feat(PLT-1735): golden vector parity — Python side

.github/workflows/ci.yml

@@ -6,17 +6,20 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081  # v5
 
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
@@ -30,10 +33,10 @@ jobs:
   license-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081  # v5
 
       - name: Install dependencies
         run: uv sync --dev
@@ -47,11 +50,14 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: read  # required by actions/dependency-review-action to fetch PR diff
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Dependency review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48  # v4
         with:
           deny-licenses: >-
             GPL-2.0-only, GPL-2.0-or-later,
@@ -60,3 +66,44 @@ jobs:
             LGPL-2.0-only, LGPL-2.0-or-later,
             LGPL-2.1-only, LGPL-2.1-or-later,
             LGPL-3.0-only, LGPL-3.0-or-later
+
+  golden-sync-check:
+    runs-on: ubuntu-latest
+    # Secrets are not available to fork PRs, so skip the check there.
+    # Internal PRs and pushes to main always run it.
+    if: >
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3
+        with:
+          app-id: ${{ secrets.STARFIX_APP_ID }}
+          private-key: ${{ secrets.STARFIX_APP_PRIVATE_KEY }}
+          repositories: starfix
+
+      - name: Fetch authoritative fixture from starfix
+        run: |
+          gh api repos/nauticalab/starfix/contents/tests/golden/include_metadata_v0.3.json \
+            --jq '.content' | base64 -d > /tmp/upstream.json
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+
+      - name: Fail on fixture drift
+        run: |
+          if [ ! -s /tmp/upstream.json ]; then
+            echo "ERROR: Could not fetch fixture from nauticalab/starfix main."
+            echo "Ensure nauticalab/starfix#main has tests/golden/include_metadata_v0.3.json"
+            echo "(starfix PLT-1735 PR must be merged before this check can pass)"
+            exit 1
+          fi
+          if ! diff tests/golden/include_metadata_v0.3.json /tmp/upstream.json; then
+            echo "ERROR: tests/golden/include_metadata_v0.3.json has drifted from nauticalab/starfix main."
+            echo "Copy the updated fixture from the starfix repo and commit it."
+            exit 1
+          fi

.github/workflows/release.yml

@@ -0,0 +1,40 @@
+name: release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version (e.g. 0.3.0)'
+        required: true
+        type: string
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Tag and push release
+        run: |
+          # Strip a leading 'v' if the operator included one (e.g. "v0.3.0" → "0.3.0"),
+          # then always prefix with 'v' so the tag is exactly "v0.3.0".
+          VERSION="${{ inputs.version }}"
+          VERSION="${VERSION#v}"
+          git tag "v${VERSION}"
+          git push origin "v${VERSION}"