package tag ledger, path-diff change detection, ephemeral version patching, and per-registry feed adapters (nuget, npm/UPM) driven by a declarative consumer-owned config
+License-File: LICENSE
+License-File: NOTICE
+Requires-Python: >=3.13
+Requires-Dist: bashrun>=0.1.0
+Requires-Dist: pydantic-settings>=2.9.1
+Requires-Dist: pydantic>=2.11.7
+Requires-Dist: stack-toolkit>=0.1.0
+Requires-Dist: typer>=0.17.4
+Requires-Dist: unity-buildkit>=0.1.0

release_kit-0.1.0/README.md

@@ -0,0 +1,61 @@
+# release-kit
+
+Publication machinery for multi-feed package releases: a per-package git-tag ledger, path-diff change detection, ephemeral version patching, per-registry feed adapters (nuget, npm/UPM, PyPI), release orchestration, and an OCI mirror scan — all driven by a declarative, consumer-owned config.
+
+Every consuming repo keeps only a `publish-config.json` (package identities, paths, tag prefixes, registry mappings) and workflow steps that are thin `uvx` invocations. See [`AGENTS.md`](./AGENTS.md) for the invariants (CI-commit-free releases, tag-ledger versioning, ephemeral `0.0.0-local` / `0.0.0.dev0` version patching) and the command catalog.
+
+## Requirements
+
+- Python 3.13+ and [uv](https://docs.astral.sh/uv/)
+- At runtime: `git`, `gh`, `dotnet` (nuget publish), `node`/`npm` (npm publish), `uv` (PyPI publish via trusted publishing), `crane` (installed by `mirror-images`)
+
+## Consuming from another repo
+
+Install nothing — release-kit is consumed **uvx-isolated** (it is a project dependency of nothing: the tool repos it publishes sit inside its own dependency graph, where a project-level release-kit edge is a resolver cycle). Pin the exact version in the workflow:
+
+```bash
+uvx --from release-kit==0.1.0 publish-packages --config build/publish-config.json
+```
+
+Then author `build/publish-config.json`:
+
+```json
+{
+  "packages": [
+    { "name": "my-api-client", "path": "generated/csharp/api-client/src/MyApiClient",
+      "feeds": { "nuget": "MyApiClient", "npm": "org.example.myproject.apiclient" } },
+    { "name": "my-core", "path": "packages/unity/Core", "feeds": { "npm": "org.example.myproject" } },
+    { "name": "my-arfoundation", "path": "packages/unity/ARFoundation",
+      "feeds": { "npm": "org.example.myproject.arfoundation" },
+      "depends_on": ["my-core"],
+      "dependency_pins": { "org.example.myproject": "my-core" } }
+  ],
+  "apps": [
+    { "name": "MyTool", "path": "apps/MyTool", "tag_prefix": "my-tool", "display_name": "My Tool" }
+  ],
+  "compose_files": ["compose.bake.yml"],
+  "ci_workflow": "my-ci.yml",
+  "mirror_prefix": "ghcr.io/my-org/mirror"
+}
+```
+
+and invoke from CI:
+
+```bash
+uvx --from release-kit==0.1.0 publish-packages --config build/publish-config.json
+uvx --from release-kit==0.1.0 publish-dev --config build/publish-config.json --run-id ${{ github.event.workflow_run.id }}
+uvx --from release-kit==0.1.0 create-release --config build/publish-config.json
+```
+
+`publish-dev` is the dev-channel job: it publishes immutable `-dev.<run-id>` prereleases (`X.Y.Z.dev<run-id>` on PyPI) of every changed package on a green push — no git tags, npm `latest` untouched — and prints the exact versions to pin.
+
+Environment (via pydantic-settings): `GITHUB_WORKSPACE`, `GITHUB_REPOSITORY`, `GITHUB_SHA`, `GITHUB_STEP_SUMMARY`, `GITHUB_OUTPUT`, `GITHUB_RUN_ID`, `NUGET_API_KEY`.
+
+## Development
+
+```bash
+uv run ruff check .
+uv run ruff format --check .
+uv run basedpyright
+uv run pytest
+```

release_kit-0.1.0/publish-config.json

@@ -0,0 +1,11 @@
+{
+  "packages": [
+    {
+      "name": "release-kit",
+      "path": ".",
+      "feeds": { "pypi": "release-kit" }
+    }
+  ],
+  "ci_workflow": "ci.yml",
+  "mirror_prefix": "ghcr.io/outernet-foundation/mirror"
+}

release_kit-0.1.0/pyproject.toml

@@ -0,0 +1,43 @@
+[project]
+name = "release-kit"
+version = "0.1.0"
+description = "Publication machinery: per-package tag ledger, path-diff change detection, ephemeral version patching, and per-registry feed adapters (nuget, npm/UPM) driven by a declarative consumer-owned config"
+requires-python = ">=3.13"
+dependencies = [
+    "bashrun>=0.1.0",
+    "stack-toolkit>=0.1.0",
+    "unity-buildkit>=0.1.0",
+    "pydantic>=2.11.7",
+    "pydantic-settings>=2.9.1",
+    "typer>=0.17.4",
+]
+
+[dependency-groups]
+dev = ["basedpyright>=1.39.10", "ruff>=0.14.11", "pytest>=8.0.0"]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project.scripts]
+create-release = "release_kit.create_release:app"
+ensure-release-pr = "release_kit.ensure_release_pr:app"
+fetch-ci-artifacts = "release_kit.fetch_ci_artifacts:app"
+mirror-images = "release_kit.mirror_images:app"
+publish-dev = "release_kit.publish_dev:app"
+publish-packages = "release_kit.publish_packages:app"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/release_kit"]
+include = [
+    "src/release_kit/py.typed",
+]
+
+[tool.basedpyright]
+venvPath = "."
+venv = ".venv"
+typeCheckingMode = "strict"
+include = ["src", "tests"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

