Comparisons and CI Improvements

.github/workflows/ci.yml

@@ -4,6 +4,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   cpp:
     runs-on: ${{ matrix.os }}
@@ -12,7 +15,9 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Configure
         run: cmake -S . -B build -DCASTE_BUILD_TESTS=ON
       - name: Build
@@ -28,22 +33,26 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
         python-version: ["3.9", "3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install and test
         run: |
-          python -m pip install -U pip
           cd python
-          python -m pip install -e ".[test]"
-          python -m pytest -q
+          python -m pip install --require-hashes -r constraints-test.txt
+          python -m pip install --no-build-isolation -e .
+          python -m unittest discover -s tests -p 'test_*.py'
 
   coverage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
       - name: Configure (coverage)
@@ -57,11 +66,11 @@ jobs:
             -DCMAKE_SHARED_LINKER_FLAGS="--coverage"
       - name: Build and test (coverage)
         run: |
+          python -m pip install "gcovr==7.0"
           cmake --build build-cov --config Debug
           ctest --test-dir build-cov -C Debug --output-on-failure
       - name: Generate coverage report
         run: |
-          python -m pip install -U pip gcovr
           gcovr \
             --root . \
             build-cov \
@@ -81,7 +90,7 @@ jobs:
             --output build-cov/coverage.xml \
             --html-details build-cov/coverage.html
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage-report
           path: |

.github/workflows/release.yml

@@ -5,6 +5,9 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: read
+
 jobs:
   cpp-artifacts:
     runs-on: ${{ matrix.os }}
@@ -13,7 +16,9 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Configure
         run: cmake -S . -B build -DCASTE_BUILD_TESTS=OFF
       - name: Build
@@ -27,7 +32,7 @@ jobs:
           cd stage
           tar -czf "../${name}.tar.gz" .
       - name: Upload workflow artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: cpp-artifact-${{ runner.os }}
           path: caste-*.tar.gz
@@ -39,29 +44,32 @@ jobs:
       contents: write
     steps:
       - name: Download cpp artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           pattern: cpp-artifact-*
           merge-multiple: true
           path: release-assets
       - name: Upload release assets
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
         with:
           files: release-assets/caste-*.tar.gz
 
-  pypi:
+  pypi-build:
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      contents: read
+    env:
+      PIP_CONSTRAINT: ${{ github.workspace }}/python/constraints-ci.txt
+      PIP_REQUIRE_HASHES: "1"
+      CIBW_ENVIRONMENT: PIP_CONSTRAINT=/project/python/constraints-ci.txt PIP_REQUIRE_HASHES=1
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
       - name: Build sdist and wheels
         run: |
-          python -m pip install -U pip build cibuildwheel
+          python -m pip install --require-hashes -r python/constraints-ci.txt
           CASTE_VERSION="$(python - <<'PY'
           import tomllib
           with open("python/pyproject.toml", "rb") as f:
@@ -83,7 +91,7 @@ jobs:
             ./ .pypi-stage/
           cat > .pypi-stage/pyproject.toml << EOF
           [build-system]
-          requires = ["scikit-build-core>=0.10.0", "pybind11>=2.11.0"]
+          requires = ["scikit-build-core==0.10.0", "pybind11==2.11.0"]
           build-backend = "scikit_build_core.build"
 
           [project]
@@ -92,17 +100,14 @@ jobs:
           description = "Opinionated hardware classification library."
           readme = "python/README.md"
           requires-python = ">=3.8"
-          license = "MIT"
+          license = { text = "MIT" }
           authors = [{ name = "Zeth", email = "holdercardteam+caste@gmail.com" }]
           keywords = ["hardware", "classification", "system-info", "gpu", "cpu"]
 
           [project.urls]
           Repository = "https://github.com/zeth/caste"
           Issues = "https://github.com/zeth/caste/issues"
 
