From 203209f4bed6831d8084a22373ba2ba5f97cd43a Mon Sep 17 00:00:00 2001
From: Munawar Shah <93397215+mwrshah@users.noreply.github.com>
Date: Wed, 12 Aug 2026 23:38:46 +0500
Subject: [PATCH] Make codedecorum package clean and PyPI-publishable

- Remove orphaned test fixtures from src/ root (cd001-003, test_cd005);
  nothing referenced them, tests write inputs inline via tmp_path.
- Scope hatchling build: wheel packages = src/codedecorum, explicit sdist
  include, so only the package (+ tests/README/LICENSE) ships.
- Add PEP 561 py.typed marker; codedecorum.api is a public plugin surface.
- Fill project metadata: authors, project.urls, keywords.
- Expose __version__ via importlib.metadata.
- Add tag-triggered PyPI publish workflow (OIDC Trusted Publishing).
- Drop approvals.py from the CD006 self-guard: locking the lock machinery
  behind its own lock adds friction without protection.
---
 .github/workflows/publish.yml | 17 +++++++++++++++++
 pyproject.toml                | 14 +++++++++++++-
 src/cd001_fixture.js          | 19 -------------------
 src/cd002_fixture.py          |  1 -
 src/cd003_fixture.py          |  2 --
 src/codedecorum/__init__.py   |  8 ++++++++
 src/codedecorum/py.typed      |  0
 src/test_cd005_fixture.py     |  2 --
 8 files changed, 38 insertions(+), 25 deletions(-)
 create mode 100644 .github/workflows/publish.yml
 delete mode 100644 src/cd001_fixture.js
 delete mode 100644 src/cd002_fixture.py
 delete mode 100644 src/cd003_fixture.py
 create mode 100644 src/codedecorum/py.typed
 delete mode 100644 src/test_cd005_fixture.py

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..82326ab
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,17 @@
+name: Publish
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uv build
+      - run: uv publish
diff --git a/pyproject.toml b/pyproject.toml
index 5b170b1..c17c764 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -9,6 +9,8 @@ description = "Run code-backed policy rules across Git repository changes"
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.11"
+authors = [{ name = "Munawar Shah" }]
+keywords = ["linter", "policy", "git", "tree-sitter", "code-quality", "ai"]
 dependencies = [
     "pygments>=2.19.2",
     "tree-sitter>=0.25.2,<0.27",
@@ -23,9 +25,20 @@ classifiers = [
   "Topic :: Software Development :: Quality Assurance",
 ]
 
+[project.urls]
+Homepage = "https://github.com/mwrshah/codedecorum"
+Repository = "https://github.com/mwrshah/codedecorum"
+Issues = "https://github.com/mwrshah/codedecorum/issues"
+
 [project.scripts]
 codedecorum = "codedecorum.cli:main"
 
+[tool.hatch.build.targets.wheel]
+packages = ["src/codedecorum"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/codedecorum", "tests", "README.md", "LICENSE"]
+
 [dependency-groups]
 dev = [
   "pytest>=8.4.1",
@@ -38,7 +51,6 @@ paths = [
   "pyproject.toml",
   "README.md",
   "src/codedecorum/api.py",
-  "src/codedecorum/approvals.py",
   "src/codedecorum/cli.py",
   "src/codedecorum/config.py",
   "src/codedecorum/engine.py",
diff --git a/src/cd001_fixture.js b/src/cd001_fixture.js
deleted file mode 100644
index ca866f4..0000000
--- a/src/cd001_fixture.js
+++ /dev/null
@@ -1,19 +0,0 @@
-const first = 1;
-
-/*
- * First complete standalone comment block.
- * It should be reported as one CD001 violation.
- */
-const second = first + 1;
-
-/*
- * Second complete standalone comment block.
- * It should be reported as one CD001 violation.
- */
-test("embedded fixture", () => second === 2);
-
-/*
- * Third complete standalone comment block.
- * It should be reported as one CD001 violation.
- */
-const third = second + 1;
diff --git a/src/cd002_fixture.py b/src/cd002_fixture.py
deleted file mode 100644
index da0a619..0000000
--- a/src/cd002_fixture.py
+++ /dev/null
@@ -1 +0,0 @@
-value = 1  # This trailing comment is intentionally longer than the permitted forty characters.
diff --git a/src/cd003_fixture.py b/src/cd003_fixture.py
deleted file mode 100644
index 47f1418..0000000
--- a/src/cd003_fixture.py
+++ /dev/null
@@ -1,2 +0,0 @@
-def unfinished_fixture() -> None:
-    pass
diff --git a/src/codedecorum/__init__.py b/src/codedecorum/__init__.py
index e69de29..3492bce 100644
--- a/src/codedecorum/__init__.py
+++ b/src/codedecorum/__init__.py
@@ -0,0 +1,8 @@
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("codedecorum")
+except PackageNotFoundError:
+    __version__ = "0.0.0"
+
+__all__ = ["__version__"]
diff --git a/src/codedecorum/py.typed b/src/codedecorum/py.typed
new file mode 100644
index 0000000..e69de29
diff --git a/src/test_cd005_fixture.py b/src/test_cd005_fixture.py
deleted file mode 100644
index ab94007..0000000
--- a/src/test_cd005_fixture.py
+++ /dev/null
@@ -1,2 +0,0 @@
-def durable_fixture() -> bool:
-    return True