ci: gate releases on three-OS sdist verification

.github/workflows/ci.yml

@@ -63,7 +63,7 @@ jobs:
   wheel-e2e:
     name: Installed wheel on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 20
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -85,15 +85,21 @@ jobs:
       - name: Sync locked dependencies
         run: uv sync --frozen --all-groups
 
-      - name: Build wheel
-        run: uv build --wheel
+      - name: Build wheel and source distribution
+        run: uv build
 
       - name: Verify installed setup and doctor
         run: >-
           uv run --frozen python scripts/verify_wheel_install.py
           --dist-dir dist
           --source tests/fixtures/synthetic_pmgs
 
+      - name: Verify sdist-derived installed setup and doctor
+        run: >-
+          uv run --frozen python scripts/verify_sdist_install.py
+          --dist-dir dist
+          --source tests/fixtures/synthetic_pmgs
+
   python-313-wheel-e2e:
     name: Installed wheel on Python 3.13
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -10,9 +10,9 @@ permissions:
 
 jobs:
   build:
-    name: Verify and build Python distributions
+    name: Build one fixed Python distribution set
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 20
 
     steps:
       - name: Check out tagged source
@@ -27,14 +27,6 @@ jobs:
           python-version: "3.12"
           enable-cache: true
 
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22"
-          cache: npm
-          cache-dependency-path: worker/package-lock.json
-          package-manager-cache: false
-
       - name: Sync locked dependencies
         run: |
           uv lock --check
@@ -45,42 +37,274 @@ jobs:
           RELEASE_TAG: ${{ github.ref_name }}
         run: uv run --frozen python scripts/verify_release_tag.py --tag "$RELEASE_TAG"
 
-      - name: Verify repository boundary
+      - name: Verify repository boundary before build
         run: uv run --frozen python scripts/verify_repository_boundary.py
 
+      - name: Build wheel and source distribution once
+        run: uv build --clear
+
+      - name: Verify the exact distribution set
+        run: uv run --frozen python scripts/verify_distribution_set.py --dist-dir dist
+
+      - name: Upload fixed distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: python-distributions
+          path: dist/*
+          if-no-files-found: error
+          retention-days: 7
+          compression-level: 0
+
+  verify-linux:
+    name: Release verification on Linux
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+
+    steps:
+      - name: Check out tagged source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        with:
+          version: "0.10.12"
+          python-version: "3.12"
+          enable-cache: true
+      - name: Sync locked dependencies
+        run: uv sync --frozen --all-groups
+      - name: Download fixed distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-distributions
+          path: dist
       - name: Verify Python source and tests
         run: |
+          uv run --frozen python scripts/verify_repository_boundary.py
           uv run --frozen ruff check .
           uv run --frozen ruff format --check .
           uv run --frozen mypy src
           uv run --frozen pytest -q
+      - name: Verify installed wheel
+        run: >-
+          uv run --frozen python scripts/verify_wheel_install.py
+          --dist-dir dist
+          --source tests/fixtures/synthetic_pmgs
+      - name: Verify isolated sdist build and install
+        run: >-
+          uv run --frozen python scripts/verify_sdist_install.py
+          --dist-dir dist
+          --source tests/fixtures/synthetic_pmgs
+      - name: Build determinism report
+        run: >-
+          uv run --frozen python scripts/verify_synthetic_determinism.py
+          --source tests/fixtures/synthetic_pmgs
+          --policy tests/fixtures/publication-policy.yaml
+          --output determinism-Linux.json
+      - name: Upload determinism report
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-determinism-Linux
+          path: determinism-Linux.json
+          if-no-files-found: error
+          retention-days: 7
 
