scientific-computing-system 2.2.0__tar.gz → 2.2.2__tar.gz

{scientific_computing_system-2.2.0 → scientific_computing_system-2.2.2}/.github/workflows/cli-package-smoke.yml

@@ -33,10 +33,15 @@ jobs:
         with:
           python-version: "3.12"
       - name: Build wheel
+        # bash, not the Windows default PowerShell: `set -euo pipefail` is bash
+        # syntax and pwsh rejects it with "A parameter cannot be found that
+        # matches parameter name 'euo'". The other steps in this job pin the
+        # shell for the same reason.
+        shell: bash
         run: |
-          python -m pip install --upgrade pip
-          pip install build
-          python -m build --wheel
+          set -euo pipefail
+          python -m pip install --require-hashes --only-binary=:all: -r requirements-build.lock
+          python -m build --wheel --no-isolation
       - name: Install wheel instead of source tree
         shell: bash
         run: |

scientific_computing_system-2.2.2/.github/workflows/npm-publish.yml

@@ -0,0 +1,403 @@
+name: npm Publish
+
+# Sole npm publish authority for this repository.
+#
+# ## What this package is
+#
+# `scientific-computing-system` on npm is a *launcher shim*: it ships
+# `index.js` and `bin/scs.js` (plus README/CHANGELOG/LICENSE/SECURITY) and
+# nothing else. It contains no Python. `scs` locates a Python interpreter and
+# execs `python -m cds`, which comes from the PyPI distribution. The npm package
+# is therefore only useful alongside `pip install scientific-computing-system`;
+# the launcher exits non-zero with an actionable message when no interpreter or
+# no `cds` package is present. This is stated in package.json's description and
+# asserted by npm.test.js.
+#
+# ## Authentication: two supported modes
+#
+# OIDC trusted publishing (preferred, the default). npm receives this job's
+# OIDC identity token (audience `npm:registry.npmjs.org`) and exchanges it for a
+# short-lived, single-use publish credential scoped to this repository, this
+# workflow file and this environment. No long-lived registry secret is involved,
+# and no `NODE_AUTH_TOKEN` is set on that path: the npm CLI detects the OIDC
+# environment before it ever looks for a token. `--provenance` attaches a
+# Sigstore-signed attestation binding the tarball to this commit. One-time
+# npmjs.com setup: package `scientific-computing-system` -> Settings -> Trusted
+# Publisher -> GitHub Actions -> owner `Furox-Art`, repository
+# `scientific-computing-system`, workflow `npm-publish.yml`, environment `npm`.
+#
+# Token mode (explicit opt-in, `use_token_fallback=true`). Uses the repository's
+# NPM_TOKEN secret through NODE_AUTH_TOKEN. This is the mode in use while the
+# npmjs.com trusted-publisher registration is pending.
+#
+# The token mode deliberately omits `--provenance`. Provenance is an OIDC-only
+# attestation: with a token there is no OIDC identity to attest to, so npm
+# rejects the combination outright. The token mode therefore publishes without
+# provenance and prints a NOTICE saying so, rather than passing a flag that
+# cannot work or pretending an attestation was produced.
+#
+# Both modes are fail-closed. A requested mode with no usable credential exits 1
+# with an actionable message. Token mode never runs automatically, so a broken
+# OIDC configuration cannot silently downgrade to the long-lived credential.
+
+on:
+  workflow_dispatch:
+    inputs:
+      use_token_fallback:
+        description: >-
+          Publish mode. false (default) = OIDC trusted publishing, which mints a
+          Sigstore provenance attestation. true = token mode, using the
+          repository NPM_TOKEN secret; that mode publishes WITHOUT provenance,
+          because a token cannot mint an attestation. Use true while the
+          npmjs.com trusted publisher is not yet registered.
+        type: boolean
+        default: false
+  push:
+    # `branches` and `tags` in one `push` mapping are OR'd by GitHub.
+    #
+    # The `v*` tag is the release path: release.yml creates the tag only after
+    # the PyPI publish has succeeded, so a single version bump reaches PyPI
+    # first and npm second. `paths` narrows *branch* pushes so unrelated merges
+    # do not run this job; GitHub does not evaluate `paths` against tag pushes.
