Release 0.7.0: v1 library, CLI and docs in 9 reviewable commits

.gitattributes

@@ -0,0 +1 @@
+tests/data/p70_correction_vectors.json -text

.github/workflows/bitcoin-core-fixtures.yml

@@ -0,0 +1,48 @@
+name: Bitcoin Core wallet fixtures
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/bitcoin-core-fixtures.yml'
+      - 'src/codex32/_bitcoin_core.py'
+      - 'src/codex32/_bip32.py'
+      - 'src/codex32/wallet.py'
+      - 'tests/data/wallet_fingerprints.json'
+      - 'tools/_wallet_test_vectors.py'
+      - 'tools/bitcoin_core_regtest.py'
+  workflow_dispatch:
+  schedule:
+    - cron: "17 9 * * 1"
+
+permissions:
+  contents: read
+
+env:
+  BITCOIN_CORE_ARCHIVE: bitcoin-32.0rc2-x86_64-linux-gnu.tar.gz
+  BITCOIN_CORE_SHA256: 0255103718033e6aee15fa944717fc277e047b845bff1e7408af0ea732d8d0c1
+  BITCOIN_CORE_URL: https://bitcoincore.org/bin/bitcoin-core-32.0/test.rc2
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.13"
+      - name: Download pinned Bitcoin Core
+        run: |
+          curl --fail --location --proto '=https' --tlsv1.2 \
+            --output "$RUNNER_TEMP/$BITCOIN_CORE_ARCHIVE" \
+            "$BITCOIN_CORE_URL/$BITCOIN_CORE_ARCHIVE"
+          echo "$BITCOIN_CORE_SHA256  $RUNNER_TEMP/$BITCOIN_CORE_ARCHIVE" | sha256sum --check
+          tar -xzf "$RUNNER_TEMP/$BITCOIN_CORE_ARCHIVE" -C "$RUNNER_TEMP"
+      - name: Verify every frozen wallet fingerprint against Core
+        env:
+          PYTHONPATH: ${{ github.workspace }}/src
+        run: |
+          core="$RUNNER_TEMP/bitcoin-32.0rc2/bin"
+          "$core/bitcoind" --version | head -1
+          python tools/bitcoin_core_regtest.py \
+            --bitcoind "$core/bitcoind" \
+            --bitcoin-cli "$core/bitcoin-cli"

.github/workflows/publish.yml

@@ -0,0 +1,60 @@
+name: Publish release
+
+on:
+  release:
+    types: [published]
+
+env:
+  SOURCE_DATE_EPOCH: "1763060600"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.13"
+      - run: >-
+          python -c "import os,tomllib;
+          version=tomllib.load(open('pyproject.toml','rb'))['project']['version'];
+          assert os.environ['GITHUB_REF_NAME'] == f'v{version}'"
+      - run: >-
+          python -m pip install --require-hashes
+          -r requirements/release-build-dependencies.txt
+      - run: python -m build --no-isolation
+      - name: Normalize source-archive metadata
+        run: |
+          archive="dist/codex32-${GITHUB_REF_NAME#v}.tar.gz"
+          mkdir normalized-sdist
+          tar -xzf "$archive" -C normalized-sdist
+          tar --sort=name --mtime="@${SOURCE_DATE_EPOCH}" --owner=0 --group=0 --numeric-owner \
+            -C normalized-sdist -cf - "codex32-${GITHUB_REF_NAME#v}" | gzip -n > "$archive.new"
+          mv "$archive.new" "$archive"
+      - name: Attach distributions to the GitHub release
+        run: gh release upload "$GITHUB_REF_NAME" dist/*
+        env:
+          GH_TOKEN: ${{ github.token }}
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: distributions
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/codex32
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: distributions
+          path: dist/
+      - name: Publish distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26 # v1.14.2

.github/workflows/python-package.yml

@@ -1,45 +1,58 @@
-# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python
-
 name: Python package
 
 on:
   push:
-    branches: [ "master" ]
   pull_request:
-    branches: [ "master" ]
+
+env:
+  SOURCE_DATE_EPOCH: "1763060600"
 
 permissions:
   contents: read
 
 jobs:
-  build:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ["3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install --require-hashes -r requirements/cli-build-dependencies.txt
+      - run: python -m pip install --no-build-isolation -e '.[dev]'
+      - run: python -m pip check
+      - run: python -m pytest -q
+      - if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13'
+        run: python -O -m pytest -q
+      - if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13'
+        run: python tools/verify_correction_constants.py
+      - run: python -m mypy src/codex32
+      - run: python -m ruff check .
+      - run: python -m ruff format --check .
+      - run: python tools/differential_correction.py --verify
+      - run: python -m build --no-isolation
+      - run: python tools/verify_wheel_environment.py
 
+  compatibility:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"]
-
+        python-version: ["3.10", "3.11", "3.14", "3.15"]
     steps:
-    - uses: actions/checkout@v4
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-      with:
-        python-version: ${{ matrix.python-version }}
-        allow-prereleases: ${{ matrix.python-version == '3.15' }}
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install flake8 pytest
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-    - name: Lint with flake8
-      run: |
-        # stop the build if there are Python syntax errors or undefined names
-        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
-        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
-    - name: Install package
-      run: pip install -e .
-    - name: Run tests
-      run: python -m pytest -q
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          allow-prereleases: ${{ matrix.python-version == '3.15' }}
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install --require-hashes -r requirements/cli-build-dependencies.txt
+      - run: python -m pip install --no-build-isolation -e '.[dev]'
+      - run: python -m pip check
+      - run: python -m pytest -q