toolframe-core 0.6.2__tar.gz → 0.6.4__tar.gz

toolframe_core-0.6.4/.dockerignore

@@ -0,0 +1,15 @@
+**
+!Dockerfile
+!scripts/
+!scripts/container-healthcheck.py
+!scripts/harden-container.py
+!build/
+!build/container/
+!build/container/amd64/
+!build/container/amd64/toolframe
+!build/container/amd64/LICENSE
+!build/container/amd64/NOTICE
+!build/container/arm64/
+!build/container/arm64/toolframe
+!build/container/arm64/LICENSE
+!build/container/arm64/NOTICE

toolframe_core-0.6.4/.github/actions/scan-container/action.yml

@@ -0,0 +1,44 @@
+name: Scan a Toolframe container
+description: Retain the full vulnerability inventory and enforce publication policy
+inputs:
+  image:
+    description: Local image tag or public registry reference
+    required: true
+  platform:
+    description: Linux platform to scan
+    required: true
+  image-source:
+    description: Trivy image source (docker or remote)
+    required: true
+runs:
+  using: composite
+  steps:
+    - uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567
+      with:
+        version: v0.76.0
+        cache: false
+    - name: Scan every severity and keep the package inventory
+      shell: bash
+      env:
+        SCAN_IMAGE: ${{ inputs.image }}
+        SCAN_PLATFORM: ${{ inputs.platform }}
+        SCAN_SOURCE: ${{ inputs.image-source }}
+      run: |
+        mkdir -p build/security
+        trivy image --image-src "$SCAN_SOURCE" --platform "$SCAN_PLATFORM" \
+          --scanners vuln --ignorefile '' --disable-telemetry --list-all-pkgs \
+          --timeout 10m --format json --output build/security/scan.json "$SCAN_IMAGE"
+        trivy version --format json > build/security/scanner.json
+        trivy convert --format cyclonedx --output build/security/sbom.cdx.json build/security/scan.json
+    - name: Enforce the security policy
+      shell: bash
+      run: |
+        python3 scripts/check-container-security.py build/security/scan.json \
+          --summary build/security/summary.md
+    - name: Add findings to the run summary
+      if: always()
+      shell: bash
+      run: |
+        if [ -f build/security/summary.md ]; then
+          cat build/security/summary.md >> "$GITHUB_STEP_SUMMARY"
+        fi

toolframe_core-0.6.4/.github/dependabot.yml

@@ -0,0 +1,50 @@
+version: 2
+updates:
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '04:23'
+      timezone: Etc/UTC
+    open-pull-requests-limit: 4
+    commit-message:
+      prefix: fix(container)
+    pull-request-branch-name:
+      prefix: chore
+      template: '{prefix}/{name}'
+    groups:
+      # Catch every version and security update, including major versions.
+      # To split a dependency out, add a named group before these catch-alls;
+      # exclusions would fall back to noncompliant solo dependency/version names.
+      container-dependencies:
+        applies-to: version-updates
+        patterns: ['*']
+      container-security:
+        applies-to: security-updates
+        patterns: ['*']
+    ignore:
+      # The 0.6.3 launcher accepts uv >=0.12.2,<0.13.0.
+      # Widen this only alongside a compatible launcher release.
+      - dependency-name: astral-sh/uv
+        versions: ['>=0.13.0']
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '04:23'
+      timezone: Etc/UTC
+    open-pull-requests-limit: 4
+    commit-message:
+      prefix: chore(ci)
+    pull-request-branch-name:
+      prefix: chore
+      template: '{prefix}/{name}'
+    groups:
+      actions-dependencies:
+        applies-to: version-updates
+        patterns: ['*']
+      actions-security:
+        applies-to: security-updates
+        patterns: ['*']

toolframe_core-0.6.4/.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    # Publication independently verifies/promotes the selected release tag.
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      rebuild:
+        description: Run all checks and builds even if validated artifacts exist
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  pull-requests: read
+  actions: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    uses: ./.github/workflows/quality.yml
+
+  validate:
+    needs: quality
+    uses: ./.github/workflows/validate.yml
+    with:
+      reuse-stage: ${{ github.ref == 'refs/heads/main' && 'main' || 'none' }}
+      rebuild: ${{ inputs.rebuild || false }}
+    secrets: inherit
+
+  result:
+    name: CI result
+    if: always()
+    needs: [quality, validate]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 2
+    steps:
+      # Require this check when configuring branch protection. A skipped
+      # validation job must not turn a failed prerequisite into a green check.
+      - name: Require successful checks and validation
+        env:
+          QUALITY_RESULT: ${{ needs.quality.result }}
+          VALIDATE_RESULT: ${{ needs.validate.result }}
+        run: |
+          echo "Quality: $QUALITY_RESULT; validation: $VALIDATE_RESULT"
+          test "$QUALITY_RESULT" = success
+          test "$VALIDATE_RESULT" = success

