From f81a041f58f45f3953ad6343fe30cf55397f70ac Mon Sep 17 00:00:00 2001 From: Dennis Goldschmidt Date: Fri, 21 Aug 2026 15:34:37 +0200 Subject: [PATCH] Make the PyPI publish job opt-in MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit flypad is not on PyPI and there is no trusted publisher configured, so as it stood every tag would build and smoke-test cleanly and then fail red on a publish step that could never have worked. A red job on every release is noise that trains you to ignore release runs. The job is now gated on a repository variable, PYPI_PUBLISH. Unset, the job is skipped — grey, which is the honest signal for "not enabled" rather than "broken". Enabling it later needs no workflow edit: register the trusted publisher on PyPI, create the `pypi` environment, set the variable to "true". Verified the variable is currently unset, so v0.2.0 will tag green with build and smoke running and publish skipped. --- .github/workflows/release.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8100382..e307004 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -42,8 +42,16 @@ jobs: publish: needs: smoke runs-on: ubuntu-latest - # Configure a PyPI "trusted publisher" for this repo + the `pypi` environment, - # then this step publishes automatically on tag. Until then it simply no-ops on PRs. + # Opt-in, and off by default: flypad is not on PyPI, so without this guard every tag + # would build and smoke-test cleanly and then fail red on a publish that was never + # configured. Skipped shows as grey, which is the honest signal for "not enabled". + # + # To publish to PyPI: register a trusted publisher on PyPI for this repository + # (workflow `release.yml`, environment `pypi`), create the `pypi` environment under + # Settings → Environments, then set the repository variable PYPI_PUBLISH to "true" + # (Settings → Secrets and variables → Actions → Variables). No workflow edit needed. + # Note that publishing is irreversible: a version, once accepted, cannot be reused. + if: vars.PYPI_PUBLISH == 'true' environment: pypi permissions: id-token: write