Skip to content

ci(release): make the PyPI publisher dispatchable - #5222

Merged
pimlock merged 3 commits into
mainfrom
ci/pypi-manual-dispatch/pimlock
Nov 3, 2026
Merged

pimlock merged 3 commits into
mainfrom
ci/pypi-manual-dispatch/pimlock

Conversation

@pimlock

@pimlock pimlock commented Nov 3, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

The v0.1.7 release never reached PyPI. The Buf push failed, Publish failed with it, and Release skipped the PyPI job. #5157 had removed wheel-publish.yml, so we had no way to publish just the wheel.

This brings wheel-publish.yml back as a workflow Release calls and maintainers can dispatch, and moves it into Publish next to snap and npm. It also writes down the rule from #4987 that every release publisher keeps a manual trigger.

Related Issue

No issue required. This restores the manual PyPI dispatch that #5157 removed, and we need it to finish v0.1.7.

Changes

  • wheel-publish.yml has workflow_call and workflow_dispatch. The steps match the job ci(release): publish stable Python wheels directly to PyPI #5157 added to release.yml. It checks the tag commit, downloads the wheel and checksums from the GitHub Release, verifies them, and uploads with Trusted Publishing.
  • release-publish.yml calls it after the GitHub Release is created, and Check Publication requires it. A Buf or snap failure no longer skips PyPI.
  • release.yml drops its own PyPI job.
  • CI.md states the manual trigger rule. The release skill has the recovery command.

PyPI matches the publisher on the file that contains the publishing job (job_workflow_ref, see warehouse). Both calls and dispatches show up as wheel-publish.yml, so the openshell PyPI project needs a publisher for workflow wheel-publish.yml and environment pypi before this merges. We can remove the release.yml publisher afterwards.

After merge, publish v0.1.7 with:

gh workflow run wheel-publish.yml -R NVIDIA/OpenShell --ref main \
  -f release-tag=v0.1.7 -f source-sha=5d25211b25a8fc887e8d5c606d57d6ab22f1d76c -f python-version=0.1.7

Buf will get its manual trigger in a separate PR.

Testing

  • mise run pre-commit passes
  • Actionlint shows only the existing concurrency.queue errors
  • Zizmor reports no medium or higher findings
  • sync_docs_website_test.py passes
  • v0.1.7 dispatch after merge

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)

Move the PyPI upload into a reusable wheel-publish.yml with workflow_call
and workflow_dispatch, called from release-publish.yml after the GitHub
Release is created. PyPI Trusted Publishing matches job_workflow_ref, so
calls and dispatches both authenticate as wheel-publish.yml. A failure in
another publisher no longer skips PyPI, and a maintainer can publish a
missing wheel for an existing release without rerunning Release.

Write down that every release publisher keeps a manual trigger.

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
@github-actions

github-actions Bot commented Nov 3, 2026

Copy link
Copy Markdown

The manual trigger rule lives in CI.md, which most changes do not need.

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
@pimlock
pimlock enabled auto-merge November 3, 2026 21:01
@pimlock
pimlock added this pull request to the merge queue Nov 3, 2026
Merged via the queue into main with commit 7ec6de0 Nov 3, 2026
85 checks passed
@pimlock
pimlock deleted the ci/pypi-manual-dispatch/pimlock branch November 3, 2026 22:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants