Release prep Phase 3: CI matrix, trusted publishing, and supply-chain hardening

[cnicholas]

Goal

Phase 3 of the pre-PyPI release prep (per the comprehensive audit). Phase 1 (packaging hygiene, commit 88477a5) and Phase 2 (docs/process, commit 5b8ce17) are merged. This issue covers the CI / release / supply-chain layer — the last release-blockers before tagging v0.1.0.

Tasks

Build & test matrix

• Expand CI matrix in .github/workflows/ci.yml to cover the supported Python range and OSes the project advertises (requires-python = ">=3.9", classifiers list 3.9–3.13). Minimum: [3.9, 3.11, 3.13] × [ubuntu-latest, macos-latest, windows-latest]. Today CI only runs 3.11 on ubuntu-latest.
• Wheel smoke-test job: after `python -m build`, install `dist/*.whl` into a clean venv and import every public symbol from `processbehavior/init.py` (ProcessBehavior, Study, AnalysisResult, make_sds, register_theme, etc.). Catches missing package data or import-time regressions in the published artifact.

Coverage

• Add [tool.coverage.run] source = [\"processbehavior\"] to pyproject.toml.
• Run `pytest --cov=processbehavior --cov-report=xml` in the test job and upload via codecov/codecov-action@<sha>. Add a coverage badge to README once the first report lands.

Release workflow (PyPI Trusted Publishing)

• Add .github/workflows/publish.yml triggered on `push: tags: ['v*']`:
  • permissions: { contents: read, id-token: write }
  • Build with `python -m build`, verify with `twine check`, publish via pypa/gh-action-pypi-publish@<sha> (no API tokens — OIDC only).
  • Optional: sigstore/gh-action-sigstore-python@<sha> for attestations.
• Configure the trusted publisher on PyPI (Project Settings → Publishing → GitHub) before the first release tag is pushed. Otherwise the first publish must use a token.
• Document the release process in CONTRIBUTING.md (tag → workflow → PyPI listing live).

Supply chain

• Add a `pip-audit --strict` step to CI. Today the dev environment has 18 known CVEs across 11 packages — all transitive dev-only (pillow, nbconvert, lxml, tornado, requests, pygments, orjson, filelock, virtualenv, pytest, pip). Runtime deps are clean.
• Bump the dev-extra pins to clear them. The biggest culprit is jupyter-book dragging the old nbconvert/lxml chain — try `jupyter-book>=2.0` (already installed locally as 2.1.0).
• Pin GitHub Actions by SHA with # vX.Y.Z comments: `actions/checkout@`, `actions/setup-python@`, `actions/setup-node@`, `actions/upload-pages-artifact@`, `actions/deploy-pages@`. Currently pinned by major tag only.
• Add .github/dependabot.yml for weekly updates on pip and github-actions ecosystems so SHA pins stay current.

Docs build sanity

• Verify the new `docs.yml` workflow actually builds successfully on `main` (this requires Pages enabled — see manual setup note in commit 5b8ce17). If it fails, fix before tagging.
• Optionally fail CI when the docs build fails on a PR (separate trigger or merge into ci.yml).

Verify before tagging v0.1.0

• All matrix jobs green
• python -m build && twine check dist/* passes locally
• Wheel-smoke-test installs and imports cleanly
• pip-audit --strict exits 0
• Docs site renders at https://cnicholas.github.io/processbehavior/
• CHANGELOG.md `[Unreleased]` is empty or moved into 0.1.0
• Tag `v0.1.0` → publish workflow uploads to PyPI
• `pip install processbehavior` in a fresh venv runs the README quickstart end-to-end

Out of scope (deferred to 0.2.x or later)

• Re-enabling mypy error codes one module at a time (P3 fix: Resolve ruff linting errors and remove scipy dependency #47)
• Surfacing missing public types in __all__ (P1 Complete or document Sampling Design State detection (only handles SDS 1-2) #18)
• Converting raw `raise ValueError` paths to `ValidationError` (P1 Refactor: Replace Abstract Factory with Strategy Pattern #19)
• Narrowing the signals/detector.py:191 broad `except` (P1 Code Quality Improvements: Logging, Constants, Docs & Cleanup #20)
• Adding a lockfile (P1 Define and document public API in __init__.py #22)
• Issue/PR templates and CODEOWNERS (P2 Add Residual and Effects Plotting + Improve Chart Design #36)
• Dropping the `engine=` kwarg from kaleido calls (P2 Phase 3: Add Residual Chart Types to SDS Detection #42, 18 DeprecationWarnings)

References

• Phase 1 commit: 88477a5 (packaging hygiene)
• Phase 2 commit: 5b8ce17 (docs/process)
• Audit P-numbers reference the in-repo pre-release evaluation