Task 13: release plumbing

[roachitect-aman]

Publishes a tagged dbprofiler.py, unmodified, with a checksum and a signed provenance attestation.

The download is byte-identical to the tag

The obvious thing to do at release time is stamp the version into the script. That is exactly what this must not do: the tool's value is that a reviewer reads the file before running it, which only holds if the file they read and the file they ran are the same bytes.

So VERSION is committed before the tag, and the workflow refuses to publish when v$(python dbprofiler.py --version) disagrees with GITHUB_REF_NAME. A guard test fails if any step could rewrite the script — sed -i, tee, patch, or a redirect onto it (with a lookahead sparing the > dbprofiler.py.sha256 that writes the checksum). git show <tag>:dbprofiler.py | diff - dbprofiler.py is empty, and the README says so.

The safety audit gates the release

A tag is the one moment the safety boundary stops being reviewable by reading the repository, so --check-safety and the unit suite run again before anything is uploaded — on Python 3.9, the oldest version the tool claims to support. A guard test asserts the ordering by line index, so moving the publish step above the audit turns the unit suite red.

Guard tests

Eleven of them, written first and mutation-tested. Trigger shape (v* tags only, no branches:, no workflow_dispatch: back door), step ordering, the tag/version gate, checksum generation and re-verification, both assets attached, no rewriting step, provenance attested, contents: read by default with contents: write scoped to the publishing job, no secrets. reference beyond github.token, every action pinned to a major version, and a README that documents the filenames the workflow actually produces.

Six mutations tried — a workflow_dispatch back door, a version-stamping sed -i, dropping the tag/version gate, unpinning the attest action to @main, publishing before the audit, and widening the top-level permission to contents: write. Each was caught by the test written for it and by no other.

Also

• --verify-tag on gh release create: without it gh will happily create the tag it was asked to release, so a typo becomes a release pointing at whatever main was.
• README gains gh attestation verify alongside the checksum — the checksum proves the file survived the transfer, the attestation proves it came from this repository's workflow — plus shasum -a 256 for macOS and a ## Releasing section recording the bump-then-tag ritual the version gate requires.
• Both workflow YAMLs were parsed before commit. A syntax error in a workflow does not fail CI; it silently means the workflow never runs, which for a release path would only be discovered at the tag.

Verification

python3 -m unittest      Ran 382 tests   OK
python3.9 -m unittest    Ran 382 tests   OK
--check-safety           OK (14 SQL constants checked)
ruff check               All checks passed