scientific-computing-system 2.2.12__tar.gz → 2.2.13__tar.gz

{scientific_computing_system-2.2.12 → scientific_computing_system-2.2.13}/.github/workflows/changelog.yml

@@ -52,11 +52,33 @@ jobs:
           ref: main
           fetch-depth: 0
 
+      # The tag is passed to git-cliff through `args`, which the pinned action
+      # interpolates into a shell command in a contents:write job. Treat the
+      # dispatch input as hostile: accept only a strict vX.Y.Z string that names
+      # an existing tag, then hand the validated output to every consumer.
+      - name: Validate the tag input
+        id: tag
+        env:
+          REQUESTED_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          tag="$REQUESTED_TAG"
+          tag_re='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'
+          if [[ ! "$tag" =~ $tag_re ]]; then
+            printf '::error::inputs.tag must be a strict vX.Y.Z release tag; got: %q\n' "$tag"
+            exit 1
+          fi
+          if ! git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then
+            printf '::error::inputs.tag does not name an existing tag: %q\n' "$tag"
+            exit 1
+          fi
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+
       - name: Install git-cliff
         uses: orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff # v4
         with:
           config: cliff.toml
-          args: --verbose --tag ${{ inputs.tag }} --output CHANGELOG.md
+          args: --verbose --tag ${{ steps.tag.outputs.tag }} --output CHANGELOG.md
 
       - name: Check for changes
         id: check
@@ -110,11 +132,11 @@ jobs:
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ steps.app-token.outputs.token }}
-          commit-message: "docs(changelog): regenerate for ${{ inputs.tag }}"
-          title: "docs(changelog): regenerate for ${{ inputs.tag }} (MANUAL — review carefully)"
+          commit-message: "docs(changelog): regenerate for ${{ steps.tag.outputs.tag }}"
+          title: "docs(changelog): regenerate for ${{ steps.tag.outputs.tag }} (MANUAL — review carefully)"
           body: |
             Auto-generated CHANGELOG update from git history.
-            Triggered by MANUAL workflow_dispatch for tag `${{ inputs.tag }}`.
+            Triggered by MANUAL workflow_dispatch for tag `${{ steps.tag.outputs.tag }}`.
 
             REVIEW THE DIFF CAREFULLY before merging. git-cliff rewrites the
             entire CHANGELOG.md from commit history; hand-curated narrative

{scientific_computing_system-2.2.12 → scientific_computing_system-2.2.13}/.github/workflows/npm-publish.yml

@@ -27,8 +27,8 @@ name: npm Publish
 # `scientific-computing-system`, workflow `npm-publish.yml`, environment `npm`.
 #
 # Token mode (explicit opt-in, `use_token_fallback=true`). Uses the repository's
-# NPM_TOKEN secret through NODE_AUTH_TOKEN. This is the mode in use while the
-# npmjs.com trusted-publisher registration is pending.
+# NPM_TOKEN secret through NODE_AUTH_TOKEN. Kept only as a break-glass path for
+# when the trusted publisher is unavailable; it is never selected automatically.
 #
 # The token mode deliberately omits `--provenance`. Provenance is an OIDC-only
 # attestation: with a token there is no OIDC identity to attest to, so npm
@@ -37,10 +37,26 @@ name: npm Publish
 # cannot work or pretending an attestation was produced.
 #
 # Both modes are fail-closed. A requested mode with no usable credential exits 1
-# with an actionable message. The automatic release-tag path deliberately uses
-# the repository's verified NPM_TOKEN until npm Trusted Publishing is registered.
-# Manual workflow_dispatch runs still default to OIDC so that path can be tested
-# and adopted later without changing the release topology.
+# with an actionable message. Automatic release runs use OIDC: the attestation
+# attached to the last OIDC publish confirmed the trusted publisher is
+# registered, so the token path is no longer the default.
+#
+# ## Automatic trigger after a release
+#
+# release.yml creates the `v*` tag with GITHUB_TOKEN, and GitHub does not start
+# workflows from events created by GITHUB_TOKEN. The tag trigger below therefore
+# never fires for a real release. This workflow also runs when the `Release`
+# workflow completes; `release_gate` reads that run's jobs and proceeds only when
+# the PyPI publish job actually succeeded, so ordinary completions and
+# non-release runs skip instead of failing on an already-published version.
+#
+# ## Trigger contract
+#
+# A manual dispatch is accepted only from `main`, and a `v*` tag push only when
+# the tag is exactly `v<package.json version>`. Every path additionally requires
+# that exact version to already exist on PyPI: the npm package is a launcher for
+# the Python distribution, so publishing it first would advertise a version that
+# `pip install` cannot yet provide.
 
