ci: fail-closed guard against left-over mutation mutants #195

	name: release-integrity

	# Release-integrity gate: version single-sourcing (pyproject == __init__ == CITATION.cff), CHANGELOG
	# documents the current version, and no undelivered post-tag drift (non-trivial commits since the last
	# tag without a version bump or an [Unreleased] section). Closes the "merged but never released" class
	# that let the M2 security fix and the 811-vs-817 changelog typo sit unreleased on main.
	# Actions are pinned to full commit SHAs (Scorecard/supply-chain hardening), matching ci.yml.

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	version-and-changelog:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	fetch-depth: 0 # full history for the post-tag-drift check
	- name: Fetch tags
	run: git fetch --tags --force
	- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: "3.12"
	- name: Version and changelog integrity
	run: python3 scripts/check_version_and_changelog.py --repo .

Provide feedback