Complete release-process follow-ups

.github/workflows/ci.yml

@@ -86,12 +86,12 @@ jobs:
       - name: Build wheel and source distribution
         run: uv build --no-sources
 
-      - name: Build wheel directly from the checkout
-        run: uv build --wheel --no-sources --out-dir direct-dist
+      - name: Build wheel from the source distribution
+        run: uv build --wheel --no-sources --out-dir sdist-dist dist/*.tar.gz
 
       - name: Compare direct and sdist-derived wheels
         shell: bash
-        run: cmp dist/*.whl direct-dist/*.whl
+        run: cmp dist/*.whl sdist-dist/*.whl
 
       - name: Upload distributions
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/release.yml

@@ -54,11 +54,11 @@ jobs:
       - name: Build wheel and source distribution
         run: uv build --no-sources
 
-      - name: Build wheel directly from the checkout
-        run: uv build --wheel --no-sources --out-dir direct-dist
+      - name: Build wheel from the source distribution
+        run: uv build --wheel --no-sources --out-dir sdist-dist dist/*.tar.gz
 
       - name: Compare direct and sdist-derived wheels
-        run: cmp dist/*.whl direct-dist/*.whl
+        run: cmp dist/*.whl sdist-dist/*.whl
 
       - name: Upload distributions
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

RELEASING.md

@@ -28,6 +28,9 @@ checkouts, Git dependencies, or prereleases.
   `id-token: write`. Other jobs need only `contents: read`.
 - Pin third-party GitHub Actions to reviewed full commit SHAs and pin `uv` to a
   reviewed version.
+- Keep a scheduled CI job that resolves current stable dependencies without
+  rewriting or relying on the committed lockfile. Ordinary CI should continue
+  to use the frozen lockfile for reproducibility.
 - Pass the distributions built and tested by CI to the publish job as an
   artifact. Never rebuild them in the publish job.
 
@@ -43,7 +46,11 @@ repository or GitHub Actions.
 3. Set the version in `pyproject.toml` and update `CHANGELOG.md` with the release
    date, compatibility changes, deprecations, and user-visible fixes.
 4. Confirm that dependency bounds and Python-version markers describe versions
-   actually tested in CI.
+   actually tested in CI. When adding support for a new Python feature release,
+   audit every direct dependency against both its declared lower bound and its
+   current stable release. Record whether each bound was retained, raised, or
+   given a Python-version marker, and test the resulting minimum-dependency
+   environment rather than relying only on the locked current environment.
 5. Regenerate and commit `uv.lock`, then verify it:
 
    ```console

pyproject.toml

@@ -49,10 +49,10 @@ dependencies = [
 ]
 
 [project.urls]
-homepage = "https://fastlmm.github.io/"
-bug-tracker = "https://github.com/fastlmm/PySnpTools/issues"
-documentation = "http://fastlmm.github.io/PySnpTools"
-source-code = "https://github.com/fastlmm/PySnpTools"
+Homepage = "https://fastlmm.github.io/"
+Documentation = "https://fastlmm.github.io/PySnpTools"
+Issues = "https://github.com/fastlmm/PySnpTools/issues"
+Source = "https://github.com/fastlmm/PySnpTools"
 
 
 [project.optional-dependencies]