 on:
   workflow_dispatch:
@@ -50,14 +66,18 @@ on:
           Publish mode. false (default) = OIDC trusted publishing, which mints a
           Sigstore provenance attestation. true = token mode, using the
           repository NPM_TOKEN secret; that mode publishes WITHOUT provenance,
-          because a token cannot mint an attestation. Use true while the
-          npmjs.com trusted publisher is not yet registered.
+          because a token cannot mint an attestation. Use true only as a
+          break-glass fallback when the npm trusted publisher is unavailable.
         type: boolean
         default: false
+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]
   push:
     # release.yml creates the version tag only after the PyPI release succeeds.
     # Publishing npm from that tag gives one version bump exactly one automatic
     # npm run, avoiding the previous branch-push + tag-push duplicate race.
+    # Kept for manual tag pushes; GITHUB_TOKEN-created tags do not trigger it.
     tags:
       - "v*"
 
@@ -70,8 +90,38 @@ permissions:
   contents: read
 
 jobs:
+  release_gate:
+    name: Require a published release
+    if: github.event_name == 'workflow_run'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: read
+    outputs:
+      published: ${{ steps.check.outputs.published }}
+    steps:
+      - name: Check the triggering Release run published
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}/jobs?per_page=100" \
+            --jq '[.jobs[] | select(.name == "Build + verify + publish to PyPI + metadata-only GitHub Release") | .conclusion] | first // "missing"')"
+          echo "Release publish job: ${conclusion}"
+          if [ "${conclusion}" = "success" ]; then
+            echo "published=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "published=false" >> "$GITHUB_OUTPUT"
+          fi
+
   publish:
     name: Verify and publish to npm with OIDC trusted publishing
+    needs: release_gate
+    if: |
+      always() &&
+      (github.event_name != 'workflow_run' || needs.release_gate.outputs.published == 'true')
     runs-on: ubuntu-latest
     timeout-minutes: 20
     # The `npm` environment is referenced by the trusted-publisher configuration
@@ -88,6 +138,101 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+          # Release-triggered runs must publish the exact commit that was released,
+          # not whatever main points at when the follow-up workflow starts.
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
+
+      # GATE: bind each trigger to the version it is allowed to publish.
+      #
+      # `workflow_dispatch` accepts an arbitrary ref, so without this a dispatch
+      # from a feature branch would publish whatever (possibly unreleased)
+      # package.json version that branch carries. The tag trigger is equally
+      # broad (`v*`), so a stray `v`-prefixed tag could publish a version that
+      # the checked-out package.json does not declare. Both cases end here.
+      - name: Validate the trigger ref and tag
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REF: ${{ github.ref }}
+        run: |
+          set -euo pipefail
+          version="$(python3 -c 'import json; print(json.load(open("package.json", encoding="utf-8"))["version"])')"
+          expected_tag="v${version}"
+          case "$EVENT_NAME" in
+            workflow_dispatch)
+              if [ "$REF" != "refs/heads/main" ]; then
+                echo "::error::workflow_dispatch may only publish from main; got ${REF}"
+                echo "::error::dispatch from main so package.json is the reviewed release version"
+                exit 1
+              fi
+              echo "PASS: manual dispatch from main (package.json ${version})"
+              ;;
+            push)
+              if [ "$REF" != "refs/tags/${expected_tag}" ]; then
+                echo "::error::tag ${REF} does not match package.json version ${version}"
+                echo "::error::expected refs/tags/${expected_tag}; refusing to publish a mismatched tag"
+                exit 1
+              fi
+              echo "PASS: tag ${expected_tag} matches package.json ${version}"
+              ;;
+            workflow_run)
+              echo "PASS: release-triggered run (release_gate checked the PyPI publish job)"
+              ;;
+            *)
+              echo "::error::unsupported trigger event: ${EVENT_NAME}"
+              exit 1
+              ;;
+          esac
+
+      # GATE: npm is a launcher for the PyPI distribution, and docs/maintenance.md
+      # promises npm only proceeds when the release is already on PyPI. The
+      # workflow_run path proves that through `release_gate`; this checks the
+      # registry itself so dispatch and tag-push paths get the same guarantee.
+      # A 404, an unparsable response, or an outage is a failure, never a pass.
+      - name: Assert the exact version is already published on PyPI
+        shell: bash
+        env:
+          DISTRIBUTION: scientific-computing-system
+        run: |
+          set -euo pipefail
+          version="$(python3 -c 'import json; print(json.load(open("package.json", encoding="utf-8"))["version"])')"
+          python3 - "$DISTRIBUTION" "$version" <<'PY'
+          import json
+          import sys
+          import urllib.error
+          import urllib.request
+
+          distribution, version = sys.argv[1], sys.argv[2]
+          url = f"https://pypi.org/pypi/{distribution}/{version}/json"
+          try:
+              with urllib.request.urlopen(url, timeout=60) as response:
+                  payload = json.load(response)
+          except urllib.error.HTTPError as exc:
+              print(
+                  f"::error::PyPI has no {distribution} {version} (HTTP {exc.code}): {url}",
+                  file=sys.stderr,
+              )
+              sys.exit(1)
+          except (urllib.error.URLError, TimeoutError, OSError) as exc:
+              print(
+                  f"::error::could not verify PyPI state for {distribution} {version}: {exc}",
+                  file=sys.stderr,
+              )
+              sys.exit(1)
+
+          info = payload.get("info") or {}
+          files = payload.get("urls") or []
+          wheels = [f for f in files if str(f.get("filename", "")).endswith(".whl")]
+          if info.get("version") != version or not wheels:
+              print(
+                  f"::error::PyPI {distribution} {version} is not fully published "
+                  f"(reported version {info.get('version')!r}, {len(files)} file(s), "
+                  f"{len(wheels)} wheel(s))",
+                  file=sys.stderr,
+              )
+              sys.exit(1)
+          print(f"PASS: PyPI already serves {distribution} {version} ({len(files)} files)")
+          PY
 
