From c6df422f8e47405608b6c06292740bb093d4bbf8 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 9 Oct 2026 10:21:15 +0100 Subject: [PATCH 1/3] fix(ci): make the release workflow build, attest and publish The release workflow has failed since it was added, so no tag has a GitHub Release. Four defects, each fixed here: - Both upload steps pinned actions/upload-artifact to ea165f8d65b6db9a, which does not exist (a corrupted copy of v4.6.2's SHA). Pinned to v7.0.1, as SMTLib.jl uses. - "Package artifacts" had no shell, so windows-latest ran it in pwsh. The build job now defaults to bash. - The SBOM step loaded JSON, which is not a dependency, from an uninstantiated project. It now instantiates the project, reads the direct dependencies, then loads JSON from a temporary environment. - The tracked Manifest.toml was written by Julia 1.13.0-alpha2, which Pkg on 1.10 cannot load. Both jobs now delete any committed manifest and resolve from [compat], the way users install the package. A manual run now checks out the requested tag, so the artefacts match the tagged tree rather than the default branch. The version is passed through env, must match vX.Y.Z, and must already exist as a tag, so a typo cannot make action-gh-release create a new tag. Also: least-privilege permissions (read at the top, write on the release job only), build provenance attested with actions/attest-build-provenance v4.2.2, and a pull_request trigger on this file so a change to it runs the build and SBOM jobs at review. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016XJoh8YA2sCWQmq93CF8RX --- .github/workflows/release.yml | 102 +++++++++++++++++++++++++--------- 1 file changed, 76 insertions(+), 26 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7703f40..d6598fb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,14 +4,19 @@ on: push: tags: - 'v*.*.*' + # A change to this file runs the build and SBOM jobs on its PR, so a broken + # release path shows up at review rather than at the next tag. The release + # job is skipped on PRs. + pull_request: + paths: + - '.github/workflows/release.yml' workflow_dispatch: inputs: version: - description: 'Version to release (e.g., v0.1.0)' + description: 'Existing tag to release (e.g., v0.1.0). The build checks out this tag.' required: true permissions: - contents: write - id-token: write + contents: read jobs: build: name: Build Package @@ -21,21 +26,33 @@ jobs: matrix: os: [ubuntu-latest, macos-latest, windows-latest] julia-version: ['1.10'] + defaults: + run: + shell: bash steps: + # On a manual run, build the tag being released, not the default branch, + # so the artefacts match the tagged and registered tree. On other events + # inputs.version is empty and checkout uses the triggering ref. - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + with: + ref: ${{ inputs.version }} - uses: julia-actions/setup-julia@fa02766e078afaaf09b14210362cee14137e6a32 # v3.0.2 with: version: ${{ matrix.julia-version }} - uses: julia-actions/cache@9353db09a0f2bbbdec6f41791918c75d37391b36 # v3.5.0 + # A library release is tested the way users install it: resolved fresh + # from Project.toml [compat]. The v0.2.1 tag carries a Manifest.toml + # written by Julia 1.13.0-alpha2, which Pkg on 1.10 cannot load. + - name: Ignore any committed manifest + run: rm -f Manifest.toml - name: Build and test - run: | - julia --project -e 'using Pkg; Pkg.build(); Pkg.test()' + run: julia --project -e 'using Pkg; Pkg.build(); Pkg.test()' - name: Package artifacts run: | mkdir -p dist tar -czf dist/Causals.jl-${{ matrix.os }}.tar.gz src/ Project.toml README.