Severity
High — release packaging can publish contradictory versions.
Problem
The Python client version is duplicated:
clients/python/pyproject.tomlclients/python/pgque/__init__.py
The release guide tells the operator to update only pyproject.toml, and release-python.yml validates only that value. The built-wheel smoke merely asserts that distribution metadata has some version; it never compares the workflow input, wheel metadata, and pgque.__version__.
Following the documented release process can therefore publish a 0.3.x distribution whose runtime reports 0.2.0, with CI green.
Expected fix
Prefer deriving __version__ from importlib.metadata.version("pgque-py"), with an intentional source-tree fallback for editable/uninstalled development. Otherwise validate both literals and the built wheel against VERSION.
Update clients/python/RELEASE.md and add source/editable/wheel tests that prove one authoritative version.
Severity
High — release packaging can publish contradictory versions.
Problem
The Python client version is duplicated:
clients/python/pyproject.tomlclients/python/pgque/__init__.pyThe release guide tells the operator to update only
pyproject.toml, andrelease-python.ymlvalidates only that value. The built-wheel smoke merely asserts that distribution metadata has some version; it never compares the workflow input, wheel metadata, andpgque.__version__.Following the documented release process can therefore publish a 0.3.x distribution whose runtime reports
0.2.0, with CI green.Expected fix
Prefer deriving
__version__fromimportlib.metadata.version("pgque-py"), with an intentional source-tree fallback for editable/uninstalled development. Otherwise validate both literals and the built wheel againstVERSION.Update
clients/python/RELEASE.mdand add source/editable/wheel tests that prove one authoritative version.