ci: gate publish on the full CI suite for the exact publish SHA - #23
Merged
Conversation
publish.yml now calls ci.yml as a reusable workflow before releasing, so buf lint/breaking, upstream/reply coverage, TS build/typecheck, and Python build/twine all run against the exact commit being published rather than a narrower rebuild in the publish job. Both release and publish-pypi depend on that gate, so both ecosystems must build successfully before either registry publish runs. Added a twine check on the PyPI job's own build to keep parity with the artifact it actually uploads.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent
publish.ymlreruns generation drift + build before publishing, but notbuf lint/buf breaking, the upstream/reply coverage gates, TS typecheck, or Pythontwine check- so it could publish an npm/PyPI pair that never passed the same suite the branch's CI enforces. It also built+published npm fully before ever building the Python distribution, so a broken PyPI build could leave npm published with nothing to match it on PyPI.workflow_call:toci.ymlso it can run as a reusable workflow, then added acijob topublish.yml(uses: ./.github/workflows/ci.yml) that both thereleaseandpublish-pypijobs depend on. Because it's a job in the samepush-triggered run, it validates the exact SHA being published, not a rebuild of it.pnpm run build, Python viabuild/twine check, both already inci.yml) and pass buf/coverage checks before either registry publish step runs.twine checkon the PyPI job's own build too, so the artifact that's actually uploaded is checked, not just the earlier CI copy.productionenvironment gate are untouched.