Skip to content

Conversation

@2bndy5
Copy link
Member

@2bndy5 2bndy5 commented Nov 24, 2025

  • separates build and deploy steps into separate jobs (in release CI) to isolate use of write access to repo contents.
  • removes duplicate jobs. Some duplicated jobs were run in different contexts. This simplifies that by adjusting CI triggers.
  • use pipx in release CI build jobs
  • simplifies the bash script used to transpose repo name into arg values
  • reduces duplicated deployment steps (for test-PyPI vs regular PyPI) into 1 step for both endpoints
  • removes most third-party actions and pin the remaining ones to their SHA
  • do not inherit default/global permissions for github.token. Instead any permissions used are explicitly declared with explanatory comments.

@2bndy5 2bndy5 added the github_actions Pull requests that update GitHub Actions code label Nov 24, 2025
@codecov
Copy link

codecov bot commented Nov 24, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.26%. Comparing base (c4496a8) to head (9602855).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master      #73   +/-   ##
=======================================
  Coverage   86.26%   86.26%           
=======================================
  Files          16       16           
  Lines        2512     2512           
=======================================
  Hits         2167     2167           
  Misses        345      345           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@2bndy5 2bndy5 force-pushed the review-ci branch 2 times, most recently from 3dd85ac to 8acd03a Compare November 24, 2025 10:46
- separates build and deploy steps into separate jobs (in release CI) to isolate use of write access to repo contents.
- removes duplicate jobs. Some duplicated jobs were run in different contexts. This simplifies that by adjusting CI triggers.
- use pipx in release CI build jobs
- simplifies the bash script used to transpose repo name into arg values
- reduces duplicated deployment steps (for test-PyPI vs regular PyPI) into 1 step for both endpoints
- removes most third-party actions and pin the remaining ones to their SHA
- do not inherit default/global permissions for `github.token`. Instead any permissions used are explicitly declared with explanatory comments.
@2bndy5 2bndy5 merged commit 9fffc0a into master Nov 24, 2025
10 checks passed
@2bndy5 2bndy5 deleted the review-ci branch November 24, 2025 11:35
adafruit-adabot pushed a commit to adafruit/CircuitPython_Community_Bundle that referenced this pull request Nov 25, 2025
Updating https://github.com/2bndy5/CircuitPython_nRF24L01 to v2.2.0 from v2.1.6:
  > bump version to v2.2.0
  > chore(dev): fix deployments to PyPI
  > build(dev): switch to `uv` (nRF24/CircuitPython_nRF24L01#75)
  > Bump actions/download-artifact from 5 to 6 in the actions group (nRF24/CircuitPython_nRF24L01#76)
  > chore(dev): revise CI (again) (nRF24/CircuitPython_nRF24L01#73)
  > build: drop support for Python v3.7 and v3.8 (nRF24/CircuitPython_nRF24L01#74)
  > chore(dev): upgrade pre-commit hooks (nRF24/CircuitPython_nRF24L01#72)
  > Bump actions/checkout from 5 to 6 in the actions group (nRF24/CircuitPython_nRF24L01#71)
  > Bump actions/upload-artifact from 4 to 5 in the actions group (nRF24/CircuitPython_nRF24L01#70)
  > chore: group dependabot updates into 1 PR
  > Bump actions/checkout from 4 to 5 (nRF24/CircuitPython_nRF24L01#67)
  > Bump actions/setup-python from 5 to 6 (nRF24/CircuitPython_nRF24L01#69)
  > Bump pypa/gh-action-pypi-publish in /.github/workflows (nRF24/CircuitPython_nRF24L01#68)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants