Automate trusted package publishing - #1028
Merged
Merged
Conversation
Co-Authored-By: Claude <noreply@anthropic.invalid>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
📝 WalkthroughWalkthroughChangesRelease automation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant MainPush
participant GitHubActions
participant ReleaseHelper
participant Registry
participant GitHubRelease
MainPush->>GitHubActions: trigger release workflow
GitHubActions->>ReleaseHelper: prepare and validate version
ReleaseHelper-->>GitHubActions: target, version, and publish decision
GitHubActions->>GitHubActions: build and smoke-test distributions
GitHubActions->>Registry: publish tested archives
GitHubActions->>ReleaseHelper: verify filenames and SHA-256 hashes
ReleaseHelper-->>GitHubActions: registry verification
GitHubActions->>GitHubRelease: create immutable tag and release
Suggested labels: 🚥 Pre-merge checks | ✅ 6 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (6 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1028 +/- ##
=======================================
Coverage 93.51% 93.51%
=======================================
Files 96 96
Lines 32024 32024
Branches 456 456
=======================================
Hits 29948 29948
Misses 2063 2063
Partials 13 13
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
tests/test_release.py (1)
1-390: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winNo coverage for
main()'s CLI dispatch or_write_github_outputs.Every public function in
scripts/release.pyis unit-tested directly except themain()subcommand wiring (prepare/notes/manifest/assert-absent/verify-registry) and_write_github_outputs. This is the actual seam the GitHub Actions workflow invokes, so an argparse wiring mistake or output-format regression here wouldn't be caught by the current suite.def test_main_prepare_writes_github_outputs(tmp_path, monkeypatch): root = _root(tmp_path) monkeypatch.setattr(release, "version_at_ref", lambda _ref, _root: "0.1.4") monkeypatch.chdir(root) out = tmp_path / "gh_output" assert release.main( ["prepare", "--mode", "push", "--before-ref", "before", "--github-output", str(out)] ) == 0 lines = out.read_text(encoding="utf-8").splitlines() assert "publish=true" in lines assert "target=pypi" in lines assert "artifact=veralang-0.1.5" in lines🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_release.py` around lines 1 - 390, Add CLI-level tests covering main() dispatch for prepare, notes, manifest, assert-absent, and verify-registry, plus _write_github_outputs formatting. Include a prepare invocation that patches required release state, passes --github-output, asserts main() returns 0, and verifies publish, target, and artifact entries in the generated file; exercise the remaining subcommands sufficiently to catch argparse wiring errors.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 87-92: Update the four release workflow steps using
steps.testpypi.outputs.version or needs.prepare.outputs.version in run commands,
including the TestPyPI/PyPI absence checks and both verify-registry invocations.
Pass each interpolated version through the step’s env mapping, then reference
the environment variable in the shell command instead of embedding the GitHub
expression directly.
- Around line 202-224: Update the verify-testpypi and verify-pypi jobs to retry
registry verification while the published filenames or hashes are not yet
visible, allowing for index propagation after publishing. Keep verification
failures for persistent missing or mismatched artifacts distinct from transient
read-after-publish delays, and apply the same behavior to both registry checks
using the existing verify-registry command.
In `@scripts/release.py`:
- Around line 346-351: Update _write_github_outputs to build the artifact value
using the existing PROJECT constant instead of hardcoding “veralang”, while
preserving the current version interpolation and output format.
In `@tests/test_release.py`:
- Around line 288-312: Extend test_registry_version_files coverage for malformed
registry responses by asserting ReleaseError for a non-dict releases value, a
non-dict file entry, and entries missing filename or SHA-256 data. Use
pytest.raises with the corresponding error-message matches, while preserving the
existing happy-path and absent-project/version tests.
---
Outside diff comments:
In `@tests/test_release.py`:
- Around line 1-390: Add CLI-level tests covering main() dispatch for prepare,
notes, manifest, assert-absent, and verify-registry, plus _write_github_outputs
formatting. Include a prepare invocation that patches required release state,
passes --github-output, asserts main() returns 0, and verifies publish, target,
and artifact entries in the generated file; exercise the remaining subcommands
sufficiently to catch argparse wiring errors.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b664389b-ca02-4327-97c8-2c2fef727c01
📒 Files selected for processing (11)
.github/workflows/release.yml.gitignoreCHANGELOG.mdCLAUDE.mdCONTRIBUTING.mdREADME.mdRELEASING.mdROADMAP.mdTESTING.mdscripts/release.pytests/test_release.py
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
aallan/vera-bench(manual)
Co-Authored-By: Claude <noreply@anthropic.invalid>
Owner
Author
|
@coderabbitai Addressed the outside-diff CLI coverage finding in 9f65e47.
The review round also adds malformed registry-payload coverage and pins retry behavior for stale registry hashes. Validation: 47 focused release tests pass; |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
git log --oneline -1 9f65e472 2>/dev/null || echo "commit not found in shallow clone"
git show --stat 9f65e472 2>/dev/null | head -50
echo "---"
rg -n "_write_github_outputs|def test_main|assert-absent|verify-registry|--github-output" tests/test_release.py | head -80Length of output: 3926
This closes the outside-diff CLI coverage gap I flagged — all the CLI subcommand entry points are now exercised via |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release behavior
This PR does not bump Vera's version and does not publish anything when merged. The first push of this workflow to
mainsees no version change and exits without building or publishing a release.After merge, the maintainer still needs to create the
testpypiand approval-protectedpypiGitHub environments and configure the matching pending Trusted Publishers. The current0.1.4package can then be staged manually on TestPyPI. The first production publication remains0.1.5, triggered by its eventual version-bump merge.This completes the release-mechanics portion of the publication plan. Issue #737 remains open until
veralangis live on PyPI and both documented installation routes have been verified.Validation
7,351 passed, 70 skipped, 26 deselectedmypy vera/ruffand formatting checks for the new helper/testsactionlintfor.github/workflows/release.ymlveralang==0.1.4Closes #481.
Summary by CodeRabbit
mainversion merges, including wheel/sdist building, smoke testing, and SHA-256 + filename verification..venventries in.gitignore.