watcherobot 0.1.1__tar.gz

watcherobot-0.1.1/.github/scripts/luxiao_review.py

@@ -0,0 +1,151 @@
+#!/usr/bin/env python3
+"""Bridge one GitHub review job to the Luxiao Hermes profile safely."""
+
+from __future__ import annotations
+
+import os
+import shlex
+import subprocess
+import sys
+import tempfile
+import uuid
+from pathlib import Path
+
+
+MAX_DIFF_CHARS = 100_000
+REMOTE_REVIEW_TIMEOUT_SECONDS = 600
+SSH_OPTIONS = ("-o", "StrictHostKeyChecking=yes", "-o", "BatchMode=yes")
+
+
+def _write_result(path: Path, text: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(text, encoding="utf-8")
+
+
+def main() -> int:
+    if len(sys.argv) != 3:
+        print("Usage: luxiao_review.py <diff_path> <output_path>", file=sys.stderr)
+        return 2
+
+    diff_path = Path(sys.argv[1])
+    output_path = Path(sys.argv[2])
+    if not diff_path.is_file():
+        _write_result(output_path, "## 🤖 Luxiao PR 审查报告\n\n⚠️ Diff 文件不存在。")
+        return 1
+
+    hermes_host = os.environ.get("LUXIAO_HERMES_HOST", "").strip()
+    remote_script = os.environ.get(
+        "LUXIAO_REMOTE_SCRIPT", "/home/hermesadmin/scripts/luxiao-run.sh"
+    ).strip()
+    remote_dir = os.environ.get(
+        "LUXIAO_REMOTE_DIR", "/home/hermesadmin/.cache/luxiao-review"
+    ).strip()
+    if not hermes_host:
+        _write_result(
+            output_path,
+            "## 🤖 Luxiao PR 审查报告\n\n⚠️ Runner 未配置 LUXIAO_HERMES_HOST。",
+        )
+        return 1
+
+    full_diff = diff_path.read_text(encoding="utf-8", errors="replace")
+    diff_text = full_diff[:MAX_DIFF_CHARS]
+    truncation_notice = ""
+    if len(full_diff) > MAX_DIFF_CHARS:
+        omitted_chars = len(full_diff) - MAX_DIFF_CHARS
+        omitted_lines = full_diff[MAX_DIFF_CHARS:].count("\n")
+        truncation_notice = (
+            "\n\n> ⚠️ Diff 过大，本次输入已明确截断："
+            f"省略 {omitted_chars} 个字符、约 {omitted_lines} 行。"
+            "审查结论必须注明未覆盖范围，不能宣称完成全量审查。"
+        )
+    if not diff_text.strip() or diff_text.strip() == "empty":
+        _write_result(output_path, "## 🤖 Luxiao PR 审查报告\n\n✅ 无代码变更。")
+        return 0
+
+    prompt = f"""请审查以下 Pull Request。按照你的审查框架（架构、产品、规范、损伤 + 意图分析 + Merge 建议）给出完整审查报告。
+
+## PR 信息
+
+- 标题: {os.environ.get('PR_TITLE', '')}
+- 描述: {os.environ.get('PR_BODY', '')}
+- 变更: {os.environ.get('PR_FILES', '')} 个文件, +{os.environ.get('PR_ADDITIONS', '')} / -{os.environ.get('PR_DELETIONS', '')}
+
+## 代码 Diff
+
+{diff_text}{truncation_notice}
+
+请直接输出审查报告，不要多余的前缀。"""
+
+    runner_temp = Path(os.environ.get("RUNNER_TEMP", tempfile.gettempdir()))
+    runner_temp.mkdir(parents=True, exist_ok=True)
+    remote_file = f"{remote_dir}/{uuid.uuid4().hex}.txt"
+    with tempfile.NamedTemporaryFile(
+        mode="w", encoding="utf-8", prefix="luxiao-prompt-", suffix=".txt", dir=runner_temp, delete=False
+    ) as prompt_file:
+        prompt_file.write(prompt)
+        local_file = Path(prompt_file.name)
+
+    try:
+        subprocess.run(
+            ["ssh", *SSH_OPTIONS, hermes_host, "mkdir", "-p", remote_dir],
+            check=True,
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+        subprocess.run(
+            ["scp", *SSH_OPTIONS, str(local_file), f"{hermes_host}:{remote_file}"],
+            check=True,
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+        result = subprocess.run(
+            [
+                "ssh",
+                *SSH_OPTIONS,
+                hermes_host,
+                "timeout",
+                "--signal=TERM",
+                "--kill-after=30s",
+                f"{REMOTE_REVIEW_TIMEOUT_SECONDS}s",
+                shlex.quote(remote_script),
+                shlex.quote(remote_file),
+            ],