+    branches: [main]
+    tags:
+      - "v*"
+    paths:
+      - "package.json"
+      - "index.js"
+      - "bin/**"
+      - "npm.test.js"
+      - ".github/workflows/npm-publish.yml"
+
+concurrency:
+  group: npm-publish
+  cancel-in-progress: false
+
+# Default-deny; the publish job below declares exactly what it needs.
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Verify and publish to npm with OIDC trusted publishing
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    # The `npm` environment is referenced by the trusted-publisher configuration
+    # on npmjs.com. Adding a required reviewer here is the other half of that
+    # control; it is intentionally left to the maintainer because a required
+    # reviewer on a single-maintainer repository would deadlock releases.
+    environment: npm
+    permissions:
+      contents: read
+      # Required to mint the OIDC token npm exchanges for a publish credential.
+      # This is the entire point of the OIDC path: no long-lived secret.
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # Node 24 ships npm 11.5.1+, the floor for trusted publishing.
+      #
+      # `registry-url` is REQUIRED for the token mode and was its missing half.
+      # Without it setup-node writes no .npmrc at all, so npm never learns that
+      # registry.npmjs.org accepts a token, and NODE_AUTH_TOKEN is exported into
+      # the environment but read by nobody. The publish then fails with:
+      #
+      #   npm error code ENEEDAUTH
+      #   npm error need auth This command requires you to be logged in to
+      #                         https://registry.npmjs.org/
+      #
+      # ENEEDAUTH means npm did not attempt authentication at all -- as opposed to
+      # E401, which means it did and the credential was rejected. Seeing ENEEDAUTH
+      # with a populated secret is the signature of "no registry auth entry
+      # configured", not "bad token".
+      #
+      # With registry-url set, setup-node writes a userconfig containing
+      #   //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+      # which is what makes the env var meaningful. Verified locally: with only
+      # NODE_AUTH_TOKEN exported and no such entry, npm goes straight to
+      # ENEEDAUTH; with the entry present it reaches the registry and fails
+      # E401 on a deliberately fake token instead.
+      - name: Set up Node
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          # Never cache in a publish job: a warm cache is a way to publish bytes
+          # this checkout did not produce.
+          package-manager-cache: false
+
+      # Toolchain floor for trusted publishing: npm 11.5.1 and Node 22.14.0.
+      #
+      # The comparison is an integer semver compare, not a regex. The previous
+      # regex here was wrong and rejected the npm that setup-node actually
+      # installs:
+      #
+      #   npm --version | grep -Eq '^11\.(5[1-9]|[6-9][0-9])\.|^1[2-9]\.'
+      #
+      # `[6-9][0-9]` covers 60-99, so `11.19.0` (what Node 24 ships) never
+      # matched and the gate failed on a compliant toolchain. Regex cannot
+      # express "greater than or equal to" for a dotted version without
+      # enumerating every minor, which is exactly the class of bug that shipped
+      # here. Numeric major/minor/patch comparison is total and obvious.
+      #
+      # The Node check that preceded it had the matching defect: it compared
+      # only major and minor, so `22.14.0` and `22.9.0` were both accepted even
+      # though only the former meets the documented floor.
+      - name: Assert the toolchain supports OIDC trusted publishing
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm_version="$(npm --version)"
+          node_version="$(node --version)"
+          echo "npm=$npm_version node=$node_version"
+
+          # `$npm_version` and `$node_version` are positional arguments, never
+          # interpolated into the JS source, so a malformed or hostile value
+          # cannot break out into code.
+          node -e '
+            const REQUIRED_NPM = [11, 5, 1];
+            const REQUIRED_NODE = [22, 14, 0];
+
+            // Strip an optional leading "v" and any pre-release/build suffix,
+            // then take the numeric leading components.
