tors 0.2.0__tar.gz

tors-0.2.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,36 @@
+---
+name: Bug Report
+about: Report a bug or unexpected behavior
+labels: bug
+---
+
+## Description
+
+A clear description of what the bug is.
+
+## Reproduction
+
+```python
+import tors
+
+# Minimal input that reproduces the issue
+```
+
+## Expected Behavior
+
+What you expected `tors` to return.
+
+## Actual Behavior
+
+What it actually returned (include the full traceback/output).
+
+## Environment
+
+- tors version:
+- Python version:
+- OS / architecture:
+- Installed from: (PyPI wheel / built from source)
+
+## Additional Context
+
+Any other context (logs, related issues, etc.).

tors-0.2.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,21 @@
+---
+name: Feature Request
+about: Suggest a new feature or enhancement
+labels: enhancement
+---
+
+## Problem
+
+What problem does this feature solve? What's the current limitation?
+
+## Proposed Solution
+
+Describe the feature or change you'd like to see.
+
+## Alternatives Considered
+
+Any alternative approaches you've considered.
+
+## Additional Context
+
+Any other context, examples, or references.

tors-0.2.0/.github/dependabot.yml

@@ -0,0 +1,36 @@
+version: 2
+
+updates:
+  # Keeps the SHA pins in every workflow (ci.yml, publish.yml, docs.yml) current —
+  # SHA-pinning actions without this entry means never receiving upstream security fixes.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps-ci)"
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps-rust)"
+    groups:
+      rust-minor-patch:
+        update-types: ["minor", "patch"]
+
+  # `uv` is a first-class Dependabot ecosystem (understands pyproject.toml and uv.lock
+  # natively) — not `pip`, which reads pyproject.toml but doesn't maintain uv.lock.
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps-py)"
+    groups:
+      python-minor-patch:
+        update-types: ["minor", "patch"]

tors-0.2.0/.github/pull_request_template.md

@@ -0,0 +1,28 @@
+## Summary
+
+Brief description of what this PR does and why.
+
+## Changes
+
+- Change 1
+- Change 2
+
+## Testing
+
+Describe how you tested these changes.
+
+```bash
+uv sync --locked
+uv run --no-sync pytest -q
+cargo test --no-default-features
+cargo clippy --all-targets -- -D warnings
+cargo fmt --check
+```
+
+## Docs
+
+- [ ] `README.md` and `docs/` updated to match any behavior or API change in this PR.
+
+## Related Issues
+
+Fixes #123

