ci(release): verify exact artifacts before publication

[jxnl]

Summary

• reconcile all pending changelog entries into one unpublished 1.15.5 section
• validate that pyproject.toml, uv.lock, the changelog section, and comparison link agree
• replace the mutating scheduled release with a read-only weekly and PR readiness workflow
• build once, validate and smoke-test the exact wheel on Python 3.9 and 3.13, then require an explicit version plus publish=true before creating a release
• make PyPI publication consume the exact wheel and sdist attached to the release instead of rebuilding from a moving branch

Release safety

The default and scheduled paths cannot create a tag, GitHub release, or PyPI publication. Publication is available only through a manual dispatch on main with the exact declared version and publish=true, after release checks and both wheel smokes pass. This PR does not dispatch that path.

Validation

• uv run --frozen pytest tests/test_prepare_release.py -q: 5 passed
• Ruff check and format: passed
• full source and test ty: passed
• uv lock --check: passed
• both workflow files parse as YAML
• scripts/prepare_release.py --expected-version 1.15.5: passed
• uv build: built instructor-1.15.5.tar.gz and instructor-1.15.5-py3-none-any.whl
• twine==6.2.0 check: passed for wheel and sdist
• clean installed-wheel smoke: passed on Python 3.9 and 3.13
• git diff --check: passed

Included / superseded

This follows merged consolidation PR #2502 and makes its release boundary coherent. It supersedes the previous automatic version-bump, changelog-overwrite, and branch-rebuild release paths in these workflows.

Skipped

• no tag or GitHub release creation
• no PyPI publication
• no dependency/provider additions
• no broad feature or architecture changes
• no social post

---

Note

Medium Risk
Changes how packages reach PyPI and when releases are created; mistakes in workflow gates could block or mis-publish, but publication requires explicit manual dispatch and uses pre-tested artifacts rather than live branch builds.

Overview
Replaces automatic version bumps and branch rebuilds with a read-only release pipeline that builds once, validates metadata, smoke-tests the exact wheel, and only publishes when someone explicitly opts in.

Release Readiness (formerly scheduled release) now runs weekly and on PRs touching release files: it checks pyproject.toml, uv.lock, changelog, and tags via new scripts/prepare_release.py, runs lint/type/offline tests, builds distributions, uploads artifacts, and smoke-installs the wheel on Python 3.9 and 3.13. GitHub release creation is limited to manual workflow_dispatch on main with the declared version and publish=true, after smoke tests pass.

PyPI upload no longer rebuilds at publish time; it downloads the wheel and sdist attached to the GitHub release, re-validates tag/metadata with prepare_release.py, runs twine check, then publishes those files.

CHANGELOG consolidates pending work into a single dated 1.15.5 section and documents the new release-safety checks under Tests / CI.

^{Reviewed by Cursor Bugbot for commit 47107a9. Configure here.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	instructor	47107a9	Commit Preview URL Branch Preview URL	Aug 03 2026, 01:14 AM

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue. You can view the agent here.}

^{Reviewed by Cursor Bugbot for commit 47107a9. Configure here.}

[cursor]

Existing tag blocks publish

Medium Severity

When a version tag already points at the current commit, release_needed is set to false, so the publish job never runs even if manual dispatch sets publish=true. A tag can exist without a GitHub release (for example after release deletion or a tag-only push), so an explicit publish request can be ignored with no failing job.

 

^{Reviewed by Cursor Bugbot for commit 47107a9. Configure here.}