Repository navigation
Publish from the manual release run without a dangerous trigger - #63
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The manual Start release workflow on
mainnow calls CI, prepares the tested source distribution, publishes it to PyPI, and then tags the same commit. Keeping those jobs in one run removes the privilegedworkflow_runtrigger, its zizmor exception, and the cross-run artifact downloads. The PyPI publisher retains therelease.ymlfilename andpypienvironment.Only the PyPI job can mint an OIDC token. Only the tagging job can write repository contents. Both jobs consume the immutable artifact ID from the preparation job, including on partial reruns. The tagging job creates its lightweight tag through the GitHub API so it can run without checking out the source tree or configuring Git credentials. A retry accepts an existing tag only at the published SHA.
This follows the guidance to call workflows directly, isolate distribution builds from publishing credentials, and grant permissions per job. zizmor trigger guidance · PyPA packaging guide · PyPI Trusted Publishing security model
Online zizmor 1.31.1 passed the repository CI audit with ignores disabled. The release workflow also passed its auditor profile with zero findings. Local tests exercised initial tag creation, partial and completed retries, and rejection of a tag at a different commit. No release was dispatched.