scientific-computing-system 2.0.1__tar.gz → 2.2.0__tar.gz

scientific_computing_system-2.2.0/.github/workflows/benchmarks.yml

@@ -0,0 +1,99 @@
+name: Benchmarks
+
+on:
+  schedule:
+    - cron: "0 3 * * 1"
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+# Benchmark execution itself is read-only. The only mutation path uses a
+# short-lived GitHub App token passed directly to create-pull-request, so the
+# workflow's default GITHUB_TOKEN never needs write scope.
+permissions:
+  contents: read
+
+concurrency:
+  group: benchmarks-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  regenerate:
+    name: Regenerate benchmark report
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout default branch (full history for SHA)
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+
+      - name: Install package
+        run: |
+          python -m pip install --upgrade pip
+          pip install ".[all]"
+
+      - name: Run reproducible robust benchmarks
+        run: python benchmarks/robust_runner.py
+
+      - name: Verify artifacts changed
+        id: changed
+        run: |
+          if git diff --quiet docs/benchmarks.md benchmarks/results.json; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check App credentials configured
+        id: cfg
+        env:
+          APP_ID: ${{ secrets.BOT_APP_ID }}
+        run: |
+          if [[ -n "$APP_ID" ]]; then
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::BOT_APP_ID not set — Benchmarks cannot open a PR."
+          fi
+
+      - name: Generate GitHub App token (triggers downstream CI)
+        id: app-token
+        if: steps.cfg.outputs.configured == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+
+      - name: Open PR with regenerated artifacts
+        if: steps.changed.outputs.changed == 'true' && steps.cfg.outputs.configured == 'true'
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          base: ${{ github.event.repository.default_branch }}
+          commit-message: "ci(benchmarks): regenerate report and results.json"
+          branch: ci/benchmark-regen
+          title: "ci(benchmarks): regenerate report and results.json"
+          body: |
+            Automated benchmark regeneration from ${{ github.event_name }} trigger.
+
+            - `docs/benchmarks.md`
+            - `benchmarks/results.json`
+
+            The JSON includes schema version, package/source identity, environment
+            metadata, deterministic seed metadata, warmup policy, and median/MAD/p95
+            timing distributions. No code changes.
+          add-paths: |
+            docs/benchmarks.md
+            benchmarks/results.json

scientific_computing_system-2.2.0/.github/workflows/bot-reviewer.yml

@@ -0,0 +1,59 @@
+name: Bot Reviewer
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+env:
+  auto-approve-maintainer: "false"
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  approve:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check App credentials configured
+        id: cfg
+        env:
+          APP_ID: ${{ secrets.BOT_APP_ID }}
+        run: |
+          if [[ -n "$APP_ID" ]]; then
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::BOT_APP_ID not set — Bot Reviewer inert."
+          fi
+      - name: Generate GitHub App token
+        id: app-token
+        if: steps.cfg.outputs.configured == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+      - name: Decide whether to approve
+        id: gate
+        if: steps.cfg.outputs.configured == 'true'
+        env:
+          ACTOR: ${{ github.actor }}
+          MAINTAINER: "Furox-Art"
+          AUTO_MAINTAINER: ${{ env.auto-approve-maintainer }}
+        run: |
+          approve="false"
+          if [[ "$ACTOR" == "dependabot[bot]" ]]; then
+            approve="true"
+          elif [[ "$AUTO_MAINTAINER" == "true" && "$ACTOR" == "$MAINTAINER" ]]; then
+            approve="true"
+          fi
+          echo "approve=$approve" >> "$GITHUB_OUTPUT"
+      - name: Submit approving review
+        if: steps.gate.outputs.approve == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          gh pr review "$PR_URL" --approve --body \
+            "Automated approval by Bot Reviewer (actor: ${{ github.actor }}). CI/CodeQL still gate merge."

