Publish v0.2.0 (from b0571b4)

Author: wshallwshall

.github/workflows/release-sync-check.yml

@@ -32,6 +32,12 @@ jobs:
           python-version: "3.13"
       - name: Check tag / PyPI / mirror are in sync
         run: |
+          # The script lives under the deny-listed scripts/publish/, so it is ABSENT on the OSS mirror;
+          # the sync check only runs on the private repo (the publish source). Skip where it's absent.
+          if [ ! -f scripts/publish/check_release_sync.py ]; then
+            echo "scripts/publish/check_release_sync.py absent (OSS mirror) — skipping the release-sync check."
+            exit 0
+          fi
           # `packaging` gives canonical version normalization (so a "0.1.0-rc1" tag and PyPI's
           # "0.1.0rc1" compare equal); the script falls back to a naive form if it's absent.
           python -m pip install --upgrade pip packaging

.github/workflows/security.yml

@@ -202,5 +202,12 @@ jobs:
         with:
           python-version: "3.13"
       - name: Scan the publishable subset for forbidden content
-        # Stdlib-only scanner (no install). Exits non-zero — failing the build — on any hit.
-        run: python scripts/publish/scan_forbidden.py --published
+        # Stdlib-only scanner (no install). Exits non-zero — failing the build — on any hit. The scanner
+        # lives under the deny-listed scripts/publish/, so it is ABSENT on the OSS mirror — there's
+        # nothing to gate there (everything is already the published subset); skip rather than error.
+        run: |
+          if [ -f scripts/publish/scan_forbidden.py ]; then
+            python scripts/publish/scan_forbidden.py --published
+          else
+            echo "scripts/publish/scan_forbidden.py absent (OSS mirror) — skipping the publish leak-gate."
+          fi

tests/test_anon_parity.py

@@ -38,6 +38,11 @@
 
 def _load_scan_forbidden() -> object:
     path = _ROOT / "scripts" / "publish" / "scan_forbidden.py"
+    if not path.exists():
+        # Private-only (scripts/publish/ is deny-listed in the OSS mirror); skip where it's absent.
+        pytest.skip(
+            "scan_forbidden.py is private-only (OSS-mirror deny-list)", allow_module_level=True
+        )
     spec = importlib.util.spec_from_file_location("scan_forbidden", path)
     assert spec is not None and spec.loader is not None
     mod = importlib.util.module_from_spec(spec)

tests/test_load_config.py

@@ -138,6 +138,13 @@ def test_invalid_transform_mode_fails_loud(monkeypatch: pytest.MonkeyPatch) -> N
 # by path — mirroring tests/test_scan_forbidden.py.
 def _load_scan_forbidden() -> object:
     path = Path(__file__).resolve().parents[1] / "scripts" / "publish" / "scan_forbidden.py"
+    if not path.exists():
+        # Private-only: scripts/publish/ is deny-listed in the OSS mirror, so the estate-token
+        # assertions this module feeds don't apply there. Skip the whole module rather than error at
+        # collection (the scanner is the single source of truth only where it exists).
+        pytest.skip(
+            "scan_forbidden.py is private-only (OSS-mirror deny-list)", allow_module_level=True
+        )
     spec = importlib.util.spec_from_file_location("scan_forbidden", path)
     assert spec is not None and spec.loader is not None
     mod = importlib.util.module_from_spec(spec)