fix(release): correct the checksum manifest and the provenance declaration

[Radiergummi]

0.1.1 reached npmjs with provenance, but the PyPI and GitHub Packages jobs both failed. Two separate bugs, both mine, both of which a local test would have caught before a tag was cut and made immutable.

1. Checksum manifest paths

sha256sum dist/* embeds the dist/ prefix in every line, while the publish job verifies the manifest after cd dist. Every path therefore resolved to dist/dist/…:

sha256sum: dist/matchory_coding_style-0.1.1-py3-none-any.whl: No such file or directory

The npm job survived only because it happens to checksum a bare filename.

Now generated from inside dist/ with explicit *.whl / *.tar.gz patterns, so the manifest holds bare names and can never checksum itself.

2. publishConfig.provenance is baked into the tarball

I omitted --provenance from the GitHub Packages publish and withheld id-token from that job deliberately, since GitHub Packages neither displays nor verifies provenance. But publishConfig.provenance: true travels inside the published tarball, so npm attempted provenance anyway:

npm error Provenance generation in GitHub Actions requires "write" access to the "id-token" permission

Removed the declaration. The npmjs job passes --provenance explicitly, so intent is per-registry rather than per-tarball. npmjs provenance is unaffected — 0.1.1 already carries attestations, which proves the flag alone suffices.

The missing test, now present

CI round-trips the checksum manifest exactly as the release verifies it, and asserts it still fails on a tampered artefact — a check that always passes is worse than none. Verified locally in both directions.

A path-prefix mistake here is invisible until a tag is already cut and immutable, which is why it needed a test rather than care.

Version

0.1.2, because tags cannot be moved here. 0.1.1 stays on npmjs as a superseded version rather than being retracted; PyPI has no 0.1.1. The three ecosystems are aligned again from 0.1.2 onward, and the changelog records the split so nobody has to work it out from workflow logs.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.