+            function parse(raw, label) {
+              const match = /^[vV]?(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(String(raw).trim());
+              if (!match) {
+                console.error(`::error::could not parse the ${label} version: ${JSON.stringify(raw)}`);
+                process.exit(1);
+              }
+              return [Number(match[1]), Number(match[2] || 0), Number(match[3] || 0)];
+            }
+
+            // Returns negative if a < b, 0 if equal, positive if a > b.
+            function compare(a, b) {
+              for (let i = 0; i < 3; i += 1) {
+                if (a[i] !== b[i]) return a[i] - b[i];
+              }
+              return 0;
+            }
+
+            const npmVersion = parse(process.argv[1], "npm");
+            const nodeVersion = parse(process.argv[2], "node");
+
+            if (compare(npmVersion, REQUIRED_NPM) < 0) {
+              console.error(
+                `::error::npm ${REQUIRED_NPM.join(".")}+ is required for OIDC trusted publishing, got ${npmVersion.join(".")}`,
+              );
+              process.exit(1);
+            }
+            if (compare(nodeVersion, REQUIRED_NODE) < 0) {
+              console.error(
+                `::error::Node ${REQUIRED_NODE.join(".")}+ is required for trusted publishing, got ${nodeVersion.join(".")}`,
+              );
+              process.exit(1);
+            }
+            console.log(
+              `PASS: npm ${npmVersion.join(".")} >= ${REQUIRED_NPM.join(".")}, ` +
+                `node ${nodeVersion.join(".")} >= ${REQUIRED_NODE.join(".")}`,
+            );
+          ' "$npm_version" "$node_version"
+
+      # The launcher previously shipped unparseable and pointing at a
+      # nonexistent module, and nothing in CI ever invoked Node.
+      - name: Syntax-check the launcher and the bin shim
+        run: |
+          node --check index.js
+          node --check bin/scs.js
+
+      - name: Run the npm entry-point contract suite
+        run: npm test
+
+      # GATE: the published tarball must contain the allowlist and nothing else.
+      # Without this, a future edit to package.json could ship the repository
+      # (tests, workflows, 10k+ statements of Python) to the public registry.
+      - name: Assert the publish tarball contains only the allowlist
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm pack --dry-run 2>&1 | tee pack-dry-run.txt
+          for forbidden in "src/" "tests/" "docs/" ".github/" "benchmarks/" "assets/"; do
+            if grep -q "$forbidden" pack-dry-run.txt; then
+              echo "::error::npm tarball would publish $forbidden"
+              exit 1
+            fi
+          done
+
+      # GATE: package.json must not be private, or `npm publish` refuses to run.
+      - name: Assert package.json is publishable
+        run: |
+          set -euo pipefail
+          node -e '
+            const pkg = require("./package.json");
+            if (pkg.private === true) {
+              console.error("::error::package.json sets private:true; npm publish is blocked");
+              process.exit(1);
+            }
+            console.log(`PASS: ${pkg.name}@${pkg.version} is publishable`);
+          '
+
+      # GATE: the repo's own version-lockstep check, which covers package.json.
+      # Catches publishing a launcher whose version disagrees with the Python
+      # distribution it shells out to.
+      - name: Assert npm version tracks the Python distribution
+        run: |
+          set -euo pipefail
+          python3 -m pip install --upgrade pip
+          python3 -m pip install .
+          node -e '
+            const fs = require("node:fs");
+            const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+            const text = fs.readFileSync("pyproject.toml", "utf8");
+            const match = /^version\s*=\s*"([^"]+)"/m.exec(text);
+            if (!match) { console.error("::error::pyproject.toml has no static version"); process.exit(1); }
+            if (pkg.version !== match[1]) {
+              console.error(`::error::npm ${pkg.version} != Python ${match[1]}`);
+              process.exit(1);
+            }
+            console.log(`PASS: npm ${pkg.version} matches Python ${match[1]}`);
+          '
+
+      # GATE: refuse to republish. A version can only be published once, so an
+      # already-present version means either a duplicate trigger or a
+      # half-finished recovery. Both should stop here rather than fail confusingly
+      # inside `npm publish`.