       # Node 24 ships npm 11.5.1+, the floor for trusted publishing.
       #
@@ -284,15 +429,16 @@ jobs:
 
       # Two supported modes, selected by the `use_token_fallback` dispatch input.
       #
-      # OIDC (preferred, default): no NODE_AUTH_TOKEN is set. The npm CLI
-      # detects the OIDC environment (id-token: write above) and exchanges the
-      # runner's identity token for a short-lived publish credential scoped to
-      # this repository, workflow and environment. `--provenance` attaches a
-      # Sigstore-signed attestation to the tarball binding it to this commit.
+      # OIDC (default, including every automatic release run): no
+      # NODE_AUTH_TOKEN is set. The npm CLI detects the OIDC environment
+      # (id-token: write above) and exchanges the runner's identity token for a
+      # short-lived publish credential scoped to this repository, workflow and
+      # environment. `--provenance` attaches a Sigstore-signed attestation to
+      # the tarball binding it to this commit.
       #
       # Token (explicit opt-in): uses the repository's existing NPM_TOKEN secret
-      # via NODE_AUTH_TOKEN. This is the mode the maintainer selected while the
-      # npmjs.com trusted-publisher registration is still pending.
+      # via NODE_AUTH_TOKEN. Break-glass only: it is never selected without a
+      # workflow_dispatch input that asks for it.
       #
       # The token mode does NOT pass --provenance, and must not. Provenance is an
       # OIDC-only attestation: without a trusted-publisher configuration npm has
@@ -320,7 +466,7 @@ jobs:
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             requested_token="${{ inputs.use_token_fallback }}"
           else
-            requested_token="true"
+            requested_token="false"
           fi
 
