Add immutable releases with automated PyPI publishing#140
Merged
Conversation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
pkopac
approved these changes
Apr 9, 2026
Contributor
|
Settings updated ✅ |
Use the gh CLI already available on the runner, fixing the zizmor superfluous-actions warning. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use GITHUB_REF_NAME env var instead of github.ref_name template expansion to fix zizmor code-injection warning. Replace --require-hashes recommendation with uv per review feedback. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
pkopac
reviewed
Apr 10, 2026
| - name: Create GitHub Release | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| run: gh release create "$GITHUB_REF_NAME" --generate-notes |
Contributor
There was a problem hiding this comment.
Zizmor points out that the branch name itself could potentially contain injection, I am not sure about that 😅 but if you put it into env it should not be evaluated, therefore nullify injection danger.
Replace manual twine upload with CI-based publishing triggered by tag push. The release workflow now runs lint, tests, version verification, builds sdist+wheel, publishes to PyPI via OIDC, and creates a GitHub Release with attached distribution files. - Add pyproject.toml with PEP 517/518 build-system declaration - Remove legacy setup.py publish command - Rewrite release.yml with lint/test/build/publish/release jobs - Update RELEASING.md with automated pipeline and setup docs
Adds SLSA provenance attestations so users can cryptographically verify that published packages were built from this repository by the release workflow.
- Rename test workflow from "Run specs and generate Code Climate report" to "Test" (Code Climate is no longer used) - Remove orphaned coverage XML generation (no service consumes it) - Replace Travis CI badge with GitHub Actions badge - Replace outdated manual releasing instructions with pointer to RELEASING.md - Drop Python 3.9 classifier (untested), add 3.14 (tested)
bin/release.sh takes patch/minor/major, checks prerequisites and CI status, shows open and merged PRs for review, bumps the version, opens a release PR, waits for merge, tags, and polls until the release workflow completes. If interrupted, prints remaining manual steps. Route version bumps through PR flow instead of pushing to main directly. Replace CHANGELOG.md contents with a link to GitHub Releases where notes are now auto-generated from merged PR titles.
The release workflow uses actions/cache for pip dependencies in the lint and test jobs. These are low-confidence findings since the cache only contains pip packages (not executable code) and the jobs have read-only permissions.
wscourge
changed the title
pkopac
approved these changes
Apr 17, 2026
Contributor
|
trusted publishing set up ✅ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/release.ymlto run the full lint+test matrix onv*tag push, build sdist+wheel, create a GitHub Release with attached distribution files, and publish to PyPI via OIDC trusted publishing with build attestationsRELEASING.mdwith release process (version bump via PR, tag, automated publish), pre-release handling, and security documentationbin/release.shto automate the entire release flow end-to-endpyproject.tomlwith PEP 517/518 build-system declarationCHANGELOG.mdcontents with a link to the GitHub Releases page, where release notes are now auto-generated from merged PR titlessetup.py publishcommandbin/release.shThe script automates the full release process:
git,gh,jq,python3)main, exits with a link to the failed run if notmainand asks for confirmation to continuechartmogul/version.pyIf interrupted (Ctrl-C) during either polling step, it prints the remaining manual steps and links needed to finish the release by hand.
Pre-merge admin setup
v*pypichartmogul/chartmogul-python, workflowrelease.yml, environmentpypi(I didn't want to save it w/o GHA env in place)Post-merge steps
vX.Y.Z-rc1) and confirm the full pipeline runsbin/release.sh patchand confirm it works end to endTest plan
python3 -m buildlocally and verify both sdist and wheel are produced with expected contentsbin/release.sh patchagainst a sandbox/fork to validate the interactive flow