Gate PyPI publication on immutable candidate validation - #28
Closed
acecchini wants to merge 4 commits into
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The previous workflow published an arbitrary selected ref after building it, without a test gate. This change resolves one commit, requires matching workflow/tag/package identity and main ancestry for publication, checks prerelease status, and runs the complete reusable validation against that immutable commit. Publication consumes the same validated distributions and does not rebuild them.
Dispatch defaults to validation only. The final pypi environment job alone receives OIDC permission. A separate evidence artifact records source SHA, package version, artifact hashes and run URL. CONTRIBUTING records the exact procedure and administrative protections still requiring owner action.
Validation: 19 tests against disposable real Git histories cover valid releases and bypass rejection; hooks and actionlint pass. All PR checks passed. The actual validation-only run https://github.com/acecchini/bearshape/actions/runs/34221337124 completed 38 jobs successfully and skipped publication. Its normally installed wheel passed 1,097 tests at each Python endpoint and subsequently all 95 CuPy tests at both GPU endpoints. The ExecPlan records exact artifact hashes.
Stacked on #27. Native union rollback, CuPy static policy, administrative controls and user merge approval remain explicit release decisions. No publication, transfer or settings mutation occurred.
Integration record: this reviewed head is preserved in main through PR #31, merge commit df81f00. The owner approved merging this work. This dependent PR is closed as integrated; its commits were not squashed or discarded.