yaaaaa

Author: vecipher

.github/workflows/homebrew_tap.yml

@@ -18,13 +18,16 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set vars
         id: vars
         env:
           INPUT_TAG: ${{ github.event.release.tag_name }}
           GH_TOKEN: ${{ github.token }}
         run: |
+          set -euo pipefail
           TAG="${INPUT_TAG}"
           # If manually dispatched, pick the latest release tag.
           if [ -z "$TAG" ]; then
@@ -37,6 +40,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          set -euo pipefail
           TAG="${{ steps.vars.outputs.tag }}"
           VER="${{ steps.vars.outputs.ver }}"
           for i in {1..30}; do
@@ -53,6 +57,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          set -euo pipefail
           VER="${{ steps.vars.outputs.ver }}"
           mkdir -p _release
           # Ensure a clean slate in case of prior attempts/reruns.
@@ -63,21 +68,30 @@ jobs:
       - name: Compute SHA256
         id: sha
         run: |
+          set -euo pipefail
           VER="${{ steps.vars.outputs.ver }}"
           echo "sha=$(sha256sum _release/clematis-${VER}.tar.gz | awk '{print $1}')" >> "$GITHUB_OUTPUT"
 
       - name: Update Formula file
         run: |
+          set -euo pipefail
           TAG="${{ steps.vars.outputs.tag }}"
           VER="${{ steps.vars.outputs.ver }}"
           SHA="${{ steps.sha.outputs.sha }}"
           F="Formula/clematis.rb"
+          if [ ! -f "$F" ]; then
+            echo "Formula file not found at $F" >&2
+            exit 1
+          fi
           echo "Updating $F → tag=$TAG ver=$VER sha=$SHA"
           sed -i -E "s|^  url \".*\"|  url \"https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/clematis-${VER}.tar.gz\"|g" "$F"
           sed -i -E "s|^  sha256 \".*\"|  sha256 \"${SHA}\"|g" "$F"
           sed -i -E "s|^  version \".*\"|  version \"${VER}\"|g" "$F"
           echo "---"
           grep -E "^  (url|sha256|version)" -n "$F"
+          grep -q "url \"https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/clematis-${VER}.tar.gz\"" "$F" || { echo "URL not updated"; exit 1; }
+          grep -q "sha256 \"${SHA}\"" "$F" || { echo "SHA not updated"; exit 1; }
+          grep -q "version \"${VER}\"" "$F" || { echo "Version not updated"; exit 1; }
 
       # Use a PAT so the PR is authored by a real user and downstream CI triggers.
       - name: Create PR with updated formula (PAT)

.github/workflows/pkg_build.yml

@@ -530,6 +530,19 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Verify VERSION matches tag
+        shell: bash
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF_NAME#v}"
+          FILE="$(tr -d '\r\n' < clematis/VERSION)"
+          echo "Tag:   $TAG"
+          echo "File:  $FILE"
+          if [ "$TAG" != "$FILE" ]; then
+            echo "VERSION mismatch: $FILE (file) vs $TAG (tag)" >&2
+            exit 1
+          fi
+
       - name: Verify no CRLF in text files
         shell: bash
         run: |
@@ -1243,14 +1256,6 @@ jobs:
           print("OK: LICENSE and NOTICE present in both sdist and wheel")
           PY
 
-      - name: Upload artifacts to Release (sdist + wheel)
-        if: ${{ github.event_name == 'release' }}
-        uses: softprops/action-gh-release@v2
-        with:
-          files: |
-            dist/*.tar.gz
-            dist/*.whl
-          fail_on_unmatched_files: true
 
       - name: Generate CycloneDX SBOM (from clean venv)
         run: |
@@ -1273,6 +1278,12 @@ jobs:
           print("SBOM JSON OK")
           PY
 
+      - name: Checksums (SHA256SUMS.txt)
+        run: |
+          cd dist
+          sha256sum * > SHA256SUMS.txt
+          cat SHA256SUMS.txt
+
       - name: Upload SBOM as workflow artifact
         uses: actions/upload-artifact@v4
         with:
@@ -1287,9 +1298,14 @@ jobs:
             dist/*.whl
             dist/*.tar.gz
 
-      - name: Attach SBOM to Release
-        if: ${{ github.event_name == 'release' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh release upload "${{ github.event.release.tag_name }}" dist/sbom.cdx.json --clobber
+      - name: Upload artifacts to Release (sdist + wheel + SBOM + checksums)
+        if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'release' }}
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/*.tar.gz
+            dist/*.whl
+            dist/SHA256SUMS.txt
+            dist/sbom.cdx.json
+          generate_release_notes: true
+          prerelease: ${{ contains(github.ref_name, 'a') || contains(github.ref_name, 'b') || contains(github.ref_name, 'rc') }}

CHANGELOG.MD

@@ -8,8 +8,26 @@ All notable changes to this project will be documented in this file.
 
 
 
+
 ## [Unreleased]
 
+## [0.9.0] - 2025-10-08
+
+### Changed (PR126 — Release prep; 0.9.0b1 → 0.9.0)
+- Stable release; no code changes since **0.9.0b1**.
+- Tagging a signed release triggers `.github/workflows/pkg_build.yml` (builds sdist/wheels and prints SHA256s) and `.github/workflows/homebrew_tap.yml` (updates `url`, `sha256`, and `version` in the tap); SBOM and SLSA attestation are attached to the GitHub release.
+
+### Added/Fixed (PR125 — Windows temp dirs & Unicode paths)
+- Replaced hard‑coded temp paths with `tempfile.gettempdir()` in code paths and tests that create ephemeral files.
+- All text file I/O now specifies `encoding="utf-8"`; `Path.read_text`/`write_text` calls in tests use explicit encodings.
+- Logging paths honor `CLEMATIS_LOG_DIR` (primary) over legacy `CLEMATIS_LOGS_DIR`; fallbacks remain `.logs/` under the repo when env is unset.
+- Snapshots respect `CLEMATIS_SNAPSHOT_DIR` for read/write; default behavior is unchanged when unset.
+- New Windows‑only test writes/reads under a Unicode temp directory to catch path/encoding regressions.
+
+### Notes
+- No functional changes versus **0.9.0b1**; see **0.9.0a1** and **0.9.0a2** below for the feature work carried into this stable release.
+
+
 ### Added (PR121 — CLI help stability & determinism)
 - **Deterministic help:** `cli_utils.py` provides a fixed‑width formatter; constant epilog (`"See Operator Guide: docs/operator-guide.md"`); subcommands listed **alphabetically**.
 - **CLI main:** `clematis/cli/main.py` surfaces the version in the description, sets `allow_abbrev=False`, sorts subcommands, and uses the deterministic formatter.

Formula/clematis.rb

@@ -9,7 +9,7 @@ class Clematis < Formula
   url "https://github.com/vecipher/Clematis3/releases/download/v0.9.0a2/clematis-0.9.0a2.tar.gz"
   sha256 "4cb4ca47e94d58e1a3b355d67ef8be54744452a8ee34cbaf6161d044bd20cd4c"
   license "MIT"
-  version "0.9.0a2"
+  version "0.9.0b1"
 
   depends_on "python@3.13"
 

clematis/VERSION

@@ -1 +1 @@
-0.9.0a2
+0.9.0b1

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "clematis"
-version = "0.9.0a2"
+version = "0.9.0b1"
 description = "Clematis — deterministic mind-like simulation engine (M1–M8 baseline)"
 readme = "README.md"
 requires-python = ">=3.11,<3.14"