tooprolix 0.5.1__tar.gz

tooprolix-0.5.1/.gitattributes

@@ -0,0 +1,2 @@
+LICENSE text eol=lf
+THIRD-PARTY-LICENSES.html text eol=lf

tooprolix-0.5.1/.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+
+patreon: sgolyshevskii
+custom: ['https://boosty.to/golyshevskii/donate']

tooprolix-0.5.1/.github/expected-tag-jobs.txt

@@ -0,0 +1,41 @@
+# EVERY JOB THAT MUST HAVE CONCLUDED `success` AT A `v*` TAG BEFORE PUBLISHING IS APPROVED.
+#
+# The expectation is pinned here so that shrinking it is a reviewable diff.
+# `scripts/check_tag_jobs.py` compares it to a tag run's prerequisite jobs by SET EQUALITY, never
+# "contains", and refuses an empty list outright — an expectation of nothing is satisfied by
+# nothing. The environment-gated `Build artifacts / Publish to PyPI` job stays outside the list,
+# but is not optional: the verifier requires exactly one pending instance before approval and one
+# successful instance in `--postupload` mode.
+#
+# `[section]` headers are `workflow_name` as the Actions API reports it; the lines under them are
+# `.name` values, not YAML job ids, which differ for a matrix job. Pairing the two is what stops a
+# run of some other workflow satisfying the expectation by carrying the right job names.
+#
+#   gh api repos/golyshevskii/tooprolix/actions/runs/<id>/jobs --paginate > ci.json
+#   python scripts/check_tag_jobs.py --tag-sha "$(git rev-parse 'v0.4.8^{commit}')" \
+#     --tag-name v0.4.8 ci.json artifacts.json
+#
+# A `v*` tag fires exactly two workflows: `CI` and `Build artifacts`. `Release-plz` triggers only on
+# pushes to `main`, and `release contract` is `pull_request_target`.
+#
+# `coverage` is listed although it is NOT a required status check: it runs at the tag, and under set
+# equality omitting it would fail an otherwise complete run. Required-check membership is decided by
+# `ci-required`'s `needs:`.
+#
+# Run `check_tag_jobs.py` before approving the `pypi` environment. The manifest below is the last
+# required preapproval job. After upload, run the same verifier with `--postupload`; Publish is
+# deliberately not allowed to certify itself as a prerequisite.
+
+[CI]
+ci-python
+ci-rust
+cargo-doc
+coverage
+ci-required
+
+[Build artifacts]
+sdist (+ the wheel built from it)
+wheel linux-x86_64
+wheel macos-arm64
+wheel windows-x86_64
+PyPI release manifest

tooprolix-0.5.1/.github/workflows/build-artifacts.yml

@@ -0,0 +1,587 @@
+name: Build artifacts
+
+# Pull requests and main builds are reversible: they build, smoke and retain artifacts but never
+# publish. Only a successful `v*` tag build reaches the manifest and environment-gated PyPI jobs.
+#
+# Stated precisely, because the publishing task inherits this reasoning: a credential IS
+# provisioned. `permissions: contents: read` gives the job a read-scoped `GITHUB_TOKEN`, and
+# `actions/checkout` reads it to clone — `persist-credentials: false` only keeps it out of
+# `.git/config` afterwards, it does not stop the checkout step receiving it. What is absent is
+# no `secrets.*` is referenced anywhere in this file. The workflow default is read-only; the final
+# publish job alone receives `id-token: write`, after the immutable manifest has been uploaded.
+#
+# # Two axes, decided separately: the BRANCH axis is filtered, the PATH axis is not
+#
+# `workflow_dispatch` alone is not enough: GitHub reads the dispatch definition from the default
+# branch, so on a feature branch that adds this file manual dispatch is not available at all.
+#
+# THE BRANCH AXIS IS NARROWED TO `main`, `v*` AND PULL REQUESTS. Under the bare `push:` this file
+# used to carry, the `v0.4.6` cycle ran six full artifact matrices of which at most two were
+# load-bearing — about 204 of its 226 billed minutes rebuilt trees already built or never released.
+# The cause is the branch axis: GitHub delivers a branch-CREATION push for every release-plz branch,
+# so the base tip is built before the release commit even exists.
+#
+# `pull_request` is the preflight, and what it grades is named rather than assumed: it checks out
+# `refs/pull/N/merge`, the MERGE tree, which is not necessarily the tree that gets tagged (for
+# `v0.4.6`, `3a1f67f` against `5d0ceef`). The `v*` tag is the authoritative matrix. The alternative
+# `push: branches: ['release-plz-**']` was rejected because a branch pattern also matches the
+# branch-CREATION event — the exact duplicate this filter exists to delete.
+#
+# THE `paths:` FILTER WAS REMOVED, AND ITS REMOVAL IS THE FIX. It listed five files —
+# `Cargo.toml`, `pyproject.toml`, this workflow, and the two scripts — under a header claiming those
+# five "decide what an artifact contains". They do not: `README.md` is the description PyPI renders,
+# `build.rs` decides the date, `src/**` and `Cargo.lock` are the binary, `LICENSE` and `docs/**` ride
+# in the archives. A README-only change — **precisely the change that breaks the transformer** —
+# skipped this workflow entirely, so not one of its checks could go red on it.
+#
+# Replacing the list with a longer list would only move the boundary: the next file nobody thought
+# of has the same effect, and the list rots silently because nothing tells you it is short. An
+# unfiltered trigger cannot be wrong about what matters. The cost is named rather than hidden: four
+# more jobs per push, roughly doubling the compile work `ci.yml` already does. Buy the filter back
+# only with a measurement showing that cost is real.
+#
+# # The supported matrix, and why it is three platforms rather than seventeen
+#
+# `linux x86_64`, `macOS arm64`, `Windows x86_64`, plus an sdist for everything else (Decisions
+# #19.3). All three run natively on free hosted runners, so **every published wheel is smoke-tested
+# on the operating system it claims**. Our reference, ruff, publishes 17 wheels of which 5 have no
+# install-smoke at all — its `macos-x86_64` job has no `Test` step whatsoever — and that is the
+# reason its width is deliberately NOT copied. Linux aarch64 and macOS x86_64 would mean QEMU or an
+# untested wheel; neither is taken on speculation.
+#
+# # The floor of each platform is DECLARED, not inherited from the runner
+#
+# A wheel that builds on the newest runner and is tagged for the oldest OS its platform tag names
+# fails at the user's dynamic loader, which is the one failure no gate here would otherwise see:
+#
+#   * linux   — `manylinux: 2_17`, i.e. glibc >= 2.17 (CentOS 7 / Ubuntu 14.04). The tag the wheel
+#     carries is checked below rather than assumed.
+#   * macOS   — `MACOSX_DEPLOYMENT_TARGET: "11.0"`. maturin defaults to exactly this for
+#     aarch64-apple-darwin (observed in its own output) and 11.0 is also the first macOS with Apple
+#     silicon, so nothing older can run an arm64 build anyway. It is written down because a default
+#     is not a promise.
+#   * windows — x86_64-pc-windows-msvc. There is no deployment-target knob; the floor is whatever
+#     the MSVC runtime the toolchain links against supports, which is Windows 10 for the pinned
+#     Rust. Said out loud rather than left blank.
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches: [main]
+    tags: ['v*']
+
+permissions:
+  contents: read
+
+# Keyed on the COMMIT, not the ref. One logical event used to deliver two pushes to one new ref
+# seconds apart — release-plz creates the branch at the base tip and pushes the release commit.
+# Keyed on the ref, the later run cancels the earlier one; on PR #37 that killed the release
+# commit's build while the base tip's survived.
