Feature/flush-out-cicd

.cookiecutter.json

@@ -1,5 +1,5 @@
 {
-  "_commit": "e3e4bd38305f544bffe1025111aa2981f1e51714",
+  "_commit": "4ae5c6e9c3027d3c9bcf48aa20f1519b37f394f7",
   "_max_python_version_minor_int": 14,
   "_min_python_version_minor_int": 10,
   "_template": "C:\\Users\\56kyl\\source\\repos\\cookiecutter-robust-python",
@@ -14,6 +14,7 @@
   "min_python_version": "3.10",
   "package_name": "robust_python_demo",
   "project_name": "robust-python-demo",
+  "publish_rust_package": false,
   "python_versions": [
     "3.10",
     "3.11",
@@ -22,7 +23,11 @@
     "3.14"
   ],
   "repository_host": "github.com",
-  "repository_path": "56kyle/robust-python-demo",
+  "repository_path": "robust-python/robust-python-demo",
   "repository_provider": "github",
+  "rust_package_name": "robust_python_demo_core",
+  "rust_project_name": "robust-python-demo-core",
+  "rust_python_abi": "abi3",
+  "rust_version": "1.83",
   "version": "0.0.0"
 }

.cruft.json

@@ -1,6 +1,6 @@
 {
   "template": "C:\\Users\\56kyl\\source\\repos\\cookiecutter-robust-python",
-  "commit": "e3e4bd38305f544bffe1025111aa2981f1e51714",
+  "commit": "4ae5c6e9c3027d3c9bcf48aa20f1519b37f394f7",
   "checkout": null,
   "context": {
     "cookiecutter": {
@@ -10,17 +10,22 @@
       "min_python_version": "3.10",
       "max_python_version": "3.14",
       "add_rust_extension": false,
+      "rust_project_name": "robust-python-demo-core",
+      "rust_package_name": "robust_python_demo_core",
+      "rust_version": "1.83",
+      "rust_python_abi": "abi3",
+      "publish_rust_package": false,
       "author": "Kyle Oliver",
       "email": "56kyleoliver+cookiecutter-robust-python@gmail.com",
       "repository_provider": "github",
       "repository_host": "github.com",
-      "repository_path": "56kyle/robust-python-demo",
+      "repository_path": "robust-python/robust-python-demo",
       "version": "0.0.0",
       "copyright_year": "2025",
       "license": "MIT",
       "development_status": "Development Status :: 1 - Planning",
       "_template": "C:\\Users\\56kyl\\source\\repos\\cookiecutter-robust-python",
-      "_commit": "e3e4bd38305f544bffe1025111aa2981f1e51714",
+      "_commit": "4ae5c6e9c3027d3c9bcf48aa20f1519b37f394f7",
       "_min_python_version_minor_int": 10,
       "_max_python_version_minor_int": 14,
       "python_versions": [

.cz.toml

@@ -1,19 +1,13 @@
 [tool.commitizen]
 tag_format = "v$version"
 version = "0.0.0"
-version_scheme = "pep440"
-version_provider = "pep621"
-
+version_scheme = "semver2"
+version_provider = "uv"
 # Set to true to allow bumping to 0.y.z from 0.(y-1).z when commit types normally trigger major bump.
 # Recommended for initial development phases before 1.0.0.
 major_version_zero = true
 
 commit_msg_file = ".git/COMMIT_EDITMSG"
 retry_after_failure = true
 update_changelog_on_bump = true
-
-[tool.commitizen.github]
-release = true
-release_asset_path = "dist/*"
-release_asset_descriptions = { "*.tar.gz" = "Source distribution", "*.whl" = "Python Wheel" }
-base_url = "https://github.com/56kyle/robust-python-demo"
+changelog_merge_prerelease = true

