ci: gate PyPI publish on full CI + approved environment - #113
Merged
Conversation
Extract the publish steps into a reusable workflow_call workflow (release.yml) so a tag push reruns the exact lint/type/test/build+twine gate on the release SHA before publishing, and publish now waits on the pypi environment's required-reviewer approval instead of a bare tag push being the trust boundary. python-publish.yml becomes a thin caller scoped to vX.Y.Z tags, and release.yml is parameterized so sibling repos can call it directly instead of copying the job.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent
vX.Y.Ztag push was the only trust boundary for shipping to PyPI: the publish workflow built and published straight off the tag with no re-run of lint/type/test and no human checkpoint.workflow_callworkflow (.github/workflows/release.yml) that reruns the full gate (ruff, pyright, pytest,uv build+twine check) on the exact tagged commit before touching PyPI.publish-to-pypinow runs under thepypienvironment and only proceeds after a manual approval - I configured the environment's required-reviewer protection via the API since there's no way to do it fromSettings > Environmentsin the UI.python-publish.ymlis now a thin caller scoped topush: tags: ["v*.*.*"](it previously ran the build job on every push to every branch) and keeps the existing PyPA OIDC trusted-publishing action unchanged.release.ymltakespackage-dir/pypi-project-url/python-versioninputs specifically soaiopowerwallandpython-teslemetry-streamcan call it directly (uses: Teslemetry/python-tesla-fleet-api/.github/workflows/release.yml@main) instead of each copying the job.ruff check,pyright,pytest,uv build, andtwine checklocally - all pass. The tag-triggered path itself (gate → approval → publish) is exercised by workflow structure/inputs review only; it hasn't been proven end-to-end with a real tag push, since that would actually publish a release.