+#
+# The branch filter above now stops those pushes reaching this workflow, so that race no longer
+# fires. THE KEY STILL DOES NOT GO BACK TO `github.ref`: keying on the commit is correct whatever
+# events are accepted. The event is also part of the key: duplicate runs of one event and SHA still
+# collapse, while a manual dispatch at a tag SHA cannot cancel the authoritative tag-push run.
+# Reverting either dimension would re-arm one of those races.
+# Enforced by test_an_artifact_build_is_only_cancelled_by_the_same_event_and_commit.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.sha }}
+  cancel-in-progress: true
+
+env:
+  # The distribution floor, so every install-smoke below exercises the lowest interpreter
+  # `requires-python` promises. Not a matrix: the wheel is `py3-none-<platform>`, so only the
+  # installing interpreter is worth moving.
+  PYTHON_VERSION: "3.11"
+  # Pinned, exactly as ruff pins it. maturin decides the wheel tag and the archive layout, so an
+  # unpinned "latest" would let the shape of the published artifact change without a commit here.
+  MATURIN_VERSION: v1.14.1
+  CARGO_INCREMENTAL: "0"
+  CARGO_NET_RETRY: "10"
+  CARGO_TERM_COLOR: always
+  RUSTUP_MAX_RETRIES: "10"
+
+jobs:
+  sdist:
+    name: sdist (+ the wheel built from it)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          enable-cache: true
+
+      - name: Install cargo-about
+        uses: taiki-e/install-action@18b1216eba7f8039b0f8d131d5473787f0edce68 # v2.85.3
+        with:
+          tool: cargo-about@0.9.1
+          fallback: none
+
+      - name: The third-party licence bundle matches Cargo.lock
+        run: |
+          set -euo pipefail
+          cargo fetch --locked
+          cargo about generate --frozen --fail --output-file "$RUNNER_TEMP/THIRD-PARTY-LICENSES.html" about.hbs
+          diff -u THIRD-PARTY-LICENSES.html "$RUNNER_TEMP/THIRD-PARTY-LICENSES.html"
+
+      # THE ONLY WAY A RELEASE ARTIFACT LEARNS WHAT IT WAS BUILT FROM.
+      #
+      # `tooprolix --version` prints the COMMIT date, resolved by build.rs as SOURCE_DATE_EPOCH ->
+      # git -> `unknown`. An sdist carries no `.git`, and since `add-version-and-rules-commands` it
+      # will not borrow a surrounding repository's either — so without this line the wheel built
+      # from the sdist below prints `tooprolix 0.4.1 (unknown)`. Measured, not predicted: that is
+      # exactly what it printed, and it passed every other assertion in the smoke.
+      #
+      # `>> "$GITHUB_ENV"` so it reaches the maturin steps, which run in their own shells.
+      - name: Export SOURCE_DATE_EPOCH from the commit
+        run: |
+          echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)" >> "$GITHUB_ENV"
+          echo "commit date: $(git log -1 --format=%cs)"
+
+      # Before maturin reads `readme = "README.md"`. The script rewrites EVERY relative address
+      # into an absolute GitHub URL and FAILS THE BUILD if the README is not the shape it expects —
+      # `twine check` validates the METADATA envelope and never the links inside the description.
+      - name: Rewrite the README for the PyPI project page
+        run: uv run --no-project --with 'readme_renderer[md]' python scripts/transform_readme.py README.md
+
+      - name: Build sdist
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          maturin-version: ${{ env.MATURIN_VERSION }}
+          command: sdist
+          args: --out dist
+
+      # AC1: the sdist must be self-sufficient. A wheel built from the unpacked tarball, in a
+      # directory with no `.git` and no repository around it, is the only honest test of that — a
+      # `cargo package --list` shows what is inside but not whether it builds.
+      #
+      # THE WHEEL THIS STEP PRODUCES IS EVIDENCE, NOT A PUBLISHABLE ARTIFACT, and its own tag says
+      # so: measured in run 30605245528 it came out `py3-none-manylinux_2_34_x86_64`, because it is
+      # built directly on the runner rather than in the manylinux 2_17 container the matrix leg uses.