* LICENSE - name: Upload artifacts - uses: actions/upload-artifact@ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bb # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: package-${{ matrix.os }} path: dist/ @@ -46,15 +63,31 @@ jobs: needs: build steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + with: + ref: ${{ inputs.version }} - uses: julia-actions/setup-julia@fa02766e078afaaf09b14210362cee14137e6a32 # v3.0.2 with: version: '1.10' + # Pkg.dependencies() needs a resolved environment. JSON is not a + # dependency of this package, so it is loaded from a throwaway + # environment after the component list has been read. - name: Generate SBOM run: | + rm -f Manifest.toml julia --project -e ' - using Pkg, JSON + using Pkg + Pkg.instantiate() pkg_info = Pkg.project() - deps = Pkg.dependencies() + components = [ + Dict( + "type" => "library", + "name" => info.name, + "version" => info.version === nothing ? "stdlib" : string(info.version) + ) for (uuid, info) in Pkg.dependencies() if info.is_direct_dep + ] + Pkg.activate(temp=true) + Pkg.add("JSON") + using JSON sbom = Dict( "bomFormat" => "CycloneDX", "specVersion" => "1.4", @@ -66,30 +99,50 @@ jobs: "version" => string(pkg_info.version) ) ), - "components" => [ - Dict( - "type" => "library", - "name" => string(uuid), - "version" => string(info.version) - ) for (uuid, info) in deps if info.is_direct_dep - ] + "components" => components ) open("sbom.json", "w") do f JSON.print(f, sbom, 2) end ' - name: Upload SBOM - uses: actions/upload-artifact@ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bb # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: sbom path: sbom.json release: name: Create Release + if: github.event_name != 'pull_request' runs-on: ubuntu-latest timeout-minutes: 15 needs: [build, sbom] + permissions: + contents: write + id-token: write + attestations: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + # Refuse anything but an existing vX.Y.Z tag, so a mistyped manual run + # cannot make action-gh-release create a new tag on the default branch. + - name: Extract version + id: version + env: + EVENT_NAME: ${{ github.event_name }} + INPUT_VERSION: ${{ inputs.version }} + run: | + if [ "$EVENT_NAME" = "workflow_dispatch" ]; then + version="$INPUT_VERSION" + else + version="${GITHUB_REF#refs/tags/}" + fi + if ! printf '%s\n' "$version" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then + echo "::error::the version to release is not of the form vX.Y.Z" + exit 1 + fi + if ! git ls-remote --exit-code --tags "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" "refs/tags/$version" > /dev/null; then + echo "::error::tag $version does not exist; push the tag first" + exit 1 + fi + echo "version=$version" >> "$GITHUB_OUTPUT" - name: Download artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: @@ -99,15 +152,11 @@ jobs: mkdir -p release find release-artifacts -type f -exec cp {} release/ \; cd release - sha256sum * > checksums.txt - - name: Extract version - id: version - run: | - if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then - echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT - else - echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT - fi + sha256sum -- * > checksums.txt + - name: Attest build provenance + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 + with: + subject-path: 'release/*' - name: Create GitHub Release uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v2 with: @@ -125,6 +174,7 @@ jobs: ```bash sha256sum -c checksums.txt + gh attestation verify -R hyperpolymath/Causals.jl ``` files: release/* draft: false From 399780e966321c5c8e71066ec35f9a1a31c9069c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 9 Oct 2026 10:21:15 +0100 Subject: [PATCH 2/3] chore: stop tracking Manifest.toml .gitignore already lists /Manifest.toml, but the file has been tracked since the first commit. It was written by Julia 1.13.0-alpha2 (manifest_format 2.1) and lists Causals itself as a path dependency, so Pkg on 1.10 cannot build, resolve or list dependencies with it. CI passes only because a later Pkg.add re-resolves it. A library ships without a manifest. The file stays on disk for anyone who has it; it is only removed from the index. STATE.a2ml and Dustfile.a2ml still describe the manifest drift. They are left unchanged because A2ML is retired and is not edited. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016XJoh8YA2sCWQmq93CF8RX --- Manifest.toml | 416 -------------------------------------------------- 1 file changed, 416 deletions(-) delete mode 100644 Manifest.toml diff --git a/Manifest.toml b/Manifest.toml deleted file mode 100644 index 6a89bf8..0000000 --- a/Manifest.toml +++ /dev/null @@ -1,416 +0,0 @@ -# This file is machine-generated - editing it directly is not advised - -julia_version = "1.13.0-alpha2" -manifest_format = "2.1" -project_hash = "ae23534c7d298cd267cd75e643d198242b2dee18" - -[[deps.AliasTables]] -deps = ["PtrArrays", "Random"] -git-tree-sha1 = "9876e1e164b144ca45e9e3198d0b689cadfed9ff" -registries = "General" -uuid = "66dad0bd-aa9a-41b7-9441-69ab47430ed8" -version = "1.1.3" - -[[deps.ArnoldiMethod]] -deps = ["LinearAlgebra", "Random", "StaticArrays"] -git-tree-sha1 = "d57bd3762d308bded22c3b82d033bff85f6195c6" -registries = "General" -uuid = "ec485272-7323-5ecc-a04f-4719b315124d" -version = "0.4.0" - -[[deps.Artifacts]] -uuid = "56f22d72-fd6d-98f1-02f0-08ddc0907c33" -version = "1.11.0" - -[[deps.Base64]] -uuid = "2a0f44e3-6c83-55bd-87e4-b1978d98bd5f" -version = "1.11.0" - -[[deps.Causals]] -deps = ["Distributions", "Graphs", "LinearAlgebra", "Statistics", "StatsBase"] -path = "." -uuid = "01a11d29-d897-8383-92d8-041d500f9c95" -version = "0.2.1" - -[[deps.CompilerSupportLibraries_jll]] -deps = ["Artifacts", "Libdl"] -uuid = "e66e0078-7015-5450-92f7-15fbd957f2ae" -version = "1.3.0+1" - -[[deps.DataAPI]] -git-tree-sha1 = "abe83f3a2f1b857aac70ef8b269080af17764bbe" -registries = "General" -uuid = "9a962f9c-6df0-11e9-0e5d-c546b8b5ee8a" -version = "1.16.0" - -[[deps.DataStructures]] -deps = ["OrderedCollections"] -git-tree-sha1 = "e357641bb3e0638d353c4b29ea0e40ea644066a6" -registries = "General" -uuid = "864edb3b-99cc-5e75-8d2d-829cb0a9cfe8" -version = "0.19.3" - -[[deps.Dates]] -deps = ["Printf"] -uuid = "ade2ca70-3891-5945-98fb-dc099432e06a" -version = "1.11.0" - -[[deps.Distributions]] -deps = ["AliasTables", "FillArrays", "LinearAlgebra", "PDMats", "Printf", "QuadGK", "Random", "SpecialFunctions", "Statistics", "StatsAPI", "StatsBase", "StatsFuns"] -git-tree-sha1 = "fbcc7610f6d8348428f722ecbe0e6cfe22e672c6" -registries = "General" -uuid = "31c24e10-a181-5473-b8eb-7969acd0382f" -version = "0.25.123" - - [deps.Distributions.extensions] - DistributionsChainRulesCoreExt = "ChainRulesCore" - DistributionsDensityInterfaceExt = "DensityInterface" - DistributionsTestExt = "Test" - - [deps.Distributions.weakdeps] - ChainRulesCore = "d360d2e6-b24c-11e9-a2a3-2a2ae2dbcce4" - DensityInterface = "b429d917-457f-4dbc-8f4c-0cc954292b1d" - Test = "8dfed614-e22c-5e08-85e1-65c5234f0b40" - -[[deps.DocStringExtensions]] -git-tree-sha1 = "7442a5dfe1ebb773c29cc2962a8980f47221d76c" -registries = "General" -uuid = "ffbed154-4ef7-542d-bbb7-c09d3a79fcae" -version = "0.9.5" - -[[deps.FillArrays]] -deps = ["LinearAlgebra"] -git-tree-sha1 = "2f979084d1e13948a3352cf64a25df6bd3b4dca3" -registries = "General" -uuid = "1a297f60-69ca-5386-bcde-b61e274b549b" -version = "1.16.0" -weakdeps = ["PDMats", "SparseArrays", "StaticArrays", "Statistics"] - - [deps.FillArrays.extensions] - FillArraysPDMatsExt = "PDMats" - FillArraysSparseArraysExt = "SparseArrays" - FillArraysStaticArraysExt = "StaticArrays" - FillArraysStatisticsExt = "Statistics" - -[[deps.Graphs]] -deps = ["ArnoldiMethod", "DataStructures", "Inflate", "LinearAlgebra", "Random", "SimpleTraits", "SparseArrays", "Statistics"] -git-tree-sha1 = "031d63d09bd3e6e319df66bb466f5c3e8d147bee" -registries = "General" -uuid = "86223c79-3864-5bf0-83f7-82e725a168b6" -version = "1.13.4" - - [deps.Graphs.extensions] - GraphsSharedArraysExt = "SharedArrays" - - [deps.Graphs.weakdeps] - Distributed = "8ba89e20-285c-5b6f-9357-94700520ee1b" - SharedArrays = "1a1011a3-84de-559e-8e89-a11a2f7dc383" - -[[deps.HypergeometricFunctions]] -deps = ["LinearAlgebra", "OpenLibm_jll", "SpecialFunctions"] -git-tree-sha1 = "68c173f4f449de5b438ee67ed0c9c748dc31a2ec" -registries = "General" -uuid = "34004b35-14d8-5ef3-9330-4cdb6864b03a" -version = "0.3.28" - -[[deps.Inflate]] -git-tree-sha1 = "d1b1b796e47d94588b3757fe84fbf65a5ec4a80d" -registries = "General" -uuid = "d25df0c9-e2be-5dd7-82c8-3ad0b3e990b9" -version = "0.1.5" - -[[deps.InteractiveUtils]] -deps = ["Markdown"] -uuid = "b77e0a4c-d291-57a0-90e8-8db25a27a240" -version = "1.11.0" - -[[deps.IrrationalConstants]] -git-tree-sha1 = "b2d91fe939cae05960e760110b328288867b5758" -registries = "General" -uuid = "92d709cd-6900-40b7-9082-c6be49f344b6" -version = "0.2.6" - -[[deps.JLLWrappers]] -deps = ["Artifacts", "Preferences"] -git-tree-sha1 = "0533e564aae234aff59ab625543145446d8b6ec2" -registries = "General" -uuid = "692b3bcd-3c85-4b1f-b108-f13ce0eb3210" -version = "1.7.1" - -[[deps.JuliaSyntaxHighlighting]] -deps = ["StyledStrings"] -uuid = "ac6e5ff7-fb65-4e79-a425-ec3bc9c03011" -version = "1.12.0" - -[[deps.Libdl]] -uuid = "8f399da3-3557-5675-b5ff-fb832c97cbdb" -version = "1.11.0" - -[[deps.LinearAlgebra]] -deps = ["Libdl", "OpenBLAS_jll", "libblastrampoline_jll"] -uuid = "37e2e46d-f89d-539d-b4ee-838fcccc9c8e" -version = "1.13.0" - -[[deps.LogExpFunctions]] -deps = ["DocStringExtensions", "IrrationalConstants", "LinearAlgebra"] -git-tree-sha1 = "13ca9e2586b89836fd20cccf56e57e2b9ae7f38f" -registries = "General" -uuid = "2ab3a3ac-af41-5b50-aa03-7779005ae688" -version = "0.3.29" - - [deps.LogExpFunctions.extensions] - LogExpFunctionsChainRulesCoreExt = "ChainRulesCore" - LogExpFunctionsChangesOfVariablesExt = "ChangesOfVariables" - LogExpFunctionsInverseFunctionsExt = "InverseFunctions" - - [deps.LogExpFunctions.weakdeps] - ChainRulesCore = "d360d2e6-b24c-11e9-a2a3-2a2ae2dbcce4" - ChangesOfVariables = "9e997f8a-9a97-42d5-a9f1-ce6bfc15e2c0" - InverseFunctions = "3587e190-3f89-42d0-90ee-14403ec27112" - -[[deps.MacroTools]] -git-tree-sha1 = "1e0228a030642014fe5cfe68c2c0a818f9e3f522" -registries = "General" -uuid = "1914dd2f-81c6-5fcd-8719-6d5c9610ff09" -version = "0.5.16" - -[[deps.Markdown]] -deps = ["Base64", "JuliaSyntaxHighlighting", "StyledStrings"] -uuid = "d6f4376e-aef5-505a-96c1-9c027394607a" -version = "1.11.0" - -[[deps.Missings]] -deps = ["DataAPI"] -git-tree-sha1 = "ec4f7fbeab05d7747bdf98eb74d130a2a2ed298d" -registries = "General" -uuid = "e1d29d7a-bbdc-5cf2-9ac0-f12de2c33e28" -version = "1.2.0" - -[[deps.OpenBLAS_jll]] -deps = ["Artifacts", "CompilerSupportLibraries_jll", "Libdl"] -uuid = "4536629a-c528-5b80-bd46-f80d51c5b363" -version = "0.3.29+0" - -[[deps.OpenLibm_jll]] -deps = ["Artifacts", "CompilerSupportLibraries_jll", "Libdl"] -uuid = "05823500-19ac-5b8b-9628-191a04bc5112" -version = "0.8.7+0" - -[[deps.OpenSpecFun_jll]] -deps = ["Artifacts", "CompilerSupportLibraries_jll", "JLLWrappers", "Libdl"] -git-tree-sha1 = "1346c9208249809840c91b26703912dff463d335" -registries = "General" -uuid = "efe28fd5-8261-553b-a9e1-b2916fc3738e" -version = "0.5.6+0" - -[[deps.OrderedCollections]] -git-tree-sha1 = "05868e21324cede2207c6f0f466b4bfef6d5e7ee" -registries = "General" -uuid = "bac558e1-5e72-5ebc-8fee-abe8a469f55d" -version = "1.8.1" - -[[deps.PDMats]] -deps = ["LinearAlgebra", "SparseArrays", "SuiteSparse"] -git-tree-sha1 = "e4cff168707d441cd6bf3ff7e4832bdf34278e4a" -registries = "General" -uuid = "90014a1f-27ba-587c-ab20-58faa44d9150" -version = "0.11.37" -weakdeps = ["StatsBase"] - - [deps.PDMats.extensions] - StatsBaseExt = "StatsBase" - -[[deps.PrecompileTools]] -deps = ["Preferences"] -git-tree-sha1 = "07a921781cab75691315adc645096ed5e370cb77" -registries = "General" -uuid = "aea7be01-6a6a-4083-8856-8a6e6704d82a" -version = "1.3.3" - -[[deps.Preferences]] -deps = ["TOML"] -git-tree-sha1 = "522f093a29b31a93e34eaea17ba055d850edea28" -registries = "General" -uuid = "21216c6a-2e73-6563-6e65-726566657250" -version = "1.5.1" - -[[deps.Printf]] -deps = ["Unicode"] -uuid = "de0858da-6303-5e67-8744-51eddeeeb8d7" -version = "1.11.0" - -[[deps.PtrArrays]] -git-tree-sha1 = "1d36ef11a9aaf1e8b74dacc6a731dd1de8fd493d" -registries = "General" -uuid = "43287f4e-b6f4-7ad1-bb20-aadabca52c3d" -version = "1.3.0" - -[[deps.QuadGK]] -deps = ["DataStructures", "LinearAlgebra"] -git-tree-sha1 = "9da16da70037ba9d701192e27befedefb91ec284" -registries = "General" -uuid = "1fd47b50-473d-5c70-9696-f719f8f3bcdc" -version = "2.11.2" - - [deps.QuadGK.extensions] - QuadGKEnzymeExt = "Enzyme" - - [deps.QuadGK.weakdeps] - Enzyme = "7da242da-08ed-463a-9acd-ee780be4f1d9" - -[[deps.Random]] -deps = ["SHA"] -uuid = "9a3f8284-a2c9-5f02-9a11-845980a1fd5c" -version = "1.11.0" - -[[deps.Reexport]] -git-tree-sha1 = "45e428421666073eab6f2da5c9d310d99bb12f9b" -registries = "General" -uuid = "189a3867-3050-52da-a836-e630ba90ab69" -version = "1.2.2" - -[[deps.Rmath]] -deps = ["Random", "Rmath_jll"] -git-tree-sha1 = "5b3d50eb374cea306873b371d3f8d3915a018f0b" -registries = "General" -uuid = "79098fc4-a85e-5d69-aa6a-4863f24498fa" -version = "0.9.0" - -[[deps.Rmath_jll]] -deps = ["Artifacts", "JLLWrappers", "Libdl"] -git-tree-sha1 = "58cdd8fb2201a6267e1db87ff148dd6c1dbd8ad8" -registries = "General" -uuid = "f50d1b31-88e8-58de-be2c-1cc44531875f" -version = "0.5.1+0" - -[[deps.SHA]] -uuid = "ea8e919c-243c-51af-8825-aaa63cd721ce" -version = "1.0.0" - -[[deps.Serialization]] -uuid = "9e88b42a-f829-5b0c-bbe9-9e923198166b" -version = "1.11.0" - -[[deps.SimpleTraits]] -deps = ["InteractiveUtils", "MacroTools"] -git-tree-sha1 = "be8eeac05ec97d379347584fa9fe2f5f76795bcb" -registries = "General" -uuid = "699a6c99-e7fa-54fc-8d76-47d257e15c1d" -version = "0.9.5" - -[[deps.SortingAlgorithms]] -deps = ["DataStructures"] -git-tree-sha1 = "64d974c2e6fdf07f8155b5b2ca2ffa9069b608d9" -registries = "General" -uuid = "a2af1166-a08f-5f64-846c-94a0d3cef48c" -version = "1.2.2" - -[[deps.SparseArrays]] -deps = ["Libdl", "LinearAlgebra", "Random", "Serialization", "SuiteSparse_jll"] -uuid = "2f01184e-e22b-5df5-ae63-d93ebab69eaf" -version = "1.13.0" - -[[deps.SpecialFunctions]] -deps = ["IrrationalConstants", "LogExpFunctions", "OpenLibm_jll", "OpenSpecFun_jll"] -git-tree-sha1 = "5acc6a41b3082920f79ca3c759acbcecf18a8d78" -registries = "General" -uuid = "276daf66-3868-5448-9aa4-cd146d93841b" -version = "2.7.1" - - [deps.SpecialFunctions.extensions] - SpecialFunctionsChainRulesCoreExt = "ChainRulesCore" - - [deps.SpecialFunctions.weakdeps] - ChainRulesCore = "d360d2e6-b24c-11e9-a2a3-2a2ae2dbcce4" - -[[deps.StaticArrays]] -deps = ["LinearAlgebra", "PrecompileTools", "Random", "StaticArraysCore"] -git-tree-sha1 = "eee1b9ad8b29ef0d936e3ec9838c7ec089620308" -registries = "General" -uuid = "90137ffa-7385-5640-81b9-e52037218182" -version = "1.9.16" - - [deps.StaticArrays.extensions] - StaticArraysChainRulesCoreExt = "ChainRulesCore" - StaticArraysStatisticsExt = "Statistics" - - [deps.StaticArrays.weakdeps] - ChainRulesCore = "d360d2e6-b24c-11e9-a2a3-2a2ae2dbcce4" - Statistics = "10745b16-79ce-11e8-11f9-7d13ad32a3b2" - -[[deps.StaticArraysCore]] -git-tree-sha1 = "6ab403037779dae8c514bad259f32a447262455a" -registries = "General" -uuid = "1e83bf80-4336-4d27-bf5d-d5a4f845583c" -version = "1.4.4" - -[[deps.Statistics]] -deps = ["LinearAlgebra"] -git-tree-sha1 = "ae3bb1eb3bba077cd276bc5cfc337cc65c3075c0" -registries = "General" -uuid = "10745b16-79ce-11e8-11f9-7d13ad32a3b2" -version = "1.11.1" -weakdeps = ["SparseArrays"] - - [deps.Statistics.extensions] - SparseArraysExt = ["SparseArrays"] - -[[deps.StatsAPI]] -deps = ["LinearAlgebra"] -git-tree-sha1 = "178ed29fd5b2a2cfc3bd31c13375ae925623ff36" -registries = "General" -uuid = "82ae8749-77ed-4fe6-ae5f-f523153014b0" -version = "1.8.0" - -[[deps.StatsBase]] -deps = ["AliasTables", "DataAPI", "DataStructures", "IrrationalConstants", "LinearAlgebra", "LogExpFunctions", "Missings", "Printf", "Random", "SortingAlgorithms", "SparseArrays", "Statistics", "StatsAPI"] -git-tree-sha1 = "aceda6f4e598d331548e04cc6b2124a6148138e3" -registries = "General" -uuid = "2913bbd2-ae8a-5f71-8c99-4fb6c76f3a91" -version = "0.34.10" - -[[deps.StatsFuns]] -deps = ["HypergeometricFunctions", "IrrationalConstants", "LogExpFunctions", "Reexport", "Rmath", "SpecialFunctions"] -git-tree-sha1 = "91f091a8716a6bb38417a6e6f274602a19aaa685" -registries = "General" -uuid = "4c63d2b9-4356-54db-8cca-17b64c39e42c" -version = "1.5.2" - - [deps.StatsFuns.extensions] - StatsFunsChainRulesCoreExt = "ChainRulesCore" - StatsFunsInverseFunctionsExt = "InverseFunctions" - - [deps.StatsFuns.weakdeps] - ChainRulesCore = "d360d2e6-b24c-11e9-a2a3-2a2ae2dbcce4" - InverseFunctions = "3587e190-3f89-42d0-90ee-14403ec27112" - -[[deps.StyledStrings]] -uuid = "f489334b-da3d-4c2e-b8f0-e476e12c162b" -version = "1.11.0" - -[[deps.SuiteSparse]] -deps = ["Libdl", "LinearAlgebra", "Serialization", "SparseArrays"] -uuid = "4607b0f0-06f3-5cda-b6b1-a6196a1729e9" - -[[deps.SuiteSparse_jll]] -deps = ["Artifacts", "CompilerSupportLibraries_jll", "Libdl", "libblastrampoline_jll"] -uuid = "bea87d4a-7f5b-5778-9afe-8cc45184846c" -version = "7.10.1+0" - -[[deps.TOML]] -deps = ["Dates"] -uuid = "fa267f1f-6049-4f14-aa54-33bafae1ed76" -version = "1.0.3" - -[[deps.Unicode]] -uuid = "4ec0a83e-493e-50e2-b9ac-8f72acf5a8f5" -version = "1.11.0" - -[[deps.libblastrampoline_jll]] -deps = ["Artifacts", "Libdl"] -uuid = "8e850b90-86db-534c-a0d3-1478176c7d93" -version = "5.15.0+0" - -[registries.General] -url = "https://github.com/JuliaRegistries/General.git" -uuid = "23338594-aafe-5451-b93e-139f81909106" From e536fcf82a1709c45178547b45d874b2dbd8ed47 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 9 Oct 2026 10:57:48 +0100 Subject: [PATCH 3/3] fix(ci): check out refs/tags/ on a manual release run actions/checkout resolves an unqualified ref to a branch of that name before a tag (src/ref-helper.ts:52-57 at the pinned SHA). If a branch named like the tag existed, a manual run would package that branch, while the release job only confirms that the tag exists. Both checkouts now pass refs/tags/ on a manual run, and an empty ref (the triggering ref) on push and pull_request runs, as before. Raised by CodeRabbit on hyperpolymath/Causals.jl#69. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016XJoh8YA2sCWQmq93CF8RX --- .github/workflows/release.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d6598fb..60a6fe2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,11 +31,13 @@ jobs: shell: bash steps: # On a manual run, build the tag being released, not the default branch, - # so the artefacts match the tagged and registered tree. On other events - # inputs.version is empty and checkout uses the triggering ref. + # so the artefacts match the tagged and registered tree. The ref is + # qualified as refs/tags/: checkout resolves a bare name to a branch of + # that name before a tag (src/ref-helper.ts). On other events + # inputs.version is empty, ref is empty, and checkout uses the triggering ref. - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: - ref: ${{ inputs.version }} + ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || '' }} - uses: julia-actions/setup-julia@fa02766e078afaaf09b14210362cee14137e6a32 # v3.0.2 with: version: ${{ matrix.julia-version }} @@ -64,7 +66,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: - ref: ${{ inputs.version }} + ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || '' }} - uses: julia-actions/setup-julia@fa02766e078afaaf09b14210362cee14137e6a32 # v3.0.2 with: version: '1.10'