-      - name: Verify Worker and WebMCP source
+  verify-windows:
+    name: Release verification on Windows
+    needs: build
+    runs-on: windows-latest
+    timeout-minutes: 40
+
+    steps:
+      - name: Check out tagged source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        with:
+          version: "0.10.12"
+          python-version: "3.12"
+          enable-cache: true
+      - name: Sync locked dependencies
+        run: uv sync --frozen --all-groups
+      - name: Download fixed distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-distributions
+          path: dist
+      - name: Verify Python source and tests
         run: |
-          npm --prefix worker ci
-          npm --prefix worker run verify
+          uv run --frozen python scripts/verify_repository_boundary.py
+          uv run --frozen ruff check .
+          uv run --frozen ruff format --check .
+          uv run --frozen mypy src
+          uv run --frozen pytest -q
+      - name: Verify installed wheel
+        run: >-
+          uv run --frozen python scripts/verify_wheel_install.py
+          --dist-dir dist
+          --source tests/fixtures/synthetic_pmgs
+      - name: Verify isolated sdist build and install
+        run: >-
+          uv run --frozen python scripts/verify_sdist_install.py
+          --dist-dir dist
+          --source tests/fixtures/synthetic_pmgs
+      - name: Build determinism report
+        run: >-
+          uv run --frozen python scripts/verify_synthetic_determinism.py
+          --source tests/fixtures/synthetic_pmgs
+          --policy tests/fixtures/publication-policy.yaml
+          --output determinism-Windows.json
+      - name: Upload determinism report
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-determinism-Windows
+          path: determinism-Windows.json
+          if-no-files-found: error
+          retention-days: 7
 
-      - name: Build wheel and source distribution
-        run: uv build
+  verify-macos:
+    name: Release verification on macOS
+    needs: build
+    runs-on: macos-latest
+    timeout-minutes: 40
 
-      - name: Verify the installed wheel
+    steps:
+      - name: Check out tagged source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        with:
+          version: "0.10.12"
+          python-version: "3.12"
+          enable-cache: true
+      - name: Sync locked dependencies
+        run: uv sync --frozen --all-groups
+      - name: Download fixed distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-distributions
+          path: dist
+      - name: Verify Python source and tests
+        run: |
+          uv run --frozen python scripts/verify_repository_boundary.py
+          uv run --frozen ruff check .
+          uv run --frozen ruff format --check .
+          uv run --frozen mypy src
+          uv run --frozen pytest -q
+      - name: Verify installed wheel
         run: >-
           uv run --frozen python scripts/verify_wheel_install.py
           --dist-dir dist
           --source tests/fixtures/synthetic_pmgs
-
-      - name: Upload verified distributions
+      - name: Verify isolated sdist build and install
+        run: >-
+          uv run --frozen python scripts/verify_sdist_install.py
+          --dist-dir dist
+          --source tests/fixtures/synthetic_pmgs
+      - name: Build determinism report
+        run: >-
+          uv run --frozen python scripts/verify_synthetic_determinism.py
+          --source tests/fixtures/synthetic_pmgs
+          --policy tests/fixtures/publication-policy.yaml
+          --output determinism-macOS.json
+      - name: Upload determinism report
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: python-distributions
-          path: dist/*
+          name: release-determinism-macOS
+          path: determinism-macOS.json
           if-no-files-found: error
           retention-days: 7
-          compression-level: 0
+
+  compare-synthetic-determinism:
+    name: Compare release determinism
+    needs: [verify-linux, verify-windows, verify-macos]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Check out tagged source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        with:
+          version: "0.10.12"
+          python-version: "3.12"
+      - name: Download determinism reports
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: release-determinism-*
+          path: determinism-reports
+          merge-multiple: true
+      - name: Compare stable contracts
+        run: >-
+          uv run --python 3.12 --no-project python scripts/compare_determinism_reports.py
+          --directory determinism-reports
+
+  verify-distributions:
+    name: Verify fixed distribution metadata and hashes
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Check out tagged source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        with:
+          version: "0.10.12"
+          python-version: "3.12"
+      - name: Download fixed distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-distributions
+          path: dist
+      - name: Verify artifact set
+        run: >-
+          uv run --python 3.12 --no-project python scripts/verify_distribution_set.py
+          --dist-dir dist
+
+  verify-worker:
+    name: Verify Cloudflare Worker on Node 22
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out tagged source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: worker/package-lock.json
+          package-manager-cache: false
+      - name: Verify Worker and WebMCP source
+        run: |
+          npm --prefix worker ci
+          npm --prefix worker run verify
 
   publish-pypi:
     name: Publish to PyPI after approval
-    needs: build
+    needs:
+      - build
+      - verify-linux
+      - verify-windows
+      - verify-macos
+      - compare-synthetic-determinism
+      - verify-distributions
+      - verify-worker
     runs-on: ubuntu-latest
     timeout-minutes: 15
     environment:
@@ -96,7 +320,6 @@ jobs:
         with:
           name: python-distributions
           path: dist
-
       - name: Publish with trusted publishing and attestations
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
@@ -117,7 +340,6 @@ jobs:
         with:
           name: python-distributions
           path: dist
-
       - name: Create the GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}