+      # glibc 2.34 is a far higher floor than the one this project promises. It lives in
+      # `dist-from-sdist/` and never in `dist/` for exactly that reason. Whoever adds the publish job
+      # uploads `dist/` and the matrix artifacts — never this one.
+      - name: Build a wheel FROM the sdist
+        run: |
+          set -euo pipefail
+          mkdir -p from-sdist && tar xzf dist/tooprolix-*.tar.gz -C from-sdist
+          test ! -e from-sdist/tooprolix-*/.git
+          uvx "maturin==${MATURIN_VERSION#v}" build --release --locked \
+            --manifest-path from-sdist/tooprolix-*/Cargo.toml \
+            --out dist-from-sdist --compatibility pypi
+
+      # EXACTLY ONE FILE PER DIRECTORY, OR THIS FAILS. `$(echo dist/*.whl)` looks like "the
+      # wheel" and is really a space-joined list: run 30604813542 had a stray wheel in `dist/` and
+      # handed uv `<macos wheel> <linux wheel>` as one path, which then failed with a URL-encoded
+      # space in it. That is a guard failing open — the step before it had already "passed" on the
+      # same two-file string, because `basename` on it returns the last one. Counting first is what
+      # makes the later steps grade one named artifact instead of whatever the glob swept up.
+      - name: Resolve the artifacts, exactly one of each
+        run: |
+          set -euo pipefail
+          for pair in "SDIST:dist/*.tar.gz" "WHEEL_FROM_SDIST:dist-from-sdist/*.whl"; do
+            name="${pair%%:*}"
+            # shellcheck disable=SC2206
+            found=(${pair#*:})
+            if [ "${#found[@]}" -ne 1 ] || [ ! -f "${found[0]}" ]; then
+              echo "FAIL: expected exactly one ${pair#*:}, found ${#found[@]}: ${found[*]}" >&2
+              exit 1
+            fi
+            echo "$name=${found[0]}" >> "$GITHUB_ENV"
+            echo "$name = ${found[0]}"
+          done
+
+      - name: twine check
+        run: uvx twine check --strict "$SDIST" "$WHEEL_FROM_SDIST"
+
+      # AC3 AND AC8, GATED IN CODE RATHER THAN OBSERVED IN A REPORT. `twine check --strict`
+      # validates the METADATA envelope and the description's markup; it never asks what the licence
+      # says, whether a LICENSE file is actually in the archive, whether the sdist carries the two
+      # documents the README links to, or which file the shipped description came from. All three
+      # exploits were measured green under every other gate here — see the script's own header.
+      #
+      # README.md on disk is the TRANSFORMED one at this point, which is the object AC8 names.
+      - name: The archives carry MIT, required licence files, docs/, and the transformed README
+        run: |
+          uv run --no-project python scripts/check_artifact.py "$SDIST" README.md
+          uv run --no-project python scripts/check_artifact.py "$WHEEL_FROM_SDIST" README.md
+
+      # AC4 for the source path, with an ORACLE rather than a shape check: the expected date is
+      # `git log -1 --format=%cs`, computed here from the checkout, so a binary built from any other
+      # commit fails. Without it the smoke accepted `tooprolix 0.4.1 (2000-01-01)` — measured.
+      - name: install-smoke the wheel built from the sdist
+        run: scripts/install-smoke.sh "$WHEEL_FROM_SDIST" "$(git log -1 --format=%cs)"
+
+      # THE NON-CIRCULAR HALF, AND IT PINS AN ACCEPTED LIMITATION RATHER THAN HIDING ONE.
+      #
+      # Every other step here runs with SOURCE_DATE_EPOCH exported, so "the sdist produces a dated
+      # binary" was only ever proved in an environment that handed it the date. A real
+      # `pip install tooprolix` from the sdist — what a user on a platform outside the matrix gets —
+      # has no such environment and no `.git`, so `build.rs` falls through to `unknown`.
