fix: preserve PyPI trusted publisher identity - #204
Conversation
|
You have reached your Codex usage limits for security reviews. Please try again later. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Dependency ReviewThe following issues were found:
License Issues.github/workflows/release.yml
OpenSSF Scorecard
Scanned Files
|
|
Warning Review limit reachedNext included review available in 43 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
💤 Files with no reviewable changes (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details🧰 Additional context used📓 Path-based instructions (8)Do not assign directly to `document.cookie`.📄 CodeRabbit inference engine (AGENTS.md) Files:
Keep Node.js, WASM, and Python bindings as thin adapters over the single Rust implementation; do not hand-write validator logic in bindings.📄 CodeRabbit inference engine (CONTRIBUTING.md) Files:
Preserve per-country module boundaries and public export paths; package exports are public API.📄 CodeRabbit inference engine (AGENTS.md) Files:
Binding layers should remain thin: business logic belongs in the Rust core, while TypeScript, Python, WASM, and NAPI layers translate types and call shared core logic.📄 CodeRabbit inference engine (AGENTS.md) Files:
Prefer TypeScript features that make invalid states structurally impossible, including branded types, discriminated unions, exhaustive checks, and named discriminators instead of growing boolean state flags.📄 CodeRabbit inference engine (AGENTS.md) Files:
Use property and mutation testing for checksum behavior and differential testing of specialized canonical validators against the full validator.📄 CodeRabbit inference engine (AGENTS.md) Files:
After adding or changing a validator, use `bun run codegen` to generate npm entrypoints, TypeScript and Python registry types, package exports, and README tables; do not manually maintain generated outputs.📄 CodeRabbit inference engine (CONTRIBUTING.md) Files:
Prefer explicit designs, fail fast at boundaries, return or throw early, and minimize brace nesting with early returns.📄 CodeRabbit inference engine (AGENTS.md) Files:
🔇 Additional comments (3)
📝 WalkthroughWalkthroughThe release workflows update pinned reusable actions, split PyPI wheel preparation, publication, and verification, remove changelog credentials, and retain release and npm publishing credentials. Tests now verify the revised workflow contract and exact action configuration. ChangesRelease workflows
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: 🔵 Low · up to This PR preserves the intended PyPI trusted-publisher identity while keeping artifact preparation, verification, and release finalization gated. If an upload is interrupted after only some wheels are accepted, the public release may be temporarily incomplete and retry behavior is not fully established, so it is mergeable with explicit owner awareness of recovery handling. Sequence Diagram(s)sequenceDiagram
participant PyPIJob
participant PypiPublishHardened
participant PypaPublishAction
participant PypiPublishVerify
PyPIJob->>PypiPublishHardened: Prepare versioned wheels in dist
PypiPublishHardened->>PypaPublishAction: Publish wheels with skip-existing
PypaPublishAction->>PypiPublishVerify: Verify published files
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.) ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2a6226e6e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
24c58b0 to
b8011d9
Compare
b8011d9 to
bbac4e1
Compare
1 participant
Summary
0f814e1a0c6c7401778e661209553b6e15f8d92aRoot cause
PyPI Trusted Publishing identifies the caller workflow. The old composite action nested the Docker-based publisher, which GitHub Actions cannot invoke correctly from that boundary. The top-level publisher preserves the configured
stella/stdnum/.github/workflows/release.ymlOIDC identity.Remote CI is the validation source for this workflow-only change.
CC on behalf of jan-kubica
Summary by CodeRabbit