v0.3.1 - Hardened retrieval-evidence Action

v0.3.1 - Hardened retrieval-evidence Action

v0.3.1 is a focused hardening and release-integrity patch for the model-free
necs-validate preflight and its composite GitHub Action. TREC validation
semantics are unchanged from v0.3.0.

The reviewed release source is merge commit
6fefdad10b60e71eedfcedee1491d6e043ebe670,
merged by PR #14.

Security hardening

The Action now invokes the validator file bundled with the selected Action
revision through $GITHUB_ACTION_PATH in Python isolated mode. This closes the
caller-package and inherited-PYTHONPATH shadowing paths covered by the
regression tests. It also rejects empty qrels/run inputs and strictness
values other than exact true or false, and reports clearly when Python 3.9
or newer is unavailable.

Verification added

• PR-head CI run
  29687925252
  passed all 10 jobs at
  02e2d3b92cce2f0051a9ea91329adadc0f03e425: Python 3.9-3.14, package smoke,
  and Action smoke on Linux, macOS, and Windows.
• Exact-merge main CI run
  29688129985
  passed the same 10-job suite at
  6fefdad10b60e71eedfcedee1491d6e043ebe670.
• Caller-package and inherited-PYTHONPATH shadowing regression coverage.
• CI builds exactly one wheel and one source archive, checks both with Twine,
  and installs/exercises the uniquely selected wheel outside the source
  checkout.
• The merge adds Verify published release assets, configured to require
  exactly one manifest, wheel, and source archive; verify exact manifest
  membership and hashes; and install/smoke both archives in separate clean
  environments. This describes workflow capability, not a completed
  post-publication run.
• Correct LF raw-byte and Windows CRLF checkout SHA-256 labels in the two
  maintainer-run v0.3.0 compatibility reports on main.

Artifact checksums

The attached NEURAL_V031_SHA256SUMS.txt covers exactly these two archives:

• wheel: ffb2b2f42f8f08817800aaeb2c493f6b9ae2e12db93281268e9d1c351054d4b5;
• source archive: 3935c95fb88cd64215157a394fb87e27d568aa6aa993752c0cec4df75bfbace4.

Use

name: Validate retrieval evidence

on: [push, pull_request]

permissions:
  contents: read

jobs:
  validate-run:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
      - uses: Madhvansh/Neural-E-Commerce-Search@6fefdad10b60e71eedfcedee1491d6e043ebe670 # v0.3.1 source commit
        with:
          qrels: evaluation/qrels.txt
          run: evaluation/run.txt

The full release-source SHA above is the strongest immutable pin. Once the
v0.3.1 tag is public, users of v0.3.0 may choose the readable tag or the full
SHA according to their update policy. The validator's file-format rules, CLI
arguments, and strictness defaults are unchanged.

Published-asset verification

Source CI is linked above. Verification of the uploaded wheel, source archive,
and checksum manifest is a separate post-publication gate: after all three
assets are public, manually dispatch Verify published release assets for
v0.3.1. Do not add a passed-status claim or run URL to these notes until that
manual run succeeds.