-          [project.optional-dependencies]
-          test = ["pytest"]
-
           [tool.scikit-build]
           cmake.version = ">=3.20"
           cmake.source-dir = "python"
@@ -113,7 +118,25 @@ jobs:
           EOF
           python -m build --sdist --outdir dist .pypi-stage
           python -m cibuildwheel --output-dir dist .pypi-stage
+      - name: Upload PyPI workflow artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: pypi-dist
+          path: dist/*
+
+  pypi-publish:
+    runs-on: ubuntu-latest
+    needs: pypi-build
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Download PyPI workflow artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: pypi-dist
+          path: dist
       - name: Upload to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@106e0b0b7c337fa67ed433972f777c6357f78598 # v1.13.0
         with:
           packages-dir: dist

.github/workflows/testpypi.yml

@@ -3,20 +3,26 @@ name: TestPyPI
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
-  pypi-test:
+  pypi-test-build:
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      contents: read
+    env:
+      PIP_CONSTRAINT: ${{ github.workspace }}/python/constraints-ci.txt
+      PIP_REQUIRE_HASHES: "1"
+      CIBW_ENVIRONMENT: PIP_CONSTRAINT=/project/python/constraints-ci.txt PIP_REQUIRE_HASHES=1
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
       - name: Build sdist and wheels
         run: |
-          python -m pip install -U pip build cibuildwheel
+          python -m pip install --require-hashes -r python/constraints-ci.txt
           CASTE_VERSION="$(python - <<'PY'
           import tomllib
           with open("python/pyproject.toml", "rb") as f:
@@ -38,7 +44,7 @@ jobs:
             ./ .pypi-stage/
           cat > .pypi-stage/pyproject.toml << EOF
           [build-system]
-          requires = ["scikit-build-core>=0.10.0", "pybind11>=2.11.0"]
+          requires = ["scikit-build-core==0.10.0", "pybind11==2.11.0"]
           build-backend = "scikit_build_core.build"
 
           [project]
@@ -47,17 +53,14 @@ jobs:
           description = "Opinionated hardware classification library."
           readme = "python/README.md"
           requires-python = ">=3.8"
-          license = "MIT"
+          license = { text = "MIT" }
           authors = [{ name = "Zeth", email = "holdercardteam+caste@gmail.com" }]
           keywords = ["hardware", "classification", "system-info", "gpu", "cpu"]
 
           [project.urls]
           Repository = "https://github.com/zeth/caste"
           Issues = "https://github.com/zeth/caste/issues"
 
-          [project.optional-dependencies]
-          test = ["pytest"]
-
           [tool.scikit-build]
           cmake.version = ">=3.20"
           cmake.source-dir = "python"
@@ -68,8 +71,26 @@ jobs:
           EOF
           python -m build --sdist --outdir dist .pypi-stage
           python -m cibuildwheel --output-dir dist .pypi-stage
+      - name: Upload TestPyPI workflow artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: testpypi-dist
+          path: dist/*
+
+  pypi-test-publish:
+    runs-on: ubuntu-latest
+    needs: pypi-test-build
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Download TestPyPI workflow artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: testpypi-dist
+          path: dist
       - name: Upload to TestPyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@106e0b0b7c337fa67ed433972f777c6357f78598 # v1.13.0
         with:
           repository-url: https://test.pypi.org/legacy/
           packages-dir: dist

CMakeLists.txt

@@ -61,7 +61,8 @@ if (CASTE_BUILD_TESTS)
         FetchContent_Declare(
             Catch2
             GIT_REPOSITORY https://github.com/catchorg/Catch2.git
-            GIT_TAG v3.5.4
+            GIT_TAG abb467ecd60fae9a727afca033c1eb5d20af2c12 # v3.5.4
+            GIT_SHALLOW TRUE
         )
         FetchContent_MakeAvailable(Catch2)
     endif()

README.md

@@ -61,6 +61,38 @@ auto result = detect_caste();
 // result.reason is a short string (optional)
 ```
 
+If you want to use the detected caste in policy code,
+`caste` supports direct comparisons:
+
+```cpp
+Caste caste = detect_caste().caste;
+
+if (caste >= Caste::Developer) {
+    // developer, workstation, or rig
+}
+```
+
+You can also define reusable ranges:
+
+```cpp
+constexpr CasteRange user_or_below{
+    Caste::Mini,
+    Caste::User
+};
+
+if (user_or_below.contains(caste)) {
+    // mini or user
+}
+```
+
+Common policy bands are also provided directly:
+
+```cpp
+if (dev_or_above.contains(caste)) {
+    // developer, workstation, or rig
+}
+```
+
 If you only want the single-word label:
 
