Publish packages from GitHub releases (#37)

Author: eric-tramel

.github/workflows/publish.yml

@@ -4,12 +4,12 @@
 name: Publish
 
 on:
-  push:
-    tags:
-      - "data-designer-*/v*"
+  release:
+    types: [published]
 
 jobs:
   publish:
+    if: startsWith(github.event.release.tag_name, 'data-designer-') && contains(github.event.release.tag_name, '/v')
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -22,6 +22,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0  # full history needed for merge-base check
+          ref: ${{ github.event.release.tag_name }}
 
       - uses: astral-sh/setup-uv@v4
         with:
@@ -30,8 +31,19 @@ jobs:
 
       - name: Parse tag
         id: tag
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          RELEASE_PRERELEASE: ${{ github.event.release.prerelease }}
         run: |
-          TAG="${GITHUB_REF_NAME}"
+          TAG="${RELEASE_TAG}"
+          if [ "${RELEASE_PRERELEASE}" = "true" ]; then
+            echo "ERROR: prerelease plugin package publication is not supported"
+            exit 1
+          fi
+          if [[ ! "${TAG}" =~ ^data-designer-[a-z0-9]+([._-][a-z0-9]+)*/v[0-9]+[.][0-9]+[.][0-9]+$ ]]; then
+            echo "ERROR: release tag must match <plugin-package>/vX.Y.Z, got ${TAG}"
+            exit 1
+          fi
           PLUGIN_NAME="${TAG%%/v*}"
           TAG_VERSION="${TAG#*/v}"
           PLUGIN_DIR="plugins/${PLUGIN_NAME}"
@@ -47,7 +59,7 @@ jobs:
       - name: Validate tagged commit is on main
         run: |
           git fetch origin main
-          git merge-base --is-ancestor "${GITHUB_SHA}" origin/main \
+          git merge-base --is-ancestor HEAD origin/main \
             || { echo "ERROR: tagged commit is not on main"; exit 1; }
 
       - name: Sync workspace
@@ -56,38 +68,6 @@ jobs:
       - name: Validate version match and metadata
         run: uv run ddp check-release "${{ steps.tag.outputs.plugin_name }}" "${{ steps.tag.outputs.tag_version }}"
 
-      - name: Authorize tag pusher against CODEOWNERS
-        env:
-          ACTOR: ${{ github.actor }}
-          PLUGIN_DIR: ${{ steps.tag.outputs.plugin_dir }}
-          # Team lookups require a token with read:org scope. The default
-          # GITHUB_TOKEN usually works for public teams; set MEMBERSHIP_TOKEN
-          # as a PAT secret if team resolution fails.
-          GH_TOKEN: ${{ secrets.MEMBERSHIP_TOKEN || secrets.GITHUB_TOKEN }}
-        run: |
-          ALL_OWNERS=$(uv run python -m ddp.release_owners --all "${PLUGIN_DIR}/CODEOWNERS")
-          OWNERS=$(uv run python -m ddp.release_owners "${PLUGIN_DIR}/CODEOWNERS")
-          MATCH=0
-          for owner in $OWNERS; do
-            case "$owner" in
-              @*/*)
-                ORG="${owner#@}"; ORG="${ORG%%/*}"
-                TEAM_SLUG="${owner##*/}"
-                if gh api "orgs/${ORG}/teams/${TEAM_SLUG}/memberships/${ACTOR}" >/dev/null 2>&1; then
-                  MATCH=1; break
-                fi
-                ;;
-              @*)
-                if [ "$owner" = "@${ACTOR}" ]; then MATCH=1; break; fi
-                ;;
-            esac
-          done
-          if [ "$MATCH" -eq 0 ]; then
-            echo "ERROR: @${ACTOR} is not an authorized owner of ${PLUGIN_DIR}/CODEOWNERS"
-            echo "Listed owners: $ALL_OWNERS"
-            exit 1
-          fi
-
       - name: Run plugin tests in isolated venv
         env:
           PLUGIN_NAME: ${{ steps.tag.outputs.plugin_name }}

Makefile

@@ -161,5 +161,6 @@ release: check-owner test-plugin build-plugin
 	echo "Creating tag: $(PLUGIN)/v$$PLUGIN_VERSION"; \
 	git tag "$(PLUGIN)/v$$PLUGIN_VERSION"; \
 	echo ""; \
-	echo "Tag created. Push to trigger CI publish:"; \
-	echo "  git push origin $(PLUGIN)/v$$PLUGIN_VERSION"
+	echo "Tag created. Push it, then publish a GitHub Release to trigger CI publish:"; \
+	echo "  git push origin $(PLUGIN)/v$$PLUGIN_VERSION"; \
+	echo "  gh release create $(PLUGIN)/v$$PLUGIN_VERSION --title \"$(PLUGIN) v$$PLUGIN_VERSION\" --notes \"Release $(PLUGIN) v$$PLUGIN_VERSION\" --latest=false"

README.md

@@ -112,8 +112,9 @@ The `ddp` command manages the monorepo. Run `uv run ddp --help` to see all subco
 make bump PLUGIN=data-designer-my-plugin PART=patch   # Bump version (major/minor/patch)
 git add plugins/data-designer-my-plugin/pyproject.toml
 git commit -m "chore(data-designer-my-plugin): bump version to 0.1.1"
-make release PLUGIN=data-designer-my-plugin            # Tag + build
-git push origin data-designer-my-plugin/v0.1.1         # Triggers CI release
+make release PLUGIN=data-designer-my-plugin            # Build and tag for GitHub Release publishing
+git push origin data-designer-my-plugin/v0.1.1
+gh release create data-designer-my-plugin/v0.1.1       # Triggers CI publish
 ```
 
 See [docs/releasing.md](docs/releasing.md) for the full release guide.

docs/releasing.md

@@ -55,6 +55,16 @@ Push the tag printed by the release command:
 git push origin data-designer-my-plugin/v0.2.0
 ```
 
+Then publish a GitHub Release for that tag. Publishing the release is the
+explicit maintainer action that starts package publication:
+
+```bash
+gh release create data-designer-my-plugin/v0.2.0 \
+  --title "data-designer-my-plugin v0.2.0" \
+  --notes "Release data-designer-my-plugin v0.2.0" \
+  --latest=false
+```
+
 ## Catalog discoverability
 
 A released plugin becomes discoverable through a catalog when the generated
@@ -128,12 +138,12 @@ entries in that package's `plugins` array.
 
 ## Release CI
 
-Tag pushes trigger the publish workflow. It verifies that:
+Publishing a GitHub Release whose tag matches `{package}/vX.Y.Z` triggers the
+publish workflow. It verifies that:
 
 - the plugin directory exists;
 - the tagged commit is reachable from `main`;
 - the tag version matches plugin metadata;
-- the tag pusher is authorized by the plugin `CODEOWNERS`;
 - required PyPI metadata is present, including `description`, `license`,
   `readme`, and `authors`;
 - the package declares `requires-python` and a direct versioned