ci: gate PyPI publish behind full CI + environment approval - #20
Conversation
Adopt the release.yml/python-publish.yml split already used in python-tesla-fleet-api: a reusable workflow_call gate job runs the same lint/type-check/test/build steps CI does on the exact tag SHA, and only then does the pypi environment (protected, OIDC trusted publishing) allow the publish step to run.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 71795a52eb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| description: Python version to build/test/publish with | ||
| required: false | ||
| type: string | ||
| default: "3.13" |
There was a problem hiding this comment.
The package supports Python 3.9+, and the normal CI test job covers 3.9 through 3.13, but this release gate runs the suite only on the single default of 3.13. A tag containing a compatibility regression on 3.9–3.12 can therefore pass this purported full-CI gate and be published; use the same version matrix as .github/workflows/ci.yml before allowing the publish job to proceed.
AGENTS.md reference: AGENTS.md:L6-L6
Useful? React with 👍 / 👎.
The gate previously tested only Python 3.13, while ci.yml covers 3.9-3.13, so a compatibility regression on an older version could pass the gate and publish. Split into lint/test/build jobs matching ci.yml's shape, with test running the same version matrix; build (and publish) stay single-version.
|
Fixed in 890d909: the release gate now runs |
1 participant
Intent
.github/workflows/release.ymlis a reusableworkflow_callwith agatejob (ruff, mypy,tests/test_*.py,uv build+twine check) that mirrors this repo's ownci.ymlsteps, followed bypublish-to-pypi(needsgate, runs under thepypienvironment) andgithub-release.python-publish.ymlis trimmed down to just the tag trigger (v*.*.*) and a call intorelease.yml, keeping the existing trusted-publishing OIDC setup (id-token: write,pypienvironment + PyPI project URL) unchanged.pypiGitHub environment already exists and gatespublish-to-pypiviaenvironment:(same as before), but it currently has no protection rules (no required reviewers) configured - that's an org/repo-admin setting outside this repo's files, so it isn't part of this diff. Adding a required reviewer there is what turns the existing environment gate into the intended manual-approval step.