ci: publish an installable wheel from every push and PR - #90
Open
pofallon wants to merge 1 commit into
Open
Conversation
Testing a branch inside another project currently means either a git dependency — which builds from source and so validates neither the sdist exclude list nor the wheel's file selection — or cutting a release. CI built nothing, so there was no third option (the repo has zero artifacts to date). Adds a `build` job producing an installable sdist + wheel per commit, retained 14 days. The run summary carries the exact `gh run download` and install commands for that build, so the path from a green CI run to "installed in my other project" is a copy-paste. Notes on the specifics: - No `needs: test`. The point is to hand you something to install from a branch, and a branch you are still debugging is exactly when you want it. The run's own status already reports whether tests passed. - Uses the PR head SHA, not `github.sha`, which on pull_request events is the ephemeral merge commit nobody can find in their branch history. - Runs `twine check` and `check-wheel-contents` on every PR. This is the real win beyond distribution: packaging regressions currently surface only at release time, when the tag is already cut. - Install-by-path in the printed commands, not `--find-links`, for the reason found while building the release gate: `--find-links` only adds to the index, so a published version higher than the local build wins the resolution and you silently test the wrong artifact. - `uv build --no-sources` matches the release workflow — build the way every other tool would, with `tool.uv.sources` disabled. Uses upload-artifact v7 (current major; v4 is several majors stale). GitHub Packages was the obvious alternative and does not work: it hosts npm, RubyGems, Maven, NuGet and Docker, but Python remains unsupported. The other option is a PEP 503 index on GitHub Pages, which would give a credential-free URL other projects' CI could resolve by name — worth doing if that need appears, but it requires per-build dev versions (0.X.Y.devN+sha) to avoid filename collisions, so it is a larger change than this. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UBTr6Q6kTGUMQiwwBHcdMj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Option B from the earlier discussion: CI-built artifacts you can install without cutting a release.
Why
Testing a branch inside another project currently means either a git dependency — which builds from source and so validates neither the sdist
excludelist nor the wheel's file selection — or cutting a release. CI built nothing, so there was no third option. The repo has zero artifacts to date.What
A
buildjob producing an installable sdist + wheel per commit, retained 14 days. The run summary carries the exact commands for that specific build:(That's the real rendered output — I executed the summary step locally with the GitHub expressions substituted, rather than trusting the heredoc escaping by eye.)
Decisions worth reviewing
needs: test. The point is to hand you something to install from a branch, and a branch you're still debugging is exactly when you want it. The run's own status already reports whether tests passed. Easy to change if you'd rather gate it.github.sha— onpull_requestevents the latter is the ephemeral merge commit, which nobody can find in their branch history.twine check+check-wheel-contentson every PR. This is arguably the bigger win: packaging regressions currently surface only at release time, when the tag is already cut. Costs ~30s.--find-links— for the reason found while building ci: verify the built artifact before publishing it #89:--find-linksonly adds to the index, so a published version higher than the local build wins the resolution and you silently test the wrong artifact.uv build --no-sources, matching ci: verify the built artifact before publishing it #89.Action versions
Uses
upload-artifact@v7— v4 is several majors stale. I checked the v5/v6/v7 release notes: the breaking changes are Node runtime bumps, andname/path/retention-days/if-no-files-foundare all unchanged. I'll bump #89'sv4pins separately; worth knowing thatdownload-artifact@v8now enforces artifact hash checks by default rather than warning, which covers most of the integrity concern I raised on that PR.What I ruled out
GitHub Packages hosts npm, RubyGems, Maven, NuGet and Docker — Python is still unsupported, with an open request from May 2026. No
pypi.pkg.github.com.A PEP 503 index on GitHub Pages would give a credential-free URL other projects' CI could resolve by name, which this can't (
gh run downloadneeds a token even on a public repo). Worth doing if that need appears, but it requires per-build dev versions like0.10.0.dev5+a1b2c3dto avoid filename collisions, so it's a larger change than this one.Overlap with #89
Both build and verify. Different triggers and purposes: this one distributes dev builds on every commit, #89 gates the release. Once both land, extracting a reusable workflow would remove the duplication — happy to do that as a follow-up rather than couple the two PRs now.
🤖 Generated with Claude Code
https://claude.ai/code/session_01UBTr6Q6kTGUMQiwwBHcdMj