tors-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,191 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  # Manual trigger for debugging a workflow change without pushing a commit.
+  workflow_dispatch:
+
+# Cancel the superseded run for the same branch when a new push lands:
+# rapid follow-up commits stop burning runner minutes on an already-outdated run.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# Least-privilege default: every job here reads and builds, none writes anything back to
+# the repo or an external registry, so the top-level GITHUB_TOKEN needs no more than this.
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  lint:
+    # Runs once, not per matrix leg: Rust fmt/clippy is Python-version-agnostic, so the
+    # 3.10–3.14 matrix would buy five identical copies of the same signal.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Rust
+        # The action installs with rustup's `--profile minimal`, which ships neither
+        # rustfmt nor clippy — this input is what makes the two steps below runnable.
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Cache cargo
+        # rust-cache, not sccache, in CI: every strategy pays its warm-up per job, and a
+        # ~10s clean build never amortizes sccache's install + cache-restore overhead on
+        # top of it. rust-cache already keys per job on the lockfile. sccache is wired
+        # where it does pay — the local edit/compile loop, via the Makefile (which does
+        # the same: sccache locally, no compiler cache in CI).
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+
+      - name: Cargo fmt
+        run: cargo fmt --check
+
+      - name: Cargo clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Cargo clippy (no default features)
+        # Second pass in the configuration `Cargo test` / `Compile benches` below actually
+        # build (--no-default-features): pyo3's cfg flags differ between the two configs,
+        # so each pass can surface lints in code the other never compiles.
+        run: cargo clippy --all-targets --no-default-features -- -D warnings
+
+      - name: Cargo deny (licenses, advisories, bans)
+        # The repo-wide, permanent licensing gate (spec v0.4 item 6): the
+        # permissive-only allowlist and the advisory/ban policy live in
+        # deny.toml; `make deny` runs the same three checks locally. The
+        # action ships a prebuilt cargo-deny binary, so the gate costs
+        # seconds, not the minutes a `cargo install cargo-deny --locked`
+        # would add to every run.
+        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
+        with:
+          command-arguments: licenses advisories bans
+
+      - name: Install uv
+        # For the ruff step below: ruff is a dev-group dependency (pyproject.toml),
+        # so the lockfile — not this workflow — owns its version.
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+
+      - name: Ruff
+        # The Python-side lint gate (config in pyproject.toml [tool.ruff];
+        # `make lint` runs the same check locally). --no-install-project keeps
+        # this a pure lint step: only the dev deps are installed, never the
+        # tors wheel (whose maturin build is the test job's business — the
+        # Rust gates above already compile the code it would wrap).
+        run: |
+          uv sync --locked --no-install-project
+          uv run --no-sync ruff check .
+
+  test:
+    # Cheap signals first: a fmt or clippy
+    # failure surfaces from `lint` in one fast job instead of after five matrix legs have
+    # each spent a uv sync + extension build on the same break.
+    needs: [lint]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+
+      - name: Cache cargo
+        # Same choice as the lint job's cache step (rationale there).
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+
+      - name: Cargo test
+        # extension-module doesn't link libpython, so plain `cargo test` needs it off.
+        # Rust-only; the crate isn't Python-version-specific, so this runs once per job
+        # rather than once per matrix entry.
+        if: matrix.python-version == '3.12'
+        run: cargo test --no-default-features
+
+      - name: Compile benches
+        # Compile-guard only: the bench docstring (benches/normalize.rs) and the design
+        # spec both promise that CI compiles the criterion benches; `--no-run` keeps that
+        # promise without spending runner time executing them. `--no-default-features`:
+        # same libpython-linking reason as `Cargo test` above — a bench binary links the rlib.
+        if: matrix.python-version == '3.12'
+        run: cargo bench --no-run --no-default-features
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Sync dependencies and build the extension
+        # --locked: fail if uv.lock is out of date with pyproject.toml, rather than silently
+        # rewriting it.
+        run: uv sync --locked
+
+      - name: Pytest
+        # -m "not timing": the timing lane (tests/test_gil_release.py and
+        # tests/test_performance.py — the asyncio heartbeat-gap and wall-band
+        # measurement cells, marked `timing` in pyproject.toml) is slow and
+        # load-sensitive, so the matrix legs deselect it and ONE dedicated
+        # step on this 3.12 leg runs it right after: the GIL/perf contracts
+        # still gate every push, once, instead of being paid on all five
+        # legs. The marker split is exact (both lane files carry a module-level
+        # pytestmark, nothing else does), so no test loses its lane — verified
+        # by `pytest --collect-only -m timing` + `-m "not timing"` summing to
+        # the unfiltered count.
+        # -rP: also show the captured stdout of PASSING tests. The suite's
+        # print-only measurement cells (deliberately unasserted bands, e.g.
+        # b64_decode's wall parity) record their numbers via print, which the
+        # default -q report swallows — -rP surfaces them in the CI log for
+        # the record.
+        run: uv run --no-sync pytest -q -rP -m "not timing"
+
+      - name: Pytest (timing lane)
+        # The lane the matrix legs above deselect, run ONCE (the 3.12 leg,
+        # after the main pytest step): the GIL-release and wall-time
+        # measurement cells. -rP so the print-only recorded bands (and the
+        # b64 battery's recorded gh-145264 divergences, should this leg's
+        # stdlib predate the fix) surface in the log. Runs last on the leg so
+        # a timing failure never masks the fast lane's results.
+        if: matrix.python-version == '3.12'
+        run: uv run --no-sync pytest -q -rP -m timing
+
+  fuzz-smoke:
+    # A cheap regression net, not a real fuzzing campaign: 15s per target
+    # (CONTRIBUTING.md's `make fuzz-quick` runs the same targets for 30s
+    # locally) — enough to catch a reintroduced panic on every push without
+    # meaningfully lengthening CI. A real multi-hour campaign against one
+    # target of active suspicion is a local `cargo +nightly fuzz run
+    # <target>`, not something this job runs.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Rust (nightly)
+        # cargo-fuzz's instrumented builds need nightly's -Z sanitizer flags;
+        # the rest of CI stays on stable (see the lint job's own note).
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+        with:
+          toolchain: nightly
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: ". -> target\nfuzz -> target"
+
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+
+      - name: Fuzz (15s per target)
+        working-directory: fuzz
+        run: |
+          set -e
+          for t in decode_utf8 decode_utf16 b64_decode html_unescape fence chunk_hierarchical normalize search segmentation diff phonetic bm25 tfidf; do
+            echo "=== $t ==="
+            cargo +nightly fuzz run "$t" -- -max_total_time=15 -close_fd_mask=3
+          done

