From b756218be18ca29466465605f8eaf10e7943f399 Mon Sep 17 00:00:00 2001
From: Steve Han <sthan@nvidia.com>
Date: Wed, 12 Aug 2026 14:17:58 -0400
Subject: [PATCH 1/2] fix: validate Core Metadata 2.5 releases

---
 pyproject.toml | 2 +-
 uv.lock        | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 204023e..a021f62 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -86,6 +86,6 @@ testpaths = ["plugins"]
 dev = [
     "dumb-pypi>=1.15.0",
     "pytest>=8.0.0",
-    "twine>=6.0.0",
+    "twine>=7.0.0",
     "zensical>=0.0.40",
 ]
diff --git a/uv.lock b/uv.lock
index 6218578..bd619b8 100644
--- a/uv.lock
+++ b/uv.lock
@@ -528,7 +528,7 @@ dev = [
 dev = [
     { name = "dumb-pypi", specifier = ">=1.15.0" },
     { name = "pytest", specifier = ">=8.0.0" },
-    { name = "twine", specifier = ">=6.0.0" },
+    { name = "twine", specifier = ">=7.0.0" },
     { name = "zensical", specifier = ">=0.0.40" },
 ]
 
@@ -2993,7 +2993,7 @@ wheels = [
 
 [[package]]
 name = "twine"
-version = "6.2.0"
+version = "7.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "id" },
@@ -3006,9 +3006,9 @@ dependencies = [
     { name = "rich" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/e0/a8/949edebe3a82774c1ec34f637f5dd82d1cf22c25e963b7d63771083bbee5/twine-6.2.0.tar.gz", hash = "sha256:e5ed0d2fd70c9959770dce51c8f39c8945c574e18173a7b81802dab51b4b75cf", size = 172262, upload-time = "2025-09-04T15:43:17.255Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/92/3c/58f808a359700f39a967dffede33efeac809262c03303fa3eec6afff8f49/twine-7.0.0.tar.gz", hash = "sha256:85cdb29c518efef867360ae4acd4b0dfd61c8654a22fca08e6f8539f05022177", size = 215032, upload-time = "2026-07-27T15:59:00.825Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/3a/7a/882d99539b19b1490cac5d77c67338d126e4122c8276bf640e411650c830/twine-6.2.0-py3-none-any.whl", hash = "sha256:418ebf08ccda9a8caaebe414433b0ba5e25eb5e4a927667122fbe8f829f985d8", size = 42727, upload-time = "2025-09-04T15:43:15.994Z" },
+    { url = "https://files.pythonhosted.org/packages/96/08/ddcdc06225eaad6de0e48e1002b06d919dbde20582d0662c7af51308e5d6/twine-7.0.0-py3-none-any.whl", hash = "sha256:b854164df26db268af05f49aa5c0344b10e27a494343ff05b1e0bad3b135f5a7", size = 43204, upload-time = "2026-07-27T15:58:59.26Z" },
 ]
 
 [[package]]

From b22342032c1bb3ab61f29f53e11ea038e87c7eb7 Mon Sep 17 00:00:00 2001
From: Steve Han <sthan@nvidia.com>
Date: Wed, 12 Aug 2026 14:41:01 -0400
Subject: [PATCH 2/2] test: validate built distributions before release

---
 Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Makefile b/Makefile
index f436b7f..b2ca79b 100644
--- a/Makefile
+++ b/Makefile
@@ -141,6 +141,7 @@ test-plugin:
 
 build-plugin: validate-release
 	uv build "$(PLUGIN_DIR)" --out-dir dist/
+	uv run twine check dist/*
 
 check-release-state:
 	@test -z "$$(git status --porcelain)" || { echo "ERROR: release worktree must be clean"; git status --short; exit 1; }