Repository navigation
Release 0.3.0 + tag-triggered PyPI publish via Trusted Publishing - #94
Merged
Merged
Conversation
cotdata had no release workflow, so publishing meant a manual twine upload with a stored API token from somebody's laptop. crucible already solved this the other way, with OIDC Trusted Publishing and no stored credentials, and one publish mechanism across the fleet is one thing to get right and one thing to audit. This is that workflow, adapted. Two guards rather than crucible's one, because cotdata carries its version in two places: pyproject.toml and src/cotdata/__init__.py. A release that bumps one and forgets the other installs fine and then lies about itself at runtime, which is exactly the kind of thing nobody checks by hand twice. Does not publish anything on its own. It needs a one-time GitHub publisher on PyPI (owner mspinola, repo cotdata, workflow release.yml, environment pypi) which can only be configured from the project owner's PyPI account, and it fires on a tag push whose version matches pyproject. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
0.2.0 was tagged earlier today and never uploaded, because this repo had no release workflow at the time and the alternative was a hand-rolled twine upload with a stored token. That tag stands as a git tag and nothing more. Main has since moved past it (#93 removed the flow decomposition), so publishing the tagged tree would ship something that was never main's head, and re-pointing the tag would change what 0.2.0 means after the fact. 0.3.0 is what main actually is. Minor rather than patch because a public CLI subcommand is gone, and everything from 0.2.0 rides along, so a consumer stepping up from PyPI's 0.1.0 gets the whole vintage subsystem in one move. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
mspinola
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cotdata had no release workflow, so publishing meant a manual
twineupload with a stored API token from somebody's laptop. crucible already solved this the other way — OIDC Trusted Publishing, no stored credentials — and one publish mechanism across the fleet is one thing to get right and one thing to audit. This is that workflow, adapted.Two guards rather than crucible's one, because cotdata carries its version in two places:
pyproject.tomlandsrc/cotdata/__init__.py. A release that bumps one and forgets the other installs fine and then lies about itself at runtime, which is exactly the kind of thing nobody checks by hand twice.Publishes nothing on its own. It needs a one-time GitHub publisher configured on PyPI (owner
mspinola, repocotdata, workflowrelease.yml, environmentpypi), which can only be done from the project owner's PyPI account, and it fires on a tag push whose version matches pyproject.workflow_dispatchbuilds andtwine checks without publishing, which is the only dry run available since there is no TestPyPI path.🤖 Generated with Claude Code