Release v3.0.2

[ecrum19]

Why 3.0.2 and not 3.0.1

3.0.1 was published to PyPI from commit 5b4b8e9 — 55 commits behind main,
dated 2026-06-02. The tag pointed at June work, so the published artifact was
three months of regressions wearing a 3.0.1 label. It has been yanked, and PyPI
reserves a version permanently once uploaded, so 3.0.1 can never be re-published.

The Docker half was caught mid-run and cancelled before it pushed, so Docker Hub
was never written to — latest is still the v2.1.0 image.

No code changes here. This is exactly the v3.0.1 content — the
multi-architecture Docker build fix, the QLever digest pin, and the idempotent
PyPI publish — under a version number that can actually be published.

How the mis-tag published silently

GitHub Actions runs the workflow file from the tagged commit. June's
publish-python had a "Sync release metadata from tag" step that rewrote the
version to match the tag, so it relabelled old code as 3.0.1 and uploaded it
without complaint.

main already replaced that with scripts/release.py --check-tag, which
validates committed metadata against the tag. Tagging the wrong commit now
fails the build instead of shipping. That guard is in this branch's base and is
what makes a repeat of this failure loud.

Verification

Everything below was run against this branch, not assumed.

Check	Result
scripts/release.py --check-tag v3.0.2	metadata agrees
All six version markers	3.0.2; conda sha256 reset to placeholder
Unit suite	641 tests, OK
python -m build	3.0.2 wheel + sdist
twine check	PASSED
sdist contents	0 test files (MANIFEST.in prune working)
wheel contents	23 entries, all 5 top-level modules, deps correct
Fresh venv install	version 3.0.2; all three console scripts run
META fix in installed package	Values=[a, b, c] → ['a','b','c']
docker buildx --platform linux/amd64,linux/arm64	exit 0, both platforms through all 24 steps
QLever link check	no warnings on either architecture
Stale 3.0.1 references	none
Relative markdown links	none broken

Tagging — please verify before pushing

The previous release failed because the tag was created on the wrong commit.
Create it against an explicit SHA and confirm it before pushing:

git fetch origin
git tag -a v3.0.2 <merge-commit-sha> -m "VCF-RDFizer v3.0.2"
git log -1 --oneline v3.0.2          # must be the merge of this PR
python3 scripts/release.py --check-tag v3.0.2   # must pass on that commit
git push origin v3.0.2

If --check-tag fails, the tag is on the wrong commit — do not push it.

After the release lands, record the conda checksum:

python3 scripts/release.py 3.0.2 --fetch-conda-sha256

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!