feat(python-release): attach built files, mark prereleases, run a dist check#292
Merged
Merged
Conversation
…t check Three gaps that make a caller lose real behaviour when it migrates off a hand-rolled release workflow: - release-files: the github-release job only ran `gh release create --generate-notes` and never downloaded the dist artifact, so a caller moving off softprops/action-gh-release (normally configured with `files: dist/*`) would publish a Release with no distributions attached. - prerelease: `auto` (default) marks the Release a prerelease when the tag carries a pre/dev segment. Without it every alpha/beta/rc tag is announced as a full release — the realistic case for a project on 2.0.0-alpha.6. - check-cmd: python-build.yml already has it; on the release path dist validation was silently dropped. The tag detection requires the marker to be delimited or to follow a digit. A plain substring test reads "rc" out of v1.0.0-darcy and "dev" out of v1.0.0-developer and would mark final releases as prereleases; verified against 16 tags including those two. Defaults reproduce the previous behaviour exactly: no files attached, no prerelease marking, no check command. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
|
CybotTM
added a commit
to netresearch/coding_agent_cli_toolset
that referenced
this pull request
Jul 23, 2026
Replaces four hand-rolled jobs (**10** step-level third-party actions) with one caller job and **zero** stray uses. Net −116/+39. ### Nothing working is lost, because the publish path never worked Verified against the repo, not assumed: ``` Actions secrets : none <- PYPI_API_TOKEN / TEST_PYPI_API_TOKEN resolved to empty tags : 0 releases : 0 environments : copilot <- no `pypi` environment pypi.org/cli-audit : HTTP 404 ``` Rather than carry a job guaranteed to fail, publishing is switched **off** and the two prerequisites are documented in the workflow itself: 1. a PyPI **Trusted Publisher** for `netresearch/coding_agent_cli_toolset`, pointing at this workflow and the environment the reusable names; 2. that GitHub Environment. Flipping `publish-pypi: true` is then the entire change — the reusable uploads via OIDC, so **no token is needed at all**. That is a strictly better position than the secret-based setup this replaces. ### Two behaviours were added to the reusable first, so they survive The audit found this repo was the only one in the fleet sweep whose release workflow mapped cleanly onto `python-release.yml` — and even it could not migrate without [netresearch/.github#292](netresearch/.github#292): | | before | after | |---|---|---| | release assets | `softprops/action-gh-release` with `files: dist/*` | `release-files: dist/*` | | prerelease | `contains(github.ref, 'alpha'\|'beta'\|'rc')` | `prerelease: auto` | `auto` reproduces the old expression **and** covers the PEP 440 spellings it missed (`v1.2.3a1`, `v1.2.3rc2`, `v2.0.0.dev3`), while not tripping on tags that merely contain those letters (`v1.0.0-darcy`, `v1.0.0-developer`). At version `2.0.0-alpha.6` prerelease tags are the normal case here, so this is not hypothetical. ### Dropped deliberately as local quirks The CHANGELOG-derived release body (replaced by `--generate-notes`) and the separate TestPyPI dispatch path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three gaps that make a caller lose real behaviour when it migrates off a hand-rolled release workflow. Found by the fleet audit: coding_agent_cli_toolset is the one repo in the sweep whose release workflow maps cleanly onto this reusable — and it still could not migrate without these.
release-files""github-releasejob never downloaded the dist artifact, so a caller moving offsoftprops/action-gh-release(normallyfiles: dist/*) would publish a Release with no distributions attachedprereleaseautocheck-cmd""python-build.ymlalready has it; on the release path dist validation was silently droppedEvery default reproduces current behaviour exactly.
Why
prerelease: autorather than a booleanThe motivating repo sits at version
2.0.0-alpha.6— prerelease tags are its normal case, not an exception. A boolean would have to be flipped by hand per release.The detection requires the marker to be delimited or to follow a digit. A plain substring test reads
rcout ofv1.0.0-darcyanddevout ofv1.0.0-developer, and would announce final releases as prereleases:16 tags verified, all correct.
true/falseremain available for callers that want to decide explicitly.Note on
release-filesThe glob is word-split into
argvso a caller cannot inject shell metacharacters, and the job fails loudly if the pattern matches nothing — attaching zero files silently is the failure mode this input exists to prevent.