chore: stabilize release readiness

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.9.0
+current_version = 0.9.1
 commit = True
 tag = True
 tag_name = v{new_version}
@@ -14,4 +14,3 @@ replace = version = "{new_version}"
 [bumpversion:file:src/TimeLocker/__init__.py]
 search = __version__ = "{current_version}"
 replace = __version__ = "{new_version}"
-

.github/workflows/artifact-smoke.yml

@@ -0,0 +1,71 @@
+name: Release Artifact Smoke
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Build once and inspect artifacts
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build
+          python scripts/validate_release_artifacts.py --expected-version 0.9.1
+      - name: Upload immutable artifact set
+        uses: actions/upload-artifact@v4
+        with:
+          name: timelocker-0.9.1-distributions
+          path: dist/
+          if-no-files-found: error
+
+  smoke:
+    needs: build
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ["3.12", "3.13"]
+        artifact: [wheel, sdist]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout smoke tooling
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: timelocker-0.9.1-distributions
+          path: dist
+      - name: Select artifact
+        id: artifact
+        shell: python
+        run: |
+          from pathlib import Path
+          import os
+
+          suffix = ".whl" if "${{ matrix.artifact }}" == "wheel" else ".tar.gz"
+          matches = list(Path("dist").glob(f"*{suffix}"))
+          if len(matches) != 1:
+              raise SystemExit(f"Expected one {suffix} artifact, found {matches}")
+          with open(os.environ["GITHUB_OUTPUT"], "a") as output:
+              output.write(f"path={matches[0]}\n")
+      - name: Install and smoke ${{ matrix.artifact }}
+        run: >-
+          python scripts/smoke_release_artifact.py
+          "${{ steps.artifact.outputs.path }}"
+          --expected-version 0.9.1

.github/workflows/release-validation.yml

@@ -0,0 +1,97 @@
+name: TimeLocker Release Validation
+
+on:
+  workflow_call:
+    inputs:
+      version_ref:
+        description: Semantic release reference to validate
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      version_ref:
+        description: Semantic release reference to rehearse without publishing
+        required: true
+        default: v0.9.1
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    env:
+      VERSION_REF: ${{ inputs.version_ref }}
+
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install Restic 0.18.0
+        shell: bash
+        run: |
+          set -euo pipefail
+          restic_version="0.18.0"
+          wget --quiet "https://github.com/restic/restic/releases/download/v${restic_version}/restic_${restic_version}_linux_amd64.bz2"
+          wget --quiet "https://github.com/restic/restic/releases/download/v${restic_version}/SHA256SUMS"
+          grep "  restic_${restic_version}_linux_amd64.bz2$" SHA256SUMS | sha256sum --check --strict
+          bunzip2 "restic_${restic_version}_linux_amd64.bz2"
+          sudo install -m 0755 "restic_${restic_version}_linux_amd64" /usr/local/bin/restic
+          restic version
+
+      - name: Install build and test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build
+          python -m pip install -e '.[dev]'
+
+      - name: Verify release intent and workflow boundary
+        run: |
+          python scripts/validate_release_intent.py --version-ref "$VERSION_REF"
+          python scripts/validate_release_workflows.py
+
+      - name: Run required test suite
+        env:
+          PYTHONPATH: src
+        run: python -m pytest -m "not performance and not stress and not minio"
+
+      - name: Build and validate distributions
+        run: |
+          python -m build
+          python scripts/validate_release_artifacts.py --expected-version "${VERSION_REF#v}"
+
+      - name: Smoke wheel and source distribution
+        shell: bash
+        run: |
+          set -euo pipefail
+          python scripts/smoke_release_artifact.py dist/*.whl --expected-version "${VERSION_REF#v}"
+          python scripts/smoke_release_artifact.py dist/*.tar.gz --expected-version "${VERSION_REF#v}"
+
+      - name: Derive release notes from changelog
+        run: >-
+          python scripts/extract_release_notes.py
+          --version "${VERSION_REF#v}"
+          --output release-notes.md
+
+      - name: Upload validated distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: timelocker-distributions-${{ inputs.version_ref }}
+          path: dist/*
+          if-no-files-found: error
+
+      - name: Upload release-note preview
+        uses: actions/upload-artifact@v4
+        with:
+          name: timelocker-release-notes-${{ inputs.version_ref }}
+          path: release-notes.md
+          if-no-files-found: error

.github/workflows/release.yml

@@ -6,101 +6,37 @@ on:
       - "v*.*.*"
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
-  release:
+  validate:
+    uses: ./.github/workflows/release-validation.yml
+    with:
+      version_ref: ${{ github.ref_name }}
+
+  publish:
+    needs: validate
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
-      - name: Checkout tagged source
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-
-      - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+      - name: Download validated distributions
+        uses: actions/download-artifact@v4
         with:
-          python-version: "3.12"
-          cache: pip
-
-      - name: Install Restic 0.18.0
-        shell: bash
-        run: |
-          set -euo pipefail
-          restic_version="0.18.0"
-          wget --quiet "https://github.com/restic/restic/releases/download/v${restic_version}/restic_${restic_version}_linux_amd64.bz2"
-          wget --quiet "https://github.com/restic/restic/releases/download/v${restic_version}/SHA256SUMS"
-          grep "  restic_${restic_version}_linux_amd64.bz2$" SHA256SUMS | sha256sum --check --strict
-          bunzip2 "restic_${restic_version}_linux_amd64.bz2"
-          sudo install -m 0755 "restic_${restic_version}_linux_amd64" /usr/local/bin/restic
-          restic version
-
-      - name: Install build and test dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install build
-          python -m pip install -e '.[dev]'
-
-      - name: Verify tag and package versions
-        shell: bash
-        run: |
-          set -euo pipefail
-          python - <<'PY'
-          import os
-          import tomllib
-
-          from TimeLocker import __version__
-
-          tag = os.environ["GITHUB_REF_NAME"]
-          if not tag.startswith("v"):
-              raise SystemExit(f"Release tag must start with v: {tag}")
-
-          tag_version = tag[1:]
-          with open("pyproject.toml", "rb") as pyproject_file:
-              package_version = tomllib.load(pyproject_file)["project"]["version"]
-
-          if tag_version != package_version or package_version != __version__:
-              raise SystemExit(
-                  "Version mismatch: "
-                  f"tag={tag_version}, pyproject={package_version}, package={__version__}"
-              )
-
-          print(f"Version verified: {package_version}")
-          PY
-
-      - name: Run required test suite
-        env:
-          PYTHONPATH: src
-        run: python -m pytest -m "not performance and not stress"
-
-      - name: Build source and wheel distributions
-        run: |
-          python -m build
-          sha256sum dist/* > dist/SHA256SUMS
-
-      - name: Smoke test the built wheel
-        shell: bash
-        run: |
-          set -euo pipefail
-          python -m venv /tmp/timelocker-release-smoke
-          /tmp/timelocker-release-smoke/bin/python -m pip install --upgrade pip
-          /tmp/timelocker-release-smoke/bin/python -m pip install dist/*.whl
-          installed_version=$(/tmp/timelocker-release-smoke/bin/tl version --short)
-          test "$installed_version" = "${GITHUB_REF_NAME#v}"
+          name: timelocker-distributions-${{ github.ref_name }}
+          path: dist
 
-      - name: Upload distribution artifacts
-        uses: actions/upload-artifact@v4
+      - name: Download derived release notes
+        uses: actions/download-artifact@v4
         with:
-          name: timelocker-${{ github.ref_name }}
-          path: dist/*
-          if-no-files-found: error
+          name: timelocker-release-notes-${{ github.ref_name }}
 
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           gh release create "$GITHUB_REF_NAME" dist/* \
             --verify-tag \
-            --generate-notes \
+            --notes-file release-notes.md \
             --title "TimeLocker $GITHUB_REF_NAME"