+            capture_output=True,
+            text=True,
+            timeout=REMOTE_REVIEW_TIMEOUT_SECONDS + 60,
+        )
+    finally:
+        local_file.unlink(missing_ok=True)
+        subprocess.run(
+            ["ssh", *SSH_OPTIONS, hermes_host, "rm", "-f", "--", remote_file],
+            capture_output=True,
+            text=True,
+            timeout=30,
+            check=False,
+        )
+
+    if result.returncode != 0 or not result.stdout.strip():
+        _write_result(
+            output_path,
+            "## 🤖 Luxiao PR 审查报告\n\n"
+            f"⚠️ Luxiao Agent 调用失败（退出码 {result.returncode}）。",
+        )
+        return 1
+
+    text = result.stdout
+    markers = ("🤖 PR 审查报告", "PR 审查报告", "## PR 审查", "## 审查报告")
+    for marker in markers:
+        if marker in text:
+            text = text[text.index(marker) :]
+            break
+    else:
+        text = text[-6000:]
+    _write_result(output_path, "## 🤖 Luxiao PR 审查报告\n\n" + text)
+    print(f"Review saved to {output_path}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

watcherobot-0.1.1/.github/workflows/pr-review.yml

@@ -0,0 +1,52 @@
+name: PR Review by Luxiao
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  review:
+    runs-on: [self-hosted, Linux, X64, sdk-ci, pr-review]
+    if: github.event.pull_request.draft == false
+    steps:
+      - name: Get PR Diff via API
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          diff_file="${RUNNER_TEMP}/pr-${{ github.event.pull_request.number }}.diff"
+          gh pr diff ${{ github.event.pull_request.number }} -R ${{ github.repository }} > "${diff_file}" 2>/dev/null
+          if [ ! -s "${diff_file}" ]; then echo "empty" > "${diff_file}"; fi
+          echo "DIFF_FILE=${diff_file}" >> "${GITHUB_ENV}"
+          echo "Diff lines: $(wc -l < "${diff_file}")"
+
+      - name: Run Luxiao Review
+        env:
+          LUXIAO_HERMES_HOST: ${{ vars.LUXIAO_HERMES_HOST }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+          PR_ADDITIONS: ${{ github.event.pull_request.additions }}
+          PR_DELETIONS: ${{ github.event.pull_request.deletions }}
+          PR_FILES: ${{ github.event.pull_request.changed_files }}
+        run: |
+          python3 /home/runner-ci/scripts/luxiao-review.py \
+            "${DIFF_FILE}" \
+            "${RUNNER_TEMP}/review_result.md"
+
+      - name: Post Review Comment
+        if: always()
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          review_file="${RUNNER_TEMP}/review_result.md"
+          if [ ! -s "${review_file}" ]; then
+            echo "## 🤖 Luxiao PR 审查报告" > "${review_file}"
+            echo "" >> "${review_file}"
+            echo "⚠️ Review agent did not produce output." >> "${review_file}"
+          fi
+          gh pr comment ${{ github.event.pull_request.number }} \
+            -R ${{ github.repository }} \
+            --body "$(cat "${review_file}")"

watcherobot-0.1.1/.github/workflows/prepare-release.yml

@@ -0,0 +1,169 @@
+name: Prepare SDK release
+
+on:
+  pull_request:
+    types: [closed]
+  workflow_dispatch:
+    inputs:
+      target_version:
+        description: "显式 PEP 440 版本；飞书指令使用此字段"
+        required: false
+        type: string
+      release_type:
+        description: "未指定显式版本时使用的版本增量"
+        required: false
+        type: choice
+        options: [none, prerelease, stable, minor, major]
+        default: none
+      source:
+        description: "发布请求来源"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  prepare:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true && github.event.pull_request.base.ref == 'main')
+    # Trusted orchestration never shares an execution identity with pull-request code.