toolframe_core-0.6.4/.github/workflows/container-security.yml

@@ -0,0 +1,52 @@
+name: Container security
+
+on:
+  schedule:
+    - cron: '23 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: container-security-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  scan:
+    name: ${{ matrix.variant }} (${{ matrix.arch }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        variant: [standard, distroless]
+        arch: [amd64, arm64]
+        include:
+          - variant: standard
+            tag: latest
+          - variant: distroless
+            tag: distroless
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Select the public image
+        id: image
+        env:
+          OWNER: ${{ github.repository_owner }}
+          TAG: ${{ matrix.tag }}
+        run: echo "ref=ghcr.io/${OWNER,,}/toolframe:$TAG" >> "$GITHUB_OUTPUT"
+      - uses: ./.github/actions/scan-container
+        with:
+          image: ${{ steps.image.outputs.ref }}
+          platform: linux/${{ matrix.arch }}
+          image-source: remote
+      - name: Save findings and the inventory
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: container-security-${{ matrix.variant }}-${{ matrix.arch }}
+          path: build/security/
+          if-no-files-found: warn
+          retention-days: 7

toolframe_core-0.6.4/.github/workflows/container.yml

@@ -0,0 +1,221 @@
+name: Container images
+
+on:
+  pull_request:
+    paths:
+      - Dockerfile
+      - .dockerignore
+      - .github/workflows/container.yml
+      - .github/workflows/container-security.yml
+      - .github/actions/scan-container/**
+      - scripts/*container*.py
+      - tests/test_container_*.py
+  workflow_call:
+    inputs:
+      publish:
+        type: boolean
+        default: false
+      release_artifacts:
+        description: Use the validated launcher artifacts from this workflow run
+        type: boolean
+        default: false
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: Publish both tested variants to GHCR
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: ${{ matrix.variant }} (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        variant: [standard, distroless]
+        arch: [amd64, arm64]
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+    outputs:
+      version: ${{ steps.metadata.outputs.version }}
+      image: ${{ steps.metadata.outputs.image }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - name: Read the version and registry namespace
+        id: metadata
+        env:
+          REPOSITORY_OWNER: ${{ github.repository_owner }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version=$(python -c 'import tomllib; print(tomllib.load(open("Cargo.toml", "rb"))["package"]["version"])')
+          # PRs exercise packaging with an available public runtime; source CI
+          # validates the unreleased Core independently.
+          if [ "$GITHUB_EVENT_NAME" = pull_request ]; then
+            tag=$(gh release view --repo "$GITHUB_REPOSITORY" --json tagName --jq .tagName)
+            version=${tag#v}
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "image=ghcr.io/${REPOSITORY_OWNER,,}/toolframe" >> "$GITHUB_OUTPUT"
+      - name: Download the validated launcher from this publication run
+        if: inputs.release_artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: validated-release
+          path: build/candidate/
+      - name: Verify the bundle and stage this platform's release
+        if: inputs.release_artifacts
+        env:
+          TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+          TOOLFRAME_TARGET: ${{ matrix.target }}
+        run: >-
+          python scripts/ci/artifacts.py export --bundle build/candidate
+          --kind release --target "$TOOLFRAME_TARGET" --output build/container-release
+      - name: Stage the verified executable
+        env:
+          USE_ARTIFACTS: ${{ inputs.release_artifacts }}
+          ARCH: ${{ matrix.arch }}
+          VERSION: ${{ steps.metadata.outputs.version }}
+        run: |
+          options=()
+          if [ "$USE_ARTIFACTS" = true ]; then
+            options+=(--release-dir build/container-release)
+          fi
+          python scripts/prepare-container.py --architecture "$ARCH" --version "$VERSION" \
+            --repository "$GITHUB_REPOSITORY" "${options[@]}"
+      - name: Build the native image
+        env:
+          ARCH: ${{ matrix.arch }}
+          VARIANT: ${{ matrix.variant }}
+          VERSION: ${{ steps.metadata.outputs.version }}
+        run: |
+          docker buildx build --platform "linux/$ARCH" --target "$VARIANT" \
+            --pull --no-cache-filter runtime \
+            --build-arg "TOOLFRAME_VERSION=$VERSION" \
+            --build-arg "TOOLFRAME_REVISION=$GITHUB_SHA" \
+            --label "org.opencontainers.image.source=https://github.com/$GITHUB_REPOSITORY" \
+            --provenance=false --load --tag toolframe-check:local .
+      - name: Verify public interfaces, persistence and shutdown
