ReproCheck 0.11.0b3

ReproCheck 0.11.0b3

The first release published to the real PyPI, and the first one with no long-lived
PyPI secret anywhere in the pipeline.

The distribution on PyPI is reprocheck-cli. The product is still
ReproCheck, the command is still reprocheck, and the importable
package is still reprocheck. The PyPI refuses to register reprocheck for
similarity with an unrelated project that already owns repro-check, so only
the name on the index changed.

pip install reprocheck-cli
reprocheck scan .

What changed since 0.11.0b2

• The distribution was renamed to reprocheck-cli, with the reason recorded in
  pyproject.toml, in CHANGELOG.md and in reprocheck.DISTRIBUTION_NAME.
• The version moved to 0.11.0b3 rather than reusing 0.11.0b2, because
  b2 belonged to the state where the release pipeline was being prepared and
  was never published. Publishing it would have uploaded metadata whose name no
  longer matched the index.
• The release workflow now looks for the artifact name setuptools actually
  writes (reprocheck_cli-…, with an underscore), which is a different string
  from the metadata name.

What has not changed

No functional change. The audit, the rules, the reports, the suggestions, the
fix and the rollback are the same code that 0.11.0b1 shipped.

Publishing

Releases are built and uploaded by .github/workflows/release.yml using
Trusted Publishing. The job is granted id-token: write and nothing else;
the PyPI exchanges that OIDC token for a single-use upload credential. There is
no API token, no .pypirc and no secret in the repository to store, rotate,
leak or revoke. The PyPI also records a digital attestation for every upload.

The workflow refuses to publish when the git tag and the package version
disagree, and the build job runs twine check --strict plus the artifact audit
before anything leaves the runner.

What it does

• Deterministic static audit. One rule per problem, each with a stable id, a
  severity, a confidence and the evidence it fired on. No model, no heuristics
  that change between runs, no network calls.
• Python and dependency consistency checks. Conflicting Python requirements
  across .python-version, pyproject.toml and CI; lockfile coherence;
  dependencies declared in one place and used in another.
• GitHub Actions reference checks. Floating action tags, inconsistent
  versions of the same action, missing local actions.
• Reproduction attempt in an isolated working copy. The analysed project is
  never modified; a fresh result is compared against a saved baseline.
• Optional runtime checks. --runtime-checks imports the project and runs
  pytest collection. It never executes test functions.
• Human-readable reports. JSON for machines, Markdown for people.
• Baselines and diffs. What changed since the last run, as an answer.
• Deterministic fix suggestions. Built from the same facts as the checks, so
  a proposal can never contain something the check did not prove.
• Safe fix application and rollback. A backup and a JSON audit record for
  every change; --rollback restores the original bytes.

Beta limitations

• environment.yml and Conda are not analysed. Dependencies come from
  pyproject.toml and requirements*.txt.
• CI that does not run on GitHub Actions is not analysed.
• setup.py and setup.cfg have limited coverage.
• A project whose version comes from .git can fail to reproduce from a copy.
• A virtual environment is not a security sandbox. reproduce runs the
  analysed project's build backend and --runtime-checks imports its code, with
  your privileges. See SECURITY.md
  and use a container or a VM for code you do not trust.
• Only RC140 has an applicable fix, one suggestion at a time. No "apply all",
  no interactive prompt.
• PASS means only that the checks which ran succeeded. Everything under
  Not verified remains unknown.
• ReproCheck reports facts about a repository. It is not proof that a
  scientific study is reproducible.

Verified

• Python 3.11.16, 3.12.3 and 3.13.15 green locally and in GitHub Actions on the
  same declared matrix.
• Wheel and sdist built, audited, twine check --strict clean, then installed
  and smoke-tested in clean environments — from the local build, from TestPyPI
  and from this release.
• pint, astropy and napari produce identical findings from an installed
  release, a locally built wheel and the published artifact.
• The sha256 digests below are the ones the release job computed before upload
  and that the PyPI reports afterwards.