tors-0.2.0/.github/workflows/commitlint.yml

@@ -0,0 +1,39 @@
+# Enforces Conventional Commits on the PR title, which is what release-please parses to
+# decide the next version bump and CHANGELOG entry.
+
+name: Commitlint
+
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  commitlint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        if: github.actor != 'dependabot[bot]' && github.actor != 'github-actions[bot]'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            docs
+            style
+            refactor
+            perf
+            test
+            chore
+            ci
+            build
+          subjectPattern: ^[a-z].+
+          subjectPatternError: |
+            The subject "{subject}" found in the pull request title "{title}"
+            didn't match the configured pattern. Please ensure that the subject
+            starts with a lowercase letter.

tors-0.2.0/.github/workflows/docs.yml

@@ -0,0 +1,51 @@
+# Builds the mkdocs site and deploys it to GitHub Pages via the modern OIDC-based deploy
+# flow (actions/deploy-pages), not the legacy push-to-a-gh-pages-branch approach. Runs
+# `mkdocs build --strict` so a broken nav entry or bad link fails CI instead of silently
+# publishing a broken page.
+
+name: docs
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - "mkdocs.yml"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/docs.yml"
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - name: Sync docs dependencies
+        # --locked: fail if uv.lock is out of date, rather than silently rewriting it.
+        run: uv sync --locked --group docs --no-install-project --no-default-groups
+      - name: Build
+        run: uv run --no-sync mkdocs build --strict
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main'
+    permissions:
+      pages: write
+      id-token: write # Required by actions/deploy-pages to verify the deployment source.
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5

tors-0.2.0/.github/workflows/fuzz.yml

@@ -0,0 +1,68 @@
+# The scheduled deep fuzzing pass. ci.yml's `fuzz-smoke` job runs the same
+# targets for 15s on every push (a regression net); this job gives them a
+# longer 30s budget on a weekly schedule, when runner minutes are cheap and
+# nobody is waiting on the result, plus a manual `workflow_dispatch` trigger
+# for running a pass on demand (e.g. after a change to a covered core).
+# Crashes fail the job (no continue-on-error); the crash inputs libFuzzer
+# writes to fuzz/artifacts/ and the accumulated corpus are uploaded on
+# failure only, so a red run carries its repro case with it.
+
+name: fuzz
+
+on:
+  schedule:
+    # Mondays 03:20 UTC: off the top of the hour, away from the busiest
+    # minute of GitHub's scheduled-workload peak.
+    - cron: "20 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  fuzz:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Rust (nightly)
+        # cargo-fuzz's instrumented builds need nightly's -Z sanitizer flags;
+        # the rest of CI stays on stable (see the lint job's own note in
+        # ci.yml).
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+        with:
+          toolchain: nightly
+
+      - name: Cache cargo
+        # Same choice as ci.yml's fuzz-smoke job (rationale there).
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: ". -> target\nfuzz -> target"
+
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+
+      - name: Fuzz (30s per target)
+        working-directory: fuzz
+        run: |
+          set -e
+          for t in decode_utf8 decode_utf16 b64_decode html_unescape fence chunk_hierarchical normalize search segmentation diff phonetic bm25 tfidf; do
+            echo "=== $t ==="
+            cargo +nightly fuzz run "$t" -- -max_total_time=30 -close_fd_mask=3
+          done
+
+      - name: Upload corpus and crash artifacts
+        # Failure only: a green run's corpus is reproducible from the seed
+        # inputs, but a red run's crash file is the repro case the report
+        # needs (minimize it locally with `cargo fuzz tmin`).
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: fuzz-crash-artifacts
+          path: |
+            fuzz/artifacts
+            fuzz/corpus
+          if-no-files-found: ignore

