ci(release): make release.yml the top-level publish workflow - #22
Conversation
Collapse the tag-triggered caller into release.yml directly and re-enable PEP 740 attestations. The reusable workflow_call split had signing identity mismatched against the PyPI trusted publisher (configured for release.yml + pypi environment), which is why attestations were disabled. Running release.yml directly restores the matching identity.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3ad02c3ff9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| environment: | ||
| name: ${{ inputs.environment-name }} | ||
| url: ${{ inputs.pypi-project-url }} | ||
| name: ${{ env.ENVIRONMENT_NAME }} |
There was a problem hiding this comment.
On every matching release tag, GitHub must evaluate this job-level environment name, but env is not available here: GitHub's context-availability table permits only github, needs, strategy, matrix, vars, and inputs for jobs.<job_id>.environment. Consequently, the release workflow is rejected before the protected pypi environment or publish step can run; hardcode pypi here or store it in vars instead.
AGENTS.md reference: AGENTS.md:L17-L17
Useful? React with 👍 / 👎.
1 participant
Intent
release.ymlwas a reusableworkflow_callworkflow invoked by a thin tag-triggeredpython-publish.ymlcaller, so attestations signed under the caller's identity - which PyPI's trusted-publisher check rejects (400).python-publish.yml's tag trigger and inputs directly intorelease.yml, making it the sole top-level workflow. It now signs asrelease.ymlitself, matching the identity the PyPI trusted publisher is already configured for.python-publish.ymlis deleted; its only job (tag trigger + per-repo input values) now lives inrelease.ymlas theon: push: tagstrigger plusenvdefaults.release.yml+pypienvironment identity now matches both the publisher check and the attestation identity.AGENTS.md's release description to match the new single-workflow shape.