From 3d84bbbc2d7b640a8fa49deff51f3e9b652dc1e9 Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Wed, 22 Apr 2026 01:27:30 +0200 Subject: [PATCH 1/3] fix(ci): switch release trigger to push on main for PyPI environment compatibility --- .github/workflows/release.yml | 16 ++++++---------- CHANGELOG.md | 14 ++++++++++++++ 2 files changed, 20 insertions(+), 10 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cb1780f..0451416 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,11 +1,11 @@ # Release workflow. -# Trigger model: only when a PR to main is closed and merged. +# Trigger model: only on direct pushes to main (merge commits). +# Using push instead of pull_request so the workflow runs under refs/heads/main, +# which satisfies the PyPI environment deployment branch protection rule. name: Release on: - pull_request: - # Closed event is filtered below to merged-only. - types: [closed] + push: branches: [main] permissions: @@ -27,8 +27,6 @@ jobs: permissions: # Needed for creating tags and GitHub releases. contents: write - # Guard: run only for merged PRs. - if: github.event.pull_request.merged == true outputs: changed: ${{ steps.version.outputs.changed }} version: ${{ steps.version.outputs.version }} @@ -39,7 +37,6 @@ jobs: with: # Full history is required by semver-action to inspect commit history. fetch-depth: 0 - ref: ${{ github.event.pull_request.merge_commit_sha }} - name: Compute semantic version from conventional commits id: semver @@ -125,7 +122,7 @@ jobs: name: Build Package Artifacts runs-on: ubuntu-latest needs: release - if: github.event.pull_request.merged == true && needs.release.outputs.changed == 'true' + if: needs.release.outputs.changed == 'true' steps: - name: Checkout @@ -133,7 +130,6 @@ jobs: with: # Full history and tags required by poetry-dynamic-versioning. fetch-depth: 0 - ref: ${{ github.event.pull_request.merge_commit_sha }} - name: Install Poetry run: pipx install poetry @@ -159,7 +155,7 @@ jobs: name: Publish to PyPI runs-on: ubuntu-latest needs: [release, build] - if: github.event.pull_request.merged == true && needs.release.outputs.changed == 'true' + if: needs.release.outputs.changed == 'true' environment: pypi permissions: # Required for OIDC trusted publishing. diff --git a/CHANGELOG.md b/CHANGELOG.md index fd2af57..e55958a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## 1.3.1 - 2026-04-22 + +Release workflow and test isolation fixes. + +### Fixed in 1.3.1 + +- Fixed release workflow trigger: switched from `pull_request: closed` to `push: branches: [main]` so the workflow runs under `refs/heads/main` and satisfies the PyPI environment deployment branch protection rule. +- Fixed `build` job checkout missing `fetch-depth: 0`, required by `poetry-dynamic-versioning` to read git tags. +- Fixed `download-artifact` version mismatch (`v5` → `v7`) to align with `upload-artifact@v7`. + ## 1.3.0 - 2026-04-22 DX, onboarding, and PyPI publishing release. @@ -21,6 +31,10 @@ DX, onboarding, and PyPI publishing release. - Updated generated artifact metadata and aligned generation tests with current template output. - Added PyPI publish job to release workflow using OIDC trusted publishing (no API tokens required). +### Fixed in 1.3.0 + +- Fixed `test_install_and_verify_exits_zero` writing generated artifacts into the repository root instead of an isolated `tmp_path`. + ## 1.2.5 - 2026-04-21 CI dependency maintenance release. From 8598e7c0a15cd52dbbd7fea4c2556f9bf395b957 Mon Sep 17 00:00:00 2001 From: Erik Schaareman <44700015+eschaar@users.noreply.github.com> Date: Wed, 22 Apr 2026 01:33:39 +0200 Subject: [PATCH 2/3] fix: update .github/workflows/release.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0451416..3dd75c6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,5 +1,5 @@ # Release workflow. -# Trigger model: only on direct pushes to main (merge commits). +# Trigger model: runs on pushes to main. # Using push instead of pull_request so the workflow runs under refs/heads/main, # which satisfies the PyPI environment deployment branch protection rule. name: Release From aec5cd2d5d76a46d24b7ea0aab4ad21483a0850a Mon Sep 17 00:00:00 2001 From: Erik Schaareman <44700015+eschaar@users.noreply.github.com> Date: Wed, 22 Apr 2026 01:34:03 +0200 Subject: [PATCH 3/3] fix: update CHANGELOG.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e55958a..63172c5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,7 @@ Release workflow and test isolation fixes. ### Fixed in 1.3.1 - Fixed release workflow trigger: switched from `pull_request: closed` to `push: branches: [main]` so the workflow runs under `refs/heads/main` and satisfies the PyPI environment deployment branch protection rule. -- Fixed `build` job checkout missing `fetch-depth: 0`, required by `poetry-dynamic-versioning` to read git tags. +- Fixed `build` job checkout configuration so `poetry-dynamic-versioning` can read git tags during the build. - Fixed `download-artifact` version mismatch (`v5` → `v7`) to align with `upload-artifact@v7`. ## 1.3.0 - 2026-04-22