+      - name: Assert the version is not already published
+        run: |
+          set -euo pipefail
+          version="$(node -p 'require("./package.json").version')"
+          if npm view "scientific-computing-system@${version}" version >/dev/null 2>&1; then
+            echo "::error::scientific-computing-system@${version} is already on npm"
+            echo "::error::nothing to do; bump package.json (and the locked version surfaces) to publish again"
+            exit 1
+          fi
+          echo "PASS: scientific-computing-system@${version} is unpublished"
+
+      # Two supported modes, selected by the `use_token_fallback` dispatch input.
+      #
+      # OIDC (preferred, default): no NODE_AUTH_TOKEN is set. The npm CLI
+      # detects the OIDC environment (id-token: write above) and exchanges the
+      # runner's identity token for a short-lived publish credential scoped to
+      # this repository, workflow and environment. `--provenance` attaches a
+      # Sigstore-signed attestation to the tarball binding it to this commit.
+      #
+      # Token (explicit opt-in): uses the repository's existing NPM_TOKEN secret
+      # via NODE_AUTH_TOKEN. This is the mode the maintainer selected while the
+      # npmjs.com trusted-publisher registration is still pending.
+      #
+      # The token mode does NOT pass --provenance, and must not. Provenance is an
+      # OIDC-only attestation: without a trusted-publisher configuration npm has
+      # no OIDC identity to attest to, so `--provenance` would fail the publish
+      # outright. Passing it and catching the error would be worse -- it would
+      # print a failure and then publish anyway. The token mode therefore
+      # publishes without provenance, and says so, rather than pretending an
+      # attestation exists.
+      #
+      # Both modes are fail-closed: a requested mode with no usable credential
+      # exits 1 with an actionable message instead of silently falling through.
+      # There is no `continue-on-error` and no `|| true` anywhere in this job.
+      #
+      # The credential preflight is a SEPARATE STEP, not an inline `if` inside
+      # the publish step. Inline, a credential check that prints an error but
+      # forgets to exit continues straight into `npm publish` -- which is
+      # precisely what the failed run did: the fail-closed branch's own source
+      # text appeared in the log and npm was invoked anyway. As its own step, a
+      # non-zero exit ends the job before any publish step can run.
+      - name: Assert the requested publish mode has a usable credential
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ "${{ inputs.use_token_fallback }}" = "true" ]; then
+            if [ -z "${NPM_TOKEN:-}" ]; then
+              echo "::error::token mode was requested (use_token_fallback=true) but the NPM_TOKEN secret is empty or unset"
+              echo "::error::add an npm automation token as the NPM_TOKEN secret, or re-run without use_token_fallback once the npmjs.com trusted publisher is registered"
+              exit 1
+            fi
+            echo "mode=token via NPM_TOKEN (no provenance: a long-lived token cannot mint a Sigstore attestation)"
+            echo "::warning::Publishing with NPM_TOKEN instead of OIDC. Register the npmjs.com trusted publisher and delete NPM_TOKEN once this release is out."
+          else
+            if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]; then
+              echo "::error::OIDC mode was requested but this job cannot mint an OIDC token"
+              echo "::error::ACTIONS_ID_TOKEN_REQUEST_URL is unset, so the runner did not grant id-token: write"
+              echo "::error::either fix the id-token: write permission, or re-run with use_token_fallback=true to publish with NPM_TOKEN instead"
+              exit 1
+            fi
+            echo "mode=oidc (provenance attestation enabled)"
+          fi
+
+      # GATE: the registry auth entry must actually exist. setup-node's
+      # `registry-url` is what writes it; this asserts the outcome rather than
+      # trusting the configuration, so a future edit that drops registry-url
+      # fails here with a clear cause instead of at `npm publish` with ENEEDAUTH.
