Use PyPI trusted publishing, pin the e2e PDP, add latest and cloud PDP jobs - #136

Draft

zeevmoney wants to merge 68 commits into

mainfrom

per-16676/release-ci-hardening

Commits on Sep 21, 2026

Fix dependency CVEs and gate PRs, releases and a weekly scan

zeevmoney
and
claude
committed
7d1c214
Move httpserver_listen_address to conftest so the port is order-independent

zeevmoney
and
claude
committed
e5a88c1
TEMP: revert permit/ to origin/main to isolate test_bulk_operations

zeevmoney
and
claude
committed
160f129
Revert "TEMP: revert permit/ to origin/main to isolate test_bulk_operations"
zeevmoney
committed
f9b4857

Commits on Sep 22, 2026

Document the resource instance ident format correctly

zeevmoney
and
claude
committed
95a1860
Fix the major correctness bugs and enable the xfail tests for 3.0.0

zeevmoney
and
claude
committed
1e6b9e6
Isolate the end-to-end tests and start the PDP with the env's own key

zeevmoney
and
claude
committed
199c4be
Give the PDP time to warm up and ABAC policy time to propagate

zeevmoney
and
claude
committed
3d11c3a
Remove dead code and dead dependencies for 3.0.0

zeevmoney
and
claude
committed
e7ce61d
Skip only the ABAC decision assertions, with the evidence

zeevmoney
and
claude
committed
c439afb
Fix resource_relations.list() and document two backend contracts

zeevmoney
and
claude
committed
98ea10a
Tolerate rate limiting during test teardown

zeevmoney
and
claude
committed
e86f630
Retry rate-limited requests instead of tolerating them

zeevmoney
and
claude
committed
0865f96
Make the rate-limit retry more patient

zeevmoney
and
claude
committed
0146bb8
Point the ABAC skip at PER-16209

zeevmoney
and
claude
committed
e33c160
Make CheckQuery.context optional for type checkers

zeevmoney
and
claude
committed
5391be2

Commits on Sep 23, 2026

Migrate packaging, dependencies and CI to uv

zeevmoney
and
claude
committed
afc16f4
Adopt strict ruff and mypy, reformat and fix the codebase

zeevmoney
and
claude
committed
1d3b5de

Commits on Sep 29, 2026

Merge main into the strict-tooling branch

zeevmoney
and
claude
committed
cc3253f

Commits on Sep 30, 2026

Adopt strict ruff, mypy and typos configuration

zeevmoney
and
claude
committed
42edcca
Find the facade test's call sites without assuming layout

zeevmoney
and
claude
committed
d0c46d4
Reformat with ruff format at line length 100

zeevmoney
and
claude
committed
c3a754d
Let the sync stub generator copy whole-module imports

zeevmoney
and
claude
committed
afcce88
Apply ruff's safe fixes

zeevmoney
and
claude
committed
c62102a
Keep IncEx a typing generic

zeevmoney
and
claude
committed
ca29753
Type and document the SDK for strict ruff and mypy

zeevmoney
and
claude
committed
a812b48
Create test_envs' environments in the project it checks

zeevmoney
and
claude
committed
5d65977
Stop test_envs' cleanup from hiding the real failure

zeevmoney
and
claude
committed
00eba47
Type the tests for strict ruff and mypy

zeevmoney
and
claude
committed
1dbf931
Type and document the repository scripts

zeevmoney
and
claude
committed
e03f03d
Type and document the migration skill

zeevmoney
and
claude
committed
ba73988
Fail clearly on non-finite Decimals in request bodies

zeevmoney
and
claude
committed
01e4ca4
Import the SDK without a DeprecationWarning

zeevmoney
and
claude
committed
a14ae11
Fail the tests on any warning

zeevmoney
and
claude
committed
961b457
Wait up to 300s for the PDP and keep its startup in the failure log

zeevmoney
and
claude
committed
ab998d0

Commits on Oct 1, 2026

Publish to PyPI by trusted publishing instead of a token

zeevmoney
and
claude
committed
4cb0f35
Turn off the Trivy action's cache in the release scan

zeevmoney
and
claude
committed
b68b88b
Pin the PDP image of the required e2e jobs by version and digest

zeevmoney
and
claude
committed
4db824c
Set timeouts on the pytest and compatibility jobs

zeevmoney
and
claude
committed
7fb2b77
Fail a release whose wheel or sdist ships more than permit

zeevmoney
and
claude
committed
dd82004
Give each release job a timeout

zeevmoney
and
claude
committed
a170bb9
Run the e2e tests on the latest PDP image and on the cloud PDP

zeevmoney
and
claude
committed
16fe8a1
Merge the release publishing changes for PER-16676

zeevmoney
and
claude
committed
e8eb692
Merge the CI PDP pin and PDP legs for PER-16676

zeevmoney
and
claude
committed
6ff940e
Check the CI-built wheel and sdist for extra packages too

zeevmoney
and
claude
committed
23a20d4
Say why PyPI accepts the release upload without a token

zeevmoney
and
claude
committed
d1f8455
Describe the release workflow's jobs and trusted publishing

zeevmoney
and
claude
committed
e77f4a4
Describe the pinned, latest and cloud PDP e2e jobs

zeevmoney
and
claude
committed
0d48ed7
Name the CI job that runs the cloud PDP tests

zeevmoney
and
claude
committed
f3e7221
Require the cloud PDP's 501 in the cloud PDP tests

zeevmoney
and
claude
committed
3552bd7
Count the four e2e jobs in CONTRIBUTING.md

zeevmoney
and
claude
committed
3764512
Say that the pypi environment limits uploads to release tags

zeevmoney
and
claude
committed
2f68a35
Run the Test and Security workflows on every PR, whatever its base

zeevmoney
and
claude
committed
fb8f928
Test offline that a PDP's 501 makes the SDK raise

zeevmoney
and
claude
committed
f8192ab
Test real decisions on the cloud PDP instead of a 501

zeevmoney
and
claude
committed
22d3c8e
Expect the cloud PDP's tenant-association role in user permissions

zeevmoney
and
claude
committed
c241a0a
Invite with a role of the invited resource in the invites e2e test

zeevmoney
and
claude
committed
2595538
Poll for the PDP's role assignment list in the RBAC e2e tests

zeevmoney
and
claude
committed
8cbc891

Commits on Oct 2, 2026

Poll for the PDP's authorized users in the RBAC e2e test

zeevmoney
and
claude
committed
ced83e0
Keep ModelListInput's runtime annotation as typing.List

zeevmoney
and
claude
committed
d4495ec
Bound each PDP health probe to 5s and keep the first horizon failure

zeevmoney
and
claude
committed
be78b11
Bound the PDP wait by elapsed time rather than by tries

zeevmoney
and
claude
committed
bad0b36
Merge the strict-tooling review fixes from the base branch

zeevmoney
and
claude
committed
52303b4
Apply the bounded PDP wait and log filter to the latest-PDP job

zeevmoney
and
claude
committed
5e219ea
Invite with a role of the invited resource in the invites e2e test

zeevmoney
and
claude
committed
3e9a388
Regenerate ApproveMessage, whose field the API renamed to detail

zeevmoney
and
claude
committed
2513e53
Merge the base branch's backported e2e and schema fixes

zeevmoney
and
claude
committed
e48adf6
Merge main after #128's squash merge

zeevmoney
and
claude
committed
5977518