ci: enforce tag version match and pywebview bundle checks

Author: clean6378-max-it

.github/workflows/release.yml

@@ -8,7 +8,7 @@ name: Release
 #   cppa_cursor_browser-<version>.tar.gz             (~225 KiB at 0.2.0)
 #   CursorChatBrowser-windows.zip
 #
-# Fork check: push v0.0.0-test and confirm all three files on the Release.
+# Fork rehearsal: push v0.2.0 (pyproject is already 0.2.0) and confirm all three assets on the Release.
 
 on:
   push:
@@ -37,6 +37,19 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Tag must match pyproject version
+        if: github.ref_type == 'tag'
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          tag_version="${RELEASE_TAG#v}"
+          pyproject_version="$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")"
+          if [ "$tag_version" != "$pyproject_version" ]; then
+            echo "Release tag is $tag_version but pyproject.toml [project].version is $pyproject_version"
+            exit 1
+          fi
+
       - name: Build hatchling distributables
         run: |
           python -m pip install --upgrade pip
@@ -65,20 +78,28 @@ jobs:
           python-version: "3.12"
 
       - name: Install runtime dependencies
-        # requirements-lock.txt for runtime; pywebview for the desktop window.
+        # Runtime from requirements-lock.txt; pywebview pin from pyproject [desktop].
+        shell: pwsh
         run: |
           python -m pip install --upgrade pip
           python -m pip install -r requirements-lock.txt
-          python -m pip install 'pywebview>=5.0,<7'
+          $spec = python scripts/read_desktop_pywebview_spec.py
+          python -m pip install $spec
 
       - name: Install PyInstaller
         run: python -m pip install 'pyinstaller>=6,<7'
 
       - name: Build PyInstaller bundle
         run: pyinstaller cursor-browser.spec --noconfirm
 
-      - name: Smoke-test PyInstaller exe (--help)
-        run: dist\CursorChatBrowser\CursorChatBrowser.exe --help
+      - name: Check webview/lib in bundle
+        shell: pwsh
+        run: |
+          $lib = 'dist\CursorChatBrowser\_internal\webview\lib'
+          if (-not (Test-Path $lib)) {
+            Write-Error "pywebview bundle missing: $lib"
+            exit 1
+          }
 
       - name: Zip onedir bundle
         shell: pwsh

.github/workflows/tests.yml

@@ -54,6 +54,24 @@ jobs:
               sys.exit(1)
           PY
 
+      - name: Check pywebview pin is single-sourced
+        run: |
+          python scripts/read_desktop_pywebview_spec.py
+          python <<'PY'
+          import sys
+          from pathlib import Path
+
+          for path in sorted(Path(".github/workflows").glob("*.yml")):
+              text = path.read_text()
+              if "pywebview>=" in text or "pywebview<" in text:
+                  print(f"{path} hardcodes a pywebview version; use scripts/read_desktop_pywebview_spec.py", file=sys.stderr)
+                  sys.exit(1)
+              if "read_desktop_pywebview_spec.py" not in text and "pywebview" in text.lower():
+                  if path.name in ("release.yml", "tests.yml"):
+                      print(f"{path} installs pywebview but does not read the pin from pyproject", file=sys.stderr)
+                      sys.exit(1)
+          PY
+
       - name: Install pip-tools
         # Pin matches update-lock.yml so lock verification uses the same resolver.
         run: python -m pip install 'pip-tools==7.5.3'
@@ -118,12 +136,13 @@ jobs:
         run: python -m pytest tests/test_api_search.py tests/test_api_workspaces.py tests/test_api_export.py tests/test_pdf_export.py tests/test_search_helpers.py tests/test_check_benchmark_regression.py tests/test_reduce_baselines.py -v --tb=short -o addopts=
 
       # ── PyInstaller desktop build (Windows only, once per workflow) ────────
-      # Closes #44. Builds the onedir bundle and smoke-tests --help so the
-      # desktop entry point is verified without launching the GUI window.
-      # pywebview matches release.yml so the Windows bundle matches what we ship.
+      # Closes #44. Check webview/lib after build; --help returns before import webview.
       - name: Install pywebview for PyInstaller bundle
         if: matrix.os == 'windows-latest' && matrix.python-version == '3.12'
-        run: python -m pip install 'pywebview>=5.0,<7'
+        shell: pwsh
+        run: |
+          $spec = python scripts/read_desktop_pywebview_spec.py
+          python -m pip install $spec
 
       - name: Install PyInstaller
         if: matrix.os == 'windows-latest' && matrix.python-version == '3.12'
@@ -133,9 +152,15 @@ jobs:
         if: matrix.os == 'windows-latest' && matrix.python-version == '3.12'
         run: pyinstaller cursor-browser.spec --noconfirm
 
-      - name: Smoke-test PyInstaller exe (--help)
+      - name: Check webview/lib in bundle
         if: matrix.os == 'windows-latest' && matrix.python-version == '3.12'
-        run: dist\CursorChatBrowser\CursorChatBrowser.exe --help
+        shell: pwsh
+        run: |
+          $lib = 'dist\CursorChatBrowser\_internal\webview\lib'
+          if (-not (Test-Path $lib)) {
+            Write-Error "pywebview bundle missing: $lib"
+            exit 1
+          }
 
   # ── Browser XSS: Playwright (sprint item #3) ─────────────────────────────
   browser-xss:

scripts/read_desktop_pywebview_spec.py

@@ -0,0 +1,21 @@
+"""Stdout the pywebview pin from pyproject.toml [desktop]."""
+
+from __future__ import annotations
+
+import sys
+import tomllib
+
+
+def main() -> None:
+    deps = tomllib.load(open("pyproject.toml", "rb"))["project"]["optional-dependencies"]["desktop"]
+    if len(deps) != 1 or not deps[0].startswith("pywebview"):
+        print(
+            "need exactly one pywebview dep in [project.optional-dependencies].desktop",
+            file=sys.stderr,
+        )
+        raise SystemExit(1)
+    print(deps[0])
+
+
+if __name__ == "__main__":
+    main()