Metadata-Version: 2.5
Name: release-certify
Version: 1.1.0
Summary: Deterministic release certification from repository-owned evidence.
Project-URL: Homepage, https://github.com/cweedman1/release-certify
Project-URL: Documentation, https://github.com/cweedman1/release-certify#readme
Project-URL: Repository, https://github.com/cweedman1/release-certify
Project-URL: Issues, https://github.com/cweedman1/release-certify/issues
Author: Release Certify Contributors
License: MIT License
        
        Copyright (c) 2026 Release Certify Contributors
        
        Permission is hereby granted, free of charge, to any person obtaining a copy
        of this software and associated documentation files (the "Software"), to deal
        in the Software without restriction, including without limitation the rights
        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
        copies of the Software, and to permit persons to whom the Software is
        furnished to do so, subject to the following conditions:
        
        The above copyright notice and this permission notice shall be included in all
        copies or substantial portions of the Software.
        
        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
        SOFTWARE.
License-File: LICENSE
Keywords: certification,ci,packaging,quality,release
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Software Development :: Build Tools
Classifier: Typing :: Typed
Requires-Python: >=3.11
Requires-Dist: pyyaml>=6.0
Provides-Extra: dev
Requires-Dist: build>=1.2; extra == 'dev'
Requires-Dist: mypy>=1.10; extra == 'dev'
Requires-Dist: pytest-cov>=5.0; extra == 'dev'
Requires-Dist: pytest>=8.2; extra == 'dev'
Requires-Dist: ruff>=0.5; extra == 'dev'
Requires-Dist: twine>=5.1; extra == 'dev'
Description-Content-Type: text/markdown

# Release Certify

[![CI](https://github.com/cweedman1/release-certify/actions/workflows/release-certify-package.yml/badge.svg)](https://github.com/cweedman1/release-certify/actions/workflows/release-certify-package.yml)
[![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/downloads/)
[![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)

Release Certify proves that the exact Python artifact you are about to release passed your repository's declared quality, packaging, installation, and runtime checks.

```console
uv tool install release-certify
cd your-python-project
release-certify
```

Prefer `pipx`? Install the same isolated command with:

```console
pipx install release-certify
```

Release Certify reads `release.evidence.yaml`, runs every declared check, installs the release in a clean environment, verifies its public imports and startup command, and writes a deterministic certificate. Exit code `0` means the evidence was certified; exit code `1` means it was not.

It does not replace Ruff, MyPy, or pytest. It proves that all of them—and the installable result—agree that this release is ready.

## Contract

This application example is ready to copy into `release.evidence.yaml`; replace the commands and import with your repository's actual release process.

```yaml
release:
  kind: application

quality:
  lint:
    command: python -m ruff check .
  typing:
    command: python -m mypy .
  tests:
    command: python -m pytest -q

packaging:
  install:
    command: python -m pip install -r requirements.txt

runtime:
  smoke:
    - command: python app.py --help
      expected_exit: 0

imports:
  - my_app

artifact:
  type: source-tree
```

Run `release-certify` from the repository root. A failure identifies the missing proof and the next action.

## Commands

```console
release-certify
release-certify --verbose
release-certify --json
release-certify --output release_certificate.json
release-certify --root path/to/repository
release-certify inspect
release-certify inspect --json
release-certify --help
release-certify --version
```

### Inspect repository evidence

`release-certify inspect` performs a read-only inspection and displays a non-authoritative starter contract when the existing deterministic inference can support one:

```console
release-certify inspect
release-certify inspect --json
release-certify inspect --root path/to/repository
```

Inspection reports repository facts as `OBSERVED`, contract suggestions as `INFERRED`, and decisions that require an engineer as `UNRESOLVED`. It does not run certification, use cached evidence as proof, create a certificate, or claim release readiness. Suggested commands are unreviewed policy proposals even when repository tool configuration supports them. Inspection does not parse or execute CI workflows.

By default, inspection writes nothing. Copy the displayed proposed YAML into `release.evidence.yaml` only after reviewing it against the repository's actual release policy. When an explicit contract already exists, inspection reports it and does not propose a replacement. `--output <path>` explicitly writes inspection JSON; it never writes or overwrites `release.evidence.yaml` implicitly.

### Evidence diagnostics

Use `--verbose` to inspect why category evidence was executed or reused, including deterministic cache fingerprints and invalidation reasons. When a freshly executed provider command fails, Release Certify displays a bounded excerpt of that provider's stdout and stderr. The provider output remains the provider's testimony; Release Certify does not reinterpret Ruff, MyPy, pytest, or arbitrary declared tools. Raw provider streams are not persisted in certificates or cache.

Release Certify remains evidence-driven and fail-closed: missing, invalid, ambiguous, or failed required evidence cannot produce a successful certificate.

## What certification means

A successful certificate says `EVIDENCE CERTIFIED`: the declared commands passed for the byte-identified artifact in the recorded environment. It does not claim that those commands are adequate or that untested environments are safe. The [Certificate Trust Model](docs/CERTIFICATE_TRUST_MODEL.md) defines the exact guarantee and its limits.

## Development

```console
python -m pip install -e ".[dev]"
python -m ruff check .
python -m mypy src tests benchmarks tools
python -m pytest
python benchmarks/mutation_benchmark.py
```

See [CONTRIBUTING.md](CONTRIBUTING.md) for the contribution and pull-request process.
