Conversation
This workflow automates the process of uploading a Python package to PyPI when a release is created, including steps for building and publishing the package.
ghost
self-requested a review
as a ![home-assistant[bot]](https://avatars.githubusercontent.com/in/97978?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hi @9turnbull
It seems you haven't yet signed a CLA. Please do so here.
Once you do that we will be able to review and accept this pull request.
Thanks!
|
Please take a look at the requested changes, and use the Ready for review button when you are done, thanks 👍 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 79cdd1624a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| path: dist/ | ||
|
|
||
| - name: Publish release distributions to PyPI | ||
| uses: pypa/gh-action-pypi-publish@release/v1 |
There was a problem hiding this comment.
This workflow uploads distributions to PyPI on every release.published, but .github/workflows/builder.yml is already triggered by the same event and already uploads the core package in build_python (with skip-existing: true). That creates two independent publish attempts for the same version; this new one does not set skip-existing, so whichever run uploads second will fail with an existing-file error and make release automation flaky/red.
Useful? React with 👍 / 👎.
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
The workflow uses floating action tags (for example actions/checkout@v4), but this repository runs a dedicated zizmor job in CI (.github/workflows/ci.yaml, --all-files) and existing workflows pin actions to immutable SHAs or explicitly suppress exceptions. Introducing unpinned uses entries here will raise unpinned-uses findings and block CI on this change.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
Adds a new GitHub Actions workflow intended to build and publish a Python package to PyPI when a GitHub Release is published.
Changes:
- Introduce
.github/workflows/python-publish.ymlwith jobs to build distributions and publish them to PyPI onrelease: published.
| on: | ||
| release: | ||
| types: [published] |
There was a problem hiding this comment.
Avoid running a second PyPI publishing workflow on releases since .github/workflows/builder.yml already builds and uploads the PyPI package on release: published, so this will likely duplicate publishing and can cause conflicting/failed releases.
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| release-build: | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
Minimize default token permissions by setting top-level permissions: {} and granting only what each job needs (as done in other workflows here), since contents: read at workflow scope grants broader access than necessary.
| permissions: | |
| contents: read | |
| jobs: | |
| release-build: | |
| runs-on: ubuntu-latest | |
| permissions: {} | |
| jobs: | |
| release-build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read |
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.x" |
There was a problem hiding this comment.
Pin all uses: actions to full commit SHAs (and disable credential persistence on checkout) to match the repo’s supply-chain hardening approach, since using floating tags like @v4/@v5 increases the risk of a compromised upstream release affecting the workflow.
|
|
||
| - uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.x" |
There was a problem hiding this comment.
Use the repository’s .python-version (via python-version-file) instead of 3.x so release artifacts are built with the same Python version as the rest of the project’s CI and packaging pipeline.
| python-version: "3.x" | |
| python-version-file: ".python-version" |
| # NOTE: put your own distribution build steps here. | ||
| python -m pip install build |
There was a problem hiding this comment.
Build the release artifacts using the same pre-build steps as the existing release pipeline (notably downloading/extracting integration translations) because translations are intentionally not checked into the repo and a plain python -m build here will produce an incomplete PyPI package.
| # NOTE: put your own distribution build steps here. | |
| python -m pip install build | |
| python -m pip install build | |
| python -m script.translations develop_download |
| path: dist/ | ||
|
|
||
| - name: Publish release distributions to PyPI | ||
| uses: pypa/gh-action-pypi-publish@release/v1 |
There was a problem hiding this comment.
Pin pypa/gh-action-pypi-publish to a specific commit SHA (and align options like skip-existing with the existing publishing workflow) to avoid unexpected behavior changes from upstream action updates during a release.
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| uses: pypa/gh-action-pypi-publish@<FULL_40_CHARACTER_COMMIT_SHA> |
home-assistant
Bot
added
cla-recheck
cla-signed
and removed
cla-recheck
cla-needed
labels
justanotherariel
left a comment
justanotherariel
left a comment
There was a problem hiding this comment.
No description, no PR title.
|
Closing this one, it seems to be a mistake. Let's us know if it isn't 👍 ../Frenck
|
Breaking change
Proposed change
Type of change
Additional information
Checklist
ruff format homeassistant tests)If user exposed functionality or configuration variables are added/changed:
If the code communicates with devices, web services, or third-party tools:
Updated and included derived files by running:
python3 -m script.hassfest.requirements_all.txt.Updated by running
python3 -m script.gen_requirements_all.To help with the load of incoming pull requests: