ci: run the test suite on the release path, and pin the actions - #7
Merged
Conversation
`publish.yml` built a wheel and pushed it to PyPI on any `v*` tag without running a single assertion. `ruff`, `mypy` and the 3.9-3.13 `pytest` matrix all existed and all passed -- on push/PR to `main`, which the tag path never touches. A tag could be cut from any commit and shipped to users untested. Gate the release on CI by CALLING it (`workflow_call`) rather than restating the steps. A second copy of the matrix would be one more thing to keep in sync, and that drift stays invisible until a bad release is already public. Also pin every action to a commit SHA. This is the workspace convention and it matters most here: these four actions run on the path that produces and uploads a public artifact, so a moved tag upstream is a supply-chain event. Pinned at the current majors -- this is not a version bump. Note `pypa/gh-action-pypi-publish` v1.14.2 is an annotated tag, so its commit SHA differs from the SHA its ref points at; the commit is what is pinned.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The gap
publish.ymlbuilds a wheel and pushes it to PyPI on anyv*tag — without running a single assertion.ruff check,ruff format --check,mypy, and the 3.9–3.13pytestmatrix all exist and all pass. They run on push/PR tomain, which the tag path never touches. So av*tag could be cut from any commit and published to users with nothing having tested it.The sibling SDK already does this correctly —
routeplane-devtools' publish workflow runs its test suite before publishing.The change
Gate the release on CI by calling it.
test: uses: ./.github/workflows/ci.yml, withbuilddepending on it. CI is nowworkflow_call-able.Calling rather than restating is deliberate: a second copy of the lint/type/test matrix would be one more thing to keep in sync, and that drift stays invisible until a bad release is already on PyPI.
Pin every action to a commit SHA. These four run on the path that produces and uploads a public artifact, so a moved tag upstream is a supply-chain event.
actions/checkout11d5960(v4.4.0)actions/setup-pythona26af69(v5.6.0)actions/upload-artifactea165f8(v4.6.2)actions/download-artifactd3f86a1(v4.3.0)pypa/gh-action-pypi-publishdc37677(v1.14.2)Pinned at the current majors — this is not a version bump.
One subtlety worth flagging for review:
pypa/gh-action-pypi-publishv1.14.2 is an annotated tag, so the SHA its ref points at (a892a5a) is the tag object, not the commit. The commit (dc37677) is what is pinned.Verification
actionlintclean on both files. Trusted publishing (OIDC,pypienvironment) is unchanged — no token secret is introduced.