Test-publish to test PyPI and separate jobs to limit permissions. #12578
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ 1 Ignored Deployment
|
dosubot
bot
added
the
🤖:improvement
baskaryan
approved these changes
Oct 30, 2023
obi1kenobi
added a commit
that referenced
this pull request
Nov 1, 2023
This follows the principle of least privilege. Our `poetry build` step doesn't need, and shouldn't get, access to our GitHub OIDC capability. This is the same structure as I used in the already-merged PR for refactoring the regular PyPI release workflow: #12578.
xieqihui
pushed a commit
to xieqihui/langchain
that referenced
this pull request
Nov 21, 2023
…ngchain-ai#12578) Before making a new `langchain` release, we want to test that everything works as expected. This PR lets us publish `langchain` to test PyPI, then install it from there and run checks to ensure everything works normally before publishing it "for real". It also takes the opportunity to refactor the build process, splitting up the build, release-creation, and PyPI upload steps into separate jobs that do not share their elevated permissions with each other.
xieqihui
pushed a commit
to xieqihui/langchain
that referenced
this pull request
Nov 21, 2023
…in-ai#12671) This follows the principle of least privilege. Our `poetry build` step doesn't need, and shouldn't get, access to our GitHub OIDC capability. This is the same structure as I used in the already-merged PR for refactoring the regular PyPI release workflow: langchain-ai#12578.
hoanq1811
pushed a commit
to hoanq1811/langchain
that referenced
this pull request
Feb 2, 2024
…ngchain-ai#12578) Before making a new `langchain` release, we want to test that everything works as expected. This PR lets us publish `langchain` to test PyPI, then install it from there and run checks to ensure everything works normally before publishing it "for real". It also takes the opportunity to refactor the build process, splitting up the build, release-creation, and PyPI upload steps into separate jobs that do not share their elevated permissions with each other.
hoanq1811
pushed a commit
to hoanq1811/langchain
that referenced
this pull request
Feb 2, 2024
…in-ai#12671) This follows the principle of least privilege. Our `poetry build` step doesn't need, and shouldn't get, access to our GitHub OIDC capability. This is the same structure as I used in the already-merged PR for refactoring the regular PyPI release workflow: langchain-ai#12578.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Before making a new
langchainrelease, we want to test that everything works as expected. This PR lets us publishlangchainto test PyPI, then install it from there and run checks to ensure everything works normally before publishing it "for real".It also takes the opportunity to refactor the build process, splitting up the build, release-creation, and PyPI upload steps into separate jobs that do not share their elevated permissions with each other.