Loading .gitlab-ci.yml +2 −2 Changes for .gitlab-ci.yml: 2 added lines, 2 removed lines. Original line number Diff line number Diff line workflow: rules: - if: $CI_PIPELINE_SOURCE == "merge_request_event" - if: $CI_COMMIT_TAG =~ /^v2[.]0[.][0-9]+(rc[1-9][0-9]*|-release)?$/ - if: $CI_COMMIT_TAG =~ /^v2[.]0[.][0-9]+(rc[1-9][0-9]*)?$/ - if: $CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "develop") - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS when: never Loading Loading @@ -175,7 +175,7 @@ publish-package: - if: '$CI_COMMIT_BRANCH == "main" && $CI_COMMIT_REF_PROTECTED == "true" && $CI_PIPELINE_SOURCE == "push"' when: on_success allow_failure: false - if: '$CI_COMMIT_TAG =~ /^v2[.]0[.][0-9]+(rc[1-9][0-9]*|-release)?$/ && $CI_COMMIT_REF_PROTECTED == "true"' - if: '$CI_COMMIT_TAG =~ /^v2[.]0[.][0-9]+(rc[1-9][0-9]*)?$/ && $CI_COMMIT_REF_PROTECTED == "true"' when: on_success allow_failure: false - when: never Loading ci/RELEASE.md +1 −1 Changes for ci/RELEASE.md: 1 added line, 1 removed line. Original line number Diff line number Diff line Loading @@ -4,7 +4,7 @@ main through its release MR. The merge is the publication approval. 2. The main pipeline builds the wheel and source distribution once, verifies those bytes, runs the Python matrix, dependency audit and linked SRM consumer. 3. After required checks pass, publish-package creates v2.0.0-release for package 3. After required checks pass, publish-package creates v2.0.0 for package 2.0.0 and uploads those same artifacts to the existing GitLab Python registry. The job-token tag push starts no second pipeline. GitLab Release pages remain with the release owner. Explicit protected candidate/tag pipelines remain Loading ci/release.py +4 −4 Changes for ci/release.py: 4 added lines, 4 removed lines. Original line number Diff line number Diff line Loading @@ -17,9 +17,9 @@ from verify import DIST, OUT, ROOT, sha256, write_json def check_tag(tag, version, protected): if not re.fullmatch(r"v2\.0\.\d+(?:rc[1-9][0-9]*|-release)?", tag): raise ValueError("Use an immutable v2.0.X-release, v2.0.X or v2.0.XrcN release tag") if Version(tag[1:].removesuffix("-release")) != Version(version): if not re.fullmatch(r"v2\.0\.\d+(?:rc[1-9][0-9]*)?", tag): raise ValueError("Use an immutable v2.0.X or v2.0.XrcN release tag") if Version(tag[1:]) != Version(version): raise ValueError("Release tag and package version differ") if protected != "true": raise ValueError("Publication requires a protected release tag") Loading @@ -37,7 +37,7 @@ def release_context(version): raise ValueError("Automatic publication requires a protected main push") if Version(version).is_prerelease: raise ValueError("Use a stable package version for automatic main publication") return f"v{version}-release", True return f"v{version}", True def ensure_main_tag(tag, revision, *, create=True): Loading tests/ci/test_main_release.py +2 −2 Changes for tests/ci/test_main_release.py: 2 added lines, 2 removed lines. Original line number Diff line number Diff line Loading @@ -32,7 +32,7 @@ def test_only_a_protected_main_push_supplies_automatic_release_approval( }.items(): monkeypatch.setenv(key, value) if allowed: assert release.release_context("2.0.0") == ("v2.0.0-release", True) assert release.release_context("2.0.0") == ("v2.0.0", True) with pytest.raises(ValueError): release.release_context("2.0.0rc6") else: Loading Loading @@ -73,7 +73,7 @@ def test_automatic_tag_is_created_once_and_never_moves(tmp_path, monkeypatch): git("remote", "add", "origin", str(remote), cwd=work) git("push", "origin", "main", cwd=work) monkeypatch.chdir(work) tag = "v2.0.0-release" tag = "v2.0.0" assert release.ensure_main_tag(tag, first, create=False) assert git("--git-dir", str(remote), "tag", "--list") == "" assert release.ensure_main_tag(tag, first) Loading tests/ci/test_release_guards.py +2 −2 Changes for tests/ci/test_release_guards.py: 2 added lines, 2 removed lines. Original line number Diff line number Diff line Loading @@ -18,7 +18,6 @@ import verify # noqa: E402 "tag,version,protected", [ ("v2.0.0", "2.0.0", "true"), ("v2.0.0-release", "2.0.0", "true"), ("v2.0.0rc1", "2.0.0rc1", "true"), ], ) Loading @@ -36,6 +35,7 @@ def test_matching_protected_release_identity(tag, version, protected): ("v2.0.0-release", "2.0.0rc5", "true"), ("v2.0.0-release", "2.0.0", "false"), ("v2.0.0rc5-release", "2.0.0rc5", "true"), ("v2.0.0-release", "2.0.0", "true"), ("", "2.0.0", "true"), ], ) Loading @@ -47,7 +47,7 @@ def test_unapproved_or_mismatched_release_is_refused(tag, version, protected): @pytest.mark.parametrize( "tag,accepted", [ ("v2.0.0-release", True), ("v2.0.0-release", False), ("v2.0.0", True), ("v2.0.0rc5", True), ("v2.0.0rc5-release", False), Loading Loading
.gitlab-ci.yml +2 −2 Changes for .gitlab-ci.yml: 2 added lines, 2 removed lines. Original line number Diff line number Diff line workflow: rules: - if: $CI_PIPELINE_SOURCE == "merge_request_event" - if: $CI_COMMIT_TAG =~ /^v2[.]0[.][0-9]+(rc[1-9][0-9]*|-release)?$/ - if: $CI_COMMIT_TAG =~ /^v2[.]0[.][0-9]+(rc[1-9][0-9]*)?$/ - if: $CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "develop") - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS when: never Loading Loading @@ -175,7 +175,7 @@ publish-package: - if: '$CI_COMMIT_BRANCH == "main" && $CI_COMMIT_REF_PROTECTED == "true" && $CI_PIPELINE_SOURCE == "push"' when: on_success allow_failure: false - if: '$CI_COMMIT_TAG =~ /^v2[.]0[.][0-9]+(rc[1-9][0-9]*|-release)?$/ && $CI_COMMIT_REF_PROTECTED == "true"' - if: '$CI_COMMIT_TAG =~ /^v2[.]0[.][0-9]+(rc[1-9][0-9]*)?$/ && $CI_COMMIT_REF_PROTECTED == "true"' when: on_success allow_failure: false - when: never Loading
ci/RELEASE.md +1 −1 Changes for ci/RELEASE.md: 1 added line, 1 removed line. Original line number Diff line number Diff line Loading @@ -4,7 +4,7 @@ main through its release MR. The merge is the publication approval. 2. The main pipeline builds the wheel and source distribution once, verifies those bytes, runs the Python matrix, dependency audit and linked SRM consumer. 3. After required checks pass, publish-package creates v2.0.0-release for package 3. After required checks pass, publish-package creates v2.0.0 for package 2.0.0 and uploads those same artifacts to the existing GitLab Python registry. The job-token tag push starts no second pipeline. GitLab Release pages remain with the release owner. Explicit protected candidate/tag pipelines remain Loading
ci/release.py +4 −4 Changes for ci/release.py: 4 added lines, 4 removed lines. Original line number Diff line number Diff line Loading @@ -17,9 +17,9 @@ from verify import DIST, OUT, ROOT, sha256, write_json def check_tag(tag, version, protected): if not re.fullmatch(r"v2\.0\.\d+(?:rc[1-9][0-9]*|-release)?", tag): raise ValueError("Use an immutable v2.0.X-release, v2.0.X or v2.0.XrcN release tag") if Version(tag[1:].removesuffix("-release")) != Version(version): if not re.fullmatch(r"v2\.0\.\d+(?:rc[1-9][0-9]*)?", tag): raise ValueError("Use an immutable v2.0.X or v2.0.XrcN release tag") if Version(tag[1:]) != Version(version): raise ValueError("Release tag and package version differ") if protected != "true": raise ValueError("Publication requires a protected release tag") Loading @@ -37,7 +37,7 @@ def release_context(version): raise ValueError("Automatic publication requires a protected main push") if Version(version).is_prerelease: raise ValueError("Use a stable package version for automatic main publication") return f"v{version}-release", True return f"v{version}", True def ensure_main_tag(tag, revision, *, create=True): Loading
tests/ci/test_main_release.py +2 −2 Changes for tests/ci/test_main_release.py: 2 added lines, 2 removed lines. Original line number Diff line number Diff line Loading @@ -32,7 +32,7 @@ def test_only_a_protected_main_push_supplies_automatic_release_approval( }.items(): monkeypatch.setenv(key, value) if allowed: assert release.release_context("2.0.0") == ("v2.0.0-release", True) assert release.release_context("2.0.0") == ("v2.0.0", True) with pytest.raises(ValueError): release.release_context("2.0.0rc6") else: Loading Loading @@ -73,7 +73,7 @@ def test_automatic_tag_is_created_once_and_never_moves(tmp_path, monkeypatch): git("remote", "add", "origin", str(remote), cwd=work) git("push", "origin", "main", cwd=work) monkeypatch.chdir(work) tag = "v2.0.0-release" tag = "v2.0.0" assert release.ensure_main_tag(tag, first, create=False) assert git("--git-dir", str(remote), "tag", "--list") == "" assert release.ensure_main_tag(tag, first) Loading
tests/ci/test_release_guards.py +2 −2 Changes for tests/ci/test_release_guards.py: 2 added lines, 2 removed lines. Original line number Diff line number Diff line Loading @@ -18,7 +18,6 @@ import verify # noqa: E402 "tag,version,protected", [ ("v2.0.0", "2.0.0", "true"), ("v2.0.0-release", "2.0.0", "true"), ("v2.0.0rc1", "2.0.0rc1", "true"), ], ) Loading @@ -36,6 +35,7 @@ def test_matching_protected_release_identity(tag, version, protected): ("v2.0.0-release", "2.0.0rc5", "true"), ("v2.0.0-release", "2.0.0", "false"), ("v2.0.0rc5-release", "2.0.0rc5", "true"), ("v2.0.0-release", "2.0.0", "true"), ("", "2.0.0", "true"), ], ) Loading @@ -47,7 +47,7 @@ def test_unapproved_or_mismatched_release_is_refused(tag, version, protected): @pytest.mark.parametrize( "tag,accepted", [ ("v2.0.0-release", True), ("v2.0.0-release", False), ("v2.0.0", True), ("v2.0.0rc5", True), ("v2.0.0rc5-release", False), Loading