Scan every customer-readable source distribution surface

[karlwaldman]

Summary

• recursively inspect every customer-readable member in the exact built sdist, including root release/configuration files and future nested package data
• fail closed on unsafe paths, duplicate members, links, special members, oversize text candidates, root/version/provenance drift, and malformed artifacts
• explicitly exclude known binary package data before text-size bounds while retaining oversized readable-text rejection
• retain explicit test/tooling exclusions, remove mutable Free wording from the shipped environment example, and pin the build frontend used in CI/release
• release as 1.12.8

Red-green proof

• RED: initial authored/sdist suite failed 4 new cases; first implementation retained 2 root/workflow failures
• RED follow-up: ordinary PR CI and authored root coverage failed 3 new cases
• RED review follow-up: a future >5 MB .wasm was falsely rejected before binary classification
• GREEN: focused claims/release suite 76/76
• full unit: 637 passed, 13 skipped; 63.58% coverage
• ruff, mypy (46 files), pip-audit (0 vulnerabilities), py_compile, storefront scan (67 surfaces), and diff check green
• warning-free exact wheel+sdist build; exact sdist scan and RECORD-driven installed wheel scan green
• cold exact wheel: pip check, sync/async import, keyless demo 34/34 valid, authenticated sync+async Brent positive/USD/barrel/timezone-aware

Release

After protected-main merge, publish only through the existing governed v1.12.8 PyPI OIDC workflow. Then verify public wheel+sdist hashes/provenance, cold-install the exact registry wheel, run live keyless/authenticated smokes, and observe the scheduled synthetic.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release updates the package to version 1.12.8, extends storefront-claim validation to source distributions, adds CI gates for exact archives, and expands tests for archive safety, content claims, and version consistency.

Changes

Release validation

Layer / File(s)	Summary
Release metadata and public content .env.example, oilpriceapi/version.py, pyproject.toml, CHANGELOG.md	The package version is 1.12.8. Public content removes unsupported entitlement wording.
Source-distribution validator scripts/validate_storefront_claims.py	The validator checks archive paths, members, text content, metadata, package roots, version consistency, and changelog claims. The CLI accepts either --package-root or --sdist.
Continuous integration release gates .github/workflows/publish.yml, .github/workflows/test.yml	Both workflows pin build==1.5.0, build the expected versioned source distribution, and validate it.
Release readiness coverage tests/test_release_readiness.py, tests/test_storefront_claims.py	Tests verify workflow requirements, public-surface discovery, claim detection, archive safety, exclusions, and version consistency.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant Build
  participant SourceDistribution
  participant StorefrontValidator
  ReleaseWorkflow->>Build: build versioned source distribution
  Build->>SourceDistribution: create exact .tar.gz archive
  ReleaseWorkflow->>StorefrontValidator: validate --sdist archive
  StorefrontValidator->>SourceDistribution: inspect members and metadata
  StorefrontValidator-->>ReleaseWorkflow: return validation result

Loading

Possibly related PRs

• OilpriceAPI/python-sdk#84: Extends storefront-claim validation from source files to source distributions.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: scanning all customer-readable source distribution surfaces.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/exhaustive-sdist-claims-1-12-8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/validate_storefront_claims.py`:
- Around line 414-416: Update validate_sdist to exclude members whose suffix is
in BINARY_SUFFIXES before applying the MAX_SDIST_TEXT_BYTES check, allowing
large known binaries such as .wasm files to bypass the text-size failure while
preserving the limit for text candidates. Add a regression test covering a
binary member larger than MAX_SDIST_TEXT_BYTES.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 818f2254-18f1-4c40-925a-acbafeec7f82

📥 Commits

Reviewing files that changed from the base of the PR and between eb40146 and 14fdc9b.

📒 Files selected for processing (9)

• .env.example
• .github/workflows/publish.yml
• .github/workflows/test.yml
• CHANGELOG.md
• oilpriceapi/version.py
• pyproject.toml
• scripts/validate_storefront_claims.py
• tests/test_release_readiness.py
• tests/test_storefront_claims.py