.github/workflows/build-docs.yml

@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v6

.github/workflows/finalize-release.yml.rej

@@ -0,0 +1,228 @@
+diff a/.github/workflows/finalize-release.yml b/.github/workflows/finalize-release.yml	(rejected hunks)
+@@ -1,193 +1,80 @@
+-name: Finalize Release
++name: Publish Release
+
+ on:
+-  pull_request:
+-    branches: [main]
+-    types: [closed]
+   push:
+     tags: ["v*"]
+-  workflow_dispatch:
+-    inputs:
+-      version:
+-        description: Release version without the v prefix
+-        required: true
+-        type: string
+-      commit:
+-        description: Exact commit to release; defaults to the selected ref
+-        required: false
+-        type: string
+
+ concurrency:
+-  group: finalize-release-${{ github.event_name == 'pull_request' && github.event.pull_request.merge_commit_sha || github.ref_name }}
++  group: publish-release-${{ github.ref_name }}
+   cancel-in-progress: false
+
+ permissions:
+   contents: read
+
+ jobs:
+-  resolve:
+-    if: github.event_name != 'pull_request' || (github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/'))
+-    name: Resolve immutable release identity
++  validate:
++    name: Validate the annotated release tag
+     runs-on: ubuntu-latest
+-    outputs:
+-      version: ${{ steps.release-pr.outputs.version || steps.release-dispatch.outputs.version || steps.release-tag.outputs.version }}
+-      cargo_version: ${{ steps.release-pr.outputs.cargo_version || steps.release-dispatch.outputs.cargo_version || steps.release-tag.outputs.cargo_version }}
+-      commit: ${{ steps.release-pr.outputs.commit || steps.release-dispatch.outputs.commit || steps.release-tag.outputs.commit }}
+-      tag: ${{ steps.release-pr.outputs.tag || steps.release-dispatch.outputs.tag || steps.release-tag.outputs.tag }}
+     steps:
+-      - name: Check out the requested release commit
+-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
++      - name: Check out the tagged commit
++        uses: actions/checkout@v7
+         with:
+-          ref: ${{ github.event.pull_request.merge_commit_sha || inputs.commit || github.sha }}
+           fetch-depth: 0
+
+       - name: Set up uv
+-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
++        uses: astral-sh/setup-uv@v6
+
+-      - name: Resolve merged pull request identity
+-        id: release-pr
+-        if: github.event_name == 'pull_request'
+-        run: uv run --locked nox -s resolve-release-identity -- --event-kind pull_request --commit "${{ github.event.pull_request.merge_commit_sha }}" --branch "${{ github.event.pull_request.head.ref }}" --output "$GITHUB_OUTPUT"
+
+-      - name: Resolve manual-dispatch identity
+-        id: release-dispatch
+-        if: github.event_name == 'workflow_dispatch'
+-        run: uv run --locked nox -s resolve-release-identity -- --event-kind workflow_dispatch --commit "${{ inputs.commit || github.sha }}" --version "${{ inputs.version }}" --output "$GITHUB_OUTPUT"
++      - name: Validate release metadata
++        run: uv run --locked nox -s validate-release
+
+-      - name: Resolve pushed-tag identity
+-        id: release-tag
+-        if: github.event_name == 'push'
+-        run: uv run --locked nox -s resolve-release-identity -- --event-kind push --commit "${{ github.sha }}" --tag "${{ github.ref_name }}" --output "$GITHUB_OUTPUT"
++      - name: Fetch main release ancestry
++        run: git fetch origin main:refs/remotes/origin/main --tags
+
+-  validate:
+-    name: Revalidate the release commit
+-    needs: resolve
+-    runs-on: ubuntu-latest
+-    steps:
+-      - name: Check out the exact release commit
+-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+-        with:
+-          ref: ${{ needs.resolve.outputs.commit }}
+-          fetch-depth: 0
+-
+-      - name: Set up uv
+-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+-
+-      - name: Validate versions, locks, changelog, and tag state
+-        env:
+-          RELEASE_VERSION: ${{ needs.resolve.outputs.version }}
+-          RELEASE_COMMIT: ${{ needs.resolve.outputs.commit }}
+-        run: uv run --locked nox -s validate-release
++      - name: Validate the annotated tag
++        run: uv run --locked nox -s validate-release-tag -- "${{ github.ref_name }}"
+
+   build:
+-    name: Build immutable release artifacts
+-    needs: [resolve, validate]
