ci: verify installed distributions

.github/workflows/ci.yml

@@ -37,7 +37,7 @@ jobs:
             requirements*.txt
 
       - name: Install build tooling
-        run: python -m pip install "build==1.2.2.post1"
+        run: python -m pip install "build==1.2.2.post1" "twine==7.0.0"
 
       - name: Build source and wheel distributions
         run: python -m build --sdist --wheel
@@ -75,6 +75,85 @@ jobs:
           print(f"verified wheel contents: {wheels[0]}")
           PY
 
+      - name: Validate distribution metadata
+        run: |
+          mkdir -p package-evidence
+          python -m twine check dist/* | tee package-evidence/twine-check.txt
+          sha256sum dist/* | tee package-evidence/SHA256SUMS
+
+      - name: Verify installed wheel contract
+        run: |
+          mapfile -t wheels < <(find "$GITHUB_WORKSPACE/dist" -maxdepth 1 -type f -name '*.whl' -print)
+          if [ "${#wheels[@]}" -ne 1 ]; then
+            echo "expected exactly one wheel, found ${#wheels[@]}"
+            exit 1
+          fi
+
+          wheel_env="$RUNNER_TEMP/obliteratus-wheel-env"
+          wheel_cwd="$RUNNER_TEMP/obliteratus-wheel-cwd"
+          python -m venv "$wheel_env"
+          mkdir -p "$wheel_cwd"
+          "$wheel_env/bin/python" -m pip install --no-cache-dir "rich==15.0.0"
+          "$wheel_env/bin/python" -m pip install --no-cache-dir --no-deps "${wheels[0]}"
+
+          cd "$wheel_cwd"
+          "$wheel_env/bin/python" -I - <<'PY' | tee "$GITHUB_WORKSPACE/package-evidence/wheel-import.txt"
+          import importlib.metadata
+          from pathlib import Path
+
+          import obliteratus
+
+          origin = Path(obliteratus.__file__).resolve()
+          assert "site-packages" in origin.parts, origin
+          assert obliteratus.__version__ == importlib.metadata.version("obliteratus")
+          print(f"installed wheel import: {origin}")
+          print(f"version: {obliteratus.__version__}")
+          PY
+          "$wheel_env/bin/python" -I -m obliteratus --help > "$GITHUB_WORKSPACE/package-evidence/wheel-module-help.txt"
+          "$wheel_env/bin/obliteratus" --help > "$GITHUB_WORKSPACE/package-evidence/wheel-console-help.txt"
+
+      - name: Verify installed sdist contract
+        run: |
+          mapfile -t sdists < <(find "$GITHUB_WORKSPACE/dist" -maxdepth 1 -type f -name '*.tar.gz' -print)
+          if [ "${#sdists[@]}" -ne 1 ]; then
+            echo "expected exactly one sdist, found ${#sdists[@]}"
+            exit 1
+          fi
+
+          sdist_env="$RUNNER_TEMP/obliteratus-sdist-env"
+          sdist_cwd="$RUNNER_TEMP/obliteratus-sdist-cwd"
+          python -m venv "$sdist_env"
+          mkdir -p "$sdist_cwd"
+          "$sdist_env/bin/python" -m pip install --no-cache-dir "rich==15.0.0"
+          "$sdist_env/bin/python" -m pip install --no-cache-dir --no-deps "${sdists[0]}"
+
+          cd "$sdist_cwd"
+          "$sdist_env/bin/python" -I - <<'PY' | tee "$GITHUB_WORKSPACE/package-evidence/sdist-import.txt"
+          import importlib.metadata
+          from pathlib import Path
+
+          import obliteratus
+
+          origin = Path(obliteratus.__file__).resolve()
+          assert "site-packages" in origin.parts, origin
+          assert obliteratus.__version__ == importlib.metadata.version("obliteratus")
+          print(f"installed sdist import: {origin}")
+          print(f"version: {obliteratus.__version__}")
+          PY
+          "$sdist_env/bin/python" -I -m obliteratus --help > "$GITHUB_WORKSPACE/package-evidence/sdist-module-help.txt"
+          "$sdist_env/bin/obliteratus" --help > "$GITHUB_WORKSPACE/package-evidence/sdist-console-help.txt"
+
+      - name: Upload distributions and package evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: distributions-py3.12
+          path: |
+            dist/
+            package-evidence/
+          if-no-files-found: error
+          retention-days: 14
+
   lint:
     name: Ruff
     runs-on: ubuntu-latest
@@ -94,6 +173,21 @@ jobs:
       - name: Install Ruff
         run: python -m pip install "ruff==0.8.6"
 
+      - name: Install actionlint with checksum verification
+        env:
+          ACTIONLINT_VERSION: "1.7.12"
+          ACTIONLINT_SHA256: "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8"
+        run: |
+          archive="$RUNNER_TEMP/actionlint.tar.gz"
+          curl -fsSLo "$archive" \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          echo "${ACTIONLINT_SHA256}  ${archive}" | sha256sum -c -
+          tar -xzf "$archive" -C "$RUNNER_TEMP" actionlint
+
+      - name: Validate GitHub Actions workflows
+        run: |
+          "$RUNNER_TEMP/actionlint" -no-color
+
       - name: Enforce Ruff F gate
         run: >-
           python -m ruff check --select F obliteratus tests