Skip to content

A publish job that cannot succeed is not a gate, it is noise #94

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Shashankss1205 merged 1 commit into from
Aug 5, 2026
Merged

A publish job that cannot succeed is not a gate, it is noise #94

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 19 additions & 5 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,13 @@ name: release
# Publishes to PyPI when a `v*` tag is pushed. There is no API token anywhere in
# this repository or in its secrets: publishing uses PyPI Trusted Publishing
# (OIDC), which requires a one-time configuration on PyPI naming this
# repository, this workflow filename, and the `pypi` environment. Until that
# configuration exists the publish step fails closed with an OIDC error rather
# than uploading anything.
# repository, this workflow filename, and the `pypi` environment. Until the
# repository variable PYPI_TRUSTED_PUBLISHING is "true" the publish job is
# skipped rather than attempted — a tag still gets the full build-and-verify
# gate, green, and the release ships however the operator ships it. Flip the
# variable once the PyPI side exists and tags publish themselves; if it is
# flipped without that configuration, the job still fails closed on the OIDC
# exchange rather than uploading anything.

on:
push:
Expand Down Expand Up @@ -139,8 +143,18 @@ jobs:
name: publish to PyPI
needs: build
runs-on: ubuntu-latest
# Tags only. A manual dry run builds and verifies but never uploads.
if: startsWith(github.ref, 'refs/tags/')
# Tags only — and only once Trusted Publishing is actually configured.
# Until the one-time PyPI setup exists, this job cannot succeed: it fails
# closed on the OIDC exchange, which painted every tagged release red
# (v0.1.3, v0.1.4) while the release itself went out by hand. A job that
# is known in advance to fail is not a gate, it is noise that teaches
# people to ignore red. So the job now runs only when the repository
# variable PYPI_TRUSTED_PUBLISHING is set to "true" — flip it in
# Settings -> Secrets and variables -> Actions -> Variables after
# configuring this repo, this workflow filename and the `pypi`
# environment on PyPI. A manual dry run builds and verifies but never
# uploads, exactly as before.
if: startsWith(github.ref, 'refs/tags/') && vars.PYPI_TRUSTED_PUBLISHING == 'true'
environment:
name: pypi
url: https://pypi.org/p/grapharc
Expand Down
Loading