+-    permissions:
+-      contents: read
++    name: Build release artifacts
++    needs: validate
+     uses: ./.github/workflows/release-build.yml
+     with:
+-      ref: ${{ needs.resolve.outputs.commit }}
+-      artifact-prefix: release-final
++      ref: ${{ github.sha }}
++      artifact-prefix: release
+
+   bundle:
+-    name: Assemble release bundle
+-    needs: [resolve, build]
++    name: Assemble the checked artifacts
++    needs: build
+     runs-on: ubuntu-latest
+     steps:
+-      - name: Check out the exact release commit
+-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+-        with:
+-          ref: ${{ needs.resolve.outputs.commit }}
+-
+-      - name: Set up uv
+-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+-
+-      - name: Download every native artifact
+-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
++      - name: Download every checked artifact
++        uses: actions/download-artifact@v4
+         with:
+-          pattern: release-final-*
++          pattern: release-*
+           path: dist
+           merge-multiple: true
+
+-      - name: Reject duplicate or invalid distributions
+-        run: uv run --locked twine check dist/*.whl dist/*.tar.gz
++      - name: Set up uv
++        uses: astral-sh/setup-uv@v6
+
+-      - name: Create the immutable artifact manifest
+-        run: uv run --locked nox -s write-artifact-manifest -- dist release-artifacts.json
++      - name: Validate distribution metadata
++        run: uvx twine check --strict dist/*.whl dist/*.tar.gz
+
+-      - name: Upload the immutable release bundle
+-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
++      - name: Upload the release bundle
++        uses: actions/upload-artifact@v4
+         with:
+-          name: release-bundle-${{ needs.resolve.outputs.tag }}
++          name: release-bundle
+           path: |
+-            dist/
+-            release-artifacts.json
++            dist/*.whl
++            dist/*.tar.gz
+           if-no-files-found: error
+           retention-days: 30
+
+-  testpypi:
+-    name: Publish and verify TestPyPI
+-    needs: [resolve, bundle]
+-    runs-on: ubuntu-latest
+-    environment: testpypi
+-    permissions:
+-      contents: read
+-      id-token: write
+-    steps:
+-      - name: Check out the exact release commit
+-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+-        with:
+-          ref: ${{ needs.resolve.outputs.commit }}
+-
+-      - name: Set up uv
+-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+-
+-      - name: Download the immutable release bundle
+-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+-        with:
+-          name: release-bundle-${{ needs.resolve.outputs.tag }}
+-
+-      - name: Publish to TestPyPI
+-        run: >-
+-          uv publish dist/* --trusted-publishing always
+-          --publish-url https://test.pypi.org/legacy/
+-          --check-url https://test.pypi.org/simple/
+-
+-      - name: Verify TestPyPI filenames, metadata, and hashes
+-        env:
+-          RELEASE_VERSION: ${{ needs.resolve.outputs.version }}
+-          RELEASE_COMMIT: ${{ needs.resolve.outputs.commit }}
+-        run: uv run --locked nox -s verify-release-index -- testpypi release-artifacts.json
+-
+-  tag:
+-    name: Create the protected release tag
+-    needs: [resolve, testpypi]
+-    runs-on: ubuntu-latest
+-    environment: release-tag
+-    permissions:
+-      contents: write
+-    steps:
+-      - name: Check out the exact release commit
+-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+-        with:
+-          ref: ${{ needs.resolve.outputs.commit }}
+-          fetch-depth: 0
+-
+-      - name: Set up uv
+-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+-
+-      - name: Create or verify the annotated tag
+-        run: uv run --locked nox -s finalize-release -- "${{ needs.resolve.outputs.version }}" "${{ needs.resolve.outputs.commit }}"
+-
+-      - name: Push the release tag
+-        run: git push origin "refs/tags/${{ needs.resolve.outputs.tag }}"
+-
+
+   pypi:
+-    name: Publish the tested Python artifacts to PyPI
++    name: Publish Python distributions
+     needs:
+-      - resolve
+-      - tag
++      - bundle
+
+     runs-on: ubuntu-latest
+     environment: pypi

.github/workflows/lint-python.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up uv
         uses: astral-sh/setup-uv@v6