release_kit-0.1.0/ruff.toml

@@ -0,0 +1,80 @@
+target-version = "py313"
+line-length = 120
+preview = true
+
+[lint]
+select = ["ALL"]
+ignore = [
+    # ── Permanent ─────────────────────────────────────────────────────────
+    # Type annotations — basedpyright strict mode handles this
+    "ANN",
+    # No docstrings, no copyright headers
+    "D",
+    "DOC",
+    "CPY",
+    # TODO/FIXME comment formatting
+    "TD",
+    "FIX",
+    # Exception message ergonomics — literal-indirection and custom-class churn without benefit
+    "raw-string-in-exception",
+    "f-string-in-exception",
+    "raise-vanilla-args",
+    # Class attribute names never conflict with builtins via self.x
+    "builtin-attribute-shadowing",
+    # Function-size counters — C901 already covers structural complexity
+    "too-many-return-statements",
+    "too-many-branches",
+    "too-many-arguments",
+    "too-many-locals",
+    "too-many-statements",
+    "too-many-positional-arguments",
+    # Typer's Option/Argument in argument defaults is its standard API pattern
+    "function-call-in-default-argument",
+    # Boolean parameters read fine as keyword-only flags here
+    "boolean-type-hint-positional-argument",
+    "boolean-default-value-positional-argument",
+    "boolean-positional-value-in-call",
+    # Relative imports are the intra-package convention
+    "relative-imports",
+    # Formatter-owned; enforced by `ruff format`
+    "missing-trailing-comma",
+    "unsorted-imports",
+    # Magic values in comparisons are readable in this CLI
+    "magic-value-comparison",
+    # The formatter owns wrapping; long string literals and URLs stay on one line
+    "line-too-long",
+    # src-layout tests need no __init__.py
+    "implicit-namespace-package",
+    # Runtime-used typing imports stay at module level
+    "typing-only-first-party-import",
+    "typing-only-third-party-import",
+    "typing-only-standard-library-import",
+    # Small literal tuples read fine in membership tests
+    "literal-membership",
+    # Feed and ledger adapters are classes so they satisfy their Protocols and can carry
+    # per-instance auth state (e.g. NuGetFeed's api key); not every adapter uses `self`
+    "no-self-use",
+
+    # ── Deferred to PLE-248 — Enforce the deferred ruff rules
+    # https://linear.app/plerionplatforms/issue/PLE-248
+    # Mirrors placeframe's root ruff.toml transitional Ticket-N blocks; lifting
+    # a rule here should happen alongside lifting it from placeframe's ruff.toml.
+    "complex-structure",     # function too complex — Ticket 9
+    "too-many-nested-blocks",  # too many nested blocks — Ticket 9
+
+    # ── Deferred to PLE-336 — Replace print() with structured logging
+    # https://linear.app/plerionplatforms/issue/PLE-336
+    "print",     # print found
+]
+
+[lint.per-file-ignores]
+"tests/**" = ["assert", "suspicious-subprocess-import", "start-process-with-partial-path", "no-self-use", "unused-method-argument"]
+# feeds.py catches subprocess.CalledProcessError raised by bashrun — the stdlib type, no way around the import
+"src/release_kit/feeds.py" = ["suspicious-subprocess-import"]
+# config.py declares the default CI-runner scratch path shared by fetch-ci-artifacts and create-release
+"src/release_kit/config.py" = ["hardcoded-temp-file"]
+# tests assert that same default
+"tests/test_config.py" = ["hardcoded-temp-file"]
+
+[lint.flake8-builtins]
+ignorelist = ["id", "map"]

release_kit-0.1.0/src/release_kit/__init__.py

@@ -0,0 +1,35 @@
+from .config import AppConfig, PackageConfig, PublishConfig, load_config, select_packages
+from .feeds import Feed, NuGetFeed, NpmFeed, PublishRequest, build_feeds, pep440_dev_version, semver_dev_version
+from .ledger import GitLedger
+from .plan import (
+    PackagePlan,
+    TagLedger,
+    compute_plan,
+    next_version,
+    render_dev_summary,
+    render_summary,
+    resolved_dependency_versions,
+)
+
+__all__ = [
+    "AppConfig",
+    "Feed",
+    "GitLedger",
+    "NpmFeed",
+    "NuGetFeed",
+    "PackageConfig",
+    "PackagePlan",
+    "PublishConfig",
+    "PublishRequest",
+    "TagLedger",
+    "build_feeds",
+    "compute_plan",
+    "load_config",
+    "next_version",
+    "pep440_dev_version",
+    "render_dev_summary",
+    "render_summary",
+    "resolved_dependency_versions",
+    "select_packages",
+    "semver_dev_version",
+]