build(release): pin workspace siblings to the lockstep version

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pipefy",
   "displayName": "Pipefy",
-  "version": "0.2.0-beta.1",
+  "version": "0.3.0-alpha.1",
   "description": "Pipefy workflow integration for Claude Code.",
   "author": { "name": "Pipefy", "url": "https://github.com/pipefy" },
   "homepage": "https://github.com/pipefy/ai-toolkit",

.github/workflows/release.yml

@@ -73,14 +73,26 @@ jobs:
           from pathlib import Path
 
           dist = Path("dist")
-          for prefix in ("pipefy", "pipefy_mcp_server", "pipefy_cli", "pipefy_auth", "pipefy_infra"):
+          expected = ("pipefy", "pipefy_mcp_server", "pipefy_cli", "pipefy_auth", "pipefy_infra")
+          for prefix in expected:
               wheels = list(dist.glob(f"{prefix}-*.whl"))
               if len(wheels) != 1:
                   print(
                       f"expected exactly one wheel matching {prefix}-*.whl, got {wheels!r}",
                       file=sys.stderr,
                   )
                   sys.exit(1)
+          # Bound the set: a new workspace member builds a wheel that is not in
+          # `expected` and so never gets staged for PyPI, shipping a partial
+          # release. Fail here so adding a package forces updating this list.
+          all_wheels = list(dist.glob("*.whl"))
+          if len(all_wheels) != len(expected):
+              print(
+                  f"expected exactly {len(expected)} wheels in dist/, got "
+                  f"{sorted(w.name for w in all_wheels)!r}",
+                  file=sys.stderr,
+              )
+              sys.exit(1)
           PY
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2

RELEASE.md

@@ -96,6 +96,6 @@ Same steps as above. PyPI publishing already runs on every tag; a **`v1.`** tag
 
 | Piece | Role |
 | --- | --- |
-| `scripts/bump_version.py` | Reads the SDK `__version__`, applies the bump, writes the same value to SDK, MCP, CLI, Auth, and Infra `__init__.py` plus the root `pyproject.toml`'s `[project].version`, then runs `uv lock` to refresh `uv.lock`. Also exposes a `verify` mode that asserts every version-bearing file agrees. |
-| `.github/workflows/ci.yml` | Invokes `scripts/bump_version.py verify` to assert the five `__version__` strings and root `pyproject.toml` `[project].version` all match. |
-| `.github/workflows/release.yml` | On `v*` tags: asserts the tag matches SDK `__version__`, extracts the matching `CHANGELOG.md` section as the GitHub Release body, builds wheels and sdists with `uv build --all-packages -o dist --wheel --sdist`, attaches wheels to the GitHub Release, and uploads all five wheels to PyPI via Trusted Publishing on every `v*` tag. |
+| `scripts/bump_version.py` | Reads the SDK `__version__`, applies the bump, writes the same value to SDK, MCP, CLI, Auth, and Infra `__init__.py`, the root `pyproject.toml`'s `[project].version`, the `.claude-plugin/plugin.json` `version`, and each published package's sibling `==` pins, then runs `uv lock` to refresh `uv.lock`. Also exposes a `verify` mode that asserts every version-bearing file agrees. |
+| `.github/workflows/ci.yml` | Invokes `scripts/bump_version.py verify` to assert that all version-bearing files match: the five `__version__` strings, the root `pyproject.toml` `[project].version`, `uv.lock`, the `.claude-plugin/plugin.json` `version`, and the sibling `==` pins in each published package's `pyproject.toml`. |
+| `.github/workflows/release.yml` | On `v*` tags: asserts the tag matches SDK `__version__`, extracts the matching `CHANGELOG.md` section as the GitHub Release body, builds wheels and sdists with `uv build --all-packages -o dist --wheel --sdist`, guards that `dist/` holds exactly five wheels (one per workspace member) so a sixth member cannot ship unnoticed, attaches wheels to the GitHub Release, and uploads all five wheels to PyPI via Trusted Publishing on every `v*` tag. |

packages/auth/pyproject.toml

@@ -9,7 +9,7 @@ dependencies = [
     "httpx-auth>=0.23.1",
     "keyring>=24",
     "keyrings.alt>=5",
-    "pipefy-infra",
+    "pipefy-infra==0.3.0-alpha.1",
     # RS256 validation of inbound bearers (resource-server role); [crypto] pulls cryptography.
     "pyjwt[crypto]>=2.8",
     "pydantic>=2.13.4,<3",

packages/cli/pyproject.toml

@@ -5,8 +5,8 @@ description = "Typer CLI for Pipefy (pipefy)."
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
-    "pipefy",
-    "pipefy-auth",
+    "pipefy==0.3.0-alpha.1",
+    "pipefy-auth==0.3.0-alpha.1",
     "typer>=0.12",
     "rich>=13",
     "pydantic-settings>=2.8.1",

packages/mcp/pyproject.toml

@@ -8,9 +8,9 @@ dependencies = [
     "httpx>=0.27.0",
     "mcp[cli]>=1.25.0",
     # Workspace resolves versions in dev; PyPI releases stage these wheels alongside CLI/MCP (see release workflow).
-    "pipefy-auth",
-    "pipefy-infra",
-    "pipefy",
+    "pipefy-auth==0.3.0-alpha.1",
+    "pipefy-infra==0.3.0-alpha.1",
+    "pipefy==0.3.0-alpha.1",
     "pydantic>=2.13.4,<3",
     "pydantic-settings>=2.8.1",
 ]

packages/sdk/pyproject.toml

@@ -9,7 +9,7 @@ dependencies = [
     "gql[httpx]>=4.0.0,<5",
     "httpx>=0.27.0",
     "openpyxl>=3.1.5",
-    "pipefy-infra",
+    "pipefy-infra==0.3.0-alpha.1",
     "pydantic>=2.13.4,<3",
     "pydantic-settings>=2.8.1",
     "rapidfuzz>=3.14.3",