From 4dee53a8a8718114f011b4ea44eaaf5fb0c5cb97 Mon Sep 17 00:00:00 2001 From: Carl Kadie Date: Fri, 7 Aug 2026 08:36:08 -0700 Subject: [PATCH 1/2] docs: require dependency-bound audits for Python releases --- RELEASING.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/RELEASING.md b/RELEASING.md index 205652b..cce3e1d 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -43,7 +43,11 @@ repository or GitHub Actions. 3. Set the version in `pyproject.toml` and update `CHANGELOG.md` with the release date, compatibility changes, deprecations, and user-visible fixes. 4. Confirm that dependency bounds and Python-version markers describe versions - actually tested in CI. + actually tested in CI. When adding support for a new Python feature release, + audit every direct dependency against both its declared lower bound and its + current stable release. Record whether each bound was retained, raised, or + given a Python-version marker, and test the resulting minimum-dependency + environment rather than relying only on the locked current environment. 5. Regenerate and commit `uv.lock`, then verify it: ```console From bc2a5f1dd3c907829d4a0f59902b0847a615ffdf Mon Sep 17 00:00:00 2001 From: Carl Kadie Date: Fri, 7 Aug 2026 08:40:57 -0700 Subject: [PATCH 2/2] ci: verify wheels rebuilt from source distributions --- .github/workflows/ci.yml | 6 +++--- .github/workflows/release.yml | 6 +++--- RELEASING.md | 3 +++ pyproject.toml | 8 ++++---- 4 files changed, 13 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ee9ba46..55d3797 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -86,12 +86,12 @@ jobs: - name: Build wheel and source distribution run: uv build --no-sources - - name: Build wheel directly from the checkout - run: uv build --wheel --no-sources --out-dir direct-dist + - name: Build wheel from the source distribution + run: uv build --wheel --no-sources --out-dir sdist-dist dist/*.tar.gz - name: Compare direct and sdist-derived wheels shell: bash - run: cmp dist/*.whl direct-dist/*.whl + run: cmp dist/*.whl sdist-dist/*.whl - name: Upload distributions uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 51e86d0..f666772 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -54,11 +54,11 @@ jobs: - name: Build wheel and source distribution run: uv build --no-sources - - name: Build wheel directly from the checkout - run: uv build --wheel --no-sources --out-dir direct-dist + - name: Build wheel from the source distribution + run: uv build --wheel --no-sources --out-dir sdist-dist dist/*.tar.gz - name: Compare direct and sdist-derived wheels - run: cmp dist/*.whl direct-dist/*.whl + run: cmp dist/*.whl sdist-dist/*.whl - name: Upload distributions uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 diff --git a/RELEASING.md b/RELEASING.md index cce3e1d..780ddd0 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -28,6 +28,9 @@ checkouts, Git dependencies, or prereleases. `id-token: write`. Other jobs need only `contents: read`. - Pin third-party GitHub Actions to reviewed full commit SHAs and pin `uv` to a reviewed version. +- Keep a scheduled CI job that resolves current stable dependencies without + rewriting or relying on the committed lockfile. Ordinary CI should continue + to use the frozen lockfile for reproducibility. - Pass the distributions built and tested by CI to the publish job as an artifact. Never rebuild them in the publish job. diff --git a/pyproject.toml b/pyproject.toml index 2b00112..05aef00 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -49,10 +49,10 @@ dependencies = [ ] [project.urls] -homepage = "https://fastlmm.github.io/" -bug-tracker = "https://github.com/fastlmm/PySnpTools/issues" -documentation = "http://fastlmm.github.io/PySnpTools" -source-code = "https://github.com/fastlmm/PySnpTools" +Homepage = "https://fastlmm.github.io/" +Documentation = "https://fastlmm.github.io/PySnpTools" +Issues = "https://github.com/fastlmm/PySnpTools/issues" +Source = "https://github.com/fastlmm/PySnpTools" [project.optional-dependencies]