Make CI check things it was not checking

Four defects, one duplication:

- `format` reformats `jupyddl/` and commits straight to main, but
  `web/dist` embeds those sources verbatim and `pages` refuses to deploy
  a bundle that has drifted from them. A reformat of any bundled module
  would have left main undeployable. The rebuild now happens in the same
  commit.
- Mergify's auto-merge rule required `check-success=tests`. That is the
  workflow name; the checks are the matrix jobs, `test (ubuntu-latest,
  3.12, dev)` and friends. The rule matched nothing and never fired.
  Match the jobs by pattern so growing the matrix cannot break it again.
- The `viz` extra was never installed, so six test modules
  `importorskip`ed matplotlib and the entire charting surface went
  untested. One matrix entry now installs it; the rest stay without
  matplotlib, which is both what most people install and a standing
  check that the core never imports it.
- `flake8` skipped `tools/`, which is where the bundle builder and the
  thousand-line promo renderer live.

`build` was a strict subset of `tests` — same matrix, same editable
install, same two flake8 invocations — so it cost a second full matrix
for no signal. It now builds the sdist and wheel, `twine check`s them,
installs the wheel into a clean environment and plans with it from
outside the repository. That catches packaging breakage, which is
precisely what an editable install cannot show. Verified end to end
locally: build, check, clean install, generate, solve, `Valid: True`.

Also runs the suite on 3.13 and 3.14 (both pass locally; the core is
stdlib-only), adds concurrency groups so superseded pushes stop burning
runners, and renames the pages job to `bundle` so it cannot be mistaken
for the `build` check Mergify keys on.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Meb35zHKsyBkH2sbWoyKMT

Author: claude

.github/workflows/build.yml

@@ -1,29 +1,52 @@
 name: build
 
+# What gets published, rather than what is in the working tree. `tests.yml`
+# already lints and tests the sources across the whole matrix; running the same
+# flake8 twice bought no extra signal, so this workflow builds the
+# distributions instead and proves the wheel stands on its own — no source
+# tree, no demos folder, no editable install.
+
 on: [push]
 
+concurrency:
+  group: build-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest]
-        python-version: ['3.9', '3.10', '3.11', '3.12']
-
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
-      with:
-        submodules: recursive
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v7
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install package (dev extras)
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install -e ".[dev]"
-    - name: Lint with flake8
-      run: |
-        flake8 jupyddl tests --count --select=E9,F63,F7,F82 --show-source --statistics
-        flake8 jupyddl tests --count --statistics
+      - uses: actions/checkout@v7
+        with:
+          submodules: false
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+
+      - name: Build the sdist and the wheel
+        run: |
+          python -m pip install --upgrade pip build twine
+          python -m build
+          twine check dist/*
+
+      - name: Install the wheel into a clean environment
+        run: |
+          python -m venv /tmp/fresh
+          /tmp/fresh/bin/pip install dist/*.whl
+
+      - name: Plan with the installed package, away from the repository
+        working-directory: /tmp
+        run: |
+          /tmp/fresh/bin/python -c "import jupyddl; print(jupyddl.__version__)"
+          /tmp/fresh/bin/jupyddl generate gripper -n 3 --seed 1 -o /tmp/smoke
+          /tmp/fresh/bin/jupyddl solve \
+            /tmp/smoke/gripper-03-1/domain.pddl \
+            /tmp/smoke/gripper-03-1/problem.pddl \
+            -s astar -H lmcut | tee /tmp/plan.txt
+          grep -q "Valid: True" /tmp/plan.txt
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: distributions
+          path: dist/

