ci: prepare PyPI release workflow

.github/workflows/wheels.yml

@@ -10,15 +10,21 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: wheels-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.10"
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+        with:
+          toolchain: 1.94.1
       - run: python -m pip install pytest maturin ruff tomli
       - name: Verify release tag matches package version
         if: startsWith(github.ref, 'refs/tags/')
@@ -34,18 +40,19 @@ jobs:
       matrix:
         target: [x86_64, aarch64]
     steps:
-      - uses: actions/checkout@v4
-      - uses: PyO3/maturin-action@v1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
         with:
           target: ${{ matrix.target }}
           manylinux: auto
           args: --release --out dist
+          rust-toolchain: 1.94.1
           sccache: true
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-linux-${{ matrix.target }}
           path: dist/*.whl
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         if: matrix.target == 'x86_64'
         with:
           python-version: "3.10"
@@ -57,17 +64,18 @@ jobs:
   windows:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: PyO3/maturin-action@v1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
         with:
           target: x64
           args: --release --out dist
+          rust-toolchain: 1.94.1
           sccache: true
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-windows-x86_64
           path: dist/*.whl
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.10"
       - shell: pwsh
@@ -85,17 +93,18 @@ jobs:
             target: aarch64
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: PyO3/maturin-action@v1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
         with:
           target: ${{ matrix.target }}
           args: --release --out dist
+          rust-toolchain: 1.94.1
           sccache: true
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-macos-${{ matrix.target }}
           path: dist/*.whl
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.10"
       - run: python -m pip install dist/*.whl
@@ -109,11 +118,11 @@ jobs:
         python: ["3.10", "3.14"]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python }}
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: wheels-linux-x86_64
           path: dist
@@ -122,20 +131,22 @@ jobs:
       - run: python -c "import _allium_deck_native, allium_deck, sekai_deck_recommend_cpp"
 
   publish:
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     needs: [test, smoke]
     runs-on: ubuntu-latest
     environment: pypi
     permissions:
       id-token: write
       contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           pattern: wheels-*
           path: dist
           merge-multiple: true
-      - uses: pypa/gh-action-pypi-publish@release/v1
-      - uses: softprops/action-gh-release@v2
+      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        with:
+          skip-existing: true
+      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           files: dist/*.whl

Cargo.toml

@@ -10,7 +10,7 @@ name = "_native"
 crate-type = ["cdylib"]
 
 [dependencies]
-allium-deck = { git = "https://github.com/empty-sekai/allium-deck.git", rev = "41495933b2afb86b49242b6cd769f32810db7308" }
+allium-deck = { git = "https://github.com/empty-sekai/allium-deck.git", rev = "2cf7e77736c1d545f0858ec96711feae9e6fcbed" }
 pyo3 = { version = "0.23", features = ["abi3-py310"] }
 serde_json = "1"
 

tests/test_release_workflow.py

@@ -0,0 +1,42 @@
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+WORKFLOW = ROOT / ".github" / "workflows" / "wheels.yml"
+
+
+def workflow_text() -> str:
+    return WORKFLOW.read_text(encoding="utf-8")
+
+
+def test_only_push_tags_can_publish() -> None:
+    workflow = workflow_text()
+    assert "if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')" in workflow
+
+
+def test_all_actions_are_pinned_to_full_commit_sha() -> None:
+    uses = re.findall(r"^\s*- uses: (\S+)", workflow_text(), flags=re.MULTILINE)
+    assert uses
+    for action in uses:
+        assert re.search(r"@[0-9a-f]{40}$", action), action
+
+
+def test_release_toolchain_and_pypi_retry_are_fixed() -> None:
+    workflow = workflow_text()
+    assert "toolchain: 1.94.1" in workflow
+    assert "skip-existing: true" in workflow
+
+
+def test_python_abi_floor_remains_310() -> None:
+    pyproject = (ROOT / "pyproject.toml").read_text(encoding="utf-8")
+    cargo = (ROOT / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'requires-python = ">=3.10,<4"' in pyproject
+    assert 'features = ["abi3-py310"]' in cargo
+
+
+def test_native_binding_pins_the_reviewed_deck_004_release_commit() -> None:
+    cargo = (ROOT / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'rev = "2cf7e77736c1d545f0858ec96711feae9e6fcbed"' in cargo