Repository navigation
ci(release): publish every release automatically, with no stored token - #12
Conversation
release-please now runs on every push to main, so merging the release pull request creates the tag and the release. A release created with GITHUB_TOKEN does not trigger the release event, so release-please starts release.yml for the new tag with workflow_dispatch, which GITHUB_TOKEN may trigger. release.yml accepts the tag as an input as well as the release event. Registries use trusted publishing, so no publishing token is stored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Codex review ( 💡 Code reviewReviewed commit:
When a release PR is merged before 2026-11-01 or without Alex’s explicit approval, this step immediately dispatches the PyPI publishing workflow, replacing the previous manual release gate and allowing a prohibited release. Keep publication manually gated or enforce Alex’s approval before creating the tag and dispatching AGENTS.md reference: AGENTS.md:L42-L42 Verdict: REQUEST CHANGES |
Alex approved the 1.0.0 release on 2026-10-29 and asked that every release publish straight from the repository. The pre-launch rule (no tag or publish before 2026-11-01 without his approval) is replaced: merging the release-please pull request is the release approval. docs/DESIGN.md section 13 records the same, identically in all seven SDK repositories. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Codex review ( 💡 Code reviewReviewed commit: No blocking findings in commit Verdict: APPROVE |
The SDK is released (1.0.0 on 2026-10-29) and merging the release pull request is the release approval, so the leftover pre-launch text is replaced: the README banners, the agent status line, the CONTRIBUTING release sections and the workflow comments no longer describe a private, unreleased repository or a reviewer gate on the publish environments (which have no required reviewers). docs/DESIGN.md section 2.1 records the completed didit-sdk PyPI transfer and the terms agreed with Agustin Saiz, identically in all seven repositories. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Codex review ( 💡 Code reviewReviewed commit Verdict: APPROVE |
Problem
The 1.0.0 release (2026-10-29) needed manual steps: release-please ran only by hand, and a GitHub release created with the default
GITHUB_TOKENdoes not trigger therelease: publishedevent, sorelease.yml(the publish workflow) did not start. Alex asked that every future release publish straight from the repository.Solution
main(and by hand), so merging its release pull request cuts the release.release.ymlfor the new tag withgh workflow run, whichGITHUB_TOKENis allowed to trigger (actions: write). No personal access token is stored.taginput (workflow_dispatch) next to the release event, and checks out that tag.Verification
actionlinton the changed workflows: no findings.release.ymland its environment, which aworkflow_dispatchrun keeps (the OIDC claims carry the same workflow file and environment).🤖 Generated with Claude Code