+      #
+      # Measured, and ACCEPTED: `unknown` is what `build.rs` was designed to say when it cannot know
+      # its provenance, in preference to borrowing a surrounding repository's date (the bug task #7
+      # fixed). `--help` documents it to users. So the behaviour is pinned as an expectation instead
+      # of being left as something the matrix quietly never exercises: `env -u SOURCE_DATE_EPOCH`
+      # plus the literal expected date `unknown`. The day an offline sdist starts printing something
+      # else — a wall clock, a borrowed commit — this step goes red.
+      - name: install-smoke the sdist offline, where the date is honestly unknown
+        run: env -u SOURCE_DATE_EPOCH scripts/install-smoke.sh "$SDIST" unknown
+
+      - name: Upload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: artifacts-sdist
+          path: dist/*.tar.gz
+
+      # THE BINARIES THIS JOB UPLOADS ARE WHAT ACTUALLY GETS PUBLISHED, so this job proves for
+      # itself which commit it built. Change this workflow's checkout to `ref: main` and every leg
+      # builds the wrong tree while every REST job still self-reports `head_sha=<tag>` — the tag-job
+      # grader would accept it, because `head_sha` is a label the run attaches to itself.
+      #
+      # LAST, after the artifacts are built and smoked, so a second checkout inserted between the
+      # checkout and the build cannot leave a correct-looking record of a tree nobody built. Same
+      # step, same shell, as every job in `ci.yml`.
+      - name: The gates above ran on the commit this event names
+        shell: bash
+        run: |
+          set -euo pipefail
+          sha=$(git rev-parse HEAD)
+          echo "graded commit $sha, tree $(git rev-parse "HEAD^{tree}")"
+          if [ "$sha" != "${GITHUB_SHA:-}" ]; then
+            echo "FAIL: this job graded $sha, but the event names ${GITHUB_SHA:-<unset>}." >&2
+            exit 1
+          fi
+
+  # THE THREE WHEEL LEGS RUN ON THE EVENTS THAT PRECEDE A TAG, NOT ON EVERY PULL REQUEST.
+  #
+  # Per PR, running them everywhere costs sdist 3 + linux 3 + macos 20 (the x10 private-repo
+  # multiplier) + windows 6 = 32 billed minutes, of which the wheels are 29. An ordinary PR keeps
+  # `sdist`, which grades the README transform, the archive contents and the offline-sdist
+  # behaviour. A cross-platform break is still caught before the tag, because the release-plz PR
+  # runs the full matrix. Nothing is removed from the TAG matrix — each leg there is the only smoke
+  # test of the operating system its wheel tag claims.
+  #
+  # AN EVENT CONDITION, NOT A PATH ONE. A path filter would skip the wheels on a README-only change,
+  # precisely the change able to break the transformer that rewrites the description PyPI renders.
+  # `github.head_ref` is set only on `pull_request` and `startsWith` on the empty string is false,
+  # so the release-plz clause cannot leak into a push event.
+  #
+  # THESE LEGS MUST NEVER BE REGISTERED AS REQUIRED CHECKS. GitHub does not expand a skipped matrix
+  # job: on ordinary PR #52 it reported one `skipped` check named literally
+  # `wheel ${{ matrix.platform.name }}`, while release events report three platform-specific names.
+  # Any one of those contexts disappears on the other event. The required name is `ci-required`.
+  wheels:
+    needs: sdist
+    name: wheel ${{ matrix.platform.name }}
+    runs-on: ${{ matrix.platform.runner }}
+    timeout-minutes: 30
+    if: >-
+      github.event_name == 'workflow_dispatch'
+      || startsWith(github.ref, 'refs/tags/v')
+      || startsWith(github.head_ref, 'release-plz-')
+    strategy:
+      # `fail-fast: false` so one red platform still leaves the other two measured. AC4's rule is
+      # "an artifact that could not be smoked is excluded from the matrix", and deciding that needs
+      # every platform's answer, not the first failure.
