Skip to content

Add trusted publishing release workflow#1575

Merged
tconley1428 merged 5 commits into
mainfrom
trusted-publishing-release-workflow
Jun 3, 2026
Merged

Add trusted publishing release workflow#1575
tconley1428 merged 5 commits into
mainfrom
trusted-publishing-release-workflow

Conversation

@tconley1428
Copy link
Copy Markdown
Contributor

Summary

  • add a manual release publishing workflow backed by PyPI trusted publishing
  • resolve and verify the latest successful Build Binaries artifacts from main
  • publish to TestPyPI, smoke test, publish to PyPI, smoke test, then create a draft GitHub release
  • include a dry_run mode that validates checked-in versions and release artifacts without publishing or creating a release

Validation

  • git diff --check -- .github/workflows/release-publish.yml
  • YAML parse via Ruby
  • bash -n over workflow run blocks
  • Python compile over embedded Python heredocs

@tconley1428 tconley1428 requested a review from a team as a code owner June 3, 2026 16:55
@tconley1428 tconley1428 force-pushed the trusted-publishing-release-workflow branch from 97d2728 to 5114907 Compare June 3, 2026 17:04
Comment thread .github/workflows/release-publish.yml Outdated
Comment thread .github/workflows/release-publish.yml Outdated
@tconley1428 tconley1428 marked this pull request as draft June 3, 2026 17:05
@tconley1428 tconley1428 force-pushed the trusted-publishing-release-workflow branch 3 times, most recently from d9892ed to 61f3d0e Compare June 3, 2026 17:26
@tconley1428 tconley1428 force-pushed the trusted-publishing-release-workflow branch from 61f3d0e to f8c2566 Compare June 3, 2026 20:04
@tconley1428 tconley1428 marked this pull request as ready for review June 3, 2026 20:55
Copy link
Copy Markdown
Contributor

@eamsden eamsden left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Minor issue caught by Codex that could interfere with smoke-testing re-releases
  • Please confirm the final shape of workflow dispatch for the release-publish.yml workflow.

otherwise LGTM

Comment thread .github/workflows/release-publish.yml Outdated
Comment thread .github/actions/release-smoke-package/action.yml Outdated
Comment thread .github/workflows/release-publish.yml Outdated
Comment on lines +186 to +199
smoke_testpypi:
name: Smoke test TestPyPI package
needs:
- verify_artifacts
- publish_testpypi
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: ./.github/actions/release-smoke-package
with:
version: ${{ needs.verify_artifacts.outputs.version }}
index-url: https://test.pypi.org/simple/
extra-index-url: https://pypi.org/simple/
Copy link
Copy Markdown
Contributor

@VegetarianOrc VegetarianOrc Jun 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we matrix this to smoke test across the various build targets?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could, but it isn't something we've ever done for existing releases and we haven't seen any issues. I don't believe this smoke test has ever caught an actual problem in the first place.

@tconley1428 tconley1428 merged commit 05aef6b into main Jun 3, 2026
15 checks passed
@tconley1428 tconley1428 deleted the trusted-publishing-release-workflow branch June 3, 2026 23:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants