ci: prepare manual pre-alpha PyPI publishing

[UlloaSP]

Prepare mlbundle 0.1.0a1 for the first explicitly owner-requested PyPI upload to reserve the name. Publishing remains manual, restricted to main, and gated by the existing pypi_env environment and its UlloaSP approval. This PR does not publish, trigger a publish run, create a tag/release, or change repository settings.

publish.yml has two jobs: reusable CI and upload. CI builds one immutable wheel/sdist artifact, checks metadata/README with strict Twine validation, checks archive contents and identical package bytes, runs isolated base-wheel smoke checks, and installs that exact wheel for the full Ubuntu/Windows test suites. Lint/types also gate the reusable workflow's completion. Upload only downloads those same files; it never rebuilds. Only upload has id-token: write, with OIDC and pypa/gh-action-pypi-publish@release/v1; no token or secret is added. A single concurrency group prevents overlapping publish runs. Read-only GitHub API checks confirm pypi_env requires reviewer UlloaSP and permits branch main only.

The version and lockfile, package version assertions and deterministic ZIP expectations are updated. README links and the Documentation project URL now target main, installation uses --pre, and README/SECURITY clearly disclose the unfinished format and lack of independent security review. The narrowly revised publishing rule stays in the 300-line root AGENTS.md. Owner instructions live in docs/publishing.md.

Publishing happens only on the owner's explicit request for that specific version. The owner, or an agent on that explicit request, runs the workflow. Agents never run or approve it on their own initiative or add another publish path, token or secret. No GitHub releases or version tags are created; tags still means GitHub repository topics.

Publishing steps for the owner, or an agent on the owner's explicit request:

1. After review/merge into develop, integrate this change into main through the usual reviewed process.
2. Confirm the registered PyPI pending publisher: project mlbundle, owner UlloaSP, repository mlbundle, workflow publish.yml, environment pypi_env. Confirm pypi_env still requires UlloaSP and permits only main.
3. Open Actions → Publish to PyPI → Run workflow, select main, and run it once.
4. Wait for all reusable CI checks, inspect the commit and the distributions wheel/sdist artifact, then arrange the explicitly authorized pypi_env approval.
5. Check the 0.1.0a1 PyPI files and install on Python 3.14 with python -m pip install --pre "mlbundle[sklearn]".

Local verification (Python 3.14.7 / uv 0.12.19):

• uv sync: lock regenerated; version changed from 0.1.0 to 0.1.0a1 without dependency changes.
• uv run ruff check .: All checks passed!; uv run ruff format --check .: 166 files already formatted.
• uv run pyright: 0 errors, 0 warnings, 0 informations.
• uv run pytest: 1476 passed in 93.33s; branch-inclusive coverage 91.88% (80% required). Ran against the installed built wheel with sync disabled; an external pytest plugin changed the test process's working directory to temp before collection, keeping CatBoost writes outside the checkout.
• CI-equivalent wheel-suite command from temp, with --no-sync and --cov-config=C:/software/mlbundle/pyproject.toml: 1476 passed in 88.50s, branch-inclusive 91.88%; Required test coverage of 80.0% reached.
• Latest README checks after the authorization wording update: 7 passed in 5.80s.
• Focused publish/manifest/writer checks: 111 passed in 0.86s; includes non-main refs, existing versions, HTTP failures, network/timeout failures, and old/pre-release writer versions.
• uv build: wheel and source archive built successfully; uvx twine check --strict dist/*: both PASSED.
• uv run python scripts/package_smoke.py create <temp>/smoke.mlbundle: sklearn export/load/predict and composite fixture OK; contents dist: type marker/catalog/license present, package bytes match, no tests/caches/CatBoost output/work artifacts.
• Clean base wheel: base wheel: import/help/inspect OK; optional libraries absent; composite inspect and bounded missing dependency OK; mlbundle.__version__ prints 0.1.0a1; CLI inspect of C:/software/models/best_BP_SHAP.mlbundle exits 0 with claims explicitly unverified.
• Clean wheel with sklearn/CatBoost/ONNX extras constrained to the lockfile: CLI verify and native load succeed for best_BP_SHAP.mlbundle and best_BP_SHAP.onnx.mlbundle, both written by 0.1.0; source SHA-256 values unchanged. CatBoost runs from temp.
• Wheel 142656 bytes; sdist 111528 bytes, 99 archive entries each. Both metadata records show 0.1.0a1, Requires-Python: >=3.14, MIT license, all six extras and the four expected project URLs. Both include LICENSE and py.typed; archive inventories were inspected.
• Downloaded actionlint 1.7.12 in an external temp folder: both workflows pass with exit 0 and no diagnostics.
• Repository grep: no plain pypi environment references, no relative README links. All source/test/document/workflow/TOML files are at most 300 lines; AGENTS.md 300, README.md 297, SECURITY.md 280.

Not verified: actual PyPI/OIDC upload and the owner's approval gate, which require the later explicitly owner-requested workflow. Only two C:/software/models/*.mlbundle files exist, so the third file mentioned in the original brief could not be checked. No validator change was needed: writer versions are compared within each bundle, not against the installed reader.

Latest PR CI passed for commit f7386ea38706fa61ffb3433b80e362e9a035b53a: run 38375627342. Ubuntu: 1476 passed in 92.09s; Windows: 1476 passed in 125.24s. Both measured branch-inclusive 91.88% and printed Required test coverage of 80.0% reached. Build, lint, types, strict Twine checks and both clean base-wheel smoke checks passed. The test command explicitly reads the coverage configuration while running from temp, preserving branch measurement and the 80% minimum. The PR remains unmerged.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 614ba02d-0d50-465e-bd15-871f569a2462

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}