.github/workflows/format.yml

@@ -1,25 +1,45 @@
 name: format
+
 on:
   push:
     branches: [main]
+
+concurrency:
+  group: format-main
+  cancel-in-progress: false
+
 jobs:
   format:
     runs-on: ubuntu-latest
     steps:
+      # `github.head_ref` is empty on a push event, so the old `ref:` here was
+      # a no-op that read as if it did something. This workflow only ever runs
+      # on main; check that out and say so.
       - uses: actions/checkout@v7
         with:
-          ref: ${{ github.head_ref }}
+          ref: main
+
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
           python-version: '3.14'
+
       - name: Install formatter dependencies
         run: |
           python -m pip install --upgrade pip
           python -m pip install black
+
       - name: Format with black
         run: |
-          black jupyddl tests
+          black jupyddl tests tools
+
+      # web/dist embeds the jupyddl sources verbatim, and pages.yml refuses to
+      # deploy a bundle that has drifted from them. Reformatting the sources
+      # and committing without rebuilding would push main into exactly that
+      # state, so the rebuild has to ride along in the same commit.
+      - name: Rebuild the browser bundle so it matches the formatted sources
+        run: python tools/build_web.py
+
       - name: Commit changes
         uses: stefanzweifel/git-auto-commit-action@v5
         with:

.github/workflows/pages.yml

@@ -19,14 +19,16 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  build:
+  # Not called `build`: .mergify.yml keys a merge rule on a check named
+  # `build`, and that must mean the packaging workflow, not this one.
+  bundle:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           submodules: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -48,7 +50,7 @@ jobs:
           path: web
 
   deploy:
-    needs: build
+    needs: bundle
     runs-on: ubuntu-latest
     environment:
       name: github-pages

.github/workflows/tests.yml

@@ -2,14 +2,32 @@ name: tests
 
 on: [push]
 
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        python-version: ['3.9', '3.10', '3.11', '3.12']
+        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', '3.14']
+        # The charts are an optional extra, so most of the matrix runs without
+        # matplotlib — that is the configuration nearly every user installs,
+        # and it proves the core stays importable without it. One entry pulls
+        # it in so `jupyddl/viz/` is actually executed rather than skipped.
+        extras: [dev]
+        include:
+          - os: ubuntu-latest
+            python-version: '3.12'
+            extras: dev,viz
+
+    name: test (${{ matrix.os }}, ${{ matrix.python-version }}, ${{ matrix.extras }})
+
+    env:
+      MPLBACKEND: Agg
 
     steps:
       - uses: actions/checkout@v7
@@ -19,14 +37,14 @@ jobs:
         uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
-      - name: Install package (dev extras)
+      - name: Install package (${{ matrix.extras }} extras)
         run: |
           python -m pip install --upgrade pip
-          python -m pip install -e ".[dev]"
+          python -m pip install -e ".[${{ matrix.extras }}]"
       - name: Lint with flake8
         run: |
-          flake8 jupyddl tests --count --select=E9,F63,F7,F82 --show-source --statistics
-          flake8 jupyddl tests --count --statistics
+          flake8 jupyddl tests tools --count --select=E9,F63,F7,F82 --show-source --statistics
+          flake8 jupyddl tests tools --count --statistics
       - name: Test with pytest
         run: |
           pytest --cov=jupyddl --cov-report=xml

.mergify.yml

@@ -1,3 +1,8 @@
+# `tests` is the *workflow* name; the checks it reports are the matrix jobs,
+# `test (ubuntu-latest, 3.12, dev)` and friends. A rule keyed on
+# `check-success=tests` therefore matched nothing and the auto-merge never
+# fired. Match the jobs by pattern instead, so adding a Python version to the
+# matrix does not silently break merging again.
 pull_request_rules:
   - name: Assign the main reviewers
     conditions:
@@ -11,7 +16,7 @@ pull_request_rules:
   - name: Automatic merge on approval
     conditions:
       - "#approved-reviews-by>=1"
-      - check-success=tests
+      - check-success~=^test \(
       - check-success=build
       - check-success=CodeFactor
     actions:

AGENTS.md

@@ -25,6 +25,26 @@ native build step, and the core has zero runtime dependencies.
   or `... benchmark demos --dashboard out.png`. Installed as `jupyddl` too.
   Also `jupyddl animate` (MP4/GIF replay) and `jupyddl demo` (full chart gallery).
 
