Skip to content

ci: migrate gflanguages PyPI publishing job to OSS Exit Gate - #278

Open
zarturod wants to merge 2 commits into
googlefonts:mainfrom
zarturod:chore/oss-exit-gate-migration
Open

zarturod wants to merge 2 commits into
googlefonts:mainfrom
zarturod:chore/oss-exit-gate-migration

Conversation

@zarturod

@zarturod zarturod commented Nov 7, 2026

Copy link
Copy Markdown

Summary

Migrates Python gflanguages PyPI publishing in the publish-python job of .github/workflows/publish-release.yml to publish through Google's OSS Exit Gate (gflanguages/pypi). All Rust/Python CI jobs, create-github-release, publish-rust, package-python, and upstream-subtree-merge remain unchanged.

Changes

  • Scopes publish-python permissions to contents: read and id-token: write, using 40-character SHA-pinned google-github-actions/auth and google-github-actions/setup-gcloud.
  • Authenticates via Google Cloud Workload Identity Federation (projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github).
  • Stages dist/* to https://us-python.pkg.dev/oss-exit-gate-prod/gflanguages--pypi/ and uploads manifest.json to gs://oss-exit-gate-prod-projects-bucket/gflanguages/pypi/manifests/ to trigger the OSS Exit Gate PyPI release pipeline.

Verification (Step 8 Production Smoke Test)

  • Production onboarding config (gflanguages/pypi, http://cl/1015460198) and Terraform provisioning (http://cl/1015495210) are live.
  • End-to-end Artifact Registry PyPI staging (gflanguages==0.7.11, HTTP 200) and GCS manifest upload (HTTP 200) verified.

Refs: b/582364279, b/576680589

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant