From b2e2048512041803950655ea975939d8249bf0d1 Mon Sep 17 00:00:00 2001 From: ***** <721466+soodoku@users.noreply.github.com> Date: Mon, 19 Oct 2026 21:14:07 -0700 Subject: [PATCH] Record release audit and link public documentation --- README.md | 2 +- docs/index.md | 1 + docs/release-audit.md | 43 +++++++++++++++++++++++++++++++++++++++++++ docs/releasing.md | 15 +++++++-------- pyproject.toml | 2 +- 5 files changed, 53 insertions(+), 10 deletions(-) create mode 100644 docs/release-audit.md diff --git a/README.md b/README.md index 4dbe9c4..170c39b 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # randaba [![CI](https://github.com/finite-sample/randaba/actions/workflows/ci.yml/badge.svg)](https://github.com/finite-sample/randaba/actions/workflows/ci.yml) -[![Docs](https://github.com/finite-sample/randaba/actions/workflows/docs.yml/badge.svg)](https://github.com/finite-sample/randaba/tree/main/docs) +[![Docs](https://github.com/finite-sample/randaba/actions/workflows/docs.yml/badge.svg)](https://finite-sample.github.io/randaba/) Randomized assignment-based anticlustering: random assignment to many arms that keeps the arms alike on baseline covariates. Assignment-based diff --git a/docs/index.md b/docs/index.md index ddf8f6d..9027746 100644 --- a/docs/index.md +++ b/docs/index.md @@ -7,4 +7,5 @@ api releasing +release-audit ``` diff --git a/docs/release-audit.md b/docs/release-audit.md new file mode 100644 index 0000000..af62b6c --- /dev/null +++ b/docs/release-audit.md @@ -0,0 +1,43 @@ +# Release audit + +Audit date: October 19, 2026. Candidate version: `0.1.0`. + +The release-preparation work was merged in +[PR #5](https://github.com/finite-sample/randaba/pull/5), at commit +`e31367aec2f0f1af3578353bc6f96d4068e31407`. The repository is public. The +distribution and import names are both `randaba`, and the license is MIT. + +## Validation + +| Check | Result | +|---|---| +| Native Python 3.13 and Docker Python 3.12/3.14 | 95 tests pass; 100% line coverage | +| Installed wheel on all three Python versions | 95 tests pass | +| Minimum runtime dependencies: NumPy 2.0.0, SciPy 1.13.0, Python 3.12 | 95 installed-wheel tests pass | +| Ruff lint/format, Pyright, Pydoclint, pre-commit | Pass | +| Sphinx with warnings treated as errors | Pass | +| Wheel built from source distribution; strict Twine metadata checks | Pass | +| Preen strict release audit | All 27 checks pass | +| actionlint and Zizmor | Pass | +| Gitleaks scan of all local Git history and release changes | No secrets detected | +| Research note built with latexmk | Pass | + +The [merged-commit CI run](https://github.com/finite-sample/randaba/actions/runs/39368294599) +checks the package, wheel, dependency lock, and workflow security. +The [release rehearsal](https://github.com/finite-sample/randaba/actions/runs/39368318827) +passed with publishing disabled, producing the wheel and source distribution +through the release workflow. + +The vulnerability audit cannot assess `py-canon` against PyPI advisories +because it is a Git-sourced documentation dependency. Its commit is pinned +in `uv.lock`. The full research simulation campaigns were not rerun; the +package tests include the checked-in R anticlust parity fixtures. + +## Publication status + +The GitHub repository is public. PyPI publication has not been attempted. +The GitHub environment `pypi` exists. Before pushing a release tag, configure +the matching PyPI pending trusted publisher and finalize the dated changelog. +See [Releasing randaba](releasing.md) for the exact publisher settings and +release procedure. A successful build rehearsal does not validate PyPI +credentials or reserve the package name. diff --git a/docs/releasing.md b/docs/releasing.md index caa346e..23a168f 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -2,20 +2,19 @@ The first public version is prepared as `0.1.0`. The package is not yet published on PyPI. Both the distribution and Python import are `randaba`. +The repository and [documentation site](https://finite-sample.github.io/randaba/) +are public. The [release audit](release-audit.md) records the completed checks. ## First public release -1. Merge the release-preparation branch after CI passes. It brings the - unpublished `randaba` implementation onto the existing repository history. +1. The release-preparation branch is merged and the public launch is complete. + Confirm the release commit has passing CI before tagging. 2. Run `make ci-docker` and `make ci-docker PYTHON_VERSION=3.14` on the release commit. The checks build a source distribution, build its wheel, validate metadata, and run tests against the installed wheel in an isolated environment. -3. Change repository visibility to public in GitHub Settings. Configure - Pages to use GitHub Actions, then dispatch the Docs workflow on `main`. - The workflow builds while private and deploys only from public `main`. - Once Pages is live, the documentation URL can point to - `https://finite-sample.github.io/randaba/`. -4. Create the GitHub Actions environment `pypi`. In PyPI, add a pending +3. Pages is configured to use GitHub Actions. Confirm the Docs workflow + deploys successfully from `main`. +4. The GitHub Actions environment `pypi` exists. In PyPI, add a pending trusted publisher with these exact values: | Field | Value | diff --git a/pyproject.toml b/pyproject.toml index db9ef96..897dee7 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -27,7 +27,7 @@ dependencies = [ [project.urls] Homepage = "https://github.com/finite-sample/randaba" -Documentation = "https://github.com/finite-sample/randaba/tree/main/docs" +Documentation = "https://finite-sample.github.io/randaba/" Repository = "https://github.com/finite-sample/randaba" Issues = "https://github.com/finite-sample/randaba/issues" Changelog = "https://github.com/finite-sample/randaba/blob/main/CHANGELOG.md"