tangier 0.2.1__tar.gz

tangier-0.2.1/.github/actions/build/action.yaml

@@ -0,0 +1,152 @@
+name: tangier build
+description: >-
+  Build and push one package's content-addressed image, skipping the build
+  entirely when that tag is already published.
+
+inputs:
+  package:
+    description: The SHA bucket to build. Must have an `[image.<bucket>]` table in pipeline.toml.
+    required: true
+  registry-password:
+    description: Password for the image registry.
+    required: true
+  registry-username:
+    description: >-
+      Username for the image registry. Defaults to `registry`, which is what
+      every repo but tangerinecms uses.
+    required: false
+    default: registry
+  extra-secrets:
+    description: >-
+      Space-separated buildx secret IDS — not values — for secrets not named in
+      the package's `[image.<bucket>] secrets`. The value is read from the
+      environment variable of the same name upper-cased, so `sentry_auth_token`
+      reads SENTRY_AUTH_TOKEN. A secret whose variable is unset is silently
+      dropped rather than passed empty, so pass values through the step's `env:`
+      block (a composite action cannot read the `secrets` context).
+    required: false
+    default: ""
+  regctl-version:
+    description: regctl release to install. Pinned, never `latest`.
+    required: false
+    default: v0.6.1
+  tangier-ref:
+    description: >-
+      The tangier ref to install the CLI from. Defaults to the ref this action
+      was called at. Required when calling the action locally (`uses: ./...`),
+      because `github.action_ref` is empty for a local path.
+    required: false
+    default: ""
+
+outputs:
+  tag:
+    description: The content-hash tag for this package, whether or not a build ran.
+    value: ${{ steps.build.outputs.tag }}
+  published:
+    description: >-
+      `true` when this run built and pushed the image, `false` when the tag was
+      already published and the build was skipped.
+    value: ${{ steps.build.outputs.built }}
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve the tangier ref
+      id: ref
+      shell: bash
+      # `github.action_ref` is empty inside a `run:` body but correct when bound
+      # through `env:` (actions/runner#2473), so every read here goes via the
+      # environment. It is also empty for a local `uses: ./...`, which is how
+      # tangier tests its own actions — hence the input, and a hard error rather
+      # than a silent fallback to `main`.
+      env:
+        ACTION_REF: ${{ github.action_ref }}
+        INPUT_REF: ${{ inputs.tangier-ref }}
+      run: |
+        set -euo pipefail
+        REF="${INPUT_REF:-$ACTION_REF}"
+        if [ -z "$REF" ]; then
+          echo "::error::cannot determine which tangier ref to install. Pass the tangier-ref input when calling this action by local path." >&2
+          exit 1
+        fi
+        echo "ref=$REF" >> "$GITHUB_OUTPUT"
+
+    - uses: astral-sh/setup-uv@v5
+      with:
+        version: "0.5.29"
+
+    - name: Install tangier
+      shell: bash
+      # `uv tool install`, not `uvx --from`, so `tangier` stays on PATH for any
+      # repo script that runs after this action.
+      env:
+        TANGIER_REF: ${{ steps.ref.outputs.ref }}
+      run: |
+        set -euo pipefail
+        uv tool install "git+https://github.com/sminnee/tangier@${TANGIER_REF}"
+
+    - name: Install regctl
+      shell: bash
+      # Pinned by version, never `releases/latest`: a moving binary in the hot
+      # path of every build is a silent behaviour change with no PR anywhere.
+      # `set -euo pipefail` matters here — without it a failed curl leaves a
+      # zero-byte file that fails confusingly several steps later.
+      env:
+        REGCTL_VERSION: ${{ inputs.regctl-version }}
+      run: |
+        set -euo pipefail
+        # Into $RUNNER_TEMP rather than /usr/local/bin: that directory happens to
+        # be writable on GitHub-hosted images, but not on a self-hosted runner or
+        # a container job running as non-root — and `runs-on` is already an input.
+        mkdir -p "$RUNNER_TEMP/bin"
+        curl -fsSL -o "$RUNNER_TEMP/bin/regctl" \
+          "https://github.com/regclient/regclient/releases/download/${REGCTL_VERSION}/regctl-linux-amd64"
+        chmod 755 "$RUNNER_TEMP/bin/regctl"
+        echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+        "$RUNNER_TEMP/bin/regctl" version
+
+    - uses: docker/setup-buildx-action@v3
+
+    - name: Registry login
+      shell: bash
+      # `[registry] url` is host + namespace, but `docker login` takes only the
+      # host: `${URL%%/*}` gives `registry.sminn.ee` from
+      # `registry.sminn.ee/tangerine`, and keeps a `:port` if one is configured.
+      # Read with tomllib rather than the CLI so this step does not depend on
+      # the install above having succeeded.
+      env:
+        REGISTRY_USERNAME: ${{ inputs.registry-username }}
+        REGISTRY_PASSWORD: ${{ inputs.registry-password }}
+      run: |
+        set -euo pipefail
+        URL="$(python3 -c '
+        import tomllib
+        with open("pipeline.toml", "rb") as fh:
+            print(tomllib.load(fh)["registry"]["url"])
+        ')"
+        HOST="${URL%%/*}"
+        echo "Logging in to $HOST"
+        printf '%s' "$REGISTRY_PASSWORD" | docker login "$HOST" \
+          --username "$REGISTRY_USERNAME" --password-stdin
+
+    - name: Build and push
+      id: build
+      shell: bash
+      # tangier probes the registry first and skips the build when the
+      # content-hash tag is already published — the idempotence that
+      # content-addressed tagging exists for. It emits `tag` and `built` to
+      # $GITHUB_OUTPUT itself, which is where this action's outputs come from.
+      #
+      # `resolve_secrets` reads os.environ and drops any secret whose variable
+      # is unset, so a caller supplies values through this step's `env:` and
+      # needs no input for the ids already in `[image.<bucket>] secrets`.
+      env:
+        PACKAGE: ${{ inputs.package }}
+        EXTRA_SECRETS: ${{ inputs.extra-secrets }}
+      run: |
+        set -euo pipefail
+        ARGS=()
+        for id in $EXTRA_SECRETS; do
+          ARGS+=(--secret "id=$id")
+        done
+        tangier image build "$PACKAGE" --push "${ARGS[@]+"${ARGS[@]}"}"

