ci(release): verify published artifacts end to end

Author: reacher-z

.github/workflows/ci.yml

@@ -39,6 +39,7 @@ jobs:
         run: |
           python scripts/check_rating_integrity.py
           python scripts/check_migration_coverage.py
+          python scripts/check_release_metadata.py
           pip-audit -r requirements.txt
           for file in scripts/*.sh scripts/lib/*.sh; do bash -n "$file"; done
           shellcheck scripts/*.sh scripts/lib/*.sh
@@ -97,7 +98,9 @@ jobs:
         run: |
           python -m venv /tmp/rewardharness-wheel
           /tmp/rewardharness-wheel/bin/pip install dist/*.whl
+          /tmp/rewardharness-wheel/bin/rewardharness --version
           /tmp/rewardharness-wheel/bin/rewardharness inspect
+          /tmp/rewardharness-wheel/bin/rewardharness release-status
 
       - name: Upload distributions
         uses: actions/upload-artifact@v4

.github/workflows/release.yml

@@ -7,6 +7,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -17,10 +21,7 @@ jobs:
           python-version: "3.10"
       - run: python -m pip install -r requirements-dev.txt
       - name: Verify tag and package version
-        run: |
-          package_version=$(python -c 'import rewardharness; print(rewardharness.__version__)')
-          tag_version=${GITHUB_REF_NAME#v}
-          test "${tag_version//-/}" = "$package_version"
+        run: python -m rewardharness.release --check-tag "$GITHUB_REF_NAME"
       - run: make release-check
       - uses: actions/upload-artifact@v4
         with:
@@ -31,7 +32,9 @@ jobs:
   pypi:
     needs: build
     runs-on: ubuntu-latest
-    environment: pypi
+    environment:
+      name: pypi
+      url: https://pypi.org/project/rewardharness/
     permissions:
       id-token: write
     steps:
@@ -44,7 +47,7 @@ jobs:
           attestations: true
 
   github:
-    needs: build
+    needs: [build, pypi]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -60,3 +63,36 @@ jobs:
           prerelease=""
           [[ "$GITHUB_REF_NAME" == *-* ]] && prerelease="--prerelease"
           gh release create "$GITHUB_REF_NAME" dist/* --generate-notes $prerelease
+
+  verify:
+    needs: [pypi, github]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.10"
+      - name: Wait for PyPI metadata
+        run: |
+          package_version=${GITHUB_REF_NAME#v}
+          package_version=${package_version//-/}
+          for attempt in {1..18}; do
+            curl --fail --silent --output /dev/null \
+              "https://pypi.org/pypi/rewardharness/$package_version/json" && exit 0
+            echo "PyPI metadata not visible yet (attempt $attempt/18)"
+            sleep 10
+          done
+          exit 1
+      - name: Install and smoke-test the published artifact
+        run: |
+          package_version=${GITHUB_REF_NAME#v}
+          package_version=${package_version//-/}
+          python -m venv /tmp/rewardharness-pypi
+          /tmp/rewardharness-pypi/bin/pip install --no-deps "rewardharness==$package_version"
+          /tmp/rewardharness-pypi/bin/rewardharness --version
+          /tmp/rewardharness-pypi/bin/rewardharness release-status
+      - name: Verify GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release view "$GITHUB_REF_NAME" --json tagName,isPrerelease,url

CHANGELOG.md

@@ -12,6 +12,12 @@ Large-scale architecture and release-hardening candidate. The supported API
 now uses the `rewardharness` namespace, Library assets use schema v2, and the
 deprecated `src` namespace remains as a compatibility layer for v0.2.
 
+- Package metadata imports are now lazy, so version and release checks do not
+  initialize model, dataset, or image-processing dependencies.
+- Added canonical version/tag conversion, `rewardharness release-status`,
+  cross-file release metadata validation, and post-publish PyPI/GitHub smoke
+  verification.
+
 ### Added
 
 - Active GitHub Actions CI now runs the test suite on Python 3.10–3.12,

CONTRIBUTING.md

@@ -58,4 +58,7 @@ to `CHANGELOG.md`.
 
 Release candidates use PEP 440 versions such as `0.2.0rc1` and matching tags
 such as `v0.2.0-rc1`. The tag workflow publishes the same validated artifacts
-to PyPI and GitHub through trusted publishing.
+to PyPI and GitHub through trusted publishing. Run
+`rewardharness release-status` and `python scripts/check_release_metadata.py`
+before tagging; the workflow also installs the published PyPI artifact and
+verifies the resulting GitHub Release before reporting success.

Makefile

@@ -42,6 +42,7 @@ quality:
 	mypy rewardharness
 	python scripts/check_rating_integrity.py
 	python scripts/check_migration_coverage.py
+	python scripts/check_release_metadata.py
 	pip-audit -r requirements.txt
 	@for file in scripts/*.sh scripts/lib/*.sh; do bash -n "$$file"; done
 	@if command -v shellcheck >/dev/null 2>&1; then shellcheck scripts/*.sh scripts/lib/*.sh; \

README.md

@@ -144,6 +144,7 @@ The installation exposes one supported command surface:
 ```bash
 rewardharness inspect
 rewardharness check
+rewardharness release-status
 rewardharness score-pair --help
 rewardharness evolve --help
 rewardharness benchmark --help

requirements-dev.txt

@@ -9,6 +9,7 @@ pytest-cov>=5.0
 mypy>=1.11,<2.0
 ruff>=0.9,<1.0
 types-pyyaml>=6.0
+tomli>=2.0; python_version < "3.11"
 pip-audit>=2.7,<3.0
 pre-commit>=4.0,<5.0
 

scripts/check_release_metadata.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""Verify that release metadata agrees with the canonical package version."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import yaml
+
+try:
+    import tomllib
+except ImportError:  # pragma: no cover - exercised by the Python 3.10 CI job
+    import tomli as tomllib
+
+ROOT = Path(__file__).resolve().parent.parent
+
+
+def main() -> int:
+    sys.path.insert(0, str(ROOT))
+    from rewardharness.release import ReleaseIdentity
+
+    identity = ReleaseIdentity.current()
+    pyproject = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))
+    citation = yaml.safe_load((ROOT / "CITATION.cff").read_text(encoding="utf-8"))
+    changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
+
+    if pyproject["project"]["name"] != "rewardharness":
+        raise SystemExit("pyproject project name must be rewardharness")
+    version_source = pyproject["tool"]["setuptools"]["dynamic"]["version"]["attr"]
+    if version_source != "rewardharness._version.__version__":
+        raise SystemExit("pyproject must read the canonical _version module")
+    citation_version = str(citation["version"])
+    if citation_version != identity.tag.removeprefix("v"):
+        raise SystemExit(
+            f"CITATION.cff version {citation_version!r} does not match {identity.tag!r}"
+        )
+    if f"## [{citation_version}]" not in changelog:
+        raise SystemExit(f"CHANGELOG.md has no release heading for {citation_version}")
+    print(
+        f"release metadata: package={identity.package_version} "
+        f"tag={identity.tag} citation={citation_version}"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())