ci: address review — script injection, dispatch safety, python bound

Three fixes from review of #49.

**Script injection in attach-to-release** (found by Codex, via @alessiodevoto).
`gh release upload "${{ github.event.release.tag_name }}"` interpolated the tag
into the shell script. GitHub expands `${{ }}` textually before bash parses the
line, so a tag containing `$(...)` or backticks executes — the double quotes do
not help, because substitution happens before quoting applies. The job holds
`contents: write`. The tag now goes through `env:`, so bash sees it as data.

Audited the rest of the file for the same class: this was the only instance;
every other interpolation already used the env pattern.

**Manual dispatch could reach real PyPI** (@alessiodevoto). The dispatch input
offered `pypi` as well as `testpypi`, and publish-pypi ran on
`inputs.target == 'pypi'`. Rather than reducing the choice list to one item,
the input is removed entirely: a manual run is always a TestPyPI dry run, and
real PyPI is reachable only by publishing a GitHub Release. A single-option
selector would have been a knob that cannot be turned.

**nooa-bench requires-python** (@alessiodevoto). It declared `>=3.12` with no
upper bound while depending on nooa and nooa-cli, both `>=3.12,<3.14`. On 3.14
that surfaces as "could not find a version that satisfies nooa" rather than a
clean "requires a different Python". Now consistent across all four packages.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: sklinglernv

.github/workflows/publish.yml

@@ -17,13 +17,10 @@ name: Publish
 on:
   release:
     types: [published]
+  # Manual runs are ALWAYS a TestPyPI dry run. There is deliberately no input
+  # to select the index: real PyPI is reachable only by publishing a GitHub
+  # Release, so a mis-click here cannot burn a version number on PyPI.
   workflow_dispatch:
-    inputs:
-      target:
-        description: "Index to upload to"
-        type: choice
-        options: [testpypi, pypi]
-        default: testpypi
 
 permissions: {}
 
@@ -110,7 +107,7 @@ jobs:
   # but a distinct environment is also what gives per-package approval gates.)
   publish-testpypi:
     needs: build
-    if: github.event_name == 'workflow_dispatch' && inputs.target == 'testpypi'
+    if: github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false  # a partial publish is recoverable; a cancelled one is messier
@@ -155,7 +152,8 @@ jobs:
 
   publish-pypi:
     needs: build
-    if: github.event_name == 'release' || inputs.target == 'pypi'
+    # Real PyPI is reachable ONLY from a published GitHub Release.
+    if: github.event_name == 'release'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -214,6 +212,13 @@ jobs:
         with:
           name: dist
           path: dist/
-      - env:
+      # The tag name goes through `env:`, not `${{ }}` inside the script.
+      # GitHub expands `${{ }}` textually *before* bash parses the line, so a
+      # tag containing `$(...)` or backticks would execute — double quotes do
+      # not help, because the substitution happens before quoting is applied.
+      # This job holds `contents: write`. Via env, bash sees the value as data.
+      - name: Attach artifacts to the release
+        env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release upload "${{ github.event.release.tag_name }}" dist/* --repo "$GITHUB_REPOSITORY"
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: gh release upload "$RELEASE_TAG" dist/* --repo "$GITHUB_REPOSITORY"

RELEASING.md

@@ -72,8 +72,12 @@ reviewer there gives a second pair of eyes before the irreversible step.
 
 ### Dry run against TestPyPI
 
-Run the **Publish** workflow manually (Actions → Publish → Run workflow) with
-target `testpypi`. This exercises the identical build and smoke test.
+Run the **Publish** workflow manually (Actions → Publish → Run workflow). This
+exercises the identical build, version check, and smoke test.
+
+A manual run always targets TestPyPI — there is no index selector. Real PyPI is
+reachable only by publishing a GitHub Release, so a mis-click here cannot burn
+a version number on PyPI.
 
 ### Doing it by hand
 

packages/nooa-bench/pyproject.toml

@@ -5,7 +5,11 @@ dynamic = ["version"]
 description = "Benchmark agent (BenchAgent) and Harbor runner for the NOOA framework — reproduces the tech report's SWE-bench and Terminal-Bench results"
 license = {text = "Apache-2.0"}
 readme = "README.md"
-requires-python = ">=3.12"
+# Matches nooa and nooa-cli (both >=3.12,<3.14), which this depends on.
+# Without the upper bound, installing on 3.14 fails with a confusing
+# "could not find a version that satisfies nooa" instead of a clean
+# "requires a different Python".
+requires-python = ">=3.12,<3.14"
 dependencies = [
     "nooa",
     "nooa-cli",