Verify every TUI PyPI wheel after upload

[lawrencecchen]

Summary

The stable TUI PyPI publisher preflighted each of the six immutable wheels, but after gh-action-pypi-publish it did not verify that every wheel was visible with the exact build bytes. A successful upload could therefore leave a partial or mismatched registry state unreported.

The publisher now performs a bounded post-upload reconciliation for all six local wheels. It uses PyPI JSON digests.sha256 through the existing registry reconciler, passes the complete six-wheel allowed set, waits up to 120 seconds for propagation, and requires MATCH. Any missing, unexpected, yanked, or mismatched file fails the job. The step never republishes.

The npm path is unchanged. It already uses exact post-write reconciliation for all five packages.

Regression sequence

• b193150277 adds the failing workflow contract.
• 7c8e413073 adds the post-upload six-wheel check.

Verification

• actionlint .github/workflows/tui-publish-pypi.yml .github/workflows/tui-publish-npm.yml
• python3 -m pytest -q tests/test_tui_publish_workflow_security.py (67 passed)
• python3 -m unittest cmux-tui/bindings/tests/test_reconcile_registry_artifact.py -q (55 passed)
• python3 -m pytest -q tests/test_tui_package_contract.py tests/test_tui_npm_package_artifact.py (9 passed)
• git diff --check

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Verifies every TUI PyPI wheel after upload and fails on any mismatch. Previously the publisher preflighted six wheels but did not confirm the post-upload registry state, which could leave partial or mismatched releases unreported.

Review notes

• Adds a post-upload reconciliation step that enumerates six local wheels and checks each against PyPI JSON digests.sha256 via cmux-tui/bindings/reconcile_registry_artifact.py.
• Waits up to 120 seconds for propagation and requires a match; any missing, unexpected, yanked, or mismatched file fails the job. The step never republishes.
• Keeps the npm path unchanged.
• Adds a workflow security test that enforces step ordering (verify runs after publish) and validates the check arguments.

^{Written for commit 7c8e413. Summary will update on new commits.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 65db7c4e-cf06-4a14-8e85-aa9be2085464

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}