tors-0.2.0/.github/workflows/publish.yml

@@ -0,0 +1,162 @@
+# Builds abi3 wheels (one per platform, valid for every Python 3.10+ per Cargo.toml's
+# `abi3-py310` feature — no per-Python-version build matrix needed) plus an sdist, then
+# publishes to PyPI via Trusted Publishing (OIDC) on a release-please tag. No PyPI API
+# token exists anywhere in this repo — `id-token: write` is the whole auth story.
+#
+# Platform set is the mainstream cross-platform tier most serious PyO3 packages ship
+# (Linux manylinux + musllinux on x86_64/aarch64, macOS x86_64/aarch64, Windows x64/arm64)
+# — not maturin generate-ci's full exotic-target sprawl (32-bit x86, armv7, s390x, ppc64le,
+# emscripten, android), which stays out until a real user asks for one of those.
+#
+# Tag-trigger caveat: release-please publishes its tag using GITHUB_TOKEN by default, and
+# GitHub does not start workflow runs from GITHUB_TOKEN-authored events — so this workflow's
+# `push: tags` trigger will not fire automatically unless release-please.yml is given a
+# GitHub App token (see that workflow's header). Until one is configured, run this via
+# `workflow_dispatch` against the new tag after a release PR merges.
+#
+# Job order is deliberately cheapest-first: wheels-linux (and sdist) run on ubuntu-22.04,
+# by far the cheapest and fastest GitHub-hosted runner. wheels-other (macOS, Windows —
+# both several times the per-minute cost of Linux, and macOS/Windows arm64 runners are
+# scarcer capacity) only starts once every Linux leg has passed, via `needs`. A correctness
+# bug that fails on Linux therefore never burns the expensive runners at all.
+
+name: publish
+
+on:
+  push:
+    tags: ["v[0-9]+.[0-9]+.[0-9]+"]
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  wheels-linux:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64
+            manylinux: auto
+          - target: aarch64
+            manylinux: auto
+          - target: x86_64
+            manylinux: musllinux_1_2
+          - target: aarch64
+            manylinux: musllinux_1_2
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+      - name: Build wheel
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist
+          manylinux: ${{ matrix.manylinux }}
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: wheels-linux-${{ matrix.target }}-${{ matrix.manylinux }}
+          path: dist
+
+  sdist:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Build sdist
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          command: sdist
+          args: --out dist
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: sdist
+          path: dist
+
+  wheels-other:
+    needs: wheels-linux
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-15-intel
+            target: x86_64
+          - os: macos-latest
+            target: aarch64
+          - os: windows-latest
+            target: x64
+            python_arch: x64
+          - os: windows-11-arm
+            target: aarch64
+            python_arch: arm64
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+          architecture: ${{ matrix.python_arch || 'x64' }}
+      - name: Build wheel
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: wheels-${{ matrix.os }}-${{ matrix.target }}
+          path: dist
+
+  publish:
+    name: Publish to PyPI
+    needs: [wheels-linux, wheels-other, sdist]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write # Trusted Publishing — no API token secret needed or used.
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: "wheels-*"
+          path: dist
+          merge-multiple: true
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: sdist
+          path: dist
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - name: Publish
+        run: uv publish --trusted-publishing automatic dist/*
+
+  publish-crate:
+    name: Publish to crates.io
+    # Independent of the PyPI leg above: the crate (published as `tors-core`, see
+    # Cargo.toml's own comment on the name collision) needs no wheel artifacts, just the
+    # source tree and Cargo.lock, so it runs in parallel rather than behind `needs`.
+    #
+    # First release only: crates.io has no PyPI-style "pending trusted publisher" for a
+    # crate that has never been published, so the very first `tors-core` release must be
+    # `cargo publish`d manually (from a machine already `cargo login`-ed). Only after that
+    # succeeds can a Trusted Publisher be configured in the crate's crates.io settings
+    # (GitHub owner `AZX-PBC-OSS`, repo `tors`, workflow `publish.yml`) — this job is that
+    # configuration's target and does nothing until it exists.
+    runs-on: ubuntu-latest
+    environment: crates-io
+    permissions:
+      id-token: write # Trusted Publishing (OIDC) — no API token secret needed or used.
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+      - name: Authenticate with crates.io
+        id: auth
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+      - name: Publish
+        # --no-default-features: `extension-module` (the crate's default) doesn't link
+        # libpython, which breaks a plain `cargo publish` verification build the same way
+        # it breaks `cargo test`/`cargo build` — see Cargo.toml's own feature comment.
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+        run: cargo publish -p tors-core --no-default-features