fix: centralize hardened release publishing by jan-kubica · Pull Request #201 · stella/stdnum

jan-kubica · 2026-08-29T13:54:27Z

Summary

Centralizes exact PyPI wheel publishing, attestation, and version finalization while retaining caller-specific package and platform contracts.
Makes runtime setup Bun-first from the exact packageManager pin; Node remains only where the npm publishing boundary requires it.
Pins the shared release implementation and policy to immutable commit 437d9d78c38114a15c368daed7d3d1b36fd6b8fc.

Verification

Exact-ref shared policy validation
actionlint and whitespace checks
7 focused release workflow and wheel-set tests
repository pre-push test, type, format, and instruction checks

CC on behalf of jan-kubica

Summary by CodeRabbit

Release Process
- Improved release publishing safeguards and restricted automated publishing to the main branch.
- Updated release automation to use hardened publishing controls and clearer package validation.
Tests
- Added checks to ensure published packages match the expected version, names, platforms and release artifacts.
- Strengthened validation of release package contents and publishing configuration.

chatgpt-codex-connector · 2026-08-29T13:54:36Z

You have reached your Codex usage limits for security reviews. Please try again later.

chatgpt-codex-connector · 2026-08-29T13:54:43Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T16:21:52.977709Z	`802540e`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

jan-kubica · 2026-08-29T13:55:06Z

@codex review

Please review the exact current head, focusing on release privilege boundaries, immutable shared references, artifact identity, and preserved caller-specific release behavior.

CC on behalf of jan-kubica

coderabbitai · 2026-08-29T13:55:15Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 23b1c59d-cf80-44ab-a681-fc0c5ba30692

📥 Commits

Reviewing files that changed from the base of the PR and between 4ace6a4 and 802540e.

📒 Files selected for processing (2)

.github/workflows/release-policy.yml
.github/workflows/release.yml

🚧 Files skipped from review as they are similar to previous changes (1)

.github/workflows/release-policy.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (4)

GitHub Check: Pack
GitHub Check: Changeset
GitHub Check: Bindings and packages
GitHub Check: Rust

🔇 Additional comments (2)

.github/workflows/release.yml (2)

31-43: LGTM!

Also applies to: 140-142, 194-196

333-333: 🗄️ Data Integrity & Integration

The pin is not shown to be incorrect. 437d9d78c38114a15c368daed7d3d1b36fd6b8fc is the direct child of 06d3be1f42585ac33635102120f917bb74f9ecab and adds only release-policy changes. The pinned revision therefore includes the required revision’s changes.

📝 Walkthrough

Walkthrough

The release automation now uses pinned policy and publishing workflows, restricts release publishing to main, reorders setup steps, and validates wheel and finaliser contracts with static tests.

Changes

Release automation

Layer / File(s)	Summary
Release boundary enforcement `.github/workflows/release-policy.yml`, `.github/workflows/release.yml`	The release-policy workflow uses a new pinned revision. PyPI and final release jobs require the `main` branch. Verify and packaging jobs reorder setup steps.
Hardened PyPI publishing `.github/workflows/release.yml`, `scripts/pypi-wheel-set.test.ts`	The PyPI job uses the pinned `pypi-publish-hardened` publisher with explicit version, package, distribution, and wheel platform contracts. Static tests validate the contract and reject mutated values.
Release contract validation `scripts/release-workflow.test.ts`	Tests validate finaliser package manifests, artifact matching, npm publishing, changelog handling, and forwarded secrets. Previous fingerprint and embedded verifier tests were removed.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 80254

The release workflow uses a pinned shared publishing policy while retaining package-specific contracts, and the pinned revision includes the required policy changes. No actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant PyPIPublishHardened
  participant PyPI
  ReleaseWorkflow->>PyPIPublishHardened: Supply release metadata and wheel contract
  PyPIPublishHardened->>PyPI: Validate and publish wheels
  PyPI-->>PyPIPublishHardened: Return publication result

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarises the main change: centralising hardened release publishing through shared release workflows and actions.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/use-shared-release-publishers

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-29T13:55:24Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/release.yml

Package	Version	License	Issue Type
stella/.github/.github/actions/pypi-publish-hardened	437d9d78c38114a15c368daed7d3d1b36fd6b8fc	Null	Unknown License
stella/.github/.github/workflows/npm-version-finalize.yml	437d9d78c38114a15c368daed7d3d1b36fd6b8fc	Null	Unknown License

Allowed Licenses:
MIT, Apache-2.0, Apache-2.0 WITH LLVM-exception, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, BlueOak-1.0.0, Unlicense, CC0-1.0, CC-BY-4.0, MIT-0, MPL-2.0, Python-2.0, Zlib, Unicode-3.0

Excluded from license check:
pkg:cargo/libfuzzer-sys

OpenSSF Scorecard

Package	Version	Score	Details
actions/stella/.github/.github/actions/pypi-publish-hardened	437d9d78c38114a15c368daed7d3d1b36fd6b8fc	Unknown	Unknown
actions/stella/.github/.github/workflows/npm-version-finalize.yml	437d9d78c38114a15c368daed7d3d1b36fd6b8fc	Unknown	Unknown

Scanned Files

.github/workflows/release.yml

chatgpt-codex-connector · 2026-08-29T13:58:23Z

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 4ace6a44cd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

jan-kubica · 2026-08-29T14:23:59Z

@codex review

Please review exact head b9cc0cd after the pinned-runtime policy update and review fixes, focusing on release privilege boundaries, immutable references, artifact identity, and caller-specific behavior.

CC on behalf of jan-kubica

chatgpt-codex-connector · 2026-08-29T14:27:55Z

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: b9cc0cd908

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

jan-kubica · 2026-08-29T16:17:40Z

@codex review

Please review exact head 802540e, focusing on Bun-first manifest-bound runtime setup and exact PyPI artifact publishing. CC on behalf of jan-kubica

chatgpt-codex-connector · 2026-08-29T16:21:52Z

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 802540e8fb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

fix: centralize hardened release publishing

4ace6a4

fix: pin release build runtimes

b9cc0cd

fix: enforce Bun-first release setup

802540e

jan-kubica merged commit db39485 into main Aug 29, 2026
14 checks passed

jan-kubica deleted the fix/use-shared-release-publishers branch August 29, 2026 16:27

github-actions Bot locked and limited conversation to collaborators Aug 29, 2026

Navigation Menu

Uh oh!

fix: centralize hardened release publishing - #201

fix: centralize hardened release publishing#201
jan-kubica merged 3 commits into
mainfrom
fix/use-shared-release-publishers

jan-kubica commented Aug 29, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026 •

edited

Loading

Uh oh!

jan-kubica commented Aug 29, 2026

Uh oh!

coderabbitai Bot commented Aug 29, 2026 •

edited

Loading

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Aug 29, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026

Uh oh!

jan-kubica commented Aug 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026

Uh oh!

jan-kubica commented Aug 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jan-kubica commented Aug 29, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

jan-kubica commented Aug 29, 2026

Uh oh!

coderabbitai Bot commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

License Issues

.github/workflows/release.yml

OpenSSF Scorecard

Scanned Files

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026

Uh oh!

jan-kubica commented Aug 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026

Uh oh!

jan-kubica commented Aug 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jan-kubica commented Aug 29, 2026 •

edited by coderabbitai Bot

Loading

chatgpt-codex-connector Bot commented Aug 29, 2026 •

edited

Loading

coderabbitai Bot commented Aug 29, 2026 •

edited

Loading

github-actions Bot commented Aug 29, 2026 •

edited

Loading