Repository navigation
Prepare and harden publishing for 0.2.0 - #16
Merged
Merged
Conversation
- Publish on `release: published` instead of `created`, so drafts don't upload and publishing a draft does - MANIFEST.in: keep .claude/, .github/, CLAUDE.md, uv.lock out of the sdist (setuptools-scm includes every tracked file) - Document the pypi environment approval and tag protection in CLAUDE.md and /release Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012pKTVb5TrGn27R29rHHNck
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012pKTVb5TrGn27R29rHHNck
- Pin every action to a commit SHA (version in a comment). Also lets Dependabot see setup-uv >= v8, which no longer has floating major tags - Publish workflow: build job (no OIDC) runs lint + tests, builds, and checks the built version equals the release tag; publish job only downloads the artifact and uploads with id-token: write - /release: normalize the version (strip one leading v, require X.Y.Z greater than the latest tag) so `/release v0.2.0` can't tag vv0.2.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012pKTVb5TrGn27R29rHHNck
cssho
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
release: created→published:createdalso fires for drafts (possibly uploading before the release is final) and does not fire when a draft is later publishedMANIFEST.in— setuptools-scm puts every git-tracked file in the sdist, which currently ships.claude/,.github/,CLAUDE.md,uv.lockbuildjob without OIDC runs ruff + pytest, builds, and asserts the built version equals the release tag (a malformed tag likevv0.2.0makes setuptools-scm fall back to a dev version → fail before upload);publishjob only downloads the artifact and uploads withid-token: write@v7/release: quote the YAMLdescription(it contained:and broke the frontmatter), addargument-hint, normalize the version (strip one leadingv, requireX.Y.Z> latest tag), document the approval steppypienvironment approval andv*tag protection (repo settings applied separately)Test plan
uv build→ sdist has onlymd_condition/,tests/,README.md,LICENSE,pyproject.toml,MANIFEST.in+ metadata;twine check --strictPASSEDSETUPTOOLS_SCM_PRETEND_VERSION=0.2.0): passes forv0.2.0, fails forvv0.2.0🤖 Generated with Claude Code
https://claude.ai/code/session_012pKTVb5TrGn27R29rHHNck