chore: update publish workflow

[alisonferreira-vnt]

update publish workflow to use pipx for Python dependencies and npm for frontend

Summary by Sourcery

Update the publish workflow to use pipx-managed Poetry for Python packaging and npm for frontend build and publish steps instead of pnpm.

Build:

• Switch Python dependency management in the publish workflow to install Poetry via pipx with a pinned version.
• Replace pnpm-based frontend install, build, and publish steps with npm commands in the publish workflow.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the publish GitHub Actions workflow to install Python tooling via pipx and switch the frontend pipeline from pnpm to npm, with minor formatting cleanup.

Flow diagram for updated publish GitHub Actions workflow

flowchart TD
  trigger[on release or workflow_dispatch]

  subgraph job_python[Job publish_python]
    A1[Checkout code]
    A2[Set up Python 3.12]
    A3[Install pipx via apt]
    A4[Run pipx ensurepath]
    A5[Install poetry 1.8.5 with pipx]
    A6[poetry install --with dev]
    A7[Build Python package]
    A8[Publish to PyPI]
  end

  subgraph job_frontend[Job publish_frontend]
    B1[Checkout code]
    B2[Set up Node.js 22]
    B3[npm install in frontend]
    B4[npm run build in frontend]
    B5[npm publish --no-git-checks]
  end

  trigger --> job_python
  trigger --> job_frontend

  A1 --> A2 --> A3 --> A4 --> A5 --> A6 --> A7 --> A8
  B1 --> B2 --> B3 --> B4 --> B5

Loading

File-Level Changes

Change	Details	Files
Switch Python dependency installation in the publish workflow to use pipx and pin Poetry version.	Replace direct pip-based installation of Poetry with installation of pipx via apt Add pipx ensurepath step to configure the environment Install a specific Poetry version (1.8.5) via pipx before running poetry install	.github/workflows/publish.yml
Replace pnpm-based frontend build and publish steps with npm in the publish workflow.	Remove pnpm/action-setup step and its configuration Update frontend dependency installation from pnpm install to npm install Update frontend build command from pnpm run build to npm run build Update npm package publish command to use npm publish with --no-git-checks	.github/workflows/publish.yml
Minor YAML formatting cleanup in workflow permissions section.	Normalize spacing in id-token permission comment	.github/workflows/publish.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.85%. Comparing base (8d4a020) to head (98d9e6d).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #213   +/-   ##
=======================================
  Coverage   93.85%   93.85%           
=======================================
  Files          19       19           
  Lines         700      700           
  Branches       51       51           
=======================================
  Hits          657      657           
  Misses         33       33           
  Partials       10       10           

Flag	Coverage Δ
backend-python-3.10	92.67% <ø> (ø)
backend-python-3.11	92.67% <ø> (ø)
backend-python-3.12	92.67% <ø> (ø)
backend-python-3.13	92.67% <ø> (ø)
frontend	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• The sudo apt install pipx step may block on interactive prompts in CI; consider using sudo apt-get update && sudo apt-get install -y pipx (or leveraging the preinstalled pipx on GitHub runners) to ensure non-interactive execution.
• pipx ensurepath updates the shell configuration but won’t affect the current job’s PATH in that step; you may want to either rely on the system pipx path or explicitly add the pipx bin directory to PATH before invoking poetry.
• npm publish --no-git-checks uses a pnpm-specific flag that npm does not support; update this command or its options to use flags that are valid for npm.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `sudo apt install pipx` step may block on interactive prompts in CI; consider using `sudo apt-get update && sudo apt-get install -y pipx` (or leveraging the preinstalled pipx on GitHub runners) to ensure non-interactive execution.
- `pipx ensurepath` updates the shell configuration but won’t affect the current job’s PATH in that step; you may want to either rely on the system pipx path or explicitly add the pipx bin directory to PATH before invoking `poetry`.
- `npm publish --no-git-checks` uses a pnpm-specific flag that npm does not support; update this command or its options to use flags that are valid for npm.

## Individual Comments

### Comment 1
<location> `.github/workflows/publish.yml:74` </location>
<code_context>
         working-directory: ./frontend
         run: |
-          pnpm publish --no-git-checks
+          npm publish --no-git-checks
</code_context>

<issue_to_address>
**issue (bug_risk):** `--no-git-checks` is not a valid npm flag and will cause the publish step to fail.

This flag is pnpm-specific and will cause `npm publish` to fail with an unknown option error. For npm, remove the flag or configure the desired git-check behavior via npm config or environment instead.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}