+    runs-on: [self-hosted, Linux, X64, sdk-orchestrator]
+    steps:
+      - name: Resolve one explicit release request
+        id: release
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          LABELS_JSON: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+          INPUT_TARGET: ${{ inputs.target_version }}
+          INPUT_TYPE: ${{ inputs.release_type }}
+          INPUT_SOURCE: ${{ inputs.source }}
+          SOURCE_PR: ${{ github.event.pull_request.number }}
+          SOURCE_TITLE: ${{ github.event.pull_request.title }}
+        shell: bash
+        run: |
+          python - <<'PY' >> "${GITHUB_OUTPUT}"
+          import json
+          import os
+
+          if os.environ["EVENT_NAME"] == "workflow_dispatch":
+              target = os.environ.get("INPUT_TARGET", "").strip()
+              release_type = os.environ.get("INPUT_TYPE", "").strip()
+              if release_type == "none":
+                  release_type = ""
+              if bool(target) == bool(release_type):
+                  raise SystemExit("Exactly one of target_version or release_type is required")
+              print(f"target={target}")
+              print(f"release_type={release_type}")
+              print(f"source={os.environ['INPUT_SOURCE'].strip()}")
+              print("skip=false")
+          else:
+              mapping = {
+                  "release:prerelease": "prerelease",
+                  "release:stable": "stable",
+                  "release:minor": "minor",
+                  "release:major": "major",
+              }
+              labels = json.loads(os.environ.get("LABELS_JSON") or "[]")
+              selected = [mapping[label] for label in labels if label in mapping]
+              if len(selected) > 1:
+                  raise SystemExit("A merged PR may have only one release:* label")
+              if not selected:
+                  print("skip=true")
+              else:
+                  print("target=")
+                  print(f"release_type={selected[0]}")
+                  print(
+                      "source=PR #{}：{}".format(
+                          os.environ["SOURCE_PR"], os.environ["SOURCE_TITLE"].strip()
+                      )
+                  )
+                  print("skip=false")
+          PY
+
+      - name: Mint repository-scoped GitHub App token
+        if: steps.release.outputs.skip == 'false'
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.ORULINK_RELEASE_APP_ID }}
+          private-key: ${{ secrets.ORULINK_RELEASE_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: WatcheRobot_python_sdk
+
+      - name: Check out main
+        if: steps.release.outputs.skip == 'false'
+        uses: actions/checkout@v6
+        with:
+          ref: main
+          fetch-depth: 0
+          persist-credentials: true
+          token: ${{ steps.app-token.outputs.token }}
+
+      - uses: actions/setup-python@v6
+        if: steps.release.outputs.skip == 'false'
+        with:
+          python-version: "3.12"
+
+      - name: Prepare version branch and pull request
+        if: steps.release.outputs.skip == 'false'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          RELEASE_TYPE: ${{ steps.release.outputs.release_type }}
+          TARGET_VERSION: ${{ steps.release.outputs.target }}
+          RELEASE_SOURCE: ${{ steps.release.outputs.source }}
+        shell: bash
+        run: |
+          # `packaging` is part of the trusted Python tool cache provisioned on the
+          # orchestrator runner. Release preparation must not depend on a mutable
+          # package-index download before it can even validate the requested version.
+          python -c "from packaging.version import Version; Version('0.1.1a1')"
+          arguments=(--source "${RELEASE_SOURCE}")
+          if [[ -n "${TARGET_VERSION}" ]]; then
+            arguments+=(--target "${TARGET_VERSION}")
+          else
+            arguments+=(--release-type "${RELEASE_TYPE}")
+          fi
+          version=$(python tools/prepare_release.py "${arguments[@]}")
+          python tools/check_release_availability.py "${version}" --repository "${GITHUB_REPOSITORY}"
+          branch="release/watcherobot-${version}"
+          existing=$(gh pr list --repo "${GITHUB_REPOSITORY}" --head "${branch}" --state open --json number --jq 'length')
+          if [[ "${existing}" != "0" ]]; then
+            echo "Release PR already exists for ${version}; nothing to do."
+            exit 0
+          fi
+          git switch -c "${branch}"
+          git config user.name "orulink-release-bot"
+          git config user.email "release-bot@users.noreply.github.com"
+          git add src/watcherobot/__init__.py CHANGELOG.md
+          git commit -m "chore(release): 准备发布 watcherobot ${version}" \
+            -m "由 ${RELEASE_SOURCE} 触发。此提交仅更新 SDK 唯一版本源和中文更新日志，正式发布仍需版本 PR 审查、标签门禁、TestPyPI 验证与 GitHub Environment 人工批准。"
+          git push origin "${branch}"
+          body=$(cat <<EOF
+          ## 发布来源
+
+          - 来源：${RELEASE_SOURCE}
+          - 发布类型：${RELEASE_TYPE:-显式版本}
+          - 目标版本：${version}
+
+          ## 门禁
+
+          - 本 PR 必须人工审查和合并
+          - 合并后由陆骁创建 annotated tag
+          - Tag 构建先发布并验证 TestPyPI
+          - 正式 PyPI 发布需要 GitHub Environment 人工批准
+
+          ## 已知风险与实机状态
+
+          - 本 PR 只准备版本元数据，不代表已完成实机验收
+          - 稳定版发布前必须补充 RTC 实机验证结果
+          EOF
+          )
+          gh pr create \
+            --repo "${GITHUB_REPOSITORY}" \
+            --base main \
+            --head "${branch}" \
+            --title "chore(release): 发布 watcherobot ${version}" \
+            --label "release:version" \
+            --body "${body}"

watcherobot-0.1.1/.github/workflows/release.yml

@@ -0,0 +1,288 @@
+name: Release Python package
+
+on:
+  push:
+    tags: ["v*"]
+
+concurrency:
+  group: sdk-release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  start-clean:
+    name: Clean release workspace before use
+    runs-on: [self-hosted, Linux, X64, sdk-release]
+    steps:
+      - name: Remove files left by a previous release job
+        shell: bash
+        run: |
+          workspace=$(realpath -m "${GITHUB_WORKSPACE}")
+          [[ "${workspace}" == /opt/actions-runner-release/_work/* ]] || {
+            echo "Refusing to clean unexpected workspace: ${workspace}" >&2
+            exit 1
+          }
+          shopt -s dotglob nullglob
+          rm -rf -- "${workspace}"/*
+
+  gate:
+    name: Validate release request
+    needs: start-clean
+    runs-on: [self-hosted, Linux, X64, sdk-release]
+    outputs:
+      version: ${{ steps.gate.outputs.version }}
+      prerelease: ${{ steps.gate.outputs.prerelease }}
+      commit: ${{ steps.gate.outputs.commit }}
+      reuse-artifact: ${{ steps.gate.outputs.reuse-artifact }}
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+      - run: python -m pip install --upgrade packaging
+      - id: gate
+        name: Validate tag, main ancestry, version PR and registries
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag_commit=$(git rev-list -n 1 "${GITHUB_REF_NAME}")
+          gate_json=$(python tools/check_release_gate.py \
+            --repository "${GITHUB_REPOSITORY}" \
+            --tag "${GITHUB_REF_NAME}" \
+            --sha "${tag_commit}")
+          version=$(python -c 'import json,sys; print(json.load(sys.stdin)["version"])' <<< "${gate_json}")
+          reuse_artifact=$(python -c 'import json,sys; print(str(json.load(sys.stdin)["reuse_artifact"]).lower())' <<< "${gate_json}")
+          echo "version=${version}" >> "${GITHUB_OUTPUT}"
+          echo "commit=${tag_commit}" >> "${GITHUB_OUTPUT}"
+          echo "reuse-artifact=${reuse_artifact}" >> "${GITHUB_OUTPUT}"
+          python tools/check_release_version.py "${GITHUB_REF_NAME}"
+          python -c 'from packaging.version import Version; import sys; print(f"prerelease={str(Version(sys.argv[1]).is_prerelease).lower()}")' "${version}" >> "${GITHUB_OUTPUT}"
+
+  build:
+    name: Build immutable distributions
+    needs: gate
+    runs-on: [self-hosted, Linux, X64, sdk-release]
+    steps:
+      - uses: actions/checkout@v6
+        if: needs.gate.outputs.reuse-artifact != 'true'
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@v6
+        if: needs.gate.outputs.reuse-artifact != 'true'
+        with:
+          python-version: "3.12"
+          cache: pip
+      - if: needs.gate.outputs.reuse-artifact != 'true'
+        run: python -m pip install --upgrade pip build twine
+      - if: needs.gate.outputs.reuse-artifact != 'true'
+        run: python -m pip install -e ".[test]"