+      - name: Assert the npm registry auth entry is configured
+        shell: bash
+        run: |
+          set -euo pipefail
+          userconfig="$(npm config get userconfig)"
+          echo "npm userconfig=$userconfig"
+          if [ ! -f "$userconfig" ]; then
+            echo "::error::no npm userconfig at $userconfig"
+            echo "::error::setup-node writes this file from its registry-url input; without it npm has no registry auth entry"
+            exit 1
+          fi
+          if ! grep -q '_authToken' "$userconfig"; then
+            echo "::error::$userconfig has no _authToken entry"
+            echo "::error::npm would fail with ENEEDAUTH: NODE_AUTH_TOKEN alone is inert without a registry auth entry"
+            exit 1
+          fi
+          if ! grep -q 'registry.npmjs.org' "$userconfig"; then
+            echo "::error::$userconfig does not reference registry.npmjs.org"
+            exit 1
+          fi
+          # The token value itself must never be echoed.
+          echo "PASS: npm registry auth entry present (value not shown)"
+          echo "PASS: the entry references NODE_AUTH_TOKEN by name, not a literal secret"
+
+      - name: Publish to npm (OIDC trusted publishing, with provenance)
+        if: ${{ !inputs.use_token_fallback }}
+        run: npm publish --provenance --access public
+
+      - name: Publish to npm (token mode, no provenance)
+        if: ${{ inputs.use_token_fallback }}
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          # Deliberately no --provenance: a token-authenticated publish cannot
+          # produce a Sigstore attestation. npm will reject the combination.
+          echo "NOTICE: publishing with NPM_TOKEN; this release carries no provenance attestation"
+          npm publish --access public
+
+      # Post-publish confirmation that the version is actually readable.
+      #
+      # This was a single immediate `npm view`, and it produced a false failure
+      # on run 37136131220: the upload succeeded and the registry recorded 2.2.0
+      # ninety seconds later, but the probe ran within a second of `npm publish`
+      # returning and got E404, turning a successful release into a red job.
+      # Three sibling repositories hit the same thing.
+      #
+      # The probe now polls the registry's JSON API with backoff, over a budget
+      # of several minutes -- deliberately generous, because npm's propagation
+      # gap is not bounded and shortening it to make a test fast would recreate
+      # the original false failure. It succeeds on the first match and fails
+      # closed if the version never appears, emitting a `::warning::` first so a
+      # slow-but-successful publish is never read as a hard failure.
+      #
+      # `npm view` was dropped as the probe: it reports "absent" and "denied"
+      # with the same E404, and it resolves against the userconfig this job
+      # created for writing, so a read-only confirmation had no reason to touch
+      # publish credentials at all.
+      - name: Verify the published version (polling for registry propagation)
+        run: |
+          set -euo pipefail
+          version="$(node -p 'require("./package.json").version')"
+          python3 scripts/verify_npm_publication.py \
+            --package scientific-computing-system \
+            --version "$version" \
+            --registry https://registry.npmjs.org \
+            --attempts 12 \
+            --initial-delay 5 \
+            --growth 1.5 \
+            --max-delay 30

{scientific_computing_system-2.2.0 → scientific_computing_system-2.2.2}/.github/workflows/release.yml

@@ -179,6 +179,20 @@ jobs:
       - name: Build sdist + wheel without dependency isolation
         run: python -m build --no-isolation
 
+      # Validate the core metadata *rendered* from the artifacts, before anything
+      # is uploaded. `check_version_lockstep.py` proves the version and name are
+      # right; it does not prove the artifact is renderable at all. This is the
+      # step that catches an unusable artifact while it is still local.
+      #
+      # The pin matters and is not cosmetic. twine <= 6.2.0 replaces
+      # `packaging.metadata._VALID_METADATA_VERSIONS` at import time with a list
+      # ending at 2.4, so it rejects a valid artifact with
+      # `InvalidDistribution: '2.5' is not a valid metadata version` -- a release
+      # failure with nothing wrong with the package. twine 7.0.0 (pinned in
+      # requirements-build.lock) removed the override.
