Refresh packaging and release tooling

Switch checks and release workflows to Pyrefly and generated recovery-kit bundles, remove stale prompt/Playwright packaging hooks, and verify sdists alongside wheels.

Untrack generated recovery kit bundle artifacts so CI can rebuild them for packages and releases.

Author: MinorGlitch

.github/workflows/ci.yml

@@ -16,7 +16,6 @@ on:
       - "pyproject.toml"
       - "uv.lock"
       - "ethernity.spec"
-      - "pyrightconfig.json"
       - "README_PYPI.md"
       - "LICENSE"
   pull_request:
@@ -34,7 +33,6 @@ on:
       - "pyproject.toml"
       - "uv.lock"
       - "ethernity.spec"
-      - "pyrightconfig.json"
       - "README_PYPI.md"
       - "LICENSE"
   workflow_dispatch:
@@ -71,38 +69,16 @@ jobs:
       - name: Ruff format
         run: uv run ruff format --check src tests tooling
 
-  mypy:
+  typecheck:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Setup Python
         uses: ./.github/actions/setup-python
-      - name: Mypy
-        run: uv run mypy src tooling
-
-  pyright:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: Setup Python
-        uses: ./.github/actions/setup-python
-      - name: Pyright
-        run: uv run pyright
-
-  schema:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: Setup Python
-        uses: ./.github/actions/setup-python
-      - name: Validate CLI API schema
-        run: uv run check-jsonschema --check-metaschema docs/cli_api.schema.json
+      - name: Pyrefly
+        run: uv run pyrefly check --output-format=github
 
   typos:
     runs-on: ubuntu-latest
@@ -236,27 +212,51 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Setup Python
         uses: ./.github/actions/setup-python
+      - name: Setup Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: kit/package-lock.json
+      - name: Install kit dependencies
+        working-directory: kit
+        run: npm ci
+      - name: Generate kit bundles for package artifacts
+        working-directory: kit
+        run: node build_kit.mjs
+      - name: Verify generated kit bundles
+        run: |
+          for BUNDLE in \
+            src/ethernity/resources/kit/recovery_kit.bundle.html \
+            src/ethernity/resources/kit/recovery_kit.scanner.bundle.html
+          do
+            test -s "$BUNDLE"
+            SIZE=$(stat -c%s "$BUNDLE" 2>/dev/null || stat -f%z "$BUNDLE")
+            echo "Generated bundle size ($BUNDLE): $SIZE bytes"
+            if [ "$SIZE" -lt 1000 ]; then
+              echo "ERROR: Generated bundle seems too small, may be corrupted: $BUNDLE"
+              exit 1
+            fi
+          done
       - name: Build wheel and sdist
         run: uv build --wheel --sdist --out-dir dist
-      - name: Verify wheel contents
-        run: python3 scripts/check_wheel_contents.py dist/*.whl
+      - name: Verify package contents
+        run: python3 scripts/check_wheel_contents.py dist/*.whl dist/*.tar.gz
       - name: Install built wheel
         run: python3 -m pip install --force-reinstall dist/*.whl
       - name: Smoke test installed package
-        env:
-          ETHERNITY_SKIP_PLAYWRIGHT_INSTALL: "1"
         run: |
-          python3 -c "import ethernity, ethernity.cli.bootstrap.app; print(ethernity.__file__)"
+          python3 -c "import ethernity, ethernity.main; print(ethernity.__file__)"
           python3 -m ethernity --help > /dev/null
           SMOKE_OUT="${RUNNER_TEMP:-/tmp}/ethernity-wheel-smoke"
           rm -rf "$SMOKE_OUT"
           mkdir -p "$SMOKE_OUT"
-          python3 -m ethernity recover \
+          python3 -m ethernity run restore \
             --scan tests/fixtures/v1_2/extension_golden/raw/gzip_replacement_chain/chain/qr_document.pdf \
             --scan tests/fixtures/v1_2/extension_golden/raw/gzip_replacement_chain/chain/extensions/01/qr_document-01-*.pdf \
             --passphrase stable-v1_2-extension-passphrase \
             --output "$SMOKE_OUT/recovered" \
-            --quiet
+            --yes
           test -d "$SMOKE_OUT/recovered"
 
   kit-verify:
@@ -273,50 +273,23 @@ jobs:
           cache: "npm"
           cache-dependency-path: kit/package-lock.json
 
-      - name: Verify committed bundles exist
+      - name: Verify generated bundles are not committed
         run: |
-          for BUNDLE in \
+          TRACKED="$(git ls-files -- \
             src/ethernity/resources/kit/recovery_kit.bundle.html \
-            src/ethernity/resources/kit/recovery_kit.scanner.bundle.html
-          do
-            if [ ! -f "$BUNDLE" ]; then
-              echo "ERROR: No committed bundle found at $BUNDLE"
-              echo "Run 'cd kit && node build_kit.mjs' and commit the bundles."
-              exit 1
-            fi
-            SIZE=$(stat -c%s "$BUNDLE" 2>/dev/null || stat -f%z "$BUNDLE")
-            echo "Committed bundle size ($BUNDLE): $SIZE bytes"
-            if [ "$SIZE" -lt 1000 ]; then
-              echo "ERROR: Bundle seems too small, may be corrupted: $BUNDLE"
-              exit 1
-            fi
-          done
+            src/ethernity/resources/kit/recovery_kit.scanner.bundle.html)"
+          if [ -n "$TRACKED" ]; then
+            echo "ERROR: recovery kit bundles are generated release artifacts and must not be committed."
+            echo "$TRACKED"
+            exit 1
+          fi
 
       - name: Install kit dependencies
         working-directory: kit
         run: npm ci
 