+        env:
+          ARCH: ${{ matrix.arch }}
+          VARIANT: ${{ matrix.variant }}
+        run: |
+          python scripts/verify-container.py --image toolframe-check:local \
+            --variant "$VARIANT" --platform "linux/$ARCH" \
+            --output build/container-verification.json
+      - name: Save verification evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: container-evidence-${{ matrix.variant }}-${{ matrix.arch }}
+          path: build/container-verification*
+          if-no-files-found: warn
+          retention-days: 7
+      - name: Scan the tested image before publication
+        uses: ./.github/actions/scan-container
+        with:
+          image: toolframe-check:local
+          platform: linux/${{ matrix.arch }}
+          image-source: docker
+      - name: Save security evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: container-security-${{ matrix.variant }}-${{ matrix.arch }}
+          path: build/security/
+          if-no-files-found: warn
+          retention-days: 7
+      - name: Log in to GHCR
+        if: inputs.publish
+        uses: docker/login-action@783ae9cac559640a24c9212dfa6cd9e998252f9a
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Push the exact locally tested image
+        if: inputs.publish
+        env:
+          IMAGE: ${{ steps.metadata.outputs.image }}
+          ARCH: ${{ matrix.arch }}
+          VARIANT: ${{ matrix.variant }}
+        run: |
+          ref="$IMAGE:build-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$VARIANT-$ARCH"
+          docker tag toolframe-check:local "$ref"
+          docker push "$ref"
+          mkdir -p build/digests
+          docker image inspect --format '{{index .RepoDigests 0}}' "$ref" \
+            > "build/digests/$VARIANT-$ARCH.txt"
+      - name: Save the tested image digest
+        if: inputs.publish
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: container-digest-${{ matrix.variant }}-${{ matrix.arch }}
+          path: build/digests/*.txt
+          if-no-files-found: error
+
+  publish:
+    name: Publish multi-platform tags
+    needs: build
+    if: inputs.publish
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      packages: write
+    concurrency:
+      group: container-publish-${{ github.repository }}
+      cancel-in-progress: false
+    steps:
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: container-digest-*
+          merge-multiple: true
+          path: build/digests/
+      - uses: docker/login-action@783ae9cac559640a24c9212dfa6cd9e998252f9a
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Publish both architectures after all four checks pass
+        env:
+          IMAGE: ${{ needs.build.outputs.image }}
+          VERSION: ${{ needs.build.outputs.version }}
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          latest=$(gh release view --repo "$GH_REPO" --json tagName --jq .tagName)
+          for variant in standard distroless; do
+            suffix=""
+            alias=latest
+            if [ "$variant" = distroless ]; then
+              suffix=-distroless
+              alias=distroless
+            fi
+            mapfile -t refs < <(cat build/digests/"$variant"-*.txt)
+            test "${#refs[@]}" -eq 2
+            tags=(--tag "$IMAGE:$VERSION$suffix")
+            if [ "$latest" = "v$VERSION" ] && [[ "$VERSION" != *-* ]]; then
+              tags+=(--tag "$IMAGE:$alias")
+            fi
+            docker buildx imagetools create "${tags[@]}" "${refs[@]}"
+            docker buildx imagetools inspect "$IMAGE:$VERSION$suffix"
+          done

{toolframe_core-0.6.2 → toolframe_core-0.6.4}/.github/workflows/launcher.yml

@@ -76,6 +76,7 @@ jobs:
           name: launcher-wheel-${{ matrix.target }}
           path: build/launcher-dist/wheels/*.whl
           if-no-files-found: error
+          overwrite: true
           retention-days: 14
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -86,6 +87,7 @@ jobs:
             build/launcher-dist/release/*.json
             build/launcher-dist/release/SHA256SUMS-*.txt
           if-no-files-found: error
+          overwrite: true
           retention-days: 14
       - name: Retain acceptance evidence
         if: always()
@@ -94,3 +96,4 @@ jobs:
           name: launcher-evidence-${{ matrix.target }}
           path: build/launcher-dist/*.json
           if-no-files-found: warn
+          overwrite: true

toolframe_core-0.6.4/.github/workflows/pr-policy.yml

@@ -0,0 +1,31 @@
+name: Pull request policy
+
+on:
+  workflow_call:
+  # Keep a stable required check for title edits without repeating native CI.
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  commit-policy:
+    name: PR policy
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: commit-check/commit-check-action@a61779784a953fd9047c001c102cfeac5cf26964 # commit-check 2.18.3
+        with:
+          message: true
+          branch: false
+          pr-title: true
+          pr-comments: false

