From 4fab2247b2d38c6e88a8debb185fc6f1eab45263 Mon Sep 17 00:00:00 2001
From: Fabian Joswig <fjosw@users.noreply.github.com>
Date: Fri, 21 Aug 2026 11:47:13 +0200
Subject: [PATCH 1/2] [ci] Add package-hardening CI that validates and
 smoke-tests built distributions

---
 .github/workflows/package.yml | 48 +++++++++++++++++++++++++++++++++++
 .github/workflows/release.yml |  1 +
 2 files changed, 49 insertions(+)
 create mode 100644 .github/workflows/package.yml

diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
new file mode 100644
index 00000000..465f103d
--- /dev/null
+++ b/.github/workflows/package.yml
@@ -0,0 +1,48 @@
+name: package
+
+on:
+  push:
+    branches:
+      - master
+      - develop
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  package:
+    name: Build and validate distributions
+    runs-on: ubuntu-latest
+    env:
+      SMOKE_ENV: ${{ runner.temp }}/pyerrors-wheel-smoke
+
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v7
+
+      - name: Setup Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Install packaging tools
+        run: python -m pip install --upgrade build twine
+
+      - name: Build source and wheel distributions
+        run: python -m build
+
+      - name: Validate distribution metadata
+        run: python -m twine check --strict dist/*
+
+      - name: Install wheel in a clean environment
+        run: |
+          python -m venv "$SMOKE_ENV"
+          "$SMOKE_ENV/bin/python" -m pip install dist/*.whl
+          "$SMOKE_ENV/bin/python" -m pip check
+
+      - name: Verify installed wheel
+        working-directory: ${{ runner.temp }}
+        run: |
+          "$SMOKE_ENV/bin/python" -c 'import importlib.metadata as metadata; import os; from pathlib import Path; import pyerrors; assert pyerrors.__version__ == metadata.version("pyerrors"); assert not Path(pyerrors.__file__).resolve().is_relative_to(Path(os.environ["GITHUB_WORKSPACE"]).resolve()); print(f"validated {pyerrors.__version__} from {pyerrors.__file__}")'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ebfe8ebf..7a0f1313 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,6 +40,7 @@ jobs:
         if-no-files-found: error
 
   publish:
+    if: github.event_name == 'release'
     needs: [build]
     name: Upload to PyPI
     runs-on: ubuntu-latest

From eb1de5b83dc8f062749fc9921cc0a890bb54f231 Mon Sep 17 00:00:00 2001
From: Fabian Joswig <fjosw@users.noreply.github.com>
Date: Fri, 21 Aug 2026 11:53:25 +0200
Subject: [PATCH 2/2] [Fix] Fix temp dir

---
 .github/workflows/package.yml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index 465f103d..e6c059ec 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -15,8 +15,6 @@ jobs:
   package:
     name: Build and validate distributions
     runs-on: ubuntu-latest
-    env:
-      SMOKE_ENV: ${{ runner.temp }}/pyerrors-wheel-smoke
 
     steps:
       - name: Checkout source
@@ -38,11 +36,11 @@ jobs:
 
       - name: Install wheel in a clean environment
         run: |
-          python -m venv "$SMOKE_ENV"
-          "$SMOKE_ENV/bin/python" -m pip install dist/*.whl
-          "$SMOKE_ENV/bin/python" -m pip check
+          python -m venv "$RUNNER_TEMP/pyerrors-wheel-smoke"
+          "$RUNNER_TEMP/pyerrors-wheel-smoke/bin/python" -m pip install dist/*.whl
+          "$RUNNER_TEMP/pyerrors-wheel-smoke/bin/python" -m pip check
 
       - name: Verify installed wheel
-        working-directory: ${{ runner.temp }}
         run: |
-          "$SMOKE_ENV/bin/python" -c 'import importlib.metadata as metadata; import os; from pathlib import Path; import pyerrors; assert pyerrors.__version__ == metadata.version("pyerrors"); assert not Path(pyerrors.__file__).resolve().is_relative_to(Path(os.environ["GITHUB_WORKSPACE"]).resolve()); print(f"validated {pyerrors.__version__} from {pyerrors.__file__}")'
+          cd "$RUNNER_TEMP"
+          "$RUNNER_TEMP/pyerrors-wheel-smoke/bin/python" -c 'import importlib.metadata as metadata; import os; from pathlib import Path; import pyerrors; assert pyerrors.__version__ == metadata.version("pyerrors"); assert not Path(pyerrors.__file__).resolve().is_relative_to(Path(os.environ["GITHUB_WORKSPACE"]).resolve()); print(f"validated {pyerrors.__version__} from {pyerrors.__file__}")'