 ```cpp

python/constraints-ci.txt

@@ -0,0 +1,48 @@
+# Pinned Python build and release toolchain for CI/publish workflows.
+# Install with:
+#   python -m pip install --require-hashes -r python/constraints-ci.txt
+
+scikit-build-core==0.10.0 \
+    --hash=sha256:d6ba451a84da6515b696d1aaecc935ce4e7a28ed18a8093d6effa2726d50e3fe
+pybind11==2.11.0 \
+    --hash=sha256:307443ea89b73ce88f68fa48687d160c036622a54bc2a25aae9d5ea792bef268
+packaging==26.0 \
+    --hash=sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529
+pathspec==1.0.4 \
+    --hash=sha256:fb6ae2fd4e7c921a165808a552060e722767cfa526f99ca5156ed2ce45a5c723
+
+build==1.4.2 \
+    --hash=sha256:7a4d8651ea877cb2a89458b1b198f2e69f536c95e89129dbf5d448045d60db88
+pyproject-hooks==1.2.0 \
+    --hash=sha256:9e5c6bfa8dcc30091c74b0cf803c81fdd29d94f01992a7707bc97babb1141913
+wheel==0.46.3 \
+    --hash=sha256:4b399d56c9d9338230118d705d9737a2a468ccca63d5e813e2a4fc7815d8bc4d
+tomli==2.3.0 ; python_version < "3.11" \
+    --hash=sha256:64be704a875d2a59753d80ee8a533c3fe183e3f06807ff7dc2232938ccb01549
+importlib-metadata==8.7.0 ; python_full_version < "3.10.2" \
+    --hash=sha256:e5dd1551894c77868a30651cef00984d50e1002d06942a7101d34870c5f02afd
+zipp==3.23.0 ; python_full_version < "3.10.2" \
+    --hash=sha256:071652d6115ed432f5ce1d34c336c0adfd6a884660d1e9712a256d3d3bd4b14e
+colorama==0.4.6 ; os_name == "nt" \
+    --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
+
+cibuildwheel==3.4.1 \
+    --hash=sha256:d495eb8780473029382976e86363562923401ac575c18bc52e6a9102512853ad
+bashlex==0.18 \
+    --hash=sha256:91d73a23a3e51711919c1c899083890cdecffc91d8c088942725ac13e9dcfffa
+bracex==2.6 \
+    --hash=sha256:0b0049264e7340b3ec782b5cb99beb325f36c3782a32e36e876452fd49a09952
+certifi==2026.2.25 \
+    --hash=sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa
+dependency-groups==1.3.1 \
+    --hash=sha256:51aeaa0dfad72430fcfb7bcdbefbd75f3792e5919563077f30bc0d73f4493030
+filelock==3.25.2 \
+    --hash=sha256:ca8afb0da15f229774c9ad1b455ed96e85a81373065fb10446672f64444ddf70
+humanize==4.15.0 \
+    --hash=sha256:b1186eb9f5a9749cd9cb8565aee77919dd7c8d076161cf44d70e59e3301e1769
+patchelf==0.17.2.4 ; (sys_platform == "linux" or sys_platform == "darwin") and (platform_machine == "x86_64" or platform_machine == "arm64" or platform_machine == "aarch64") \
+    --hash=sha256:d9b35ebfada70c02679ad036407d9724ffe1255122ba4ac5e4be5868618a5689
+platformdirs==4.9.4 \
+    --hash=sha256:68a9a4619a666ea6439f2ff250c12a853cd1cbd5158d258bd824a7df6be2f868
+pyelftools==0.32 \
+    --hash=sha256:013df952a006db5e138b1edf6d8a68ecc50630adbd0d83a2d41e7f846163d738