# EVERY JOB THAT MUST HAVE CONCLUDED `success` AT A `v*` TAG BEFORE PUBLISHING IS APPROVED.
#
# The expectation is pinned here so that shrinking it is a reviewable diff.
# `scripts/check_tag_jobs.py` compares it to a tag run's prerequisite jobs by SET EQUALITY, never
# "contains", and refuses an empty list outright — an expectation of nothing is satisfied by
# nothing. The environment-gated `Build artifacts / Publish to PyPI` job stays outside the list,
# but is not optional: the verifier requires exactly one pending instance before approval and one
# successful instance in `--postupload` mode.
#
# `[section]` headers are `workflow_name` as the Actions API reports it; the lines under them are
# `.name` values, not YAML job ids, which differ for a matrix job. Pairing the two is what stops a
# run of some other workflow satisfying the expectation by carrying the right job names.
#
#   gh api repos/golyshevskii/tooprolix/actions/runs/<id>/jobs --paginate > ci.json
#   python scripts/check_tag_jobs.py --tag-sha "$(git rev-parse 'v0.4.8^{commit}')" \
#     --tag-name v0.4.8 ci.json artifacts.json
#
# A `v*` tag fires exactly two workflows: `CI` and `Build artifacts`. `Release-plz` triggers only on
# pushes to `main`, and `release contract` is `pull_request_target`.
#
# `coverage` is listed although it is NOT a required status check: it runs at the tag, and under set
# equality omitting it would fail an otherwise complete run. Required-check membership is decided by
# `ci-required`'s `needs:`.
#
# Run `check_tag_jobs.py` before approving the `pypi` environment. The manifest below is the last
# required preapproval job. After upload, run the same verifier with `--postupload`; Publish is
# deliberately not allowed to certify itself as a prerequisite.

[CI]
ci-python
ci-rust
cargo-doc
coverage
ci-required

[Build artifacts]
sdist (+ the wheel built from it)
wheel linux-x86_64
wheel macos-arm64
wheel windows-x86_64
PyPI release manifest