Assets

reprocheck_cli-0.11.0b3-py3-none-any.whl	171.645 bytes, sha256 03913885…
reprocheck_cli-0.11.0b3.tar.gz	272.076 bytes, sha256 99685fa0…

Reporting

• Issues: https://github.com/RafaelMoreiraDev/ReproCheck/issues
• Support scope: SUPPORT.md
• Security: SECURITY.md

ReproCheck 0.11.0b1

ReproCheck 0.11.0b1

This is the first public beta of ReproCheck.

ReproCheck audits a Python project for reproducibility problems that are cheap to
fix and expensive to discover later: an untracked data path, a floating action
tag, a dependency pinned in one file and missing from another. It reads the
project, writes a report, and can apply one safe fix with an audit trail.

What it does

• Deterministic static audit. One rule per problem, each with a stable id
  (RC002, RC140, ...), a severity, a confidence and the evidence it fired on.
  The same tree always produces the same findings: no model, no heuristics that
  change between runs, no network calls.
• Python and dependency consistency checks. A single version declaration
  where there should be one, dependencies declared in one place and used in
  another, unpinned or conflicting requirements across pyproject.toml,
  requirements*.txt and lock files.
• GitHub Actions reference checks. Floating action tags, and a version
  declared by one file and required by another.
• Reproduction attempt in an isolated working copy. reprocheck reproduce
  builds an environment for the project in a temporary workspace. The analysed
  project is never modified, and a fresh baseline is compared against the saved
  one so any difference is visible.
• Optional runtime checks. --runtime-checks imports the project and runs
  pytest collection. It never executes test functions.
• Human-readable reports. JSON for machines, Markdown for people, plus a
  terminal summary.
• Baselines and diffs. Save a report as a reference and compare the next one
  against it, so "what changed since the last run" is an answer, not a diff of
  two JSON files by hand.
• Deterministic fix suggestions. The suggestion engine reads the same facts
  as the checks, so a proposal can never contain a pattern the check did not
  prove was missing.
• Safe fix application and rollback. --apply writes a backup and a JSON
  audit record for every change; --rollback restores the original bytes.

Install

pip install reprocheck==0.11.0b1

Requires Python 3.11 or newer. One runtime dependency, packaging.

reprocheck scan .
reprocheck suggest .

Beta limitations

Please read these before trusting a report.

• environment.yml and Conda are not analysed. Dependencies are read from
  pyproject.toml and requirements*.txt.
• CI that does not run on GitHub Actions is not analysed.
• setup.py and setup.cfg have limited coverage.
• A project whose version is derived from .git can fail to reproduce from a
  copy, because the copy is not a repository.
• A virtual environment is not a security sandbox. reproduce runs the
  analysed project's build backend, and --runtime-checks imports its code,
  with your privileges. See SECURITY.md
  before pointing it at code you do not trust, and use a container or a VM.
• Only RC140 has an applicable fix at the moment, one suggestion at a time.
  There is no "apply all" and no interactive prompt.
• PASS means only that the checks which ran succeeded. Anything under
  Not verified — the full test suite, external datasets, remote URLs, index
  state — remains unknown.
• ReproCheck reports facts about a repository. It is not proof that a
  scientific study is reproducible, and it does not attempt to establish that.

Verified

• Python 3.11.16, 3.12.3 and 3.13.15: full suite green locally, and green in
  GitHub Actions on the same matrix.
• Wheel and sdist installed and smoke-tested in clean environments, from this
  release and from the TestPyPI index.
• pint, astropy and napari produce identical findings from an installed
  release, a locally built wheel and the published artifact.

Assets

reprocheck-0.11.0b1-py3-none-any.whl	171.713 bytes, sha256 3186b8a2…
reprocheck-0.11.0b1.tar.gz	272.613 bytes, sha256 190cd8e7…

The sha256 digests of these files are identical to the ones computed locally
before upload, on both PyPI and TestPyPI.

Reporting

Bugs and feature requests: https://github.com/RafaelMoreiraDev/ReproCheck/issues
Support scope: SUPPORT.md
Security: SECURITY.md