From 9e84e6fe93cb6177607bc7f45463df8620217b4b Mon Sep 17 00:00:00 2001 From: firstmate crewmate Date: Thu, 6 Aug 2026 19:15:34 +1000 Subject: [PATCH] Make release.yml the top-level publish workflow Attestations were disabled because publish ran as release.yml called reusably from a thin tag-triggered caller, and the reusable-workflow signing identity doesn't match the configured PyPI trusted publisher (workflow release.yml + environment pypi). Converting release.yml into the top-level, directly tag-triggered workflow aligns the code to that existing publisher config, so attestations can be re-enabled with no PyPI-side change required. --- .github/workflows/python-publish.yml | 17 ---------- .github/workflows/release.yml | 48 +++++++++++----------------- AGENTS.md | 2 +- 3 files changed, 19 insertions(+), 48 deletions(-) delete mode 100644 .github/workflows/python-publish.yml diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml deleted file mode 100644 index c52e34f..0000000 --- a/.github/workflows/python-publish.yml +++ /dev/null @@ -1,17 +0,0 @@ -name: Publish Python 🐍 distribution 📦 to PyPI - -on: - push: - tags: - - "v*.*.*" - -jobs: - release: - name: Release - uses: ./.github/workflows/release.yml - with: - package-dir: tesla_fleet_api - pypi-project-url: https://pypi.org/p/tesla_fleet_api - permissions: - id-token: write - contents: write diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 13f4227..f1e5b11 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,45 +1,36 @@ name: Release gate & publish on: - workflow_call: - inputs: - package-dir: - description: Import package directory to lint/type-check (passed to ruff/pyright) - required: true - type: string - python-version: - description: Python version to build/test/publish with - required: false - type: string - default: "3.13" - pypi-project-url: - description: PyPI project URL shown on the environment deployment - required: true - type: string - environment-name: - description: Protected GitHub environment gating the publish step - required: false - type: string - default: pypi + push: + tags: + - "v*.*.*" + +env: + PACKAGE_DIR: tesla_fleet_api + PYTHON_VERSION: "3.13" + PYPI_PROJECT_URL: https://pypi.org/p/tesla_fleet_api + ENVIRONMENT_NAME: pypi jobs: gate: name: Full CI gate runs-on: ubuntu-latest + permissions: + contents: read steps: - uses: actions/checkout@v4 - name: Install uv uses: astral-sh/setup-uv@v5 with: enable-cache: true - - name: Set up Python ${{ inputs.python-version }} - run: uv python install ${{ inputs.python-version }} + - name: Set up Python ${{ env.PYTHON_VERSION }} + run: uv python install ${{ env.PYTHON_VERSION }} - name: Install dependencies - run: uv sync --python ${{ inputs.python-version }} + run: uv sync --python ${{ env.PYTHON_VERSION }} - name: Ruff - run: uv run ruff check ${{ inputs.package-dir }} tests + run: uv run ruff check ${{ env.PACKAGE_DIR }} tests - name: Pyright - run: uv run pyright ${{ inputs.package-dir }} + run: uv run pyright ${{ env.PACKAGE_DIR }} - name: Pytest run: uv run pytest tests -q - name: Build @@ -57,8 +48,8 @@ jobs: needs: gate runs-on: ubuntu-latest environment: - name: ${{ inputs.environment-name }} - url: ${{ inputs.pypi-project-url }} + name: ${{ env.ENVIRONMENT_NAME }} + url: ${{ env.PYPI_PROJECT_URL }} permissions: id-token: write steps: @@ -69,9 +60,6 @@ jobs: path: dist/ - name: Publish distribution to PyPI uses: pypa/gh-action-pypi-publish@release/v1 - with: - # Reusable-workflow identity mismatch breaks PyPI attestation verification (PEP 740). - attestations: false github-release: name: Upload distribution to GitHub Release diff --git a/AGENTS.md b/AGENTS.md index 54aa978..1b45e34 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -93,7 +93,7 @@ Scope flags on `TeslaFleetApi.__init__` control which submodules are instantiate ### Release Process -No release-please or version-bump automation. To ship: bump `version` in `pyproject.toml` and `__version__` in `tesla_fleet_api/__init__.py` in a `Bump version to X.Y.Z` commit on `main`, then push a matching `vX.Y.Z` tag. `.github/workflows/python-publish.yml` only triggers on that tag push and calls the reusable `.github/workflows/release.yml` workflow, which reruns the full CI gate (ruff, pyright, pytest, `uv build` + `twine check`) on the exact tagged commit, then requires approval on the `pypi` GitHub environment (required reviewers configured via the Environments API - there's no repo Settings UI for it) before publishing via the existing PyPA OIDC trusted-publishing action and cutting the GitHub Release. `release.yml` is written as a `workflow_call` reusable workflow (parameterized by `package-dir`/`pypi-project-url`) specifically so sibling repos can call it with `uses: Teslemetry/python-tesla-fleet-api/.github/workflows/release.yml@main` instead of copying the job. +No release-please or version-bump automation. To ship: bump `version` in `pyproject.toml` and `__version__` in `tesla_fleet_api/__init__.py` in a `Bump version to X.Y.Z` commit on `main`, then push a matching `vX.Y.Z` tag. `.github/workflows/release.yml` triggers directly on that tag push: it reruns the full CI gate (ruff, pyright, pytest, `uv build` + `twine check`) on the exact tagged commit, then requires approval on the `pypi` GitHub environment (required reviewers configured via the Environments API - there's no repo Settings UI for it) before publishing via the existing PyPA OIDC trusted-publishing action (with PEP 740 attestations) and cutting the GitHub Release. It is a plain top-level workflow, not a `workflow_call` reusable one - the PyPI trusted publisher for this project is configured as workflow `release.yml` + environment `pypi`, and a reusable-workflow caller's signing identity doesn't match that publisher/attestation identity. Sibling repos each carry their own local copy of this workflow rather than calling it cross-repo. ### Error Handling