Add release-to-pypi-uv composite action

.github/actions/generate-coverage/scripts/run_rust.py

@@ -149,6 +149,14 @@ def get_line_coverage_percent_from_cobertura(xml_file: Path) -> str:
     return _format_percent(covered, total)
 
 
+def _safe_close_text_stream(stream: typ.TextIO | None) -> None:
+    """Close ``stream`` while suppressing any cleanup errors."""
+    if stream is None:
+        return
+    with contextlib.suppress(Exception):
+        stream.close()
+
+
 def _run_cargo(args: list[str]) -> str:
     """Run ``cargo`` with ``args`` streaming output and return ``stdout``."""
     typer.echo(f"$ cargo {shlex.join(args)}")
@@ -160,104 +168,115 @@ def _run_cargo(args: list[str]) -> str:
         encoding="utf-8",
         errors="replace",
     )
-    if proc.stdout is None or proc.stderr is None:
-        msg = "cargo output streams not captured"
-        raise RuntimeError(msg)
-    stdout_lines: list[str] = []
-
-    if os.name == "nt":
-        thread_exceptions: list[Exception] = []
-
-        def pump(src: typ.TextIO, *, to_stdout: bool) -> None:
-            dest = sys.stdout if to_stdout else sys.stderr
-            try:
-                for line in iter(src.readline, ""):
-                    dest.write(line)
-                    dest.flush()
-                    if to_stdout:
-                        stdout_lines.append(line.rstrip("\r\n"))
-            except Exception as exc:  # noqa: BLE001
-                thread_exceptions.append(exc)
-                if os.environ.get("RUN_RUST_DEBUG") == "1" or os.environ.get(
-                    "DEBUG_UTF8"
-                ):
-                    sys.stderr.write(f"Exception in pump thread: {exc}\n")
-                    sys.stderr.write(traceback.format_exc())
-
-        threads = [
-            threading.Thread(
-                name="cargo-stdout",
-                target=pump,
-                args=(proc.stdout,),
-                kwargs={"to_stdout": True},
-                daemon=True,
-            ),
-            threading.Thread(
-                name="cargo-stderr",
-                target=pump,
-                args=(proc.stderr,),
-                kwargs={"to_stdout": False},
-                daemon=True,
-            ),
-        ]
-        for thread in threads:
-            thread.start()
-        # Kill cargo promptly if a pump fails to avoid deadlocks on the other pipe.
-        while True:
+    try:
+        if proc.stdout is None or proc.stderr is None:
+            missing_streams = []
+            if proc.stdout is None:
+                missing_streams.append("stdout")
+            if proc.stderr is None:
+                missing_streams.append("stderr")
+            missing = ", ".join(missing_streams)
+            message = f"cargo output streams not captured: missing {missing}"
+            with contextlib.suppress(Exception):
+                proc.kill()
+            with contextlib.suppress(Exception):
+                proc.wait(timeout=5)
+            _safe_close_text_stream(proc.stdout)
+            _safe_close_text_stream(proc.stderr)
+            typer.echo(f"::error::{message}", err=True)
+            raise typer.Exit(1)
+        stdout_lines: list[str] = []
+
+        if os.name == "nt":
+            thread_exceptions: list[Exception] = []
+
+            def pump(src: typ.TextIO, *, to_stdout: bool) -> None:
+                dest = sys.stdout if to_stdout else sys.stderr
+                try:
+                    for line in iter(src.readline, ""):
+                        dest.write(line)
+                        dest.flush()
+                        if to_stdout:
+                            stdout_lines.append(line.rstrip("\r\n"))
+                except Exception as exc:  # noqa: BLE001
+                    thread_exceptions.append(exc)
+                    if os.environ.get("RUN_RUST_DEBUG") == "1" or os.environ.get(
+                        "DEBUG_UTF8"
+                    ):
+                        sys.stderr.write(f"Exception in pump thread: {exc}\n")
+                        sys.stderr.write(traceback.format_exc())
+
+            threads = [
+                threading.Thread(
+                    name="cargo-stdout",
+                    target=pump,
+                    args=(proc.stdout,),
+                    kwargs={"to_stdout": True},
+                    daemon=True,
+                ),
+                threading.Thread(
+                    name="cargo-stderr",
+                    target=pump,
+                    args=(proc.stderr,),
+                    kwargs={"to_stdout": False},
+                    daemon=True,
+                ),
+            ]
+            for thread in threads:
+                thread.start()
+            # Kill cargo promptly if a pump fails to avoid deadlocks on the other pipe.
+            while True:
+                if thread_exceptions:
+                    with contextlib.suppress(Exception):
+                        proc.kill()
+                    break
+                if not any(t.is_alive() for t in threads):
+                    break
+                for t in threads:
+                    t.join(timeout=0.1)
+            # Ensure all threads have finished before handling results.
+            for thread in threads:
+                thread.join()
             if thread_exceptions:
+                proc.wait()
+                raise thread_exceptions[0]
+        else:
+            sel = selectors.DefaultSelector()
+            try:
+                sel.register(proc.stdout, selectors.EVENT_READ, data="stdout")
+                sel.register(proc.stderr, selectors.EVENT_READ, data="stderr")
+
+                while sel.get_map():
+                    for key, _ in sel.select():
+                        line = key.fileobj.readline()
+                        if not line:
+                            sel.unregister(key.fileobj)
+                            continue
+                        if key.data == "stdout":
+                            typer.echo(line, nl=False)
+                            stdout_lines.append(line.rstrip("\r\n"))
+                        else:
+                            typer.echo(line, err=True, nl=False)
+            except Exception:
+                # Ensure cargo does not outlive the parent if the selector loop fails.
                 with contextlib.suppress(Exception):
                     proc.kill()
-                break
-            if not any(t.is_alive() for t in threads):
-                break
-            for t in threads:
-                t.join(timeout=0.1)
-        # Ensure all threads have finished before closing streams.
-        for thread in threads:
-            thread.join()
-        # Streams are guaranteed non-None by earlier guard.
-        proc.stdout.close()
-        proc.stderr.close()
-        if thread_exceptions:
-            proc.wait()
-            raise thread_exceptions[0]
-    else:
-        sel = selectors.DefaultSelector()
-        try:
-            sel.register(proc.stdout, selectors.EVENT_READ, data="stdout")
-            sel.register(proc.stderr, selectors.EVENT_READ, data="stderr")
-
-            while sel.get_map():
-                for key, _ in sel.select():
-                    line = key.fileobj.readline()
-                    if not line:
-                        sel.unregister(key.fileobj)
-                        continue
-                    if key.data == "stdout":
-                        typer.echo(line, nl=False)
-                        stdout_lines.append(line.rstrip("\r\n"))
-                    else:
-                        typer.echo(line, err=True, nl=False)
-        except Exception:
-            # Ensure cargo does not outlive the parent if the selector loop fails.
-            with contextlib.suppress(Exception):
-                proc.kill()
-            proc.wait()
-            raise
-        finally:
-            sel.close()
-            # Safe due to earlier guard.
-            proc.stdout.close()
-            proc.stderr.close()
-
-    retcode = proc.wait()
-    if retcode != 0:
-        typer.echo(
-            f"cargo {shlex.join(args)} failed with code {retcode}",
-            err=True,
-        )
-        raise typer.Exit(code=retcode or 1)
-    return "\n".join(stdout_lines)
+                proc.wait()
+                raise
+            finally:
+                sel.close()
+
+        retcode = proc.wait()
+        if retcode != 0:
+            typer.echo(
+                f"cargo {shlex.join(args)} failed with code {retcode}",
+                err=True,
+            )
+            raise typer.Exit(code=retcode or 1)
+        return "\n".join(stdout_lines)
+    finally:
+        _safe_close_text_stream(proc.stdout)
+        _safe_close_text_stream(proc.stderr)
 