+      fail-fast: false
+      matrix:
+        platform:
+          - name: linux-x86_64
+            runner: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            manylinux: "2_17"
+            # The tag the wheel is REQUIRED to carry, checked against the file maturin produced.
+            # "it built on the runner" is not a floor.
+            expect_tag: py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64
+          - name: macos-arm64
+            runner: macos-15
+            target: aarch64-apple-darwin
+            manylinux: auto
+            expect_tag: py3-none-macosx_11_0_arm64
+          - name: windows-x86_64
+            runner: windows-latest
+            target: x86_64-pc-windows-msvc
+            manylinux: auto
+            expect_tag: py3-none-win_amd64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          enable-cache: true
+
+      - name: Export SOURCE_DATE_EPOCH from the commit
+        shell: bash
+        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)" >> "$GITHUB_ENV"
+
+      - name: Rewrite the README for the PyPI project page
+        shell: bash
+        run: uv run --no-project --with 'readme_renderer[md]' python scripts/transform_readme.py README.md
+
+      - name: Build wheel
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          maturin-version: ${{ env.MATURIN_VERSION }}
+          target: ${{ matrix.platform.target }}
+          manylinux: ${{ matrix.platform.manylinux }}
+          args: --release --locked --out dist --compatibility pypi
+          # THE MANYLINUX WHEEL BUILDS INSIDE A DOCKER CONTAINER, AND THE JOB'S ENVIRONMENT DOES
+          # NOT FOLLOW IT IN. Found by the smoke rather than by reading the action: run 30605047058
+          # was green through `Build wheel`, the tag check and `twine check`, and then
+          #
+          #   FAIL: --version printed 'tooprolix 0.4.1 (unknown)'
+          #
+          # — the linux artifact did not know what commit it was built from, while the natively
+          # built macOS wheel in the same run printed a real date. Without the version assertion in
+          # `scripts/install-smoke.sh` this run would have uploaded that wheel as a pass. This is
+          # ignored on the macOS and Windows legs, which use no container.
+          docker-options: -e SOURCE_DATE_EPOCH
+        env:
+          # Declared rather than inherited — see the header. maturin already defaults to 11.0 here;
+          # a default is not a promise, and this is the line that keeps the tag honest if it changes.
+          MACOSX_DEPLOYMENT_TARGET: "11.0"
+
+      # The count comes FIRST, and it is not tidiness. `$(echo dist/*.whl)` is a space-joined
+      # list, and `basename` on such a list silently answers with the last entry — so in run
+      # 30604813542 a check reported PASS on a directory holding a foreign macOS wheel beside the
+      # real one, and the failure only surfaced two steps later inside uv. A guard that grades
+      # whatever the glob swept up is not grading the artifact.
+      - name: Resolve the built wheel, exactly one
+        shell: bash
+        run: |
+          set -euo pipefail
+          # shellcheck disable=SC2206
+          built=(dist/*.whl)
+          if [ "${#built[@]}" -ne 1 ] || [ ! -f "${built[0]}" ]; then
+            echo "FAIL: expected exactly one wheel in dist/, found ${#built[@]}: ${built[*]}" >&2
+            exit 1
+          fi
+          echo "WHEEL=${built[0]}" >> "$GITHUB_ENV"
+          echo "built: ${built[0]}"
+
+      - name: twine check
+        shell: bash
+        run: uvx twine check --strict "$WHEEL"
+
+      # AC2 and AC3/AC8 in one committed gate — `scripts/check_artifact.py`, which the sdist job
+      # runs too and which has its own tests.
+      #
+      # `expect_tag` is declared in the matrix above rather than derived here, so it is fixed
+      # independently of whatever the build produced. The script requires BOTH the archive's
+      # `.dist-info/WHEEL` and the filename to agree with it: the in-archive read is what a resolver
+      # honours, the filename read is what catches a rename.
