[NCCU-Schultz-Lab]

Summary

Roadmap D6. After this PR, making a release takes two steps: merge the release PR, then publish a GitHub Release. The tag push, local build, twine upload and PyPI token all go away.

• .github/workflows/release.yml, triggered when a Release is published:
  • build: builds the wheel and sdist from the tag, runs the release checker, and installs the wheel in a clean venv. It then loads an example dataset from outside the repo.
  • pypi: uploads with Trusted Publishing, using the OIDC permission id-token: write only. There is no token in the repo, and the job uses the environment pypi. skip-existing means a version already on PyPI isn't treated as an error.
  • release-files: attaches the wheel and sdist to the Release. If the release notes were left empty, it fills them in from that version's CHANGELOG section.
  • It also runs as a dry run (build and check only) on PRs that touch packaging, or by hand.
  • desktop-builds.yml already attaches the installers on the same event, so this needs no change.
• scripts/release/check_release.py automates the release checks that used to be done by hand:
  • the tag is v<__version__>;
  • CHANGELOG has a dated ## [X.Y.Z] - date section and a compare link;
  • the docs version badge matches (G-035);
  • wheel: top_level.txt is eagleplot only, with nothing installed outside it (G-011); the GUI data files are present (G-012); no Windows line endings (G-032);
  • sdist: no desktop build output.
  • --notes writes the release notes.
• tests/test_release_check.py (15 tests):
  • the repository is consistent for its own version, so a release PR that forgets the badge fails CI;
  • each failure mode, using synthetic wheels;
  • the workflow publishes without a password or secrets..
• RELEASING.md: the release PR checklist, the one button (with the "Save draft starts nothing" trap from G-035), what to do if a step fails, and the one-time PyPI setup. Linked from CONTRIBUTING.md.
• Download page: a "What each version can do" table comparing the web app, desktop app and Python package. It covers install, download size, offline use, start-up, speed, folders, NIST, theme, Python API and settings.

Needed once, by the owner

On pypi.org, in eagleplot's settings, go to Publishing → Add a new publisher → GitHub and enter:

• owner The-Schultz-Lab
• repository eagleplot
• workflow release.yml
• environment pypi

Until that's done, the PyPI job of the next release will fail with a clear "trusted publisher" error and nothing will be uploaded. The other jobs are unaffected.

Test plan

• check_release.py passes on the real 3.2.0 build, on both my wheel and the one on PyPI (Python 3.13 and 3.9).
• It rejects a wrong tag.
• tests/test_release_check.py: 15 passed on Python 3.13 and 3.9. Docs tests pass. ruff and mypy are clean.
• CI, including the Release dry run that this PR triggers: build, check, clean install.

🤖 Generated with Claude Code