scientific_computing_system-2.2.0/.github/workflows/changelog.yml

@@ -0,0 +1,131 @@
+name: Generate CHANGELOG
+
+# Manual-only trigger. Previously fired on every `v*` tag push, but the
+# `git cliff --output CHANGELOG.md` invocation rewrites the ENTIRE file from
+# git history and discards the hand-curated narrative entries (see PR #24,
+# which was closed because it regressed v1.0.4/v1.0.3/v1.0.2 sections back to
+# commit-hash-only stubs). cliff.toml groups by commit-message prefix while the
+# repo uses hand-written descriptive sections — the two styles conflict.
+#
+# To regenerate locally for review only (without overwriting the curated file):
+#   git cliff --tag vX.Y.Z            # preview to stdout
+#   git cliff --latest                # preview latest tag's section
+# Run this workflow manually only if you intend to review the diff carefully
+# and reconcile the generated output with the hand-written sections.
+#
+# IDEMPOTENCY: all dispatches target a SINGLE fixed branch
+# (chore/changelog-regen). peter-evans/create-pull-request updates the existing
+# open PR on that branch (force-push) instead of opening a duplicate, so stale
+# PRs no longer accumulate across tags/releases (the previous per-tag branch
+# scheme left up to 6 OPEN PRs open at once — see #10/#19/#20/#21/#22/#23,
+# all closed as superseded). The git-diff guard below additionally skips the
+# action entirely when CHANGELOG.md is unchanged.
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to generate the changelog for (e.g. v1.0.4)"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+# Serialize dispatches: two concurrent runs would both regenerate CHANGELOG.md
+# and force-push the single shared branch, racing each other. The fixed
+# group also prevents the duplicate-PR accumulation the old per-tag scheme
+# caused.
+concurrency:
+  group: changelog-regen
+  cancel-in-progress: false
+
+jobs:
+  changelog:
+    name: Generate CHANGELOG
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout main (not the tag, to avoid detached HEAD)
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Install git-cliff
+        uses: orhun/git-cliff-action@3d96a18cc4ec17e9dc69ddcc424ccafaf1f78ce2 # v4
+        with:
+          config: cliff.toml
+          args: --verbose --tag ${{ inputs.tag }} --output CHANGELOG.md
+
+      - name: Check for changes
+        id: check
+        run: |
+          if git diff --quiet CHANGELOG.md; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Single fixed branch: create-pull-request updates the existing open PR
+      # on this branch (force-push) rather than opening a duplicate, so only
+      # one changelog PR is ever open at a time regardless of how many tags
+      # are dispatched.
+      #
+      # CONFIG GUARD: if the shared App is not configured yet, stop cleanly
+      # with a green job instead of letting create-github-app-token throw
+      # "Input required and not supplied: app-id". Mirrors the guard in
+      # benchmarks.yml / bot-reviewer.yml; once BOT_APP_ID is set this branch
+      # is always taken.
+      - name: Check App credentials configured
+        id: cfg
+        env:
+          APP_ID: ${{ secrets.BOT_APP_ID }}
+        run: |
+          if [[ -n "$APP_ID" ]]; then
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::BOT_APP_ID not set — Changelog cannot open a PR that triggers CI. Stopping cleanly (see header)."
+          fi
+
+      # TOKEN CHOICE — why a GitHub App token, not the default GITHUB_TOKEN:
+      # A PR opened with the built-in GITHUB_TOKEN does NOT trigger the
+      # `pull_request` CI/CodeQL workflows (GitHub blocks GITHUB_TOKEN-sourced
+      # events from spawning new runs to prevent recursion). That left changelog
+      # PRs stuck at `action_required` (0s) under branch protection. A
+      # short-lived GitHub App installation token is exempt, so the required
+      # checks fire and the PR can merge without a manual nudge. The same App
+      # serves benchmarks.yml, changelog.yml, and bot-reviewer.yml.
+      - name: Generate GitHub App token (triggers downstream CI)
+        id: app-token
+        if: steps.cfg.outputs.configured == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+
+      - name: Open or update PR with regenerated CHANGELOG
+        if: steps.check.outputs.changed == 'true' && steps.cfg.outputs.configured == 'true'
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          commit-message: "docs(changelog): regenerate for ${{ inputs.tag }}"
+          title: "docs(changelog): regenerate for ${{ inputs.tag }} (MANUAL — review carefully)"
+          body: |
+            Auto-generated CHANGELOG update from git history.
+            Triggered by MANUAL workflow_dispatch for tag `${{ inputs.tag }}`.
+
+            REVIEW THE DIFF CAREFULLY before merging. git-cliff rewrites the
+            entire CHANGELOG.md from commit history; hand-curated narrative
+            entries (like the v1.0.4 "Security & Tooling" block) may be dropped
+            and need to be reconciled manually. See PR #24 for the regression
+            this caused under the previous tag-push trigger.
+
+            This PR lives on a single fixed branch (`chore/changelog-regen`);
+            re-running the workflow for a different tag updates this same PR
+            instead of opening a new one.
+          branch: chore/changelog-regen
+          base: main
+          delete-branch: true
+          add-paths: CHANGELOG.md