tangier-0.2.1/.github/actions/deploy/action.yaml

@@ -0,0 +1,93 @@
+name: tangier deploy
+description: >-
+  Connect to the tailnet, then render and apply this environment's manifests
+  with the current content-addressed image tags.
+
+# READ docs/actions/tailnet.md BEFORE changing a call site. The separation
+# between uat and prod is enforced by the `environment:` line on the calling
+# job, and it is no longer visible from here.
+
+inputs:
+  env:
+    description: Environment name. Must have a `[deploy.<env>]` table in pipeline.toml.
+    required: true
+  client-id:
+    description: >-
+      OAuth client ID for this environment's deploy identity. Pass
+      `${{ vars.TS_DEPLOY_CLIENT_ID }}` — a composite action cannot read the
+      `vars` context (actions/runner#2551).
+    required: true
+  audience:
+    description: OIDC audience for this environment. Pass `${{ vars.TS_DEPLOY_AUDIENCE }}`.
+    required: true
+  tailscale-version:
+    description: Tailscale release to install. Pinned, never `latest`.
+    required: false
+    default: "1.78.1"
+  tangier-ref:
+    description: >-
+      The tangier ref to install the CLI from. Defaults to the ref this action
+      was called at. Required when calling the action locally (`uses: ./...`),
+      because `github.action_ref` is empty for a local path.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve the tangier ref
+      id: ref
+      shell: bash
+      # Resolved at THIS action's top level and passed down, rather than left to
+      # the nested action: `github.action_ref` is only correct for the action it
+      # is evaluated in, and binding it through `env:` is required because it is
+      # empty inside a `run:` body (actions/runner#2473).
+      env:
+        ACTION_REF: ${{ github.action_ref }}
+        INPUT_REF: ${{ inputs.tangier-ref }}
+      run: |
+        set -euo pipefail
+        REF="${INPUT_REF:-$ACTION_REF}"
+        if [ -z "$REF" ]; then
+          echo "::error::cannot determine which tangier ref to install. Pass the tangier-ref input when calling this action by local path." >&2
+          exit 1
+        fi
+        echo "ref=$REF" >> "$GITHUB_OUTPUT"
+
+    - uses: sminnee/tangier/.github/actions/tailnet@v0
+      with:
+        client-id: ${{ inputs.client-id }}
+        audience: ${{ inputs.audience }}
+        env: ${{ inputs.env }}
+        version: ${{ inputs.tailscale-version }}
+
+    - uses: astral-sh/setup-uv@v5
+      with:
+        version: "0.5.29"
+
+    - name: Install tangier
+      shell: bash
+      # `uv tool install`, not `uvx --from`: `tangier` must stay on PATH for any
+      # repo script that runs after this action.
+      env:
+        TANGIER_REF: ${{ steps.ref.outputs.ref }}
+      run: |
+        set -euo pipefail
+        uv tool install "git+https://github.com/sminnee/tangier@${TANGIER_REF}"
+
+    - name: Deploy
+      shell: bash
+      # `--summary` writes the build table to $GITHUB_STEP_SUMMARY before
+      # anything is applied — pass 1 overwrites the deployed tags it reads, and
+      # the table is most wanted when the deploy then fails.
+      #
+      # `set -euo pipefail` is a behaviour change from the bash this replaces,
+      # which had no `set -e` and fell through a failing summary into the real
+      # deploy. If it proves annoying, the relief valve is
+      # `continue-on-error: true` on a separate summary step — not dropping
+      # `set -e`.
+      env:
+        DEPLOY_ENV: ${{ inputs.env }}
+      run: |
+        set -euo pipefail
+        tangier deploy "$DEPLOY_ENV" --summary

