fix: make release workflow compatible with immutable releases - #290
Open
farhan wants to merge 1 commit into
Open
fix: make release workflow compatible with immutable releases#290farhan wants to merge 1 commit into
farhan wants to merge 1 commit into
Conversation
Contributor
|
Since this repo is already uv-native ( Avoids pip entirely (in line with the org's uv migration) and is ~2.5-3x faster per run in our testing — PSR's Docker image rebuilds from scratch every run (~40s overhead) vs |
irfanuddinahmad
approved these changes
Sep 1, 2026
The org has immutable releases enabled, which freezes a release's assets
the moment it is published. The old flow let python-semantic-release
publish the GitHub Release and then attached the built distributions
afterwards via publish-action, which now fails with HTTP 422 ("cannot
upload assets to an immutable release"). That failure aborts the release
job before publish_to_pypi runs, so the tag is created but the package is
never shipped.
Adopt the sample-plugin immutable-safe pattern: set vcs_release="false"
so python-semantic-release commits, tags, and builds but does not publish
the release, then create it with `gh release create` which uploads the
assets to a draft and publishes it atomically -- the ordering immutable
releases require. All actions are SHA-pinned to their latest releases
with matching version comments (checkout v7.0.1, upload-artifact v7.0.1,
download-artifact v8.0.1, python-semantic-release v10.6.2,
gh-action-pypi-publish v1.14.2). PyPI keeps OIDC trusted publishing.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
farhan
changed the title
farhan
force-pushed
the
farhan/modernize-release-workflow
branch
from
September 1, 2026 15:13
2b53564 to
6a4135f
Compare
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Updates
.github/workflows/release.ymlto match the current sample-plugin release standard, adapted for forum (single backend package,dist/at repo root, OIDC PyPI publishing preserved).Relevant PR: https://github.com/openedx/sample-plugin/pull/57/changes
Why
The previous workflow attached release assets with
python-semantic-release/publish-action, which fails with HTTP 422 once a GitHub Release is frozen on publish (immutable releases). The new standard avoids this by building the release as a draft first.Details
vcs_release: "false"onpython-semantic-releaseso it commits, tags, pushes, and builds but does not create the GitHub Release. The release is then created viagh release create --verify-tagas a draft, assets uploaded, and only then published — so assets attach reliably.upload-artifactSHA was reallyv4.6.2, notv7.0.1;download-artifactSHA was reallyv4.3.0, notv8.0.1) and pinnedpython-semantic-releaseto the annotated-tag object SHA rather than the commit SHA. Now pinned to commit SHAs with accurate comments.actions/checkout→ v6.0.2,pypa/gh-action-pypi-publish→ v1.14.0.contents: readalongsideid-token: writefor least privilege.Notes
The multi-component jobs in sample-plugin (tutor plugin, npm/frontend publish) do not apply to forum and were intentionally omitted.
🤖 Generated with Claude Code