release-integrity.yml

name: release-integrity

# Release-integrity gate: version single-sourcing (pyproject == __init__ == CITATION.cff), CHANGELOG
# documents the current version, and no undelivered post-tag drift (non-trivial commits since the last
# tag without a version bump or an [Unreleased] section). Closes the "merged but never released" class
# that let the M2 security fix and the 811-vs-817 changelog typo sit unreleased on main.
# Actions are pinned to full commit SHAs (Scorecard/supply-chain hardening), matching ci.yml.

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  version-and-changelog:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0          # full history for the post-tag-drift check
      - name: Fetch tags
        run: git fetch --tags --force
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: "3.12"
      - name: Version and changelog integrity
        run: python3 scripts/check_version_and_changelog.py --repo .