 
 def _merge_lcov(base: Path, extra: Path) -> None:

.github/actions/generate-coverage/tests/test_scripts.py

@@ -108,7 +108,7 @@ def kill(self) -> None:
             if track_lifecycle:
                 self.killed = True
 
-        def wait(self) -> int:
+        def wait(self, timeout: float | None = None) -> int:
             if track_lifecycle:
                 self.waited = True
             return returncode
@@ -198,6 +198,37 @@ def fake_echo(line: str, *, err: bool = False, nl: bool = True) -> None:
     assert res == "out-line"
 
 
+def test_run_cargo_windows_closes_streams(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """``_run_cargo`` closes captured streams on success."""
+    mod = _load_module(monkeypatch, "run_rust")
+    monkeypatch.setattr(mod.os, "name", "nt")
+    monkeypatch.setattr(mod.typer, "echo", lambda *a, **k: None)
+
+    class TrackingStream(io.StringIO):
+        def __init__(self, value: str) -> None:
+            super().__init__(value)
+            self.close_calls = 0
+
+        def close(self) -> None:
+            self.close_calls += 1
+            super().close()
+
+    stdout = TrackingStream("out-line\n")
+    stderr = TrackingStream("err-line\n")
+    fake_cargo = _make_fake_cargo(stdout, stderr)
+    monkeypatch.setattr(mod, "cargo", fake_cargo)
+
+    result = mod._run_cargo(["llvm-cov"])
+
+    assert result == "out-line"
+    assert stdout.closed
+    assert stderr.closed
+    assert stdout.close_calls >= 1
+    assert stderr.close_calls >= 1
+
+
 def test_run_cargo_windows_nonzero_exit(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
@@ -228,8 +259,8 @@ def test_run_cargo_windows_pump_exception(
 
     class BoomIO(io.StringIO):
         def readline(self) -> str:
-            msg = "boom in pump"
-            raise RuntimeError(msg)
+            message = "boom in pump"
+            raise RuntimeError(message)
 
     fake_cargo = _make_fake_cargo(BoomIO(), io.StringIO(""), track_lifecycle=True)
     monkeypatch.setattr(mod, "cargo", fake_cargo)
@@ -249,9 +280,14 @@ def test_run_cargo_windows_none_stdout(
     monkeypatch.setattr(mod.os, "name", "nt")
     monkeypatch.setattr(mod.typer, "echo", lambda *a, **k: None)
 
-    monkeypatch.setattr(mod, "cargo", _make_fake_cargo(None, "err-line\n"))
-    with pytest.raises(RuntimeError):
+    fake_cargo = _make_fake_cargo(None, "err-line\n")
+    monkeypatch.setattr(mod, "cargo", fake_cargo)
+    with pytest.raises(mod.typer.Exit):
         mod._run_cargo([])
+    proc = fake_cargo.last_proc
+    assert proc is not None
+    assert proc.stderr is not None
+    assert proc.stderr.closed
 
 
 def test_run_cargo_windows_none_stderr(
@@ -262,9 +298,46 @@ def test_run_cargo_windows_none_stderr(
     monkeypatch.setattr(mod.os, "name", "nt")
     monkeypatch.setattr(mod.typer, "echo", lambda *a, **k: None)
 
-    monkeypatch.setattr(mod, "cargo", _make_fake_cargo("out-line\n", None))
-    with pytest.raises(RuntimeError):
+    fake_cargo = _make_fake_cargo("out-line\n", None)
+    monkeypatch.setattr(mod, "cargo", fake_cargo)
+    with pytest.raises(mod.typer.Exit):
         mod._run_cargo([])
+    proc = fake_cargo.last_proc
+    assert proc is not None
+    assert proc.stdout is not None
+    assert proc.stdout.closed
+
+
+def test_run_cargo_stream_close_error_suppressed(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Errors closing streams are suppressed during cleanup."""
+    mod = _load_module(monkeypatch, "run_rust")
+    monkeypatch.setattr(mod.os, "name", "nt")
+    monkeypatch.setattr(mod.typer, "echo", lambda *a, **k: None)
+
+    class ExplodingStream(io.StringIO):
+        def __init__(self, value: str) -> None:
+            super().__init__(value)
+            self.close_calls = 0
+
+        def close(self) -> None:
+            self.close_calls += 1
+            super().close()
+            message = "close failure"
+            raise RuntimeError(message)
+
+    stdout = ExplodingStream("out-line\n")
+    stderr = io.StringIO("err-line\n")
+    fake_cargo = _make_fake_cargo(stdout, stderr)
+    monkeypatch.setattr(mod, "cargo", fake_cargo)
+
+    result = mod._run_cargo(["llvm-cov"])
+
+    assert result == "out-line"
+    assert stdout.close_calls >= 1
+    assert stdout.closed
+    assert stderr.closed
 
 
 def test_run_rust_with_cucumber(tmp_path: Path, shell_stubs: StubManager) -> None:
@@ -510,8 +583,8 @@ def test_lcov_permission_error(
     lcov.write_text("LF:1\nLH:1\n")
 
     def bad_read_text(*_: object, **__: object) -> str:
-        msg = "nope"
-        raise PermissionError(msg)
+        message = "nope"
+        raise PermissionError(message)
 
     monkeypatch.setattr(Path, "read_text", bad_read_text, raising=False)
     with pytest.raises(run_rust_module.typer.Exit) as excinfo:
@@ -679,8 +752,8 @@ def test_cobertura_permission_error(
     xml.write_text("<coverage/>")
 
     def raise_permission_error(*_: object, **__: object) -> object:
-        msg = "denied"
-        raise PermissionError(msg)
+        message = "denied"
+        raise PermissionError(message)
 
     import coverage_parsers
 

.github/actions/release-to-pypi-uv/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+## v1.0.2 (2025-09-18)
+
+- Add a configurable `python-version` input and ensure all uv commands honour
+  it, letting workflows pin their interpreter version.
+- Harden release validation: retry GitHub API lookups with exponential
+  backoff, tighten semantic version detection, and expand TOML validation
+  coverage along with unit tests for the helper scripts.
+
+## v1.0.1 (2025-09-18)
+
+- Document required workflow permissions for trusted publishing, clarify that
+  the action forwards `GITHUB_TOKEN` automatically, and fix the README usage
+  example to reference the local path without a version suffix.
+
+## v1.0.0 (2025-09-18)
+
+- Initial release: resolve release tags, ensure GitHub Release readiness, and
+  publish Python distributions with uv Trusted Publishing support.
+- Validate `pyproject.toml` versions against the release tag and optionally
+  block dynamic version declarations.