+      - if: needs.gate.outputs.reuse-artifact != 'true'
+        run: python -m pytest
+      - if: needs.gate.outputs.reuse-artifact != 'true'
+        run: python -m mypy src/watcherobot
+      - if: needs.gate.outputs.reuse-artifact != 'true'
+        run: python -m build
+      - if: needs.gate.outputs.reuse-artifact != 'true'
+        run: python -m twine check dist/*
+      - name: Verify wheel installation
+        if: needs.gate.outputs.reuse-artifact != 'true'
+        run: |
+          python -m venv .venv-wheel-check
+          .venv-wheel-check/bin/python -m pip install --force-reinstall dist/*.whl
+          .venv-wheel-check/bin/python -m pip check
+          .venv-wheel-check/bin/python -c "import watcherobot; assert watcherobot.__version__ == '${{ needs.gate.outputs.version }}'"
+          .venv-wheel-check/bin/watcherobot --help
+      - name: Record distribution hashes
+        if: needs.gate.outputs.reuse-artifact != 'true'
+        run: sha256sum dist/* > SHA256SUMS
+      - name: Recover immutable distributions from the matching draft Release
+        if: needs.gate.outputs.reuse-artifact == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          mkdir -p dist
+          gh release download "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --pattern 'watcherobot-*' --dir dist
+          gh release download "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --pattern SHA256SUMS --dir .
+          sha256sum --check SHA256SUMS
+      - uses: actions/upload-artifact@v7
+        with:
+          name: watcherobot-${{ needs.gate.outputs.version }}-${{ github.run_attempt }}
+          path: |
+            dist/
+            SHA256SUMS
+          if-no-files-found: error
+          retention-days: 30
+
+  draft-release:
+    name: Create draft GitHub Release
+    needs: [gate, build]
+    runs-on: [self-hosted, Linux, X64, sdk-release]
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: watcherobot-${{ needs.gate.outputs.version }}-${{ github.run_attempt }}
+          path: artifact/
+      - name: Create immutable draft Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          prerelease_flag=()
+          if [[ "${{ needs.gate.outputs.prerelease }}" == "true" ]]; then prerelease_flag=(--prerelease); fi
+          if gh release view "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
+            echo "Matching draft Release already exists; reusing it."
+          else
+            gh release create "${GITHUB_REF_NAME}" artifact/dist/* artifact/SHA256SUMS \
+              --repo "${GITHUB_REPOSITORY}" \
+              --target "${{ needs.gate.outputs.commit }}" \
+              --title "watcherobot ${{ needs.gate.outputs.version }}" \
+              --generate-notes \
+              --draft \
+              "${prerelease_flag[@]}"
+          fi
+
+  publish-testpypi:
+    name: Publish to TestPyPI
+    needs: [gate, build, draft-release]
+    runs-on: [self-hosted, Linux, X64, sdk-release]
+    environment: testpypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: watcherobot-${{ needs.gate.outputs.version }}-${{ github.run_attempt }}
+          path: artifact/
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      - name: Publish immutable distributions to TestPyPI with OIDC
+        env:
+          UV_PUBLISH_CHECK_URL: https://test.pypi.org/simple/
+        run: >-
+          uv publish
+          --trusted-publishing always
+          --publish-url https://test.pypi.org/legacy/
+          artifact/dist/*
+
+  verify-testpypi:
+    name: Verify TestPyPI installation
+    needs: [gate, build, publish-testpypi]
+    runs-on: [self-hosted, Linux, X64, sdk-release]
+    steps:
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - uses: actions/download-artifact@v8
+        with:
+          name: watcherobot-${{ needs.gate.outputs.version }}-${{ github.run_attempt }}
+          path: artifact/
+      - name: Install exact release from TestPyPI
+        run: |
+          python -m venv .venv-testpypi
+          .venv-testpypi/bin/python -m pip install --index-url https://pypi.org/simple/ artifact/dist/*.whl
