mara004

I'd close this as stalled/outdated for now but I'll make another attempt in the future.

I found that calling `gh at verify` in a `for`-loop was quite inefficient compared to our past usage of `slsa-verifier` which supported verifying multiple artifacts in one go. However, it...

I'm currently trying to build an own dataclass-like framework and took a look at `dataclass_transform()`, too. Unfortunately it seems extremely inflexible. I think it won't work well with anything except...

> like a generic plugin API to tell analyzers where to look See also https://github.com/microsoft/pyright/issues/607 and https://github.com/davidhalter/jedi/issues/1787 (both rejected, unfortunately :/) Interestingly, [MyPy does have a plugin mechanism](https://mypy.readthedocs.io/en/stable/extending_mypy.html#extending-mypy-using-plugins), but it...

FWIW, the project I maintain and our upstream have enabled immutable releases, and from what I can tell the feature is quite well-designed. Tag protection only hits once the GH...

The main drawback I can think of is, all artifacts have to be released in one go. Unlike PyPI, you can't attach new artifacts after a release has been emitted....