{toolframe_core-0.6.2 → toolframe_core-0.6.4}/.github/workflows/publish.yml

@@ -11,9 +11,15 @@ on:
           - pypi
         default: testpypi
         required: true
+      rebuild:
+        description: Validate and rebuild at the tag instead of promoting main artifacts
+        type: boolean
+        default: false
 
 permissions:
   contents: read
+  actions: read
+  pull-requests: read
 
 concurrency:
   group: publish-${{ github.ref }}-${{ inputs.index }}
@@ -33,9 +39,19 @@ jobs:
       - name: Require the exact project version tag
         run: python scripts/ci/check-release.py --ref "$GITHUB_REF"
 
-  validate:
+  quality:
     needs: release-tag
+    permissions:
+      contents: read
+      pull-requests: read
+    uses: ./.github/workflows/quality.yml
+
+  validate:
+    needs: [release-tag, quality]
     uses: ./.github/workflows/validate.yml
+    with:
+      reuse-stage: release
+      rebuild: ${{ inputs.rebuild }}
     secrets: inherit
 
   publish-core:
@@ -45,22 +61,24 @@ jobs:
     environment:
       name: ${{ inputs.index }}
     permissions:
+      contents: read
       id-token: write
     steps:
-      - name: Download the distributions validated in this run
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - name: Download the bundle validated in this run
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: python-dist
-          path: dist/
-      - name: Require the complete Core release set
-        run: |
-          python - <<'PY'
-          from pathlib import Path
-          files = list(Path('dist').iterdir())
-          assert len(list(Path('dist').glob('toolframe_core-*.whl'))) == 1
-          assert len(list(Path('dist').glob('toolframe_core-*.tar.gz'))) == 1
-          assert len(files) == 2
-          PY
+          name: validated-release
+          path: build/candidate/
+      - name: Verify and stage the exact Core distributions
+        env:
+          TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+        run: python scripts/ci/artifacts.py export --bundle build/candidate --kind core --output dist
       - name: Publish Core using its Trusted Publisher
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
@@ -74,22 +92,24 @@ jobs:
     environment:
       name: ${{ inputs.index }}-launcher
     permissions:
+      contents: read
       id-token: write
     steps:
-      - name: Download all four validated native wheels
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - name: Download the bundle validated in this run
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          pattern: launcher-wheel-*
-          merge-multiple: true
-          path: dist/
-      - name: Require the complete launcher release set
-        run: |
-          python - <<'PY'
-          from pathlib import Path
-          files = list(Path('dist').iterdir())
-          assert len(list(Path('dist').glob('toolframe-*.whl'))) == 4
-          assert len(files) == 4
-          PY
+          name: validated-release
+          path: build/candidate/
+      - name: Verify and stage all four exact native wheels
+        env:
+          TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+        run: python scripts/ci/artifacts.py export --bundle build/candidate --kind wheel --output dist
       - name: Publish the launcher using its Trusted Publisher
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
@@ -104,11 +124,20 @@ jobs:
     permissions:
       contents: write
     steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          pattern: launcher-release-*
-          merge-multiple: true
-          path: releases/
+          name: validated-release
+          path: build/candidate/
+      - name: Verify and stage the exact release archives
+        env:
+          TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+        run: python scripts/ci/artifacts.py export --bundle build/candidate --kind release --output releases
       - name: Publish verified executables and checksums
         env:
           GH_TOKEN: ${{ github.token }}
@@ -126,3 +155,14 @@ jobs:
           EOF
           gh release create "$RELEASE_TAG" --verify-tag --title "Toolframe $RELEASE_TAG" \
             --notes-file release-notes.txt releases/*.tar.gz releases/SHA256SUMS releases/manifest-*.json releases/*.whl
+
+  publish-containers:
+    needs: release-binaries
+    if: inputs.index == 'pypi'
+    permissions:
+      contents: read
+      packages: write
+    uses: ./.github/workflows/container.yml
+    with:
+      publish: true
+      release_artifacts: true

toolframe_core-0.6.4/.github/workflows/quality.yml

@@ -0,0 +1,49 @@
+name: Code quality
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  branch-policy:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - name: Check the source branch or selected release tag
+        env:
+          BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
+        run: |
+          if [ "$GITHUB_REF_TYPE" = tag ]; then
+            python scripts/ci/check-release.py --ref "$GITHUB_REF"
+          else
+            python scripts/check_branch_name.py "$BRANCH_NAME"
+          fi
+
+  code-quality:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '0.12.8'
+          enable-cache: false
+      - name: Check Python lint and formatting
+        run: uvx prek==0.5.5 run ruff-check ruff-format --all-files --show-diff-on-failure
+
+  commit-policy:
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: read
+    uses: ./.github/workflows/pr-policy.yml