tangier-0.2.1/.github/actions/tailnet/action.yaml

@@ -0,0 +1,119 @@
+name: tangier tailnet
+description: >-
+  Connect the runner to the tailnet as this environment's deploy identity and
+  point kubectl at the Tailscale Kubernetes operator.
+
+# READ docs/actions/tailnet.md BEFORE changing a call site. The separation
+# between uat and prod is enforced by the `environment:` line on the calling
+# job, and it is no longer visible from here.
+
+inputs:
+  client-id:
+    description: >-
+      OAuth client ID for this environment's deploy identity. Pass
+      `${{ vars.TS_DEPLOY_CLIENT_ID }}` — a composite action cannot read the
+      `vars` context at all (actions/runner#2551), so it must be forwarded.
+      The value differs per environment; the NAME is deliberately the same.
+    required: true
+  audience:
+    description: >-
+      OIDC audience for this environment. Pass `${{ vars.TS_DEPLOY_AUDIENCE }}`.
+      Same reasoning, and the same deliberate name-sharing, as `client-id`.
+    required: true
+  env:
+    description: >-
+      Environment name, used to look up `[tailnet.<env>] tag` in pipeline.toml.
+      Omit when passing `tag` directly.
+    required: false
+    default: ""
+  tag:
+    description: >-
+      Tailnet ACL tag, overriding config. For a repo with no pipeline.toml —
+      k8s-cluster is helm and kubectl with no images, and a config describing
+      no tags, buckets or images would misrepresent it and trip
+      `_warn_tags_without_input`.
+    required: false
+    default: ""
+  operator:
+    description: >-
+      Tailscale Kubernetes operator hostname, overriding `[tailnet] operator`.
+      Defaults to `tailscale-operator` when there is no config to read.
+    required: false
+    default: ""
+  version:
+    description: Tailscale release to install. Pinned, never `latest`.
+    required: false
+    default: "1.78.1"
+
+outputs:
+  tag:
+    description: The tailnet tag this runner authenticated as.
+    value: ${{ steps.resolve.outputs.tag }}
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve the tag and operator
+      id: resolve
+      shell: bash
+      # Read with inline tomllib rather than through the CLI: four of the eight
+      # call sites want the tailnet connect ALONE, and making them install uv
+      # and tangier to read one string would defeat the point of the action.
+      env:
+        INPUT_TAG: ${{ inputs.tag }}
+        INPUT_ENV: ${{ inputs.env }}
+        INPUT_OPERATOR: ${{ inputs.operator }}
+      run: |
+        set -euo pipefail
+        # Precedence: explicit input, then config. An explicit `tag` also means
+        # `pipeline.toml` need not exist at all — which is how a repo with no
+        # images (k8s-cluster is helm and kubectl) uses this action without a
+        # config file that would misrepresent it.
+        TAG="$INPUT_TAG"
+        OPERATOR="$INPUT_OPERATOR"
+
+        if [ -f pipeline.toml ]; then
+          # Two lines out, so an absent value stays distinguishable from an
+          # empty one without quoting games.
+          CFG="$(INPUT_ENV="$INPUT_ENV" python3 -c '
+        import os, tomllib
+        with open("pipeline.toml", "rb") as fh:
+            cfg = tomllib.load(fh).get("tailnet", {})
+        env = os.environ.get("INPUT_ENV", "")
+        print((cfg.get(env) or {}).get("tag", "") if env else "")
+        print(cfg.get("operator", "tailscale-operator"))
+        ')"
+          CFG_TAG="$(printf '%s' "$CFG" | sed -n 1p)"
+          CFG_OPERATOR="$(printf '%s' "$CFG" | sed -n 2p)"
+          TAG="${TAG:-$CFG_TAG}"
+          OPERATOR="${OPERATOR:-$CFG_OPERATOR}"
+        fi
+        OPERATOR="${OPERATOR:-tailscale-operator}"
+
+        if [ -z "$TAG" ]; then
+          echo "::error::no tailnet tag for env [${INPUT_ENV:-<unset>}]. Add a [tailnet.<env>] table to pipeline.toml, or pass the tag input." >&2
+          exit 1
+        fi
+        echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+        echo "operator=$OPERATOR" >> "$GITHUB_OUTPUT"
+        echo "Connecting as $TAG via $OPERATOR"
+
+    - name: Connect to the tailnet
+      uses: tailscale/github-action@v3
+      with:
+        oauth-client-id: ${{ inputs.client-id }}
+        tags: ${{ steps.resolve.outputs.tag }}
+        version: ${{ inputs.version }}
+        use-cache: "true"
+        args: --advertise-tags=${{ steps.resolve.outputs.tag }}
+      env:
+        TS_EXPERIMENT_OAUTH_AUDIENCE: ${{ inputs.audience }}
+
+    - name: Point kubectl at the operator
+      shell: bash
+      env:
+        OPERATOR: ${{ steps.resolve.outputs.operator }}
+      run: |
+        set -euo pipefail
+        tailscale configure kubeconfig "$OPERATOR"
+        kubectl config current-context

