ylspec 0.1.1__tar.gz

ylspec-0.1.1/.clang-format

@@ -0,0 +1,8 @@
+BasedOnStyle: LLVM
+IndentWidth: 4
+ColumnLimit: 100
+AllowShortFunctionsOnASingleLine: Empty
+AllowShortIfStatementsOnASingleLine: Never
+AllowShortLoopsOnASingleLine: false
+BreakBeforeBraces: Attach
+SortIncludes: CaseSensitive

ylspec-0.1.1/.gitattributes

@@ -0,0 +1,3 @@
+* text=auto eol=lf
+*.png binary
+*.bin binary

ylspec-0.1.1/.github/action-pins.json

@@ -0,0 +1,46 @@
+{
+  "actions/checkout": {
+    "tag": "v7.0.1",
+    "sha": "3d3c42e5aac5ba805825da76410c181273ba90b1"
+  },
+  "actions/setup-python": {
+    "tag": "v7.1.0",
+    "sha": "6d4fd22b20465ccc0f7354476588e8df7c9ca0e0"
+  },
+  "actions/upload-artifact": {
+    "tag": "v7.0.2",
+    "sha": "cf430e030ddbb5b0abf93d22962f4752f3646cd9"
+  },
+  "actions/download-artifact": {
+    "tag": "v8.0.2",
+    "sha": "9000827ccba6bdab643e8b6fd33ac0654aef8333"
+  },
+  "actions/setup-go": {
+    "tag": "v7.0.0",
+    "sha": "b7ad1dad31e06c5925ef5d2fc7ad053ef454303e"
+  },
+  "actions/setup-node": {
+    "tag": "v7.1.0",
+    "sha": "949feb2413d6458794dcd2491c4babbbce0c15c1"
+  },
+  "pypa/cibuildwheel": {
+    "tag": "v4.3.4",
+    "sha": "b9e566a2b284570af229f6c2a33673410d0389a3"
+  },
+  "actions/setup-java": {
+    "tag": "v6.1.0",
+    "sha": "b843ebf9b913146b38da2eaa7aeddf76074ae1ad"
+  },
+  "gradle/actions/setup-gradle": {
+    "tag": "v6.4.1",
+    "sha": "8da46b539cd8fe6ab27ca75128919a18d757604c"
+  },
+  "reactivecircus/android-emulator-runner": {
+    "tag": "v2",
+    "sha": "4c44018e59b437e86cdfc41da381398f93ed8808"
+  },
+  "pypa/gh-action-pypi-publish": {
+    "tag": "release/v1",
+    "sha": "7245906fb61fa33a13554f9d5fb856fe61758086"
+  }
+}

ylspec-0.1.1/.github/workflows/ci.yml

@@ -0,0 +1,15 @@
+# Copyright 2026 Cavanşir Qurbanzadə. SPDX-License-Identifier: Apache-2.0
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  verify:
+    uses: ./.github/workflows/verify.yml

ylspec-0.1.1/.github/workflows/languages.yml

@@ -0,0 +1,236 @@
+# Copyright 2026 Cavanşir Qurbanzadə. SPDX-License-Identifier: Apache-2.0
+name: Language adapters
+on:
+  workflow_call:
+permissions:
+  contents: read
+jobs:
+  desktop:
+    name: Node and JNI ${{ matrix.node }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {os: ubuntu-24.04, node: linux-x64-gnu, jvm: linux-x86_64, docker: x86_64}
+          - {os: ubuntu-24.04-arm, node: linux-arm64-gnu, jvm: linux-arm64, docker: aarch64}
+          - {os: windows-2022, node: win32-x64, jvm: windows-x86_64, docker: ''}
+          - {os: macos-15-intel, node: darwin-x64, jvm: macos-x86_64, docker: ''}
+          - {os: macos-26, node: darwin-arm64, jvm: macos-arm64, docker: ''}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
+        with: {python-version: '3.13'}
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
+        with: {node-version: '24'}
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
+        with: {distribution: temurin, java-version: '17'}
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
+        with: {gradle-version: '9.1.0'}
+      - name: Build desktop adapters
+        shell: bash
+        run: |
+          if [ -n '${{ matrix.docker }}' ]; then
+            python scripts/bindings.py headers
+            node_version="$(node -p process.version)"
+            docker run --rm -v "$PWD:/source" -v "$JAVA_HOME:/jdk:ro" -w /source -e JAVA_HOME=/jdk -e "YLSPEC_NODE_HEADERS=/source/build/node-headers/node-${node_version}/include/node" quay.io/pypa/manylinux_2_28_${{ matrix.docker }} bash -lc 'export PATH=/opt/python/cp313-cp313/bin:$PATH; python -m pip install "cmake>=3.26"; python scripts/bindings.py desktop --node-target ${{ matrix.node }} --jvm-target ${{ matrix.jvm }}'
+          else
+            python scripts/bindings.py desktop --node-target '${{ matrix.node }}' --jvm-target '${{ matrix.jvm }}'
+          fi
+      - name: Test Java, Kotlin, and native Node
+        shell: bash
+        run: |
+          case '${{ matrix.jvm }}' in
+            windows*) library=ylspec_jni.dll;;
+            macos*) library=libylspec_jni.dylib;;
+            *) library=libylspec_jni.so;;
+          esac
+          native_path="$PWD/jvm/natives/src/main/resources/natives/${{ matrix.jvm }}/$library"
+          if [ '${{ runner.os }}' = Windows ]; then native_path="$(cygpath -w "$native_path")"; fi
+          gradle -p jvm :java:smokeTest :kotlin:smokeTest -Dylspec.native.path="$native_path" --no-daemon
+          cd javascript
+          npm test
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with:
+          name: bindings-${{ matrix.node }}
+          path: |
+            javascript/prebuilds/
+            jvm/natives/src/main/resources/natives/
+          if-no-files-found: error
+  musl:
+    name: Alpine Node and JNI ${{ matrix.arch }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {os: ubuntu-24.04, arch: x64, jvm: x86_64}
+          - {os: ubuntu-24.04-arm, arch: arm64, jvm: arm64}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - name: Build and execute against musl
+        run: |
+          docker run --rm -v "$PWD:/source" -w /source -e JAVA_HOME=/usr/lib/jvm/java-17-openjdk alpine:3.21 sh -ec '
+            apk add --no-cache python3 cmake make gcc musl-dev nodejs nodejs-dev npm openjdk17-jdk
+            python3 scripts/bindings.py desktop --system-headers --node-target linux-${{ matrix.arch }}-musl --jvm-target linux-${{ matrix.jvm }}-musl
+            cd javascript && npm test && cd ..
+            mkdir -p build/java-musl
+            javac -encoding UTF-8 -d build/java-musl $(find jvm/java/src -name "*.java")
+            java -Dylspec.native.path=/source/jvm/natives/src/main/resources/natives/linux-${{ matrix.jvm }}-musl/libylspec_jni.so -cp build/java-musl io.github.younglionorganization.ylspec.SmokeTest'
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with:
+          name: bindings-linux-${{ matrix.arch }}-musl
+          path: |
+            javascript/prebuilds/
+            jvm/natives/src/main/resources/natives/
+          if-no-files-found: error
+  wasm:
+    name: Browser WebAssembly and React
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
+        with: {python-version: '3.13'}
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
+        with: {node-version: '24'}
+      - name: Install pinned Emscripten SDK
+        run: |
+          git clone --branch 6.0.13 --depth 1 https://github.com/emscripten-core/emsdk.git build/emsdk
+          test "$(git -C build/emsdk rev-parse HEAD)" = 35659964bc2762fffec0d257997fb61475f765b7
+          build/emsdk/emsdk install 6.0.13
+          build/emsdk/emsdk activate 6.0.13
+      - name: Build the C core as WebAssembly
+        run: |
+          source build/emsdk/emsdk_env.sh
+          emcmake cmake -S . -B build/web -DCMAKE_BUILD_TYPE=Release -DYLSPEC_BUILD_WASM=ON -DYLSPEC_BUILD_CLI=OFF -DBUILD_TESTING=OFF
+          cmake --build build/web --parallel 2
+          python scripts/bindings.py prepare-js
+          cp build/web/core.mjs build/web/core.wasm javascript/wasm/
+      - name: Type-check and test in a real browser
+        working-directory: javascript
+        run: |
+          npm install --ignore-scripts
+          npm run typecheck
+          npx playwright install --with-deps chromium
+          npm run test:browser
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with:
+          name: bindings-wasm
+          path: javascript/wasm/
+          if-no-files-found: error
+  android:
+    name: Android JNI ${{ matrix.abi }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        abi: [armeabi-v7a, arm64-v8a, x86, x86_64]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - name: Install NDK and cross-compile
+        run: |
+          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" 'ndk;28.2.13676358'
+          cmake -S . -B build/android -DCMAKE_BUILD_TYPE=Release -DCMAKE_TOOLCHAIN_FILE="$ANDROID_HOME/ndk/28.2.13676358/build/cmake/android.toolchain.cmake" -DANDROID_ABI=${{ matrix.abi }} -DANDROID_PLATFORM=android-26 -DYLSPEC_BUILD_JNI=ON -DBUILD_TESTING=OFF -DYLSPEC_BUILD_CLI=OFF
+          cmake --build build/android --parallel 2
+          mkdir -p jvm/android/src/main/jni/${{ matrix.abi }}
+          cp build/android/libylspec_jni.so jvm/android/src/main/jni/${{ matrix.abi }}/
+          "$ANDROID_HOME/ndk/28.2.13676358/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-nm" -D build/android/libylspec_jni.so | grep Java_io_github_younglionorganization_ylspec_Native_process
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with:
+          name: bindings-android-${{ matrix.abi }}
+          path: jvm/android/src/main/jni/
+          if-no-files-found: error
+  package:
+    name: Package npm and Maven distributions
+    needs: [desktop, musl, wasm, android]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
+        with: {python-version: '3.13'}
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
+        with: {node-version: '24'}
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
+        with: {distribution: temurin, java-version: '17'}
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
+        with: {gradle-version: '9.1.0'}
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
+        with: {pattern: 'bindings-*', path: build/downloads}
+      - name: Collect native resource trees
+        run: python scripts/collect_bindings.py
+      - name: Build JVM publications and npm tarball
+        run: |
+          gradle -p jvm publishAllPublicationsToStagingRepository :java:smokeTest :kotlin:smokeTest --no-daemon
+          python scripts/bindings.py package
+          mkdir -p build/npm-consumer
+          cd build/npm-consumer
+          npm install --ignore-scripts ../../dist/languages/*.tgz
+          node --input-type=module -e "import {createClient} from '@younglionorganization/ylspec'; const y=await createClient(); if(y.unpack(y.pack(new y.Document({n:42n}))).data.n!==42n) throw Error('Packaged native module failed');"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with: {name: language-packages, path: 'dist/languages/*', if-no-files-found: error}
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with:
+          name: android-smoke-inputs
+          path: |
+            jvm/java/build/libs/java-*.jar
+            jvm/android/build/distributions/*.aar
+          if-no-files-found: error
+  android-runtime:
+    name: Android API 26 runtime
+    needs: package
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
+        with: {distribution: temurin, java-version: '17'}
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
+        with: {gradle-version: '8.14.3'}
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
+        with: {name: android-smoke-inputs, path: jvm}
+      - name: Enable KVM access
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+      - uses: reactivecircus/android-emulator-runner@4c44018e59b437e86cdfc41da381398f93ed8808
+        with:
+          api-level: 26
+          arch: x86_64
+          disable-animations: true
+          script: |
+            gradle -p jvm/android-smoke assembleDebug --no-daemon
+            adb install -r jvm/android-smoke/build/outputs/apk/debug/ylspec-android-smoke-debug.apk
+            adb shell am instrument -w io.github.younglionorganization.ylspec.smoke/.SmokeInstrumentation | tee build-android-result.txt
+            grep 'YLSpec Android JNI tests passed' build-android-result.txt
+  editor:
+    name: VS Code language extension
+    needs: wasm
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
+        with: {python-version: '3.13'}
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
+        with: {node-version: '24'}
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
+        with: {name: bindings-wasm, path: javascript/wasm}
+      - name: Assemble the bundled editor engine
+        run: |
+          python -m pip install 'cairosvg==2.8.2'
+          python scripts/prepare_editor.py
+      - name: Verify grammar and extension integration, then package VSIX
+        working-directory: editors/vscode
+        run: |
+          npm install --ignore-scripts
+          npm test
+          xvfb-run -a npm run test:integration
+          npm run package
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with: {name: editor-package, path: 'dist/editor/*.vsix', if-no-files-found: error}

ylspec-0.1.1/.github/workflows/publish-maven.yml

@@ -0,0 +1,35 @@
+# Copyright 2026 Cavanşir Qurbanzadə. SPDX-License-Identifier: Apache-2.0
+name: Publish Maven Central libraries
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Published GitHub Release version; empty uses release/release.json'
+        required: false
+        type: string
+permissions: {contents: read}
+concurrency: {group: ylspec-maven-publish, cancel-in-progress: false}
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
+        with: {python-version: '3.13'}
+      - name: Require main
+        run: test "$GITHUB_REF" = refs/heads/main
+      - name: Download and verify the published release artifact
+        env:
+          GH_TOKEN: ${{ github.token }}
+          INPUT_VERSION: ${{ inputs.version }}
+        run: python scripts/publish_registry.py prepare-maven
+      - name: Sign unchanged binaries and publish the Central bundle
+        env:
+          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+          MAVEN_GPG_PRIVATE_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+        run: |
+          test -n "$MAVEN_CENTRAL_USERNAME" && test -n "$MAVEN_CENTRAL_PASSWORD" && test -n "$MAVEN_GPG_PRIVATE_KEY" || { echo '::error::Configure the Maven Central token and OpenPGP secrets.'; exit 1; }
+          python scripts/publish_registry.py central

