Bits & Flames Fyron
bitsandflames/fyron

Open Source Release Checklist

Use this checklist before publishing a Fyron public-beta release or announcing the repository more broadly.

Required Local Checks

bash
uv run pytest
uv run python scripts/build_docs.py
uv build
uv run python scripts/check_release_readiness.py --skip-git-clean

Expected result:

  • tests pass, allowing intentional skips for integration-only tests,
  • docs build without broken generated links,
  • wheel and source distribution build successfully,
  • release-readiness reports no failures.

Repository Safety

  • Confirm public examples use synthetic or de-identified data.
  • Confirm no secrets, tokens, private endpoint URLs, real FHIR payloads, or patient-identifying DICOM data are included.
  • Check that local artifacts remain ignored: .env, .venv, site/, dist/, Curate uploads/exports, Docker volumes, SQLite files, and node build outputs.
  • Review issue/PR templates for PHI and privacy reminders.

Package And Versioning

  • Update pyproject.toml, src/fyron/__init__.py, src/fyron/banner.py, CITATION.cff, and uv.lock together.
  • Add a release note under docs/releases/.
  • Build and smoke-test the wheel.
  • Tag the release only after checks pass.
  • Publish new PyPI filenames only; PyPI does not allow replacing uploaded files.

Documentation

  • Update module docs for public API changes.
  • Regenerate generated reference docs with uv run python scripts/build_docs.py.
  • Check docs/reference/docstring-coverage.md and prioritize top-level user-facing APIs.
  • Keep public-beta limitations visible in README and docs.

Warning Backlog

  • Review pytest warnings for pandas observed, sklearn calibration, lifelines/NumPy deprecations, and Matplotlib layout warnings.
  • Do not block public-beta releases on known upstream warnings unless they indicate incorrect Fyron behavior.
  • Prefer focused cleanup issues when warning fixes require API choices or dependency-bound behavior changes.

Security Automation

  • Dependabot should watch Python, GitHub Actions, and Curate npm dependencies.
  • CodeQL should scan Python and JavaScript/TypeScript surfaces.
  • Security issues should be reported privately through SECURITY.md.

Optional Future Publishing

If Fyron moves to GitHub Actions publishing, prefer PyPI Trusted Publishing over long-lived API tokens. Keep manual publishing commands documented until that workflow is adopted.