release: tag-triggered GitHub Release workflow (python) - #72
Merged
Conversation
repo-publish's template pinned astral-sh/setup-uv@e58605a9b6da..., which is not a commit at all — it is the ANNOTATED TAG OBJECT for the floating `v5` tag (`refs/tags/v5`), currently dereferencing to commit d4b2f3b6ecc6 (v5.4.2). astral-sh re-points `v5` on every v5.x release, and re-pointing writes a NEW tag object with a NEW sha, so this pin either breaks or silently tracks whatever v5 becomes. Either way it delivers none of the immutability the comment 'Pinned action SHAs (supply-chain)' claims — it is `@v5` with extra steps. Repinned to the commit d4b2f3b6ecc6 and labelled with the exact release. Also narrowed checkout's comment from 'v4' to 'v4.3.1' — that one WAS already a real commit sha, but the floating label invites the same mistake on the next update. Same bad string is live in terse (.github/workflows/tests.yml on main) and in all three checked-in copies of repo-publish; fixing those is separate work.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scaffolded by
repo-publish. Adds av*-tag-triggered GitHub Release workflow (python, git-install-first — no PyPI publish).The version mechanism is already in place
Every item on
repo-publish's printed Python checklist landed in #71, so this PR is just the workflow:hatch-vcs,
[tool.hatch.version] source = "vcs",version-file,dynamic = ["version"]with no static literal,__init__.pyfalling back toimportlib.metadata, and_version.pygitignored.Verified before opening this: tagged a scratch clone
v0.1.0→uv build→testgraph-0.1.0-py3-none-any.whl→ ran this workflow's version assert verbatim → PASS.Two checklist items deliberately skipped:
fetch-depth: 0intest.yml(that workflow never builds, and no test asserts__version__) and a--versionflag (rides with the[project.scripts]decision deferred in #71).Second commit fixes a defect in the generated template
repo-publishemittedastral-sh/setup-uv@e58605a9b6da...under the comment "Pinned action SHAs (supply-chain)". That is not a commit. It is the annotated tag object for the floatingv5tag (refs/tags/v5), which currently dereferences to commitd4b2f3b6ecc6(v5.4.2). astral-sh re-pointsv5on every v5.x release, and re-pointing writes a new tag object with a new sha — so the pin either breaks or silently tracks whateverv5becomes. It is@v5with extra steps, and delivers none of the immutability a SHA pin exists for.Repinned to the commit, labelled with the exact release.
actions/checkout@34e1148was checked too and is a genuine commit sha (tagged v4.3.1) — only its comment was narrowed fromv4..github/workflows/tests.ymlon main) and in all three checked-in copies ofrepo-publish— separate work, not fixed here.Next:
repo-publish --finalize v0.1.0(cuts the tag, fires this workflow, offers the visibility flip).