Repository navigation
Set up releases to PyPI, and prepare the first release - #33
Conversation
Add the release procedure from hotdata-langchain, adapted to uv and make verify. - scripts/release.sh prepares a release pull request and pushes the tag. - scripts/changelog.py moves the Unreleased notes into a version section, prints the notes of a version, and checks that a version change has a section. - publish.yml builds on a vX.Y.Z tag, publishes through PyPI trusted publishing in the pypi environment, then creates the GitHub Release. - check-release.yml runs the changelog check on a pull request. - verify.yml runs make verify on Python 3.11 to 3.14, and make floor runs the tests at the lowest allowed dependency versions. The sdist now holds src/hotmemory, README.md, CHANGELOG.md, and LICENSE only. pyproject.toml gains classifiers, project URLs, and an SPDX license. The hotdata extra needs pyarrow 16.0. At the floor, pyarrow 14.0.0 installs next to numpy 2 and fails to import, and pyarrow 16.0.0 passes the offline tests. The README links to repository files with absolute links, so they work on PyPI, and check_links.py checks those links too.
…y audit - CHANGELOG.md: the Unreleased section describes the first release as one Added list. The pre-release history stays in git. - verify.yml pins each action by commit SHA, as publish.yml does. Dependabot updates the pins and hotdata-framework each week. - The internal docs no longer name a person, the private engine branch and its flag, the engine team, the engine work in progress, or the machine that runs the benchmarks.
- docs/internal/ is now ignored: the plan, the roadmap, the brief, the survey, and the benchmark research stay only in the owner's checkout. - docs/local.md moves there too, because the engine image is private and only the Hotdata team can start the local stack. - docs/architecture.md is public. It no longer names the engine, the storage paths of the local catalog, or what the framework source says about the network between the client and the engine. - The public docs say "the Hotdata engine" or "the local engine stack" in place of the engine's name, and no longer link to the moved files.
… the measurement scripts The scripts declare pyarrow 16.0, as the hotdata extra does. .gitignore lists the worktrees, settings.local.json, and the lock file of Claude Code, so the rest of .claude/ can be shared.
The package does not include skills/hotmemory/, so the README tells the reader to install hotmemory and copy the folder into the skills folder of the agent.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
The full diff was omitted from the review prompt. Files read from the checkout: .github/workflows/publish.yml, .github/workflows/check-release.yml, .github/workflows/verify.yml, scripts/release.sh, scripts/changelog.py, scripts/check_links.py, tests/test_changelog.py, pyproject.toml, Makefile, CHANGELOG.md, RELEASING.md, README.md (skill section and link references). The removed docs/internal/ files and the doc wording edits were not read line by line. A grep found no remaining tracked links to docs/internal/ or docs/local.md. The verify, floor, and integration checks had not reported when this review started.
| if [[ "$GITHUB_REF_NAME" != "v$version" ]]; then | ||
| echo "The tag $GITHUB_REF_NAME does not match version $version in pyproject.toml" >&2 | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
nit: Add a check that the tagged commit is on main (not blocking).
Suggested step after the checkout, with fetch-depth: 0 on the checkout:
- name: Check that the tag is on main
run: git merge-base --is-ancestor "$GITHUB_SHA" origin/mainThe workflow publishes any v* tag whose version matches pyproject.toml. A tag pushed from a feature branch publishes unreviewed code to PyPI. RELEASING.md:4 says to tag only through release.sh, and the workflow does not enforce that rule. A tag rule on the pypi environment is an alternative fix.
There was a problem hiding this comment.
The full diff was omitted from the review prompt. Files read from the checkout: scripts/release.sh, scripts/changelog.py, scripts/check_links.py, tests/test_changelog.py, .github/workflows/publish.yml, .github/workflows/check-release.yml, .github/workflows/verify.yml, .github/dependabot.yml, pyproject.toml, Makefile, CHANGELOG.md, RELEASING.md, .gitignore. The doc edits and the deletions under docs/internal/ were checked by a search for internal references, not read line by line.
This PR adds the release procedure for PyPI, prepares the changelog for 0.1.0, and cleans the repository for a public package. It does not change the version.
./scripts/release.sh prepare 0.1.0does that in a later PR.How
make verify:scripts/release.sh prepareopens a release PR.scripts/release.sh publishpushes the tag.scripts/changelog.pymoves the notes, prints the notes of a version, and checks that a version change has a changelog section.vX.Y.Ztag,publish.ymlbuilds the wheel and the sdist, checks them with twine, and uploads them through PyPI trusted publishing in the environmentpypi. After the upload, it creates the GitHub Release.check-release.ymlruns the changelog check on PRs.RELEASING.mdgives the procedure and the one-time setup.verifyruns on Python 3.11 to 3.14.floorjob tests at the lowest allowed dependency versions. This found that thehotdataextra needs pyarrow 16.0.src/hotmemory, the README, the CHANGELOG, and the LICENSE. The README uses absolute GitHub links so that they work on PyPI, andcheck_links.pychecks them.docs/internal/is now in.gitignoreand no longer tracked.docs/local.mdmoved into it, because the engine image is private.docs/architecture.mdis public. I removed its section on the local catalog storage paths and its note on the network between the client and the engine.skills/hotmemory/..gitignore: lists the local state of the coding agent under.claude/(worktrees,settings.local.json, the lock file), so the rest of.claude/can be shared.Verification
make verifypasses with 304 tests.make floorpasses.uv buildandtwine check --strictpass on both archives. The wheel holds onlyhotmemory/.hotmemory.hotdataandhotmemory.openaiimport with the extras.HotdataStoreREADME example (needs the cloud),make integration, andpublish.yml, which runs only on a tag.Notes
compose.yaml, theMakefile, and CI. These lines are the image name and the configuration keys that the engine requires.pypiand the pending trusted publisher on PyPI.RELEASING.mdlists the values.