tangier-0.2.1/.github/workflows/build.yaml

@@ -0,0 +1,87 @@
+name: Build packages
+
+# One matrixed job in place of a hand-written job per package. Feed `packages`
+# from `tangier changemap build-matrix`, which emits exactly this shape.
+
+on:
+  workflow_call:
+    inputs:
+      packages:
+        description: >-
+          JSON array of SHA buckets to build, e.g. '["astrochat","smartypants"]'.
+          A JSON *string* rather than a list because matrices need `fromJSON` and
+          Actions has no typed list input. `changemap build-matrix` emits it.
+        required: true
+        type: string
+      registry-username:
+        description: Registry username. Defaults to `registry`.
+        required: false
+        type: string
+        default: registry
+      extra-secrets:
+        description: Space-separated extra buildx secret IDs (not values).
+        required: false
+        type: string
+        default: ""
+      regctl-version:
+        required: false
+        type: string
+        default: v0.6.1
+      tangier-ref:
+        description: tangier ref to install the CLI from. Defaults to this workflow's ref.
+        required: false
+        type: string
+        default: ""
+      fail-fast:
+        description: >-
+          Cancel sibling legs when one fails. Defaults to false: an unrelated
+          package's failure should not discard a build that already succeeded,
+          and content-addressed tags make a partial set safe to resume.
+        required: false
+        type: boolean
+        default: false
+      runs-on:
+        required: false
+        type: string
+        default: ubuntu-latest
+    secrets:
+      registry-password:
+        required: true
+      sentry-auth-token:
+        description: >-
+          Passed to EVERY matrix leg — Actions offers no per-leg secret routing.
+          Safe because tangier fails closed: `resolve_secrets` emits `--secret`
+          only for ids the bucket's `[image.<bucket>] secrets` declares, so a
+          package that does not want it never references it.
+        required: false
+
+jobs:
+  build:
+    # An empty `strategy.matrix` is a hard error ("Matrix vector 'package' does
+    # not contain any values"), not a skip — and any docs-only PR produces one.
+    # The quoting is load-bearing: `!= []` does not evaluate false for an empty
+    # array, so the comparison is against the JSON *string*.
+    if: ${{ inputs.packages != '[]' && inputs.packages != '' }}
+    runs-on: ${{ inputs.runs-on }}
+    strategy:
+      fail-fast: ${{ inputs.fail-fast }}
+      matrix:
+        package: ${{ fromJSON(inputs.packages) }}
+    name: build ${{ matrix.package }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # tangier hashes the git tree to derive the tag, so a shallow checkout
+          # would produce a different hash from a local run.
+          fetch-depth: 0
+
+      - uses: sminnee/tangier/.github/actions/build@v0
+        with:
+          package: ${{ matrix.package }}
+          registry-username: ${{ inputs.registry-username }}
+          registry-password: ${{ secrets.registry-password }}
+          extra-secrets: ${{ inputs.extra-secrets }}
+          regctl-version: ${{ inputs.regctl-version }}
+          tangier-ref: ${{ inputs.tangier-ref }}
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.sentry-auth-token }}

