Repository navigation
Publish to PyPI from CI on GitHub release (ADR-0007) - #11
Merged
Merged
Conversation
publish.yml builds the release tag with uv build, refuses a tag that is not v + the pyproject version, runs twine check --strict and a tool-install smoke test, then uploads by PyPI trusted publishing from the `pypi` environment; no token is stored. If the release already has a wheel and sdist attached, the CI build must be byte-identical to them or nothing is uploaded; if it has none, the CI build is attached with a SHA256SUMS after publishing. workflow_dispatch with a tag is a dry run that never publishes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishing a GitHub release now publishes it to PyPI. There's no token anywhere: the upload uses PyPI trusted publishing from the GitHub environment
pypi, which is already created and limited tov*tags.What
publish.ymldoescontents: read): checks out the release tag, fails unless the tag isv+ the version inpyproject.toml, runsuv buildandtwine check --strict, installs the wheel withuv tool install, and checksjevify --version.id-token: write, environmentpypi): runspypa/gh-action-pypi-publish, which also uploads attestations by default.contents: write): runs only when the release had no files. It uploads the CI build plus aSHA256SUMSto the release.workflow_dispatchwithtagruns the build job only and never publishes.ADR-0007 records the decision and has a row in the ADR index.
Before the next release
On PyPI, add a trusted publisher under jevify → Settings → Publishing with these values:
fidecastrojevifypublish.ymlpypiWithout it, the publish job fails.
Checks
actionlintis clean.v0.2.0. A fresh clone's build is byte-identical to the files attached to the 0.2.0 release.gh workflow run publish.yml -f tag=v0.2.0should pass the compare and skip publishing.🤖 Generated with Claude Code