feat: renew publishing to PyPI - #1086
Conversation
WalkthroughThe publish workflow now triggers on Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Git Tag (agent-builder-*-image-*-main)
participant GH as GitHub Actions
participant Extract as Extract version from tag
participant Echo as Show extracted version
participant Poetry as Poetry CLI
participant Publish as Publish Step
Dev->>GH: Push tag
GH->>Extract: Run Bash regex to parse tag
alt Parse success
Extract-->>GH: set outputs.version
GH->>Echo: echo Version is <version>
GH->>Poetry: poetry version <version>
GH->>Publish: run publish
else Parse failure
Extract-->>GH: log error and exit (job fails)
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![hackerone-code[bot]](https://avatars.githubusercontent.com/in/3434?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔍 This pull request has been sent to HackerOne's PullRequest review team because our automation detected one or more changes with potential security impact or requires further evaluation. Experts are now being assigned to this review based on relevant expertise and will validate or dismiss any security findings accordingly and post their feedback as comments within this pull request.
⏱️ Latest scan covered changes up to commit cf2073c (latest)
Check the status or cancel this secure code review here.
There was a problem hiding this comment.
✅ Graham C reviewed all the included code changes and associated automation findings and determined that there were no immediately actionable security flaws. Note that they will continue to be notified of any new commits or comments and follow up as needed throughout the duration of this pull request's lifecycle.
Reviewed with ❤️ by PullRequest
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/publish.yml (2)
23-24: Optional: downgrade to a notice or remove the echo for quieter logsEchoing the version is fine; consider using a workflow command notice or removing it to keep logs clean.
Example:
- run: echo "Version is ${{ steps.extract_version.outputs.version }}" + run: echo "::notice title=Version::${{ steps.extract_version.outputs.version }}"
46-47: Consider updating the version earlier in the jobIf any generation step embeds the project version, updating only right before publish might produce mismatched artifacts. Safer sequence:
- Checkout
- Extract and validate version
- poetry version
- Install/generate/build/publish
I can propose a reordered step layout if you want to move this earlier in the workflow.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/publish.yml(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (13)
- GitHub Check: build (3.12)
- GitHub Check: build (3.13)
- GitHub Check: build (3.11)
- GitHub Check: build (3.9)
- GitHub Check: build (3.10)
- GitHub Check: tests (webkit)
- GitHub Check: tests (chromium)
- GitHub Check: tests (firefox)
- GitHub Check: build (3.9)
- GitHub Check: build (3.13)
- GitHub Check: build (3.11)
- GitHub Check: build (3.12)
- GitHub Check: build (3.10)
cf2073c to
32827d8
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
.github/workflows/publish.yml (2)
6-6: Consider adding least-privilege permissions and concurrency guardOptional hardening:
- Set workflow permissions to read-only (prevents accidental write access via GITHUB_TOKEN).
- Add concurrency to avoid double-publishing on duplicated/tagged runs.
Add these snippets:
YAML (top-level after
name:):permissions: contents: readYAML (under
jobs.build:):concurrency: group: publish-${{ github.ref }} cancel-in-progress: true
16-26: Minor hardening: enable strict bash options; optionally expose image version tooNot critical, but
set -euo pipefailadds safety, and capturing the second group can be useful for logging/diagnostics later.Apply this diff:
run: | - REF="${{ github.ref_name }}" + set -euo pipefail + REF="${{ github.ref_name }}" if [[ "$REF" =~ ^agent-builder-([0-9]+\.[0-9]+\.[0-9]+)-image-([0-9]+\.[0-9]+\.[0-9]+)-main$ ]]; then - echo "version=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT" + echo "version=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT" + echo "image_version=${BASH_REMATCH[2]}" >> "$GITHUB_OUTPUT" else echo "Unable to parse version from tag: $REF" >&2 exit 1 fi
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/publish.yml(3 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-08-18T10:46:57.535Z
Learnt from: UladzislauK-Writer
PR: writer/writer-framework#1086
File: .github/workflows/publish.yml:6-6
Timestamp: 2025-08-18T10:46:57.535Z
Learning: GitHub Actions on.push.tags filters support glob patterns that include the `+` character along with *, **, ?, ! and others. The `+` character works in glob patterns for GitHub Actions, not just as a regex quantifier.
Applied to files:
.github/workflows/publish.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (13)
- GitHub Check: tests (firefox)
- GitHub Check: build (3.13)
- GitHub Check: build (3.11)
- GitHub Check: tests (webkit)
- GitHub Check: build (3.10)
- GitHub Check: build (3.12)
- GitHub Check: tests (chromium)
- GitHub Check: build (3.9)
- GitHub Check: build (3.12)
- GitHub Check: build (3.9)
- GitHub Check: build (3.13)
- GitHub Check: build (3.10)
- GitHub Check: build (3.11)
🔇 Additional comments (4)
.github/workflows/publish.yml (4)
6-6: Trigger tag glob looks correctThe glob with
+quantifiers and digit classes is valid for GitHub Actions tag filters. This should match your intended tags.
16-26: Robust version parsing and fail-fast behavior LGTMGood use of a strict Bash regex with
BASH_REMATCHand early exit on mismatch. This prevents accidental invalid versions reaching Poetry.
27-28: Echo step is fine for visibilityLightweight confirmation of the extracted version; harmless and useful in logs.
44-45: No monorepo risk: single pyproject.toml detected
The repository contains exactly onepyproject.toml, so runningpoetry versionat the root will target the correct project. No additionalworking-directory:orpoetry -C <path>flags are required.
2 participants
Summary by CodeRabbit