fix: merge publish into release workflow#184
Merged
Merged
Conversation
The default GITHUB_TOKEN doesn't trigger downstream workflows, so the release: published event from release.yml never fired publish.yml. Folding both into a single workflow sidesteps the chain entirely. PyPI publishing still uses Trusted Publisher (OIDC) with Sigstore attestations, just inside the same job that bumps the version and creates the GitHub release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The default
GITHUB_TOKENdoesn't trigger downstream workflows. That's whypublish.ymldidn't fire afterrelease.ymlcreated v3.1.1; therelease: publishedevent was suppressed.Folding everything into a single workflow sidesteps the chain. Same job bumps the version, creates the GitHub release, builds, and publishes to PyPI. OIDC Trusted Publisher and Sigstore attestations stay in place.
Trade-off: the publish step now shares
contents: writewith the rest of the job instead of running in an isolated job. For a solo-maintainer repo the simpler structure is worth more than the extra isolation.Once this merges, the next conventional commit (
fix:,feat:, etc) will produce an attested release on PyPI, which should clear the HA core requirements bot.