axe-selenium-python

[Stormheg]

Hi @django-commons/axe-selenium-python - we'll be using this public discussion to occasionally check-in and assist you with any issues that crop up. Feel free to ask our help here and tag @django-commons/admins and one of us will get back to you as soon as possible.

If you'd like to chat with us privately, our email is [email protected]. Thanks!

[Stormheg]

To start off, I wanted to publicly share some of the notes I made during the transfer call with @thibaudcolas on September 18th, 2025. These are minor issues or questions we ran in to during the transfer call.

Sigstore in release action

The release workflow pull request (django-commons/axe-selenium-python#209) introduced an extra step to the release process that signs the Python distrubution with sigstore.

Thibaud asked me what sigstore is and what it does. Me, being unfamiliar with sigstore myself, was not in a position to answer this accurately. We, as admins, can do a better job of explaining our suggested release action workflow.

Since I suppose I technically still owe you an explanation @thibaudcolas, here is my understanding of it now summarized as one paragraph:

Sigstore is a project that lowers the barrier of implementing software signing in your project. Traditionally, software signing can be quite complex but sigtore integrates with providers like GitHub to make this easy. By signing your software, it helps users verify releases really came from you and haven't been tampered with. This helps protect the software supply chain from bad actors.

Migrating GitHub project boards

The maintainers of axe-selenium-python have created a GitHub project board to document maintenance tasks. Unfortunately, these boards are bound to a user or organization and GitHub does not allow you to transfer them. There is an open feature request for that: https://github.com/orgs/community/discussions/8548

In this specific case, it wasn't a big issue because there were only a few items on the board and not too difficult to recreate on a new board in the Django Commons organization. It is still a point of friction and something to be aware of for future projects that use GitHub projects extensively.

[tim-schilling]

For what it's worth, I pulled the original release.yml file from the PyPI packaging tutorial.

[ryancheley]

I took at a look at the sigstore GitHub Action repo and it had this comment in the readme

Important

Are you publishing a package to PyPI? If so, you do not need this action:
pypa/gh-action-pypi-publish
will handle signing for you!

It looks like the tutorial may have been updated to use this new guidance.

Given that I believe the best action would be to create an issue to update our release.yml

[tim-schilling]

Makes sense. We need to update the best practices repo too. Thanks Ryan!

[ryancheley]

Created issue 14 for this effort