+      - name: Validate artifact metadata renders
+        run: python -m twine check --strict dist/*
+
       # Assert the *contents* of both artifacts before anything is published.
       # The version/name verification below proves the metadata says 2.1.0; this
       # proves the wheel actually ships `cds` with its `py.typed` marker and the

{scientific_computing_system-2.2.0 → scientific_computing_system-2.2.2}/.github/workflows/tests.yml

@@ -307,6 +307,53 @@ jobs:
         run: python scripts/check_version_discipline.py --base-ref "${{ steps.base.outputs.ref }}"
       - name: Reject version metadata lockstep drift
         run: python scripts/check_version_lockstep.py
+      # The release toolchain must stay pinned, and the twine pin must stay able
+      # to validate the Metadata-Version the build backend actually emits --
+      # twine<=6.2.0 overrides packaging's list at import time and rejects valid
+      # artifacts with `'2.5' is not a valid metadata version`.
+      #
+      # GITHUB_TOKEN is passed so the advisory upstream checks authenticate.
+      # Unauthenticated GitHub API calls are capped at 60/hour, which is easy to
+      # exceed and fails in a way that looks like success: a sibling guard
+      # "verified" pins under rate limiting and silently verified nothing.
+      # Fast, offline, workflow-shape gate: pins and `twine check --strict` usage.
+      # The authoritative run, including the twine/Metadata-Version compatibility
+      # check, is in the `packaging` job below -- the only job that has built
+      # artifacts to read the emitted Metadata-Version from.
+      - name: Reject unpinned release toolchain
+        run: python scripts/check_release_toolchain.py --skip-network
+      # The provenance prose asserts, per registry, whether the published
+      # release carries a build attestation. That claim was originally written
+      # from memory and nothing checked it, so it could have kept being
+      # asserted after a release changed the answer. This runs the committed
+      # guard (`docs/checks/verify_provenance_claims.py`) against the live
+      # registries and fails if the prose contradicts them.
+      #
+      # Placed here rather than in a new job on purpose: this job already owns
+      # release-metadata verification and already sits in the required `CI`
+      # aggregate, so this strengthens an existing gate instead of adding a
+      # required check that would need a ruleset change. `permissions:
+      # contents: read` above is sufficient -- the guard only reads PyPI and npm,
+      # never the GitHub API, so no token is needed.
+      #
+      # `--strict-network` is deliberately NOT set: a registry outage is
+      # reported as UNKNOWN and the run passes with a NOTICE, because a required
+      # gate that fails on a DNS blip teaches people to re-run it rather than
+      # read it. A false claim still fails. The unit test
+      # (`tests/test_provenance_claims.py`) is the deterministic gate and needs
+      # no network at all.
+      #
+      # The version is read from `pyproject.toml` rather than hardcoded: a
+      # literal here would go stale at the next release, which is the same class
+      # of stale-constant bug this step exists to catch. A version that has not
+      # shipped yet is reported as unverifiable rather than "unattested", so a
+      # bump PR is not blocked by asking about a release that does not exist.
+      - name: Reject provenance claims that contradict the live registries
+        run: >-
+          python docs/checks/verify_provenance_claims.py
+          --version "$(python -c 'import tomllib, pathlib;
+          print(tomllib.loads(pathlib.Path("pyproject.toml").read_text(encoding="utf-8"))
+          ["project"]["version"])')"
 
   packaging:
     name: built wheel and sdist contents on Linux with Python 3.12
@@ -332,6 +379,19 @@ jobs:
         run: python scripts/check_version_lockstep.py --dist-dir dist
       - name: Assert wheel and sdist contents
         run: python scripts/check_distribution_contents.py dist
+      # Read the Metadata-Version out of the artifacts just built and prove the
+      # pinned twine can validate it. twine<=6.2.0 overrides packaging's
+      # metadata-version list at import time and rejects a valid artifact with
+      # `'2.5' is not a valid metadata version`; a sibling release failed that
+      # way with nothing wrong with the package.
+      #
+      # GITHUB_TOKEN is passed so the advisory upstream checks authenticate.
+      # Unauthenticated GitHub API calls are capped at 60/hour, and under rate
+      # limiting a pin check can silently verify nothing while reporting success.
+      - name: Assert the pinned twine can validate the built metadata
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: python scripts/check_release_toolchain.py --dist-dir dist
       # A source distribution whose own test suite cannot pass is not a source
       # distribution. 13 release-contract tests used to fail here because
       # `.github/workflows` was missing from the sdist; this step is what keeps