
  # no-pypi-surface (PKG-12) — fail if any mgf-* publish/index/verify surface
  # targets pypi.org (the Codeberg cutover). Stdlib-only, no install. Allowlists
  # comments / "not pypi.org" negations / --extra-index-url third-party fallbacks.
  - name: no-pypi-surface
    image: python:3.12-slim
    commands:
      - python scripts/check_no_pypi_surface.py