ylspec-0.1.1/.github/workflows/publish-npm.yml

@@ -0,0 +1,36 @@
+# Copyright 2026 Cavanşir Qurbanzadə. SPDX-License-Identifier: Apache-2.0
+name: Publish npm package
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Published GitHub Release version; empty uses release/release.json'
+        required: false
+        type: string
+permissions: {contents: read}
+concurrency: {group: ylspec-npm-publish, cancel-in-progress: false}
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
+        with: {python-version: '3.13'}
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
+        with: {node-version: '24', registry-url: 'https://registry.npmjs.org'}
+      - name: Require main and configured token
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          test "$GITHUB_REF" = refs/heads/main
+          test -n "$NPM_TOKEN" || { echo '::error::Add the NPM_TOKEN repository secret.'; exit 1; }
+      - name: Download and verify the published release artifact
+        env:
+          GH_TOKEN: ${{ github.token }}
+          INPUT_VERSION: ${{ inputs.version }}
+        run: python scripts/publish_registry.py prepare-npm
+      - name: Publish the verified npm tarball
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish "$REGISTRY_ASSET" --access public --ignore-scripts

ylspec-0.1.1/.github/workflows/publish-vscode.yml

@@ -0,0 +1,36 @@
+# Copyright 2026 Cavanşir Qurbanzadə. SPDX-License-Identifier: Apache-2.0
+name: Publish VS Code extension
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Published GitHub Release version; empty uses release/release.json'
+        required: false
+        type: string
+permissions: {contents: read}
+concurrency: {group: ylspec-vscode-publish, cancel-in-progress: false}
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
+        with: {python-version: '3.13'}
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
+        with: {node-version: '24'}
+      - name: Require main and configured publisher credential
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+        run: |
+          test "$GITHUB_REF" = refs/heads/main
+          test -n "$VSCE_PAT" || { echo '::error::Configure the Marketplace publisher and VSCE_PAT repository secret.'; exit 1; }
+      - name: Download and verify the published VSIX
+        env:
+          GH_TOKEN: ${{ github.token }}
+          INPUT_VERSION: ${{ inputs.version }}
+        run: python scripts/publish_registry.py prepare-vscode
+      - name: Publish the verified VSIX
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+        run: npx --yes --package @vscode/vsce@4.1.0 vsce publish --packagePath "$REGISTRY_ASSET"

ylspec-0.1.1/.github/workflows/publish.yml

@@ -0,0 +1,100 @@
+# Copyright 2026 Cavanşir Qurbanzadə. SPDX-License-Identifier: Apache-2.0
+name: Publish release
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: ylspec-publish
+  cancel-in-progress: false
+jobs:
+  gate:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Require the main branch
+        env:
+          REF: ${{ github.ref }}
+        run: test "$REF" = refs/heads/main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: '3.13'
+      - run: python scripts/release.py metadata
+  verify:
+    needs: gate
+    uses: ./.github/workflows/verify.yml
+  stage:
+    needs: verify
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: '3.13'
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: release-candidate
+          path: artifacts
+      - name: Stage and validate complete release
+        run: |
+          python scripts/release.py stage --sha "$GITHUB_SHA"
+          python -m pip install twine
+          python -c "import json,pathlib,subprocess; v=json.loads(pathlib.Path('release/release.json').read_text())['version']; subprocess.run(['python','-m','twine','check',*map(str,pathlib.Path('dist/release').glob('*.whl')),f'dist/release/ylspec-{v}.tar.gz'],check=True)"
+      - name: Create draft and attach verified assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: python scripts/release.py draft --source dist/release --sha "$GITHUB_SHA"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-staged
+          path: dist/release/*
+          if-no-files-found: error
+  pypi:
+    needs: stage
+    runs-on: ubuntu-24.04
+    environment: pypi
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: '3.13'
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: release-staged
+          path: staged
+      - name: Verify existing PyPI files and select unpublished distributions
+        id: pending
+        run: python scripts/release.py pending --source staged --output pending
+      - name: Require the PyPI API token
+        if: steps.pending.outputs.has_files == 'true'
+        env:
+          PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+        run: |
+          if [ -z "$PYPI_API_TOKEN" ]; then
+            echo "::error::Add the PYPI_API_TOKEN repository secret in Settings > Secrets and variables > Actions."
+            exit 1
+          fi
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1
+        if: steps.pending.outputs.has_files == 'true'
+        with:
+          user: __token__
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          packages-dir: pending/
+          attestations: false
+  finalize:
+    needs: pypi
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: '3.13'
+      - env:
+          GH_TOKEN: ${{ github.token }}
+        run: python scripts/release.py finalize