+          .venv-testpypi/bin/python -m pip uninstall -y watcherobot
+          for attempt in {1..12}; do
+            if .venv-testpypi/bin/python -m pip download \
+              --index-url https://test.pypi.org/simple/ \
+              --no-deps --only-binary=:all: --dest testpypi-download \
+              "watcherobot==${{ needs.gate.outputs.version }}"; then
+              break
+            fi
+            if [[ "${attempt}" == "12" ]]; then exit 1; fi
+            sleep 10
+          done
+          expected_wheel=$(find artifact/dist -maxdepth 1 -name '*.whl' -printf '%f\n')
+          test "$(sha256sum "testpypi-download/${expected_wheel}" | cut -d' ' -f1)" = \
+            "$(sha256sum "artifact/dist/${expected_wheel}" | cut -d' ' -f1)"
+          .venv-testpypi/bin/python -m pip install --no-deps "testpypi-download/${expected_wheel}"
+          .venv-testpypi/bin/python -m pip check
+          .venv-testpypi/bin/python -c "import watcherobot; assert watcherobot.__version__ == '${{ needs.gate.outputs.version }}'"
+          .venv-testpypi/bin/watcherobot --help
+
+  publish-pypi:
+    name: Publish to PyPI
+    needs: [gate, build, verify-testpypi, draft-release]
+    runs-on: [self-hosted, Linux, X64, sdk-release]
+    environment:
+      name: pypi
+      url: https://pypi.org/p/watcherobot
+    permissions:
+      id-token: write
+    if: needs.gate.outputs.prerelease == 'false'
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: watcherobot-${{ needs.gate.outputs.version }}-${{ github.run_attempt }}
+          path: artifact/
+      - name: Verify artifact hashes before production upload
+        run: (cd artifact && sha256sum --check SHA256SUMS)
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      - name: Publish the original distributions to PyPI with OIDC
+        run: uv publish --trusted-publishing always artifact/dist/*
+
+  verify-pypi:
+    name: Verify PyPI and publish GitHub Release
+    needs: [gate, publish-pypi]
+    runs-on: [self-hosted, Linux, X64, sdk-release]
+    permissions:
+      contents: write
+    if: needs.gate.outputs.prerelease == 'false'
+    steps:
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - name: Install exact release from PyPI
+        run: |
+          python -m venv .venv-pypi
+          for attempt in {1..12}; do
+            if .venv-pypi/bin/python -m pip install "watcherobot==${{ needs.gate.outputs.version }}"; then break; fi
+            if [[ "${attempt}" == "12" ]]; then exit 1; fi
+            sleep 10
+          done
+          .venv-pypi/bin/python -m pip check
+          .venv-pypi/bin/python -c "import watcherobot; assert watcherobot.__version__ == '${{ needs.gate.outputs.version }}'"
+          .venv-pypi/bin/watcherobot --help
+      - name: Publish verified GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release edit "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --draft=false
+
+  finalize-prerelease:
+    name: Publish verified TestPyPI prerelease
+    needs: [gate, verify-testpypi]
+    if: needs.gate.outputs.prerelease == 'true'
+    runs-on: [self-hosted, Linux, X64, sdk-release]
+    permissions:
+      contents: write
+    steps:
+      - name: Publish GitHub prerelease after TestPyPI verification
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release edit "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --draft=false --prerelease
+
+  finish-clean:
+    name: Clean release workspace after use
+    if: always()
+    needs: [gate, build, draft-release, publish-testpypi, verify-testpypi, publish-pypi, verify-pypi, finalize-prerelease]
+    runs-on: [self-hosted, Linux, X64, sdk-release]
+    steps:
+      - name: Remove checked-out code, environments and downloaded artifacts
+        shell: bash
+        run: |
+          workspace=$(realpath -m "${GITHUB_WORKSPACE}")
+          [[ "${workspace}" == /opt/actions-runner-release/_work/* ]] || {
+            echo "Refusing to clean unexpected workspace: ${workspace}" >&2
+            exit 1
+          }
+          shopt -s dotglob nullglob
+          rm -rf -- "${workspace}"/*