Under the /goal "verify accurate release with minimal
drift", a post-v0.4.0 audit ran every check that could surface
release inaccuracy. Three real findings — one critical:
| Check | Finding | Fix in v0.4.1 |
|---|---|---|
| Version drift across 4 version-bearing files | clean (all 0.4.0) | — |
nstat-toolbox on PyPI | 404 — never published | new publish.yml workflow + tagging |
Stale 0.3.2 footer in extras_summary.html | "Generated as part of the nSTAT-python v0.3.2 release" | made version-agnostic |
| GitHub Releases for v0.4.0 | Latest, present | — |
| Live docs reflect v0.4.0 | clean, extras symbols render | — |
pip install nstat-toolbox works, but the package has
never been on PyPI. v0.4.1 makes that promise true.
.github/workflows/publish.yml using PyPI's
Trusted Publisher (OIDC, no API tokens). Triggers on any
v* tag whose version matches pyproject.toml
(the workflow asserts the match at build time).
One-time setup steps for the maintainer are documented in the
refreshed RELEASE_READINESS.md.extras-clusterless CI job —
parallel to extras-dynamax. Installs
[clusterless] (pulls JAX + replay_trajectory_classification)
and runs tests/extras/test_clusterless_bridge.py
end-to-end. Closes the Tier 2.1 CI story.statsmodels>=0.15 pinned in
[test-parity]. Older versions imported
scipy._lib._util._lazywhere (private API scipy
removed); pinning forward kills the recurring local-only test
failure.extras_summary.html.RELEASE_READINESS.md reset to v0.5
planning + the PyPI Trusted-Publisher setup instructions.| Check | Result |
|---|---|
test_version_sync (5 tests, all 4 files on 0.4.1) | PASS |
test_intro_page (5 drift guards) | PASS |
make readme-check + make helpfile-check | PASS |
make docs-strict (two-pass -W) | PASS |
publish.yml tag-vs-pyproject assertion | guard in place |
nstat-toolbox project name on PyPI (account flow).https://pypi.org/manage/project/nstat-toolbox/settings/publishing/
with owner cajigaslab, repository nSTAT-python,
workflow publish.yml, environment pypi.pypi GitHub Environment (Settings →
Environments) — optionally with a required-reviewer rule for
extra safety.After those three clicks, every tag push (starting with
v0.4.1 itself) auto-publishes to PyPI.