chore: Trusted environment publish hardening#70
Merged
Conversation
- Rename build.yml → ci.yml (lint + build + test on push/PR only) - Remove version-munging job and manifest_version.py script; version is now solely what's in Cargo.toml - Create publish.yml triggered on v* tags with: - OIDC trusted publishing (id-token: write, no stored credentials) - pypi-publish environment (requires manual approval + tag restriction) - pypa/gh-action-pypi-publish for upload - GitHub Release creation with checksums - Remove dev/main branch publish logic and prerelease handling Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ensures the tagged commit exists on the main branch before building and publishing. Combined with tag protection rules (v* restricted to maintainers) and environment approval, this provides defense-in-depth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens and simplifies the project’s release workflow by moving to PyPI trusted publishing via GitHub Environments and switching releases to a tag-driven model off main (instead of publishing prereleases from dev and finals from main merges).
Changes:
- Replace the prior combined CI/build/publish workflow with a dedicated
CIworkflow and a tag-triggeredPublish to PyPIworkflow. - Implement trusted publishing (
pypa/gh-action-pypi-publish) and environment-gated publishing. - Remove build-number/version materialization logic and the previous branch-based publish flow.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| .github/workflows/publish.yml | Adds tag-triggered build + trusted PyPI publish + GitHub Release creation. |
| .github/workflows/ci.yml | Adds CI workflow for formatting, linting, tests, and artifact builds across platforms. |
| .github/workflows/build.yml | Removes the prior combined CI/build/publish workflow and branch-based publishing logic. |
| .github/build/manifest_version.py | Removes the build-number-based version materialization script used by the old release flow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Scope workflow-level permissions to contents:read; only publish job gets id-token:write and contents:write - Add tag/version mismatch check (tag v1.3.0 must match Cargo.toml 1.3.0) - Add skip-existing to pypi-publish for idempotent re-runs - Add Rust and Python unit tests to the release build job Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
.github/workflows/publish.yml:31
- The Cargo.toml version check is brittle: it relies on
grep '^version' ... | head -1, which will silently start reading the wrongversion = ...line if the file is reordered (e.g., a[dependencies.<crate>]table with a top-levelversionkey appears before[package]). Since this gate controls releases, it’s safer to parse TOML and read[package].versionexplicitly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moving to a trusted publication process through pypi and github environments. Also simplifying the release process. Previously pre-releases would be published via merge to dev and final releases when we merge to main, but we're switching over to a tag release model off of main instead.