Automate releases, and cut 2.3.0 - #158
Merged
Merged
Conversation
PyPI has been serving `0.4.1` -- the original Julia-backed wrapper -- since long before the pure-Python rewrite landed. There was no release automation and nobody published by hand, so `pip install jupyddl` has been handing people a different library than this repository documents, for four minor versions. That is the actual bug being fixed here. `.github/workflows/release.yml` fires on a `v*` tag: build, verify, publish, cut the GitHub Release from the changelog section for that version. Authentication is PyPI Trusted Publishing over OIDC, so there is no API token in this repository to leak or rotate. It costs one one-time setup on PyPI that only a project maintainer can do, written up in docs/RELEASING.md. Four things it refuses to do, because each is a way a release goes wrong quietly and PyPI will not let you take a version back: - a tag that disagrees with pyproject.toml - a `jupyddl.__version__` that disagrees with the metadata - anything `twine check --strict` objects to - a wheel that does not work -- it is installed into a clean environment, away from the source tree, and made to generate and solve an instance, which is what catches a module missing from the wheel `workflow_dispatch` runs the same pipeline against TestPyPI so this file can be changed without spending a real version number. The `pypi` job is the only one gated on the trusted publisher, so a tag pushed before that setup exists still produces verified artifacts rather than a half-finished release. 2.3.0 closes the changelog section that had accumulated the learned heuristics, the RL stage and the CI work. Metadata filled out for a listing people will actually read: Python 3.9-3.14 classifiers, audience and status, changelog/issues/workbench URLs. Development Status is Beta rather than Stable on purpose -- jupyddl.learn is new and its API will move. No `Typing :: Typed` classifier, because there is no py.typed marker and the annotations are not complete enough to claim one. Verified locally end to end: builds, `twine check --strict` passes on both artifacts, the version guards accept v2.3.0 and refuse v2.4.0, the changelog extraction pulls the right 4466 characters, and the wheel installs clean and solves an instance reporting 2.3.0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Meb35zHKsyBkH2sbWoyKMT
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The actual problem
PyPI has been serving
jupyddl0.4.1 — the original Julia-backed wrapper — since long before the pure-Python rewrite landed. There was no release automation and nobody published by hand, sopip install jupyddlhas been handing people a different library than this repository documents, across four minor versions (1.0.0, 2.0.0, 2.1.0, 2.2.0).The README says
pip install jupyddland then describes a dependency-free planning framework. Today that install gives you something that wants Julia.What lands
.github/workflows/release.yml— push a tag, get a release:Build → verify → publish to PyPI → cut the GitHub Release from that version's changelog section.
Authentication is PyPI Trusted Publishing (OIDC), so there is no API token in this repository to leak, rotate, or forget about. That trade costs one piece of setup only a PyPI maintainer can do — see below.
Four things it refuses to do
Each is a way a release goes wrong quietly, and PyPI never lets you take a version back:
pyproject.toml2.3.0from av2.4.0tag is unfixablejupyddl.__version__disagrees with the metadatatwine check --strictobjectsworkflow_dispatchruns the same pipeline against TestPyPI, so this workflow can be changed without spending a real version number.The
pypijob is the only one gated on the trusted publisher, so a tag pushed before that setup exists still produces verified artifacts rather than a half-finished release.The
pypijob will fail until this exists. On https://pypi.org/manage/project/jupyddl/settings/publishing/:APLA-ToolboxPythonPDDLrelease.ymlpypiThe environment name is load-bearing — PyPI rejects a token minted from anywhere else, which is what stops a workflow added later by someone else from publishing.
Optionally add yourself as a required reviewer on the
pypienvironment if you would rather a mistaken tag not reach PyPI unattended.Full runbook in
docs/RELEASING.md.2.3.0
Closes the changelog section that accumulated the learned heuristics, the RL stage, and the CI work. Metadata filled out for a listing people will actually read: Python 3.9–3.14 classifiers, audience and status, changelog/issues/workbench URLs, and a real
pip install jupyddlblock in the README.Two deliberate omissions:
jupyddl.learnis new and its API will move.Typing :: Typedclassifier — there is nopy.typedmarker and the annotations are not complete enough to claim one.Verified locally, end to end
twine check --strictpasses on both sdist and wheel.v2.3.0and refusev2.4.0.2.3.0.Generated by Claude Code