ReproCheck 0.11.0b3

ReproCheck 0.11.0b3

The first release published to the real PyPI, and the first one with no long-lived
PyPI secret anywhere in the pipeline.

The distribution on PyPI is reprocheck-cli. The product is still
ReproCheck, the command is still reprocheck, and the importable
package is still reprocheck. The PyPI refuses to register reprocheck for
similarity with an unrelated project that already owns repro-check, so only
the name on the index changed.

pip install reprocheck-cli
reprocheck scan .

What changed since 0.11.0b2

• The distribution was renamed to reprocheck-cli, with the reason recorded in
  pyproject.toml, in CHANGELOG.md and in reprocheck.DISTRIBUTION_NAME.
• The version moved to 0.11.0b3 rather than reusing 0.11.0b2, because
  b2 belonged to the state where the release pipeline was being prepared and
  was never published. Publishing it would have uploaded metadata whose name no
  longer matched the index.
• The release workflow now looks for the artifact name setuptools actually
  writes (reprocheck_cli-…, with an underscore), which is a different string
  from the metadata name.

What has not changed

No functional change. The audit, the rules, the reports, the suggestions, the
fix and the rollback are the same code that 0.11.0b1 shipped.

Publishing

Releases are built and uploaded by .github/workflows/release.yml using
Trusted Publishing. The job is granted id-token: write and nothing else;
the PyPI exchanges that OIDC token for a single-use upload credential. There is
no API token, no .pypirc and no secret in the repository to store, rotate,
leak or revoke. The PyPI also records a digital attestation for every upload.

The workflow refuses to publish when the git tag and the package version
disagree, and the build job runs twine check --strict plus the artifact audit
before anything leaves the runner.

What it does

• Deterministic static audit. One rule per problem, each with a stable id, a
  severity, a confidence and the evidence it fired on. No model, no heuristics
  that change between runs, no network calls.
• Python and dependency consistency checks. Conflicting Python requirements
  across .python-version, pyproject.toml and CI; lockfile coherence;
  dependencies declared in one place and used in another.
• GitHub Actions reference checks. Floating action tags, inconsistent
  versions of the same action, missing local actions.
• Reproduction attempt in an isolated working copy. The analysed project is
  never modified; a fresh result is compared against a saved baseline.
• Optional runtime checks. --runtime-checks imports the project and runs
  pytest collection. It never executes test functions.
• Human-readable reports. JSON for machines, Markdown for people.
• Baselines and diffs. What changed since the last run, as an answer.
• Deterministic fix suggestions. Built from the same facts as the checks, so
  a proposal can never contain something the check did not prove.
• Safe fix application and rollback. A backup and a JSON audit record for
  every change; --rollback restores the original bytes.

Beta limitations

• environment.yml and Conda are not analysed. Dependencies come from
  pyproject.toml and requirements*.txt.
• CI that does not run on GitHub Actions is not analysed.
• setup.py and setup.cfg have limited coverage.
• A project whose version comes from .git can fail to reproduce from a copy.
• A virtual environment is not a security sandbox. reproduce runs the
  analysed project's build backend and --runtime-checks imports its code, with
  your privileges. See SECURITY.md
  and use a container or a VM for code you do not trust.
• Only RC140 has an applicable fix, one suggestion at a time. No "apply all",
  no interactive prompt.
• PASS means only that the checks which ran succeeded. Everything under
  Not verified remains unknown.
• ReproCheck reports facts about a repository. It is not proof that a
  scientific study is reproducible.

Verified

• Python 3.11.16, 3.12.3 and 3.13.15 green locally and in GitHub Actions on the
  same declared matrix.
• Wheel and sdist built, audited, twine check --strict clean, then installed
  and smoke-tested in clean environments — from the local build, from TestPyPI
  and from this release.
• pint, astropy and napari produce identical findings from an installed
  release, a locally built wheel and the published artifact.
• The sha256 digests below are the ones the release job computed before upload
  and that the PyPI reports afterwards.

Assets

reprocheck_cli-0.11.0b3-py3-none-any.whl	171.645 bytes, sha256 03913885…
reprocheck_cli-0.11.0b3.tar.gz	272.076 bytes, sha256 99685fa0…

Reporting

• Issues: https://github.com/RafaelMoreiraDev/ReproCheck/issues
• Support scope: SUPPORT.md
• Security: SECURITY.md