Repository navigation
feat(release): publish library and CLI independently - #40
Conversation
Publish morphir 0.0.1 as the dependency-free library and SDK. Release morphir-python 0.0.2 as the CLI, depending on the library rather than bundling its files. Use independent package tags and OIDC publishing jobs. Verify namespace ownership, isolated installs, migration from the old bundle, and the exact published core before CLI promotion.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e6021f7685
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| [tool.uv.workspace] | ||
| members = ["packages/morphir"] | ||
| members = ["packages/morphir", "packages/morphir-tools"] |
There was a problem hiding this comment.
For a fresh checkout, the README's Setup section still runs uv sync --all-groups, but the root is now a virtual project with no dependencies on either workspace member. That command installs the development tools without installing morphir, morphir_tools, or the CLI dependencies, so the subsequent documented checks fail on missing imports. I confirmed this with uv sync --frozen --all-groups --dry-run --offline; neither distribution appears in the install plan. Update Setup to use mise run install or add --all-packages, which uv sync --help describes as “Sync all packages in the workspace.”
Useful? React with 👍 / 👎.
Publish
morphir==0.0.1as the library and SDK with no third-party runtime dependencies or console commands. Restoremorphir-pythonas a CLI-only distribution depending on the library, with version0.0.2because the bundled0.0.1is already immutable on PyPI. Keepmorphir_toolsimports and themorphir-pythonexecutable.The root becomes a development workspace; package metadata lives in the two package projects. Package-specific tags select only one OIDC publisher and one GitHub release artifact set:
morphir-v0.0.1for the library andpython-v0.0.2for the CLI. Both PyPI projects trust ownerfinos, repomorphir-python, workflowrelease.yml, environmentpypi. The environment now permitsmorphir-v*as well as the existing CLI tag prefix. The README documents the exact setup and release steps.Qualification enforces complete sources, disjoint namespaces, library dependency/script isolation, a versioned CLI dependency, and tag/version identity. CLI promotion additionally requires the tested library wheel SHA256 to match the already published core wheel. PR CI qualifies both runtime environments and the documented uninstall/reinstall migration from the old bundle; tagged runtime scans follow the selected package. MEP extension-protocol commands and possible WASM tooling remain future CLI responsibilities.
Validation: 2,075 tests, BDD, lint/format, both type checkers including release support code, 98.50% coverage, actionlint, strict wheel/source metadata, isolated library and CLI installs, migration, CVE/license gates all pass locally. Tag/metadata/namespace regressions and missing/different published-core rejection tests pass. The CLI promotion check correctly refuses publication before the library exists on PyPI.
Tracker: morphir-ov51. Publish the library first, then qualify the CLI against that published artifact. Existing published versions and tags remain unchanged.