           if [ "$requested_token" = "true" ]; then
@@ -330,7 +476,7 @@ jobs:
               exit 1
             fi
             echo "mode=token via NPM_TOKEN (no provenance: a long-lived token cannot mint a Sigstore attestation)"
-            echo "::warning::Automatic release-tag publishing uses NPM_TOKEN until npm Trusted Publishing is registered."
+            echo "::warning::Publishing with NPM_TOKEN break-glass mode; this release carries no provenance attestation."
           else
             if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]; then
               echo "::error::OIDC mode was requested but this job cannot mint an OIDC token"
@@ -384,7 +530,7 @@ jobs:
       # trusted publisher is the cause, and "bump the version" would not have
       # helped.
       - name: Publish to npm (OIDC trusted publishing, with provenance)
-        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.use_token_fallback }}
+        if: ${{ !inputs.use_token_fallback }}
         run: |
           # `-e` is on by default in this shell, so it is explicitly suspended
           # around npm to capture the exit code instead of aborting before the
@@ -430,7 +576,7 @@ jobs:
           echo "PASS: npm publish returned 0"
 
       - name: Publish to npm (token mode, no provenance)
-        if: ${{ github.event_name != 'workflow_dispatch' || inputs.use_token_fallback }}
+        if: ${{ inputs.use_token_fallback }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |

{scientific_computing_system-2.2.12 → scientific_computing_system-2.2.13}/.github/workflows/pr-automation.yml

@@ -40,12 +40,28 @@ jobs:
       github.event_name == 'workflow_dispatch'
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          # Never interpolate a dispatch input into JavaScript source. Passing
+          # it through env keeps it a string value, and the strict check below
+          # makes malformed input fail the job instead of becoming NaN.
+          REQUESTED_PR_NUMBER: ${{ inputs.pr_number }}
         with:
           script: |
             const { owner, repo } = context.repo;
             let prNumber = context.issue ? context.issue.number : null;
             if (context.eventName === 'workflow_dispatch') {
-              prNumber = parseInt('${{ inputs.pr_number }}');
+              const raw = process.env.REQUESTED_PR_NUMBER || '';
+              if (!/^[1-9][0-9]{0,9}$/.test(raw)) {
+                core.setFailed(
+                  `pr_number must be a positive integer (got ${JSON.stringify(raw)})`,
+                );
+                return;
+              }
+              prNumber = Number(raw);
+              if (!Number.isSafeInteger(prNumber)) {
+                core.setFailed(`pr_number is outside the safe integer range: ${raw}`);
+                return;
+              }
             }
             if (!prNumber) {
               console.log('No PR number provided');

scientific_computing_system-2.2.12/.github/workflows/pypi-registry-smoke.yml → scientific_computing_system-2.2.13/.github/workflows/pypi-release-policy.yml

@@ -1,4 +1,4 @@
-name: PyPI Registry CLI Smoke
+name: PyPI Release Policy
 
 on:
   workflow_run:
@@ -11,52 +11,28 @@ on:
       - main
     paths:
       - ".github/workflows/release.yml"
-      - ".github/workflows/pypi-registry-smoke.yml"
-      - "scripts/verify_pypi_release.py"
+      - ".github/workflows/pypi-release-policy.yml"
       - "scripts/verify_release_integrity.py"
+  workflow_dispatch:
 
-# Default-deny; each job below declares exactly the scopes it needs.
+# Default-deny; the policy job below declares exactly the scopes it needs.
 permissions:
   contents: read
 
 concurrency:
-  group: pypi-registry-smoke-${{ github.event.workflow_run.head_sha || github.sha }}
+  group: pypi-release-policy-${{ github.event.workflow_run.head_sha || github.sha }}
   cancel-in-progress: false
 
+# PyPI download statistics count every fetched distribution file, including
+# files fetched by CI. This workflow therefore reads the public PyPI JSON API
+# only and never installs or downloads the released distribution.
 jobs:
-  registry-cli:
+  github-release-policy:
     if: >-
       github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
-    name: public PyPI CLI on ${{ matrix.os }} / Python 3.12
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 25
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - macos-latest
-          - windows-latest
-    steps:
-      - name: Check out released source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
-        with:
-          python-version: "3.12"
-
-      - name: Verify exact release from public PyPI
-        run: python scripts/verify_pypi_release.py
-
-  github-release-policy:
     name: enforce metadata-only GitHub Release policy
-    needs: registry-cli
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions: