Skip to content

docs(release): the first package took the repository's visibility #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlexeyShalaev merged 1 commit into from
Oct 7, 2026
Merged

docs(release): the first package took the repository's visibility #9

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/project/release.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@ touchmark adds nothing stricter to them on purpose: no required approval (a main
3. **Tags** (Settings → Rules → Rulesets): a tag ruleset for `v*` that restricts updates and deletions and blocks force pushes. Restrict creations only with the GitHub Actions app on the ruleset's bypass list (GitHub accepts it there in an organization's repository): Release Please creates the tags with `GITHUB_TOKEN`. Either way, a tag pushed by hand is not published unless it is `vX.Y.Z`, its commit is on `master`, and both the manifest and `action.yml` at that commit carry its version: `publish.yml` checks this with `master`'s copy of `check-version.sh`, never the tag's, and then builds the tag's commit by its id. The org's other repositories have no tag ruleset; touchmark adds it because the Go module proxy and every hub that pins the Action keep the first commit a tag named.
4. **Packages** (organisation settings): allow public packages.
5. **The first release pull request.** `CHANGELOG.md` has no release yet, so Release Please writes `# Changelog`, the 0.1.0 section, and then the file's own header, demoted to `## Changelog`. Before merging, edit `CHANGELOG.md` in the pull request: the header back on top, the 0.1.0 section below it. Later releases go in above the previous one.
6. **The package.** The first Publish run creates `ghcr.io/bedrock-python/touchmark` private, and its `verify` jobs fail at the anonymous steps. In the package's settings: check that it is linked to the repository (the index's `org.opencontainers.image.source`) and that the repository's Actions have write access, then **Change visibility → Public**, and re-run the failed jobs. Hubs and the Action pull anonymously.
6. **The package.** The first Publish run creates `ghcr.io/bedrock-python/touchmark`, linked to the repository by the index's `org.opencontainers.image.source`. With public packages allowed in the organisation, it takes the public repository's visibility: v0.1.0's package was public from its first push, and `verify` passed on the first run. Should a package come out private, `verify` fails at the anonymous steps: in the package's settings, check the link to the repository and that the repository's Actions have write access, then **Change visibility → Public**, and re-run the failed jobs. Hubs and the Action pull anonymously.

PyPI is not part of a release yet: see [Adding PyPI later](#adding-pypi-later).

Expand Down
Loading