feat(distribution): switch on the parts that were built and never published - #509
Open
darklordVirtual wants to merge 1 commit into
Open
feat(distribution): switch on the parts that were built and never published#509darklordVirtual wants to merge 1 commit into
darklordVirtual wants to merge 1 commit into
Conversation
…lished
The distribution layer was not missing, it was built and left off. The
release workflow already produced wheel, sdist, CycloneDX SBOM, checksums
and Sigstore build-provenance attestations from the tagged commit, and
published none of them. mkdocs.yml existed and nothing ever built the
site. CITATION.cff carried the metadata with DOI and ORCID marked
pending. So reaching the eight-scenario offline CLI demo required cloning
the repository first, which is the barrier, not the absence of a demo.
The distribution name changes to remora-assurance. `remora` is taken on
PyPI by an unrelated project ("A replacement for NRPE", 0.0.1), so
publishing under it is impossible and `pip install remora` would install
that instead. The import package and the console script stay `remora`;
only the name pip resolves moves, and the three importlib.metadata
lookups move with it.
Nothing publishes on merge. The PyPI job requires a tag push AND the
repository variable PUBLISH_TO_PYPI; the Pages deploy requires master AND
PUBLISH_DOCS. Until those are set, a tag produces exactly what it
produced before and the docs job only builds. Publication authenticates
through Trusted Publishing, so no API token is stored in the repository.
Each workflow carries the one-time setup steps that must happen outside
it, and CITATION.cff carries the Zenodo procedure, including that
archiving has to be enabled before the release is published rather than
after.
The docs build runs with --strict on every push and pull request, so a
broken link fails where it is introduced rather than at deploy time.
README install lines are deliberately untouched: they should change in
the commit that follows a first successful publish, not before it, so
they never name a package nobody can install.
6492 passed, 24 skipped. mypy clean over 359 files, ruff clean, mkdocs
--strict clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepares every distribution step and leaves the outward-facing action to you. Nothing publishes when this merges.
What was actually wrong
Not a missing distribution layer — a built one that was never switched on:
release.yml: wheel, sdist, CycloneDX SBOM, SHA256SUMS, Sigstore build-provenance + SBOM attestations, verified in-runmkdocs.yml, fulldocs/tree under the document registerCITATION.cffwith title, abstract, version, keywordsremora demo(eight offline scenarios),remora tryBlocking discovery: the PyPI name is taken
remoraon PyPI is an unrelated project ("A replacement for NRPE", 0.0.1). Publishing under it is impossible, andpip install remorawould install that. The distribution name becomesremora-assurance(verified available). The import package and console script stayremora; the threeimportlib.metadata.version(...)lookups move with the distribution name. Wheel builds asremora_assurance-0.11.0-py3-none-any.whl; artefact globs inrelease.ymlandci.ymlare now name-agnostic.Say the word if you want a different name — it is one field plus three lookups.
Two locks, both yours to open
PyPI (
release.yml, newpublish-pypijob): requires a tag push and repo variablePUBLISH_TO_PYPI=true. Trusted Publishing via OIDC, so no token in the repo. Publishes exactly the artefacts the same run attested, with the SBOM and checksums stripped.Setup, once: create the PyPI project
remora-assurance; add a Trusted Publisher (ownerdarklordVirtual, repoREMORA-research, workflowrelease.yml, environmentpypi); create thepypiGitHub environment (add reviewers if you want a second pair of eyes per publish); setPUBLISH_TO_PYPI.Docs (
docs-site.yml, new): builds withmkdocs build --stricton every push and PR so a broken link fails where it is introduced. Deploys only on master andPUBLISH_DOCS=true.Setup, once: Settings → Pages → Source: GitHub Actions; set
PUBLISH_DOCS.Zenodo/DOI:
.zenodo.jsoncommitted.CITATION.cffcarries the procedure, including the part that bites — archiving must be enabled before the release is published, and the concept DOI is the one that belongs inCITATION.cff. The ORCID field is left empty rather than guessed; it needs your iD in two places.Deliberately not done
README and docs install lines still say
pip install -e ".[dev]". They should change in the commit that follows a first successful publish, not before, so they never name a package nobody can install.Verification
6492 passed, 24 skipped. mypy clean (359 files), ruff clean,
mkdocs build --strictclean, wheel builds under the new name. Every pinned action SHA was resolved against the GitHub API rather than written from memory.