+### What CI actually checks
+- **`tests`** — lint (`flake8 jupyddl tests tools`) and the suite on Python
+  3.9–3.14. Most of the matrix installs `.[dev]` *without* matplotlib, which is
+  what nearly everyone installs and keeps the core honest about not importing
+  it; one entry installs `.[dev,viz]` so `jupyddl/viz/` is executed rather than
+  skipped. Six test modules `importorskip` matplotlib, so without that entry
+  the whole charting surface goes untested.
+- **`build`** — builds the sdist and wheel, `twine check`s them, installs the
+  wheel into a clean venv and plans with it from outside the repository. It
+  deliberately does *not* repeat the lint: it is there to catch packaging
+  breakage (a module missing from the wheel, an entry point that does not
+  resolve), which an editable install hides.
+- **`format`** — runs `black` on a push to main and commits the result. It
+  rebuilds `web/dist` in the same commit; reformatting a bundled source and
+  committing without the rebuild would leave main in a state where `pages`
+  refuses to deploy.
+- **`pages`** — bundles, refuses to deploy a stale `web/dist`, then deploys.
+  Its job is called `bundle`, not `build`, because `.mergify.yml` keys a merge
+  rule on a check named `build` and that has to mean the packaging workflow.
+
 ### Layout beyond the core
 - `jupyddl/requirements.py` — **the source of truth** for what every PDDL
   requirement flag does here. Change support for a feature *here first*; the
@@ -87,7 +107,10 @@ planners must go through the task rather than the operator to honour them:
   `jupyddl/` (including a `black` reformat) run `python tools/build_web.py` and
   commit the result, or `tests/test_web_bundle.py` and the Pages workflow fail.
   The bundle deliberately excludes `jupyddl/viz/` (matplotlib is not loaded in
-  the browser).
+  the browser). The builder must stay **byte-reproducible**: it sorts both the
+  directory walk and the JSON keys, because an unsorted `os.walk` bundles the
+  same sources in a disk-dependent order and the staleness check then fails on
+  a bundle that is not stale.
 - **The playground's Python lives in `web/bootstrap.py`**, fetched at runtime
   rather than embedded in `worker.js`. Do not inline it back into a JS template
   literal: reStructuredText double-backticks in a docstring terminate the

CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to this project are documented in this file. The format is
 based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Fixed
+- **The browser bundle is byte-reproducible again.** `tools/build_web.py`
+  sorted the files inside each directory but let `os.walk` visit the
+  subdirectories in filesystem order, so `jupyddl-sources.json` came out
+  byte-different on a CI runner and the staleness check failed on a bundle that
+  was not stale.
+- **`format` no longer strands `pages`.** It reformats `jupyddl/` and commits to
+  main; `web/dist` embeds those sources verbatim and `pages` refuses to deploy a
+  bundle that has drifted, so the reformat could leave main undeployable. The
+  rebuild now rides along in the same commit.
+- **Mergify's auto-merge rule matched no check.** It required
+  `check-success=tests`, which is the *workflow* name — the checks are the
+  matrix jobs (`test (ubuntu-latest, 3.12, dev)`), so the rule never fired.
+
+### Changed
+- CI runs the suite on Python 3.13 and 3.14 as well as 3.9–3.12, and lints
+  `tools/` alongside `jupyddl` and `tests`.
+- One matrix entry installs the `viz` extra. Six test modules `importorskip`
+  matplotlib, so the entire charting surface was silently skipped in CI.
+- `build` no longer re-runs the lint the `tests` matrix already ran. It builds
+  the sdist and wheel, `twine check`s them, installs the wheel into a clean
+  environment and plans with it from outside the repository — packaging
+  breakage an editable install cannot show.
+- `actions/checkout` v4 → v7, `actions/setup-python` v5 → v7,
+  `codecov/codecov-action` v4 → v7 (#146, #150, #145); the `format` job runs on
+  Python 3.14 (#149); the Mergify config drops the deprecated
+  `delete_head_branch` block (#143).
+
 ## [2.2.0] - 2026-07-28
 
 Closes the PDDL gap: 20 of the 21 requirement flags are now supported, up from