scientific_computing_system-2.2.0/.github/workflows/cli-package-smoke.yml

@@ -0,0 +1,83 @@
+name: Installed CLI Smoke
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cli-package-smoke-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  installed-cli:
+    name: installed CLI on ${{ matrix.os }} / Python 3.12
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 25
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+      - name: Build wheel
+        run: |
+          python -m pip install --upgrade pip
+          pip install build
+          python -m build --wheel
+      - name: Install wheel instead of source tree
+        shell: bash
+        run: |
+          set -euo pipefail
+          wheel="$(find dist -maxdepth 1 -name '*.whl' -print -quit)"
+          test -n "$wheel"
+          python -m pip install --force-reinstall --no-deps "$wheel"
+      - name: Verify installed console and module entry points
+        run: python scripts/verify_cli_install.py
+      # The wheel is installed from `dist/`, but the *source* tree is still on
+      # disk for the checkout. Without this, a source-tree import could mask a
+      # packaging defect (a missing module, a broken `py.typed`, a bad
+      # entry point) that the installed wheel would have failed on.
+      - name: Assert the installed wheel has no source-tree fallback
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pip install --upgrade pip
+          python - <<'PY'
+          import importlib.util
+          import pathlib
+          import subprocess
+          import sys
+          import tempfile
+
+          checkout = pathlib.Path.cwd().resolve()
+          with tempfile.TemporaryDirectory() as tmp:
+              result = subprocess.run(
+                  [sys.executable, "-c", "import cds, pathlib; print(pathlib.Path(cds.__file__).resolve())"],
+                  cwd=tmp,
+                  capture_output=True,
+                  text=True,
+                  check=True,
+              )
+          resolved = pathlib.Path(result.stdout.strip()).resolve()
+          if checkout in resolved.parents:
+              raise SystemExit(f"cds resolved from the checkout, not the wheel: {resolved}")
+          print(f"PASS: installed cds resolves to {resolved}")
+
+          spec = importlib.util.find_spec("cds")
+          if spec is None or not spec.origin:
+              raise SystemExit("cds is not importable from the installed distribution")
+          print("PASS: cds is importable from the installed distribution")
+          PY

scientific_computing_system-2.2.0/.github/workflows/codeql.yml

@@ -0,0 +1,55 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - '.github/CODEOWNERS'
+      - '.github/FUNDING.yml'
+      - '.github/ISSUE_TEMPLATE/**'
+      - '.github/PULL_REQUEST_TEMPLATE.md'
+      - 'CITATION.cff'
+      - 'CODE_OF_CONDUCT.md'
+      - 'CONTRIBUTING.md'
+      - 'LICENSE'
+      - 'SECURITY.md'
+      - 'docs/**'
+      - '*.md'
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "37 4 * * 1"
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-and-quality
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+        with:
+          category: "/language:${{ matrix.language }}"

scientific_computing_system-2.2.0/.github/workflows/npm-publish.yml

@@ -0,0 +1,27 @@
+name: npm Publish
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: npm-publish
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Publish to npm
+        run: echo "npm publishing is disabled; PyPI is the install path" && exit 0
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

scientific_computing_system-2.2.0/.github/workflows/pr-automation.yml

@@ -0,0 +1,80 @@
+name: PR Automation
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to run automation for'
+        required: true
+        type: string
+
+concurrency:
+  group: pr-automation-${{ github.event.pull_request.number || inputs.pr_number }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  labeler:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+
+  review-checklist:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write
+    if: |
+      (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'needs-review')) ||
+      github.event_name == 'workflow_dispatch'
+    steps:
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            let prNumber = context.issue ? context.issue.number : null;
+            if (context.eventName === 'workflow_dispatch') {
+              prNumber = parseInt('${{ inputs.pr_number }}');
+            }
+            if (!prNumber) {
+              console.log('No PR number provided');
+              return;
+            }
+            const { data: comments } = await github.rest.issues.listComments({
+              owner, repo, issue_number: prNumber
+            });
+            const hasChecklist = comments.some(c =>
+              c.body.includes('PR Review Checklist') && c.user.type === 'Bot'
+            );
+            if (hasChecklist) {
+              console.log('Review checklist comment already exists');
+              return;
+            }
+            const checklist = `## PR Review Checklist
+
+            Maintainer quick checklist for this PR:
+
+            - [ ] Tests added or updated where needed
+            - [ ] Documentation updated (README, docstrings, examples)
+            - [ ] No unnecessary dependencies added
+            - [ ] Code follows project style (run ruff locally)
+            - [ ] CHANGELOG updated if user-facing
+
+            Feel free to ping the maintainer for review.`;
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body: checklist
+            });

scientific_computing_system-2.2.0/.github/workflows/pypi-registry-smoke.yml

@@ -0,0 +1,121 @@
+name: PyPI Registry CLI Smoke
+
+on:
+  workflow_run:
+    workflows:
+      - Release
+    types:
+      - completed
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/release.yml"
+      - ".github/workflows/pypi-registry-smoke.yml"
+      - "scripts/verify_pypi_release.py"
+      - "scripts/verify_release_integrity.py"
+
+# Default-deny; each job below declares exactly the scopes it needs.
+permissions:
+  contents: read
+
+concurrency:
+  group: pypi-registry-smoke-${{ github.event.workflow_run.head_sha || github.sha }}
+  cancel-in-progress: false
+
+jobs:
+  registry-cli:
+    if: >-
+      github.event_name == 'push' ||
+      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
+    name: public PyPI CLI on ${{ matrix.os }} / Python 3.12
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 25
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - windows-latest
+    steps:
+      - name: Check out released source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+
+      - name: Verify exact release from public PyPI
+        run: python scripts/verify_pypi_release.py
+
+  github-release-policy:
+    name: enforce metadata-only GitHub Release policy
+    needs: registry-cli
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write
+    steps:
+      - name: Check out released source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+
+      - name: Resolve package version
+        id: release
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="$(python - <<'PY'
+          import tomllib
+          from pathlib import Path
+
+          project = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))["project"]
+          print(project["version"])
+          PY
+          )"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "tag=v$version" >> "$GITHUB_OUTPUT"
+
+      - name: Remove forbidden wheel and sdist assets from matching GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          release_id="$(
+            gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" --jq '.id'
+          )"
+          asset_ids="$(
+            gh api --paginate "repos/$GITHUB_REPOSITORY/releases/$release_id/assets" \
+              --jq '.[] | select((.name | endswith(".whl")) or (.name | endswith(".tar.gz"))) | .id'
+          )"
+          if [ -z "$asset_ids" ]; then
+            echo "No forbidden distribution assets found on $RELEASE_TAG."
+          else
+            for asset_id in $asset_ids; do
+              echo "Deleting forbidden GitHub Release distribution asset id=$asset_id"
+              gh api --method DELETE "repos/$GITHUB_REPOSITORY/releases/assets/$asset_id"
+            done
+          fi
+
+      - name: Verify public PyPI and asset-free GitHub Release policy
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_VERSION: ${{ steps.release.outputs.version }}
+        run: >-
+          python scripts/verify_release_integrity.py
+          --version "$RELEASE_VERSION"
+          --repository "$GITHUB_REPOSITORY"