From e504eb137e18c42c756a8364bed06db8dd9692c5 Mon Sep 17 00:00:00 2001
From: Jon Allen <joallen@nvidia.com>
Date: Thu, 28 Aug 2025 09:25:45 -0700
Subject: [PATCH 1/3] Add license allowlist.

---
 justfile | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/justfile b/justfile
index f09ce621..06bf4e12 100644
--- a/justfile
+++ b/justfile
@@ -17,10 +17,16 @@ lint: setup
 # Run tests
 test: lint
 
+# https://spdx.org/licenses/
+allow_licenses := "MIT BSD-2-CLAUSE BSD-3-CLAUSE APACHE-2.0 ISC"
+ignore_package_licenses := "nvidia-* hf-xet certifi filelock matplotlib typing-extensions"
+
 # Update the license
 license: install
-  uvx licensecheck --show-only-failing --ignore-packages "nvidia-*" "hf-xet" --zero
+  uvx licensecheck --show-only-failing --only-licenses {{allow_licenses}} --ignore-packages {{ignore_package_licenses}} --zero
   uvx pip-licenses --python .venv/bin/python --format=plain-vertical --with-license-file --no-license-path --no-version --with-urls --output-file ATTRIBUTIONS.md
+  pre-commit run --all-files trailing-whitespace || true
+  pre-commit run --all-files end-of-file-fixer || true
 
 # Release a new version
 release pypi_token='dry-run' *args:

From c7718736e065c6d74ce93a43df15e6f2fa9cac9a Mon Sep 17 00:00:00 2001
From: Jon Allen <joallen@nvidia.com>
Date: Thu, 28 Aug 2025 09:47:30 -0700
Subject: [PATCH 2/3] Update

---
 .pre-commit-config.yaml |  1 +
 CONTRIBUTING.md         | 26 ++++++++++++++++++++++++++
 bin/release.sh          |  3 +--
 justfile                | 10 +++++++---
 4 files changed, 35 insertions(+), 5 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index bae888f9..b4e71ba9 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -52,3 +52,4 @@ repos:
       - id: markdown-link-check
         args: [--config, ".link-check.json", --quiet]
         stages: [manual]
+        exclude: \bATTRIBUTIONS\b
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index bc7e2136..8e82ebd5 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -28,6 +28,32 @@ To see all available commands, run
 just
 ```
 
+## Releasing
+
+To release, you must be a maintainer of the [cosmos-predict2 package](https://pypi.org/project/cosmos-predict2/).
+
+Run pre-release check:
+
+```shell
+just release-check
+```
+
+Commit any changes.
+
+Release to PyPI:
+
+```shell
+just release <pypi_token>
+```
+
+Push the new tag to GitHub:
+
+```shell
+git push git@github.com:nvidia-cosmos/cosmos-predict2.git "v$(uv version --short)"
+```
+
+Merge the new commit to GitHub.
+
 ## Code Reviews
 
 All submissions, including submissions by project members, require review. We use GitHub pull requests for this purpose. Consult
diff --git a/bin/release.sh b/bin/release.sh
index e132ad48..417646d4 100755
--- a/bin/release.sh
+++ b/bin/release.sh
@@ -24,6 +24,7 @@ fi
 PYPI_TOKEN="$1"
 shift
 
+# Check that there are no uncommitted changes
 if [[ $(git status --porcelain) ]]; then
   echo "There are uncommitted changes. Please commit or stash them before proceeding."
   exit 1
@@ -31,8 +32,6 @@ fi
 
 # Bump the version and tag the release
 PACKAGE_VERSION=$(uv version --bump patch --short)
-just license
-just lint
 git add .
 git commit -m "v$PACKAGE_VERSION"
 git tag "v$PACKAGE_VERSION"
diff --git a/justfile b/justfile
index 06bf4e12..65d39a42 100644
--- a/justfile
+++ b/justfile
@@ -25,8 +25,12 @@ ignore_package_licenses := "nvidia-* hf-xet certifi filelock matplotlib typing-e
 license: install
   uvx licensecheck --show-only-failing --only-licenses {{allow_licenses}} --ignore-packages {{ignore_package_licenses}} --zero
   uvx pip-licenses --python .venv/bin/python --format=plain-vertical --with-license-file --no-license-path --no-version --with-urls --output-file ATTRIBUTIONS.md
-  pre-commit run --all-files trailing-whitespace || true
-  pre-commit run --all-files end-of-file-fixer || true
+  pre-commit run --files ATTRIBUTIONS.md || true
+
+# Pre-release checks
+release-check:
+  just license
+  pre-commit run --all-files --hook-stage manual
 
 # Release a new version
 release pypi_token='dry-run' *args:
@@ -39,7 +43,7 @@ docker-build cuda_version='12.6.3' *args:
 # Run the docker container
 docker cuda_version='12.6.3' *args:
   # https://github.com/astral-sh/uv-docker-example/blob/main/run.sh
-  just -f {{justfile()}} docker-build "{{cuda_version}}"
+  just docker-build "{{cuda_version}}"
   docker run --gpus all --rm -v .:/workspace -v /workspace/.venv -it cosmos-predict2:{{cuda_version}} {{args}}
 
 # Run the arm docker container

From 38e3241f80f69068ad6a1256efd2009db99f4386 Mon Sep 17 00:00:00 2001
From: Jon Allen <joallen@nvidia.com>
Date: Thu, 28 Aug 2025 09:50:33 -0700
Subject: [PATCH 3/3] Fix

---
 CONTRIBUTING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 8e82ebd5..9127bdad 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -40,7 +40,7 @@ just release-check
 
 Commit any changes.
 
-Release to PyPI:
+Release to PyPI (omit `<pypi_token>` to dry-run):
 
 ```shell
 just release <pypi_token>