Skip to content

Trunk-based releases: build on main, publish from a GitHub Release - #57

Merged
tomasr78 merged 1 commit into
mainfrom
trunk-based-release
Oct 20, 2026
Merged

tomasr78 merged 1 commit into
mainfrom
trunk-based-release

Conversation

@tomasr78

Copy link
Copy Markdown
Contributor

Moves the Python SDK to the same release flow as https://github.com/ConvertAPI/convertapi-library-dotnet: main is the only branch, merging builds, and a GitHub Release v{semver} publishes.

Build (build.yml, replaces main.yml) — on every PR and push to main:

  • test on Python 3.10, 3.11, 3.12, 3.13 with pytest (was 3.7/3.9 with nose, which no longer runs on current Python);
  • build (the required check): passes only if every test job passed, then builds the sdist and wheel as 0.0.0.dev{run}+g{sha}, runs twine check --strict, installs the wheel in a clean venv and uploads it as an artifact. Nothing is published.

Publish (publish.yml, same file name and pypi environment, so the existing PyPI trusted publisher still matches) — on a published GitHub Release:

  • refuses a release published or re-run by anyone but tomasr78 (checked in both jobs);
  • checks the tag (v2.0.1, v2.1.0-rc.1 → 2.1.0rc1), the pre-release tick, that a stable tag is on main, and that PyPI has never had the version;
  • writes the version into convertapi/__init__.py, builds, tests the installed wheel;
  • uploads with Trusted Publishing from a separate job (only that job gets id-token: write), PEP 740 attestations, never skip-existing.

Other

  • setup.py/setup.cfg → pyproject.toml; the PyPI page now shows the README and project links; the wheel is py3-none-any instead of py2.py3.
  • Tests: the old service-calling tests are kept, marked live, and skipped unless CONVERT_API_SECRET is set (the repository has no such secret, so they had not run in CI). New mocked tests (responses) cover the request/response handling without network.
  • Actions pinned to SHAs (checkout v7.0.1, setup-python v7.0.0, upload-artifact v7.0.2, download-artifact v8.0.2, pypa/gh-action-pypi-publish v1.14.2); weekly Dependabot for actions.
  • RELEASING.md, CHANGELOG.md, README updated (pytest, main, badge).

Repository settings done alongside: master renamed to main; rulesets for main (PR, merge commits only, build required, admin bypass), v* tags admin-only and v* tags pattern-checked; pypi environment limited to v* tags; squash and rebase merging off.

🤖 Generated with Claude Code

…lease

- build.yml (replaces main.yml): tests on Python 3.10-3.13 with pytest, then builds and checks the
  sdist and wheel as a 0.0.0.devN+gSHA artifact; the `build` job is the required check.
- publish.yml: a GitHub Release v{semver} published by tomasr78 builds the tag with the tag's version,
  tests the installed wheel and uploads to PyPI with Trusted Publishing (same file and pypi environment,
  so the existing trusted publisher still matches). Never re-uploads an existing version.
- Packaging moved to pyproject.toml; __version__ is a placeholder written from the tag.
- Tests ported from nose to pytest; new mocked tests run without network, the old ones are `live`.
- Actions pinned to SHAs, upload-artifact v7, weekly Dependabot for actions.
- RELEASING.md and CHANGELOG.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 20, 2026 07:48
@tomasr78
tomasr78 merged commit 9823ef1 into main Oct 20, 2026
6 checks passed
@tomasr78
tomasr78 deleted the trunk-based-release branch October 20, 2026 07:52

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Package metadata must enforce the documented Python 3.10 minimum to prevent installers selecting unsupported releases.

1 open issue
What changed in this PR

Moves the Python SDK to trunk-based releases: changes to main build artifacts, while published GitHub Releases trigger PyPI publishing.

Changes:

  • Separates build validation from guarded Trusted Publishing.
  • Migrates packaging to pyproject.toml.
  • Replaces nose with pytest, adds mocked tests, and documents releasing.
File Description
tests/​utils.py Removes obsolete unittest helper.
tests/​test_convertapi.py Migrates live tests to pytest.
tests/​test_client.py Adds mocked client tests.
tests/​conftest.py Adds configuration restoration and live-test fixtures.
test-requirements.txt Updates test dependencies.
setup.py Removes legacy packaging script.
setup.cfg Removes legacy packaging configuration.
requirements.txt Removes redundant dependency declaration.
RELEASING.md Documents release procedures and safeguards.
README.md Updates installation, requirements, and development guidance.
pyproject.toml Defines packaging metadata and pytest configuration.
convertapi/​__init__.py Introduces a build-time version placeholder.
CHANGELOG.md Records packaging and release changes.
.gitignore Ignores pytest cache.
.github/​workflows/​publish.yml Adds release validation and isolated PyPI publishing.
.github/​workflows/​main.yml Removes the previous build workflow.
.github/​workflows/​build.yml Adds test matrix and artifact validation.
.github/​dependabot.yml Enables weekly action updates.

Review effort: Balanced

Comment thread pyproject.toml
license-files = ["LICENSE.txt"]
authors = [{ name = "Tomas Rutkauskas", email = "support@convertapi.com" }]
keywords = ["convert", "api", "client", "conversion"]
dependencies = ["requests>=2.4.2"]

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Deliberately not adding requires-python in a patch release: 2.0.0 declared no minimum, and a floor would quietly pin 3.8/3.9 users to 2.0.0 without the 2.0.1 fix. The README now states the tested versions instead of a minimum (#58). A minimum belongs in a minor release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants