Publish keylessly via WIF (drop the stored credential) - #2
Closed
rbehal wants to merge 7 commits into
Closed
Conversation
- pyo3 abi3-py312 -> abi3-py310: one cp310-abi3 wheel serves CPython 3.10+ - requires-python >= 3.10; patch the 3.11-only constructs (datetime.UTC, typing.Self) with runtime-equivalent 3.10 forms - defer the translation import in switchyard_rust/__init__.py so the bindings-only surface (switchyard_rust.libsy) never needs provider SDKs - move the upstream core deps (openai/anthropic/httpx/pydantic) into the new 'lib' extra so embedding hosts do not inherit provider-SDK floors; the server/cli/all extras pull it in transitively - version lookups try the renamed dist first, upstream's name second Co-authored-by: Cursor <cursoragent@cursor.com>
Binds LlmClassifierConfig::Custom (CustomClassifierConfig + TargetSelector) as custom_classifier(judge_target, targets, *, default_target, config): schema-driven routing across two or more labeled targets, with the judge's verdict selecting a label through a JSON Pointer and unusable verdicts falling open to default_target. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Artifact Registry rejects twine's --skip-existing capability probe. Co-authored-by: Cursor <cursoragent@cursor.com>
GitHub's OIDC token federates through the switchyard-github pool and impersonates the agenthub-github-ci-cd CI SA. Merge after the backend terraform (module switchyard_wif, environments/staging) has applied; the GCP_ARTIFACT_REGISTRY_CREDENTIALS secret can be deleted once this lands. Co-authored-by: Cursor <cursoragent@cursor.com>
rbehal
force-pushed
the
gumloop-main
branch
3 times, most recently
from
August 11, 2026 20:29
e512532 to
c8c5181
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switches the publish workflow from the stored
GCP_ARTIFACT_REGISTRY_CREDENTIALSsecret to keyless OIDC federation: the workflow impersonates the existingagenthub-github-ci-cdCI service account (which already carriesartifactregistry.repositories.uploadArtifactsvia theAgentHubGitHubCICDcustom role) through the newswitchyard-githubWIF pool.Merge order: this needs the backend terraform on
rahul-GMLP-9804(moduleswitchyard_wifinenvironments/staging, mirroring theversioned_fsWIF setup) to have applied first — it trustsgumloop-v*tags andworkflow_dispatchruns fromgumloop-main. TheGCP_WIF_PROVIDERrepo variable is already set to the provider name.After merging: delete the
GCP_ARTIFACT_REGISTRY_CREDENTIALSsecret and verify with aworkflow_dispatchrun (idempotent — already-published wheels are skipped via the simple index).Made with Cursor