[PETOSS-980] Fix twine install escaping the venv in publish workflow - #239
Merged
Merged
Conversation
added 2 commits
August 10, 2026 13:33
sudo pip install twine ran outside the activated venv and tried to upgrade the system's apt-installed packaging package, which has no pip RECORD metadata and can't be uninstalled, failing the Install dependencies step. Install twine via the venv's pip instead.
Each workflow run: block is a fresh shell, so the venv activated in Install dependencies didn't carry over to the Publish to PyPi step. Append the venv's bin dir to GITHUB_PATH so twine keeps resolving there without needing to escape the venv via sudo. Verified locally with act (catthehacker/ubuntu:act-latest, which has the same apt-installed python3-packaging 24.0 as the real runner): the old sudo pip install step fails the same way, the new step installs twine cleanly inside the venv, twine --version resolves correctly in a later step with no venv activation, and the apt packaging package is left untouched.
the-chris-mitchell
marked this pull request as ready for review
August 10, 2026 02:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Publish & Release SDKworkflow's Install dependencies step ransudo pip install twineafter activating a venv.sudodoesn't inherit the venv'sPATH, so twine was installed into the runner's system Python instead.packaging>=26.1, so pip tried to upgrade the system'spackagingpackage — which was installed viaapt/debian and has no pip RECORD metadata — causingERROR: Cannot uninstall packaging 24.0, RECORD file not foundand failing the job (run 31346531884).run:block is a fresh shell, so the venv activated in Install dependencies didn't carry over to the laterPublish to PyPistep anyway — that's why the original code usedsudoin the first place (to force twine onto the system Python so it stayed reachable). The real fix: install twine inside the venv, then append the venv'sbindir to$GITHUB_PATHso it stays resolvable in later steps without ever touching the apt-managed system packages.Test plan
act(catthehacker/ubuntu:act-latest, which ships the same apt-installedpython3-packaging 24.0-1as the real runner):sudo pip install twinestep.twine --versionresolves correctly in a later step with no venv re-activation, and the aptpackagingpackage is left untouched.Publish & Release SDKworkflow viaworkflow_dispatchand confirm theInstall dependenciesandPublish to PyPisteps succeed end to end.