tangier-0.2.1/.github/workflows/ci.yaml

@@ -0,0 +1,143 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    # The Python versions are members of the `[gate.test]` group in pipeline.toml.
+    # One step for each member, so each version reports and reuses its own record.
+    runs-on: ubuntu-latest
+    steps:
+      # Depth 20 follows the checkout-depth rule in skills/tangier/reference/
+      # github-actions.md. These gates have no placeholder, so they need only HEAD^1.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 20
+      - uses: astral-sh/setup-uv@v6
+        with:
+          # A verified gate never calls uv, and an empty cache fails the post step.
+          enable-cache: false
+      - name: Run test.py311
+        # No setup-python: the runner's own Python runs tangier, which is the
+        # environment tangier must work in.
+        env:
+          EVENT: ${{ github.event_name }}
+        run: |
+          # A pull request reuses a gate record. Any other event is the full
+          # build that does not consult records.
+          flags=(--read-only)
+          if [ "$EVENT" = pull_request ]; then flags+=(--base HEAD^1); else flags+=(--full); fi
+          python3 -m tangier gate run test.py311 "${flags[@]}"
+      - name: Run test.py312
+        env:
+          EVENT: ${{ github.event_name }}
+        run: |
+          flags=(--read-only)
+          if [ "$EVENT" = pull_request ]; then flags+=(--base HEAD^1); else flags+=(--full); fi
+          python3 -m tangier gate run test.py312 "${flags[@]}"
+      - name: Run test.py313
+        env:
+          EVENT: ${{ github.event_name }}
+        run: |
+          flags=(--read-only)
+          if [ "$EVENT" = pull_request ]; then flags+=(--base HEAD^1); else flags+=(--full); fi
+          python3 -m tangier gate run test.py313 "${flags[@]}"
+      - name: CLI smoke check
+        run: python3 -m tangier --help
+
+  no-dependencies:
+    # The check is `[gate.no-dependencies]` in pipeline.toml.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 20
+      - name: Run no-dependencies
+        # No setup-python: the runner's own Python is the one tangier must work on.
+        env:
+          EVENT: ${{ github.event_name }}
+        run: |
+          flags=(--read-only)
+          if [ "$EVENT" = pull_request ]; then flags+=(--base HEAD^1); else flags+=(--full); fi
+          python3 -m tangier gate run no-dependencies "${flags[@]}"
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 20
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: false
+      - run: uv tool install ruff
+      - name: Run lint.check
+        env:
+          EVENT: ${{ github.event_name }}
+        run: |
+          flags=(--read-only)
+          if [ "$EVENT" = pull_request ]; then flags+=(--base HEAD^1); else flags+=(--full); fi
+          python3 -m tangier gate run lint.check "${flags[@]}"
+      - name: Run lint.format
+        env:
+          EVENT: ${{ github.event_name }}
+        run: |
+          flags=(--read-only)
+          if [ "$EVENT" = pull_request ]; then flags+=(--base HEAD^1); else flags+=(--full); fi
+          python3 -m tangier gate run lint.format "${flags[@]}"
+
+  lint-actions:
+    # `action-validator` covers `actions/*/action.yaml`, the file type nothing
+    # in this estate lints today. `actionlint` shellchecks every `run:` body,
+    # which is the higher-value of the two given these actions are mostly shell.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: action-validator
+        # One file per invocation — the CLI takes a single path.
+        run: |
+          set -euo pipefail
+          for f in .github/workflows/*.yaml .github/actions/*/action.yaml; do
+            echo "validating $f"
+            npx --yes @action-validator/cli@0.6.0 "$f"
+          done
+      - name: actionlint
+        # Covers workflows only — composite `action.yaml` files are the next step.
+        uses: docker://rhysd/actionlint:1.7.7
+        with:
+          args: -color
+      - name: shellcheck composite action run bodies
+        # actionlint shellchecks `run:` bodies in WORKFLOWS but does not read
+        # `actions/*/action.yaml`, so these scripts are otherwise unlinted — and
+        # they are mostly shell. Extract each body and check it directly.
+        run: |
+          set -euo pipefail
+          # Cleared, not just created: stale extracts from an earlier run would
+          # otherwise be checked against code no longer in the tree.
+          rm -rf "$RUNNER_TEMP/sc"
+          mkdir -p "$RUNNER_TEMP/sc"
+          python3 - <<'PY'
+          import os, re
+          out = os.path.join(os.environ["RUNNER_TEMP"], "sc")
+          for name in sorted(os.listdir(".github/actions")):
+              path = f".github/actions/{name}/action.yaml"
+              if not os.path.exists(path):
+                  continue
+              text = open(path).read()
+              for i, block in enumerate(re.findall(r"      run: \|\n((?:        .*\n|\n)+)", text)):
+                  body = "\n".join(line[8:] for line in block.splitlines())
+                  with open(os.path.join(out, f"{name}_{i}.sh"), "w") as fh:
+                      fh.write("#!/bin/bash\n" + body + "\n")
+          PY
+          count=$(find "$RUNNER_TEMP/sc" -name '*.sh' | wc -l)
+          test "$count" -gt 0 || { echo "::error::extracted no run bodies — the regex has drifted"; exit 1; }
+          echo "shellchecking $count run bodies, plus bin/"
+          find "$RUNNER_TEMP/sc" -name '*.sh' -print0 | xargs -0 shellcheck
+          # bin/ is otherwise ungated, and it holds the release script that
+          # force-moves the alias every consumer pins. `parity-check` is not in
+          # the list: it has a pre-existing SC2015 that predates this gate, and
+          # cleaning it belongs in its own change rather than here.
+          shellcheck bin/release bin/test

