From e7f0dfaa72d505c0be0e755fa04910facb1b23f1 Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Wed, 22 Apr 2026 02:02:18 +0200 Subject: [PATCH 1/2] fix(ci): enable poetry dynamic versioning plugin in release build --- .github/workflows/release.yml | 7 ++++++- CHANGELOG.md | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7d0c781..c131c17 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -134,7 +134,12 @@ jobs: fetch-tags: true - name: Install Poetry - run: pipx install poetry + run: | + pipx install poetry + pipx inject poetry "poetry-dynamic-versioning[plugin]>=1.0.0,<2.0.0" + + - name: Show Poetry plugins + run: poetry self show plugins - name: Setup Python uses: actions/setup-python@v6 diff --git a/CHANGELOG.md b/CHANGELOG.md index 3107351..a70844e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,7 @@ Release build version-guard fix. ### Fixed in 1.3.2 - Fixed release build determinism by checking out `refs/tags/` in the build job instead of building from a moving branch ref. -- Fixed accidental `0.0.0` package publishing by validating that HEAD is pinned to the expected release tag before build and that produced artifacts include the expected version. +- Fixed accidental `0.0.0` package publishing by installing/enabling `poetry-dynamic-versioning` in the CI Poetry runtime and validating that both HEAD tag and built artifact version match the computed release version. ## 1.3.1 - 2026-04-22 From 04cd7843c58d34f77f39b5f3d9f3f47347634f7d Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Wed, 22 Apr 2026 02:23:40 +0200 Subject: [PATCH 2/2] fix(ci): harden release build versioning and pin Poetry across workflows --- .github/workflows/qa.yml | 6 ++++-- .github/workflows/release.yml | 31 +++++++++++-------------------- .github/workflows/security.yml | 4 +++- .github/workflows/verify.yml | 6 ++++-- CHANGELOG.md | 14 +++++++++++++- 5 files changed, 35 insertions(+), 26 deletions(-) diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml index 7eef39c..a0268b0 100644 --- a/.github/workflows/qa.yml +++ b/.github/workflows/qa.yml @@ -15,6 +15,8 @@ permissions: env: # Baseline interpreter for non-matrix checks. PYTHON_VERSION: "3.11" + # Pin Poetry CLI version for deterministic CI behavior. + POETRY_VERSION: "2.3.4" # Keep Poetry virtual environments inside the workspace for deterministic paths. POETRY_VIRTUALENVS_IN_PROJECT: "true" @@ -29,7 +31,7 @@ jobs: uses: actions/checkout@v6 - name: Install Poetry - run: pipx install poetry + run: pipx install "poetry==${POETRY_VERSION}" - name: Setup Python uses: actions/setup-python@v6 @@ -64,7 +66,7 @@ jobs: uses: actions/checkout@v6 - name: Install Poetry - run: pipx install poetry + run: pipx install "poetry==${POETRY_VERSION}" - name: Setup Python uses: actions/setup-python@v6 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c131c17..9b932cb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,8 @@ permissions: env: # Shared interpreter version for build and metadata steps. PYTHON_VERSION: "3.11" + # Pin Poetry CLI version for deterministic release builds. + POETRY_VERSION: "2.3.4" # Opt in to Node.js 24 for JavaScript-based actions ahead of runner defaults. FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" @@ -76,33 +78,22 @@ jobs: echo "changed=${{ steps.version.outputs.changed }}" echo "version=${{ steps.version.outputs.version }}" - - name: Enforce no-v SemVer tags + - name: Create and push git tag if: steps.version.outputs.changed == 'true' run: | VERSION="${{ steps.version.outputs.version }}" - - # Repository policy: tags must be plain SemVer (for example 1.0.0), never v1.0.0. - if [[ "$VERSION" =~ ^v ]]; then - echo "ERROR: release tag must not start with 'v' (got '$VERSION')." - exit 1 - fi - - if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then - echo "ERROR: release tag must match X.Y.Z (got '$VERSION')." + [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { + echo "ERROR: release tag must match X.Y.Z without a v-prefix (got '$VERSION')." exit 1 - fi - - - name: Create and push git tag - if: steps.version.outputs.changed == 'true' - run: | + } git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" - git rev-parse "${{ steps.version.outputs.version }}" >/dev/null 2>&1 && { - echo "ERROR: tag '${{ steps.version.outputs.version }}' already exists."; + git rev-parse "$VERSION" >/dev/null 2>&1 && { + echo "ERROR: tag '$VERSION' already exists."; exit 1; } - git tag -a "${{ steps.version.outputs.version }}" -m "release ${{ steps.version.outputs.version }}" - git push origin "${{ steps.version.outputs.version }}" + git tag -a "$VERSION" -m "release $VERSION" + git push origin "$VERSION" - name: Compute release date if: steps.version.outputs.changed == 'true' @@ -135,7 +126,7 @@ jobs: - name: Install Poetry run: | - pipx install poetry + pipx install "poetry==${POETRY_VERSION}" pipx inject poetry "poetry-dynamic-versioning[plugin]>=1.0.0,<2.0.0" - name: Show Poetry plugins diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 963eb44..879d6a6 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -15,6 +15,8 @@ permissions: env: # Keep scanner runtime consistent across runs. PYTHON_VERSION: "3.11" + # Pin Poetry CLI version for deterministic CI behavior. + POETRY_VERSION: "2.3.4" jobs: security: @@ -27,7 +29,7 @@ jobs: uses: actions/checkout@v6 - name: Install Poetry - run: pipx install poetry + run: pipx install "poetry==${POETRY_VERSION}" - name: Setup Python uses: actions/setup-python@v6 diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 2324696..0a1082a 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -14,6 +14,8 @@ permissions: env: # Shared interpreter version for reproducible CI behavior. PYTHON_VERSION: "3.11" + # Pin Poetry CLI version for deterministic CI behavior. + POETRY_VERSION: "2.3.4" # Keep Poetry virtual environments inside the workspace for deterministic paths. POETRY_VIRTUALENVS_IN_PROJECT: "true" @@ -28,7 +30,7 @@ jobs: uses: actions/checkout@v6 - name: Install Poetry - run: pipx install poetry + run: pipx install "poetry==${POETRY_VERSION}" - name: Setup Python uses: actions/setup-python@v6 @@ -53,7 +55,7 @@ jobs: uses: actions/checkout@v6 - name: Install Poetry - run: pipx install poetry + run: pipx install "poetry==${POETRY_VERSION}" - name: Setup Python uses: actions/setup-python@v6 diff --git a/CHANGELOG.md b/CHANGELOG.md index a70844e..15b0f0b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,17 @@ # Changelog +## 1.3.3 - 2026-04-22 + +Release build plugin activation fix. + +### Fixed in 1.3.3 + +- Fixed CI release builds producing `0.0.0` artifacts by installing/enabling `poetry-dynamic-versioning` in the Poetry runtime used by the build job. +- Fixed release build reproducibility by pinning the Poetry CLI version in workflow environment configuration. +- Fixed CI drift by aligning Poetry installation to the same pinned version across `release.yml`, `qa.yml`, `verify.yml`, and `security.yml`. +- Fixed release workflow noise by inlining SemVer format validation into the tag creation step. +- Added Poetry plugin visibility in release logs via `poetry self show plugins` to simplify troubleshooting. + ## 1.3.2 - 2026-04-22 Release build version-guard fix. @@ -7,7 +19,7 @@ Release build version-guard fix. ### Fixed in 1.3.2 - Fixed release build determinism by checking out `refs/tags/` in the build job instead of building from a moving branch ref. -- Fixed accidental `0.0.0` package publishing by installing/enabling `poetry-dynamic-versioning` in the CI Poetry runtime and validating that both HEAD tag and built artifact version match the computed release version. +- Fixed accidental `0.0.0` package publishing by validating that HEAD is pinned to the expected release tag before build and that produced artifacts include the expected version. ## 1.3.1 - 2026-04-22