+      #
+      # It compares TAG SETS, not strings. `.dist-info/WHEEL` carries one `Tag:` line per tag
+      # while the filename carries PEP 425's compressed set, and run 30613111390 went red on the
+      # linux leg for exactly that difference in representation. macOS and Windows wheels are
+      # single-tag, which is why only CI could find it.
+      #
+      # WHAT THIS DOES NOT CHECK, said plainly: no symbol versions are audited. Nothing opens the
+      # ELF to compare its `GLIBC_*` requirements against the 2.17 the tag promises — **the
+      # manylinux build container IS the whole guarantee** for that, being a sysroot old enough that
+      # a newer symbol cannot be linked in the first place. If the linux leg ever stops going
+      # through `manylinux: 2_17`, this keeps passing while the promise breaks, and `auditwheel`
+      # becomes the missing step.
+      - name: The wheel is the promised tag and carries MIT, its LICENSE, and the transformed README
+        shell: bash
+        run: |
+          uv run --no-project python scripts/check_artifact.py "$WHEEL" README.md \
+            --expect-tag "${{ matrix.platform.expect_tag }}"
+
+      - name: install-smoke
+        shell: bash
+        run: scripts/install-smoke.sh "$WHEEL" "$(git log -1 --format=%cs)"
+
+      - name: Upload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: artifacts-${{ matrix.platform.name }}
+          path: dist/*.whl
+
+      - name: The gates above ran on the commit this event names
+        shell: bash
+        run: |
+          set -euo pipefail
+          sha=$(git rev-parse HEAD)
+          echo "graded commit $sha, tree $(git rev-parse "HEAD^{tree}")"
+          if [ "$sha" != "${GITHUB_SHA:-}" ]; then
+            echo "FAIL: this job graded $sha, but the event names ${GITHUB_SHA:-<unset>}." >&2
+            exit 1
+          fi
+
+  release-manifest:
+    name: PyPI release manifest
+    needs: [sdist, wheels]
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Download the four independently built artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: artifacts-*
+          path: downloaded
+
+      - name: Assemble the immutable PyPI release candidate
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ "${GITHUB_EVENT_NAME:-}" != "push" ] \
+            || [[ "${GITHUB_REF:-}" != refs/tags/v* || "${GITHUB_REF_NAME:-}" != v* ]]; then
+            echo "FAIL: release candidates require a v* tag push event." >&2
+            exit 1
+          fi
+          version="${GITHUB_REF_NAME#v}"
+          declared_version=$(sed -n '/^\[package\]/,/^\[/{s/^version = "\([^"]*\)"/\1/p;}' Cargo.toml)
+          if [ -z "$version" ] || [ "$version" != "$declared_version" ]; then
+            echo "FAIL: tag $GITHUB_REF_NAME does not match Cargo.toml version $declared_version." >&2
+            exit 1
+          fi
+          tag_sha=$(git rev-parse HEAD)
+          if [ "$tag_sha" != "${GITHUB_SHA:-}" ]; then
+            echo "FAIL: checkout $tag_sha does not match triggering SHA ${GITHUB_SHA:-<unset>}." >&2
+            exit 1
+          fi
+          tree_sha=$(git rev-parse 'HEAD^{tree}')
+
+          artifact_ids=(sdist linux-x86_64 macos-arm64 windows-x86_64)
+          filenames=(
+            "tooprolix-${version}.tar.gz"
+            "tooprolix-${version}-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+            "tooprolix-${version}-py3-none-macosx_11_0_arm64.whl"
+            "tooprolix-${version}-py3-none-win_amd64.whl"
+          )
+          mapfile -t downloaded_entries < <(find downloaded -mindepth 1 -maxdepth 1 -print | sort)
+          if [ "${#downloaded_entries[@]}" -ne 4 ]; then
+            echo "FAIL: expected four downloaded artifacts, found ${#downloaded_entries[@]}." >&2
+            exit 1
+          fi
+
+          mkdir dist
+          for index in "${!artifact_ids[@]}"; do
+            directory="downloaded/artifacts-${artifact_ids[$index]}"
+            expected="${filenames[$index]}"
+            mapfile -t members < <(find "$directory" -mindepth 1 -maxdepth 1 -print | sort)
+            if [ "${#members[@]}" -ne 1 ] || [ ! -f "${members[0]:-}" ] || [ "$(basename "${members[0]:-}")" != "$expected" ]; then
+              echo "FAIL: $directory must contain only $expected." >&2
+              exit 1
+            fi
+            cp -- "${members[0]}" "dist/$expected"
+          done
+
+          {
+            printf 'tag: %s\n' "$GITHUB_REF_NAME"
+            printf 'tag-target-sha: %s\n' "$tag_sha"
+            printf 'tree-sha: %s\n' "$tree_sha"
+            printf 'run-id: %s\n\n' "$GITHUB_RUN_ID"
+            printf 'size\tfilename\tsha256\n'
+            for filename in "${filenames[@]}"; do
+              size=$(wc -c < "dist/$filename" | tr -d ' ')
+              digest=$(sha256sum "dist/$filename" | cut -d ' ' -f 1)
+              printf '%s\t%s\t%s\n' "$size" "$filename" "$digest"
+            done
+          } > release-manifest.txt
+          cat release-manifest.txt
+
+      - name: Upload the immutable human-readable manifest
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-manifest-${{ github.run_id }}
+          path: release-manifest.txt
+
+      - name: Upload the reusable release verifier
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-verifier-${{ github.run_id }}
+          path: scripts/check_release_manifest.py
+
+      - name: Upload the immutable release candidate
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-candidate-${{ github.run_id }}
+          path: dist/*
+
+      - name: The gates above ran on the commit this event names
+        shell: bash
+        run: |
+          set -euo pipefail
+          sha=$(git rev-parse HEAD)
+          echo "graded commit $sha, tree $(git rev-parse "HEAD^{tree}")"
+          if [ "$sha" != "${GITHUB_SHA:-}" ]; then
+            echo "FAIL: this job graded $sha, but the event names ${GITHUB_SHA:-<unset>}." >&2
+            exit 1
+          fi
+
+  publish-pypi:
+    name: Publish to PyPI
+    needs: [sdist, wheels, release-manifest]
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: pypi
+      url: https://pypi.org/p/tooprolix
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Download the immutable manifest
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-manifest-${{ github.run_id }}
+          path: .
+
+      - name: Download the release verifier from the manifest job
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-verifier-${{ github.run_id }}
+          path: scripts
+
+      - name: Download the immutable release candidate
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-candidate-${{ github.run_id }}
+          path: dist
+
+      - name: Verify the approved PyPI release candidate
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ "${GITHUB_EVENT_NAME:-}" != "push" ] \
+            || [[ "${GITHUB_REF:-}" != refs/tags/v* || "${GITHUB_REF_NAME:-}" != v* ]]; then
+            echo "FAIL: publishing requires a v* tag push event." >&2
+            exit 1
+          fi
+          if ! grep -Fxq "tag: $GITHUB_REF_NAME" release-manifest.txt \
+            || ! grep -Fxq "tag-target-sha: ${GITHUB_SHA:-}" release-manifest.txt \
+            || ! grep -Fxq "run-id: $GITHUB_RUN_ID" release-manifest.txt; then
+            echo "FAIL: release manifest does not belong to this tag run." >&2
+            exit 1
+          fi
+
+          version="${GITHUB_REF_NAME#v}"
+          python scripts/check_release_manifest.py --version "$version" release-manifest.txt dist
+
+      - name: Publish the verified release candidate to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 2026-07-28
+        with:
+          packages-dir: dist