ci: add generation slsa for release

[dzhalaevd]

Summary by CodeRabbit

• Release Verification

  • Added SLSA provenance generation and verification for published wheel and source distributions.
  • Provenance files are published alongside release artifacts and checked against the release tag and source repository.
  • Added checksum generation and validation for distribution files.
  • Replaced per-artifact attestation verification with SLSA provenance verification.

• Linting

  • Added checks that reject runtime uses of typing.TYPE_CHECKING branches.
  • Added automated tests for the new lint rule.

• Documentation

  • Documented provenance generation for the exact packages published to PyPI.

Related issue

Closes #19

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: aadf3f0c-f8c1-4800-a4c4-fc16dcc78e6a

📥 Commits

Reviewing files that changed from the base of the PR and between 575382a and 3f5c256.

📒 Files selected for processing (12)

• .github/workflows/ci.yml
• .pre-commit-config.yaml
• changelog.d/+no-type-checking.ci.md
• lint/rule-tests/no-type-checking-test.yml
• lint/rules/no-type-checking.yml
• ruff.toml
• sgconfig.yml
• src/caxton/_internal/backends/openpyxl/__init__.py
• src/caxton/_internal/backends/openpyxl/__init__.pyi
• src/caxton/_internal/templates/xlsx.py
• src/caxton/core/protocols/__init__.py
• src/caxton/core/protocols/__init__.pyi

💤 Files with no reviewable changes (2)

• src/caxton/_internal/backends/openpyxl/init.py
• src/caxton/core/protocols/init.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The workflows now generate, verify, and publish SLSA provenance for release distributions. The repository also adds CAXTON001 ast-grep checks for runtime TYPE_CHECKING usage and adds stubs for lazy exports.

Changes

SLSA provenance release flow

Layer / File(s)	Summary
Distribution hash outputs .github/workflows/ci.yml	The build workflow creates SHA256SUMS inside dist, base64-encodes it, and exposes it as the hashes output.
Provenance generation and release assets .github/workflows/release.yml, changelog.d/19.ci.md	The release workflow generates provenance from distribution hashes, verifies one provenance file, and uploads it with release distributions.
PyPI provenance verification .github/workflows/publish.yml	The publish workflow downloads provenance, validates its count and checksums, and verifies both distributions with slsa-verifier.

TYPE_CHECKING lint enforcement

Layer / File(s)	Summary
TYPE_CHECKING rule and validation sgconfig.yml, .pre-commit-config.yaml, lint/rules/no-type-checking.yml, lint/rule-tests/no-type-checking-test.yml, changelog.d/+no-type-checking.ci.md	The repository configures ast-grep hooks and adds tested rule CAXTON001 for runtime TYPE_CHECKING usage.
Runtime imports and package stubs src/caxton/_internal/backends/openpyxl/*, src/caxton/_internal/templates/xlsx.py, src/caxton/core/protocols/*, ruff.toml	The modules remove TYPE_CHECKING-only imports, make PivotDescriptor a runtime import, and add stubs for lazy exports. Ruff ignores undefined names for the lazy-export modules.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Build
  participant Provenance
  participant Release
  participant Publish
  Build->>Provenance: Provide distribution hashes and version
  Provenance->>Release: Generate provenance artifact
  Release->>Release: Verify checksums and provenance
  Release->>Publish: Publish distributions and provenance
  Publish->>Publish: Verify distributions with SLSA

Loading

Merge Risk: ⚪ Minimal · up to 3f5c2

The new lint rule also rejects aliased typing.TYPE_CHECKING guards, so no actionable issue remains.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The pull request includes changes unrelated to issue #19. The new CAXTON001 TYPE_CHECKING lint rule, its tests and configuration, the TYPE_CHECKING source edits, new type stubs, and the `ruff.to…	Remove the unrelated lint, type-checking, stub, and Ruff changes from this pull request, or link them to a separate issue and submit them separately.
Description check	⚠️ Warning	The description includes the related issue but omits the required Summary section and does not explain the changes or technical decisions.	Add a Summary section that describes SLSA provenance generation, artifact verification, checksum updates, and the related lint changes. Keep the existing Related issue section with Closes #19.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Issue #19 requirements are met. The existing CI build job creates and validates one wheel and one sdist, writes dist/SHA256SUMS, and exports its base64 contents as hashes. The release workflow p…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Title check	✅ Passed	The title identifies the main change: adding SLSA generation for releases. It is concise and related to the changeset, although the wording could be more grammatical.

Full details: Out of Scope Changes check

Explanation

The pull request includes changes unrelated to issue #19. The new CAXTON001 TYPE_CHECKING lint rule, its tests and configuration, the TYPE_CHECKING source edits, new type stubs, and the ruff.toml ignores do not implement or verify SLSA provenance for PyPI artifacts.

• Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.28%. Comparing base (80d6847) to head (3f5c256).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #54      +/-   ##
==========================================
- Coverage   89.29%   89.28%   -0.01%     
==========================================
  Files         121      121              
  Lines        7564     7562       -2     
  Branches      995      995              
==========================================
- Hits         6754     6752       -2     
  Misses        547      547              
  Partials      263      263              

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.