Publish only the policyengine-uk release files whose checks passed

.github/actions/test-environment/action.yml

@@ -0,0 +1,115 @@
+name: Test environment
+description: >
+  Install the locked test environment (uv.lock, with the dev extra) and the
+  policyengine-uk to test: the checked-out source tree, or a built wheel.
+  Puts the environment's bin directory first on PATH and says where the tests
+  are.
+
+inputs:
+  dist-artifact:
+    description: >
+      Name of an artifact holding the built wheel. Empty to test the
+      checked-out source tree instead.
+    default: ""
+  wheel-sha256:
+    description: The sha256 the wheel in dist-artifact must have.
+    default: ""
+
+outputs:
+  mode:
+    description: "source or wheel"
+    value: ${{ steps.install.outputs.mode }}
+  tests:
+    description: The policyengine_uk/tests directory to run.
+    value: ${{ steps.install.outputs.tests }}
+  rootdir:
+    description: The pytest rootdir, so node ids start with policyengine_uk/tests.
+    value: ${{ steps.install.outputs.rootdir }}
+
+runs:
+  using: composite
+  steps:
+    - name: Install uv
+      uses: astral-sh/setup-uv@v8.1.0
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: "3.13"
+    - name: Download the wheel
+      if: ${{ inputs.dist-artifact != '' }}
+      uses: actions/download-artifact@v8
+      with:
+        name: ${{ inputs.dist-artifact }}
+        path: ${{ runner.temp }}/dist
+    - name: Install the locked environment and policyengine-uk
+      id: install
+      shell: bash
+      env:
+        DIST_ARTIFACT: ${{ inputs.dist-artifact }}
+        WHEEL_SHA256: ${{ inputs.wheel-sha256 }}
+      run: |
+        set -euo pipefail
+        if [ -z "$DIST_ARTIFACT" ]; then
+          # The source tree, installed editable into .venv with the locked
+          # dependencies. --frozen installs uv.lock exactly as committed.
+          uv sync --frozen --extra dev --python 3.13
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+          {
+            echo "mode=source"
+            echo "tests=policyengine_uk/tests"
+            echo "rootdir=$PWD"
+          } >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+
+        # The wheel the release will publish, and nothing else.
+        shopt -s nullglob
+        wheels=("$RUNNER_TEMP"/dist/*.whl)
+        if [ "${#wheels[@]}" -ne 1 ]; then
+          echo "::error::expected one wheel in $DIST_ARTIFACT, found ${#wheels[@]}"
+          exit 1
+        fi
+        wheel="${wheels[0]}"
+        actual=$(sha256sum "$wheel" | cut -d' ' -f1)
+        if [ -z "$WHEEL_SHA256" ] || [ "$actual" != "$WHEEL_SHA256" ]; then
+          echo "::error::$(basename "$wheel") has sha256 $actual; expected '$WHEEL_SHA256'"
+          exit 1
+        fi
+        echo "Testing $(basename "$wheel") (sha256 $actual)"
+
+        # The locked dependencies, without the project, in an environment
+        # outside the checkout. The wheel goes in on top, without resolving
+        # anything else.
+        venv="$RUNNER_TEMP/venv"
+        UV_PROJECT_ENVIRONMENT="$venv" uv sync --frozen --extra dev --no-install-project --python 3.13
+        uv pip install --python "$venv/bin/python" --no-deps "$wheel"
+
+        # Remove the checkout's copy of the package, so nothing can import
+        # the source tree instead of the wheel.
+        rm -rf policyengine_uk
+
+        # Confirm from an empty directory (Python puts the current directory
+        # on sys.path) that the import is the installed wheel.
+        mkdir -p "$RUNNER_TEMP/empty"
+        package=$(cd "$RUNNER_TEMP/empty" && "$venv/bin/python" - "$venv" <<'EOF'
+        import importlib.metadata
+        import pathlib
+        import sys
+
+        import policyengine_uk
+
+        package = pathlib.Path(policyengine_uk.__file__).resolve().parent
+        venv = pathlib.Path(sys.argv[1]).resolve()
+        if venv not in package.parents:
+            sys.exit(f"policyengine_uk was imported from {package}, not {venv}")
+        print(package)
+        EOF
+        )
+        installed=$("$venv/bin/python" -c 'import importlib.metadata as m; print(m.version("policyengine-uk"))')
+        echo "Installed policyengine-uk $installed at $package"
+        echo "$venv/bin" >> "$GITHUB_PATH"
+        {
+          echo "mode=wheel"
+          echo "tests=$package/tests"
+          echo "rootdir=$(dirname "$package")"
+        } >> "$GITHUB_OUTPUT"

.github/build-constraints.txt

@@ -0,0 +1,13 @@
+# The build backend the release workflow builds with (uv build
+# --build-constraint), pinned with its dependencies so a rebuild of the same
+# commit gives the same bytes. With these pins, a build of 6d89338ab
+# reproduces PyPI's policyengine-uk 2.126.8 wheel and sdist byte for byte.
+# A rebuild must match: if an upload stopped part way, "Re-run all jobs"
+# rebuilds, and Publish refuses a file that differs from what PyPI has.
+# Update these deliberately, in their own pull request.
+hatchling==1.32.4
+packaging==26.3
+pathspec==1.1.1
+pluggy==1.6.0
+tomlkit==0.15.1
+trove-classifiers==2026.9.21.13

.github/changed_code.py

@@ -0,0 +1,52 @@
+"""Say whether a pull request changes code, for pr_code_changes.yaml.
+
+    git -c core.quotePath=false diff --name-only --no-renames -z BASE HEAD > changed
+    CODE_PATHS="policyengine_uk/** ..." python3 .github/changed_code.py changed
+
+prints ``code=true`` or ``code=false`` for ``$GITHUB_OUTPUT``. A path is code
+if it matches one of ``CODE_PATHS`` (whitespace-separated): ``dir/**`` matches
+every file under ``dir/``, anything else matches that one file, as in a
+workflow's ``paths`` filter. An empty change list counts as code, so an
+unexpected input runs the tests rather than skipping them.
+
+When this says false, the pull request's tests are skipped and the required
+"Test / Result" check passes without running anything, so a false negative
+would let untested code through: it errs towards true.
+
+Standard library only.
+"""
+
+import os
+import sys
+
+
+def is_code(path: str, patterns: list[str]) -> bool:
+    for pattern in patterns:
+        if pattern.endswith("/**"):
+            if path.startswith(pattern[:-2]):
+                return True
+        elif path == pattern:
+            return True
+    return False
+
+
+def changes_code(changed: list[str], patterns: list[str]) -> bool:
+    return not changed or any(is_code(path, patterns) for path in changed)
+
+
+def main(argv=None) -> int:
+    argv = sys.argv[1:] if argv is None else argv
+    patterns = os.environ.get("CODE_PATHS", "").split()
+    if not patterns or any("*" in p and not p.endswith("/**") for p in patterns):
+        print(f"CODE_PATHS must be dir/** or file paths: {patterns}", file=sys.stderr)
+        return 2
+    with open(argv[0], encoding="utf-8") as file:
+        changed = [path for path in file.read().split("\0") if path]
+    code = [path for path in changed if is_code(path, patterns)]
+    print(f"{len(code)} of {len(changed)} changed files are code", file=sys.stderr)
+    print(f"code={'true' if changes_code(changed, patterns) else 'false'}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())