-      - name: Run kit tests
+      - name: Generate kit bundles
         working-directory: kit
-        run: npm test
-
-      - name: Setup Python
-        uses: ./.github/actions/setup-python
-
-      - name: Run kit interoperability tests
-        env:
-          ETHERNITY_SKIP_PLAYWRIGHT_INSTALL: "1"
-        run: uv run pytest tests/unit/test_kit_vectors.py tests/unit/test_kit_interop.py -v
-
-      - name: Install libdeflate tools
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libdeflate-tools
-
-      - name: Verify kit builds successfully
-        working-directory: kit
-        env:
-          ETHERNITY_KIT_GZIP_COMPRESSOR: libdeflate
         run: node build_kit.mjs
 
       - name: Verify build output
@@ -326,11 +299,15 @@ jobs:
           ls -la src/ethernity/resources/kit/recovery_kit.scanner.bundle.html
           ls -la kit/dist/
 
-      - name: Verify bundles are up to date
-        run: |
-          git diff --exit-code -- \
-            src/ethernity/resources/kit/recovery_kit.bundle.html \
-            src/ethernity/resources/kit/recovery_kit.scanner.bundle.html
+      - name: Run kit tests
+        working-directory: kit
+        run: npm test
+
+      - name: Setup Python
+        uses: ./.github/actions/setup-python
+
+      - name: Run kit interoperability tests
+        run: uv run pytest tests/unit/test_kit_vectors.py tests/unit/test_kit_interop.py -v
 
   pip-audit:
     runs-on: ubuntu-latest

.github/workflows/pyinstaller.yml

@@ -233,8 +233,52 @@ jobs:
               time.sleep(poll_seconds)
           PY
 
-  build:
+  kit-bundles:
     needs: precheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: ${{ needs.precheck.outputs.commit_sha }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: kit/package-lock.json
+
+      - name: Install kit dependencies
+        working-directory: kit
+        run: npm ci
+
+      - name: Generate kit bundles
+        working-directory: kit
+        run: node build_kit.mjs
+
+      - name: Prepare kit bundle artifact
+        run: |
+          set -euo pipefail
+          mkdir -p release-kit-bundles
+          cp \
+            src/ethernity/resources/kit/recovery_kit.bundle.html \
+            src/ethernity/resources/kit/recovery_kit.scanner.bundle.html \
+            release-kit-bundles/
+          ls -la release-kit-bundles/
+
+      - name: Upload kit bundle artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6
+        with:
+          name: release-kit-bundles
+          if-no-files-found: error
+          path: release-kit-bundles/*.html
+
+  build:
+    needs: [precheck, kit-bundles]
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     strategy:
@@ -283,6 +327,29 @@ jobs:
       - name: Install build dependencies
         run: uv sync --extra build --frozen
 
+      - name: Download generated kit bundles
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-kit-bundles
+          path: src/ethernity/resources/kit
+
+      - name: Verify generated kit bundles
+        shell: bash
+        run: |
+          set -euo pipefail
+          for BUNDLE in \
+            src/ethernity/resources/kit/recovery_kit.bundle.html \
+            src/ethernity/resources/kit/recovery_kit.scanner.bundle.html
+          do
+            test -s "$BUNDLE"
+            SIZE=$(wc -c < "$BUNDLE")
+            echo "Generated bundle size ($BUNDLE): $SIZE bytes"
+            if [ "$SIZE" -lt 1000 ]; then
+              echo "ERROR: Generated bundle seems too small, may be corrupted: $BUNDLE"
+              exit 1
+            fi
+          done
+
       - name: Build with PyInstaller (onedir)
         run: uv run pyinstaller --clean --noconfirm ethernity.spec
 
@@ -300,12 +367,12 @@ jobs:
           SMOKE_OUT="${RUNNER_TEMP:-/tmp}/ethernity-pyinstaller-smoke"
           rm -rf "$SMOKE_OUT"
           mkdir -p "$SMOKE_OUT"
-          "$BIN" recover \
+          "$BIN" run restore \
             --scan tests/fixtures/v1_2/extension_golden/raw/gzip_replacement_chain/chain/qr_document.pdf \
             --scan tests/fixtures/v1_2/extension_golden/raw/gzip_replacement_chain/chain/extensions/01/qr_document-01-*.pdf \
             --passphrase stable-v1_2-extension-passphrase \
             --output "$SMOKE_OUT/recovered" \
-            --quiet
+            --yes
           test -d "$SMOKE_OUT/recovered"
 
       - name: Package release archive

.gitignore

@@ -35,8 +35,10 @@ htmlcov/
 # Node tooling
 node_modules/
 
-# Kit build outputs (dev only, canonical bundle is in src/ethernity/resources/kit/)
+# Kit build outputs
 kit/dist/
+src/ethernity/resources/kit/recovery_kit*.bundle.html
+test-debug/
 backup-*/
 generated_backups/
 generated_backups_input.txt

.pre-commit-config.yaml

@@ -8,7 +8,6 @@ repos:
       - id: check-toml
       - id: check-added-large-files
         args: ["--maxkb=5000"]
-        exclude: '^src/ethernity/resources/kit/recovery_kit(\.scanner)?\.bundle\.html$'
       - id: check-merge-conflict
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
@@ -20,14 +19,9 @@ repos:
 
   - repo: local
     hooks:
-      - id: pyright
-        name: pyright
-        entry: uv run pyright
-        language: system
-        pass_filenames: false
-      - id: check-jsonschema-cli-api
-        name: check-jsonschema cli api
-        entry: uv run check-jsonschema --check-metaschema docs/cli_api.schema.json
+      - id: pyrefly
+        name: pyrefly
+        entry: uv run pyrefly check
         language: system
         pass_filenames: false
       - id: typos