Skip to content

RATYK-200 | Hashed action versions #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nicobav wants to merge 2 commits into
base: main
Choose a base branch
from
Open

RATYK-200 | Hashed action versions #50

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
35fcf86
ci: remove duplicate pre-commit
nicobav May 11, 2026
d1feb4f
ci: switch release.yml to more common publish.yml
nicobav May 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 0 additions & 27 deletions .github/workflows/pre-commit.yml
View file
Open in desktop

This file was deleted.

56 changes: 56 additions & 0 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
name: Create release & publish to PyPI
# If ran manually, e.g. with ref set to "refs/tags/v1.2.3", set the run name to "Publish refs/tags/v1.2.3".
run-name: ${{ inputs.ref && format('Publish {0}', inputs.ref) || null }}

on:
push:
branches:
- main
# Run daily to keep the release PR date current
schedule:
- cron: '1 0 * * *'
workflow_dispatch:
inputs:
ref:
description: "The branch, tag or SHA to publish."
required: true
type: string

jobs:
release-please:
uses: City-of-Helsinki/.github/.github/workflows/release-please.yml@main
permissions:
contents: write
pull-requests: write
with:
include-component-in-tag: false

build:
needs:
- release-please
uses: City-of-Helsinki/.github/.github/workflows/build-python-dists.yml@main
with:
ref: ${{ inputs.ref }}
# Run build job if a release was created or a ref was specified (i.e. workflow was invoked manually)
if: ${{ needs.release-please.outputs.release_created || inputs.ref }}
Comment on lines +33 to +35

@sentry sentry Bot May 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: On automated triggers like push or schedule, inputs.ref is empty. If a release is created, this empty ref is passed to the reusable build workflow, likely causing it to fail.
Severity: HIGH

Suggested Fix

Provide a fallback value for the ref input to handle cases where inputs.ref is not available. A common and safe default is github.sha. The with block for the build job should be updated to ref: ${{ inputs.ref || github.sha }}.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: .github/workflows/publish.yml#L33-L35

Potential issue: The `build` job in the `publish.yml` workflow is triggered when a
release is created. On non-manual triggers such as `push` or `schedule`, the
`inputs.ref` context variable is empty. The workflow passes this empty `ref` to the
reusable `build-python-dists.yml` workflow. If the reusable workflow does not have a
defensive default for the `ref` input, the `actions/checkout` step within it will likely
fail because an empty string is not a valid branch, tag, or commit SHA. This would cause
automated releases triggered by pushes or schedules to fail.

Did we get this right? 👍 / 👎 to inform future reviews.


publish-to-pypi:
name: Publish to PyPI
runs-on: ubuntu-latest
needs:
- build
# Run publish job if an artifact was uploaded
if: ${{ needs.build.outputs.artifact_name }}
environment:
name: pypi
url: https://pypi.org/p/django-ilmoitin

@nicobav nicobav May 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this project needs to be switched to under city of helsinki first from the user helsinki

permissions:
id-token: write # mandatory for trusted publishing
steps:
- name: Download all the dists
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: ${{ needs.build.outputs.artifact_name }}
path: dist/
- name: Publish distribution to PyPI
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
27 changes: 0 additions & 27 deletions .github/workflows/release.yml
View file
Open in desktop

This file was deleted.

Loading