diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ee9ba46..55d3797 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -86,12 +86,12 @@ jobs: - name: Build wheel and source distribution run: uv build --no-sources - - name: Build wheel directly from the checkout - run: uv build --wheel --no-sources --out-dir direct-dist + - name: Build wheel from the source distribution + run: uv build --wheel --no-sources --out-dir sdist-dist dist/*.tar.gz - name: Compare direct and sdist-derived wheels shell: bash - run: cmp dist/*.whl direct-dist/*.whl + run: cmp dist/*.whl sdist-dist/*.whl - name: Upload distributions uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 51e86d0..f666772 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -54,11 +54,11 @@ jobs: - name: Build wheel and source distribution run: uv build --no-sources - - name: Build wheel directly from the checkout - run: uv build --wheel --no-sources --out-dir direct-dist + - name: Build wheel from the source distribution + run: uv build --wheel --no-sources --out-dir sdist-dist dist/*.tar.gz - name: Compare direct and sdist-derived wheels - run: cmp dist/*.whl direct-dist/*.whl + run: cmp dist/*.whl sdist-dist/*.whl - name: Upload distributions uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 diff --git a/RELEASING.md b/RELEASING.md index 205652b..780ddd0 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -28,6 +28,9 @@ checkouts, Git dependencies, or prereleases. `id-token: write`. Other jobs need only `contents: read`. - Pin third-party GitHub Actions to reviewed full commit SHAs and pin `uv` to a reviewed version. +- Keep a scheduled CI job that resolves current stable dependencies without + rewriting or relying on the committed lockfile. Ordinary CI should continue + to use the frozen lockfile for reproducibility. - Pass the distributions built and tested by CI to the publish job as an artifact. Never rebuild them in the publish job. @@ -43,7 +46,11 @@ repository or GitHub Actions. 3. Set the version in `pyproject.toml` and update `CHANGELOG.md` with the release date, compatibility changes, deprecations, and user-visible fixes. 4. Confirm that dependency bounds and Python-version markers describe versions - actually tested in CI. + actually tested in CI. When adding support for a new Python feature release, + audit every direct dependency against both its declared lower bound and its + current stable release. Record whether each bound was retained, raised, or + given a Python-version marker, and test the resulting minimum-dependency + environment rather than relying only on the locked current environment. 5. Regenerate and commit `uv.lock`, then verify it: ```console diff --git a/pyproject.toml b/pyproject.toml index 2b00112..05aef00 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -49,10 +49,10 @@ dependencies = [ ] [project.urls] -homepage = "https://fastlmm.github.io/" -bug-tracker = "https://github.com/fastlmm/PySnpTools/issues" -documentation = "http://fastlmm.github.io/PySnpTools" -source-code = "https://github.com/fastlmm/PySnpTools" +Homepage = "https://fastlmm.github.io/" +Documentation = "https://fastlmm.github.io/PySnpTools" +Issues = "https://github.com/fastlmm/PySnpTools/issues" +Source = "https://github.com/fastlmm/PySnpTools" [project.optional-dependencies]