Skip to content

0.7.0 release checklist

Status: tip packaged as 0.7.0. Tip CI must be green before retagging (pre-publish gates run on tip via reusable CI). Configure the pending PyPI Trusted Publisher, then create annotated tag v0.7.0 to publish crates.io + PyPI wheels. See the 0.7 compatibility report.

Preflight

  • ADR-017 accepted; milestone + design docs present
  • python/ package builds (maturin develop)
  • Pytest green locally
  • Pyright green locally
  • Examples run
  • Tip CI includes pre-publish gates: version alignment, cargo publish --dry-run, full 15-wheel validation after install smokes, and cargo audit (narrow R-020 quick-xml ignores only, self-expiring)
  • Tip CI green on main after the R-020 tip exception alignment
  • docs/reports/0.7.md, user guide, parity/roadmap updates prepared
  • Tip checks documented for maintainers (fmt/clippy/test/docs/python)
  • Pending PyPI Trusted Publisher configured for owner eddiethedean, repository oxiland, workflow release.yml, environment pypi
  • Prefer upgrading Oxigraph when a release accepts quick-xml >=0.41 (clears RUSTSEC-2026-0194/0195; tracked as R-020)
  • Delete failed v0.7.0 tag if present, then push a fresh annotated v0.7.0 after tip is green (Release workflow publishes crates.io + PyPI)

Commands

cargo test
cargo clippy --all-targets -- -D warnings
python3 scripts/check-security-exceptions.py
cargo audit --file Cargo.lock --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195
cargo audit --file python/Cargo.lock --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195
cd python && maturin develop && pytest && pyright

Tagging triggers the Release workflow (.github/workflows/release.yml), which re-runs tip CI then publishes: crates.io via CARGO_REGISTRY_TOKEN, followed by PyPI wheels only through OIDC Trusted Publishing. The PyPI job downloads the exact wheels built and install-smoked by CI; it does not rebuild them. Before publication, the workflow validates package metadata, licenses, type declarations, native extension tags, and the embedded CycloneDX SBOM, then records GitHub build provenance attestations. After both registries succeed, it creates or updates the GitHub release with all 15 wheels and SHA256SUMS. Both registries skip versions already present so a partial release can be rerun safely. Source distributions are not published in 0.7.0 (path dependency on the Rust crate).