tangier-0.2.1/.github/workflows/release.yaml

@@ -0,0 +1,35 @@
+name: Release
+
+# Publish to PyPI when an exact version tag is pushed. The `v0`
+# alias does not match `v*.*.*`, so moving it publishes nothing.
+#
+# Trusted publishing, so the repo holds no PyPI token. CONTRIBUTING.md has the setup.
+
+on:
+  push:
+    tags: ["v*.*.*"]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: false
+      - name: Check the tag matches the package version
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          version="$(python3 -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
+          if [ "$TAG" != "v$version" ]; then
+            echo "::error::tag $TAG does not match pyproject.toml version $version"
+            exit 1
+          fi
+      - run: uv build
+      # Pinned by commit: this job can publish as tangier, so a moved tag must not change what runs.
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

tangier-0.2.1/.github/workflows/test-empty-matrix.yaml

@@ -0,0 +1,38 @@
+name: Empty matrix guard
+
+# Two lines guarding the footgun most likely to break a consumer's PR flow: a
+# `strategy.matrix` over `[]` is a hard error in Actions, not a skip, and any
+# docs-only PR produces exactly that. The assertion is that the run SUCCEEDS
+# with the build job skipped.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  empty:
+    uses: ./.github/workflows/build.yaml
+    with:
+      packages: "[]"
+    secrets:
+      registry-password: unused
+
+  assert-skipped:
+    needs: empty
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Assert the build job was skipped, not failed
+        env:
+          RESULT: ${{ needs.empty.result }}
+        run: |
+          set -euo pipefail
+          # Exactly `skipped`. Accepting `success` too would let a regression
+          # that removed the `if:` guard pass whenever the matrix happened to
+          # run — which is the one thing this test exists to catch.
+          test "$RESULT" = skipped || {
+            echo "::error::expected the build job to be skipped, got result=$RESULT"
+            exit 1
+          }
+          echo "empty matrix handled: build job skipped"

tangier-0.2.1/.gitignore

@@ -0,0 +1,10 @@
+.claude/CLAUDE.local.md
+__pycache__/
+*.pyc
+.ruff_cache/
+dist/
+*.egg-info/
+.env
+.drafts/
+.claude/
+uv.lock