[Nagi-Inaba]

概要

タグ付きreleaseが、Linux・Windows・macOSの検証を待たずにPyPIへ進める問題と、公開するsdistを実際にbuild／installしていない問題を修正します。

• wheelとsdistを一度だけbuildし、同一artifactを全gateと公開jobで使用
• 3 OSでsource test、installed-wheel E2E、sdist由来wheel E2E、synthetic determinismを実行
• sdistのpath traversal、absolute path、link、special file、duplicate path、想定外root、過大展開を拒否
• sdist由来wheelとrelease wheelのruntime payload・metadataを照合
• Worker検証とcross-OS determinismもPyPI公開前の必須gateに設定
• 通常PR CIでも3 OSのsdist E2Eを継続検証

ローカル検証

• release／CI workflowの構造契約
• distribution setとsdist安全展開の単体契約
• wheel runtime・metadata drift、duplicate memberの拒否
• 21 passed, 2 deselected

GitHub Actionsの全matrix成功後にReady化し、最終レビューを行います。

Closes #20
Closes #34

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b94135fe59

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove the broken self-mutating repair workflow

For any same-repository PR whose head is the hard-coded ci/release-gates-sdist branch, this job runs, but the reviewed tree contains neither .github/step1-chunks/ nor .github/workflows/apply-release-gates-sdist.yml (a repository-wide search finds only these references). With set -euo pipefail, this cat therefore terminates the job before the repair, leaving that PR check failing; if the inputs were restored, the workflow would also commit and push automatically despite the repository's explicit-authorization rule. Remove this one-off workflow instead of shipping it.

AGENTS.md reference: AGENTS.md:L118-L121

Useful? React with 👍 / 👎.