chore: release workflow, CI hardening, dependency refresh, small fixes - #108
chore: release workflow, CI hardening, dependency refresh, small fixes#108HarryMWinters wants to merge 1 commit into
Conversation
…ixes - Add Release workflow publishing to PyPI via Trusted Publishing on a GitHub release; tag must match pyproject version. Document in CONTRIBUTING. - Test workflow: read-only permissions, cancel superseded runs, pass a token to setup-task to avoid anonymous API rate-limit failures. - Dependabot: group minor/patch pip updates and all actions updates. - pre-commit autoupdate (black 26.5, isort 9, mypy 2.3, flake8 7.3, bandit 1.9, poetry 2.4); poetry-lock --check -> poetry-check --lock. - Widen dev constraints (pre-commit/pylint 4.x, uvicorn, types-cachetools) and refresh the lock: cryptography 46 -> 50.0.1, fastapi 0.141, starlette 1.6, pydantic 2.13.5, requests 2.34. httpx2 replaces httpx for TestClient, silencing Starlette's deprecation warning. - discovery.py: raise_for_status on the JWKS fetch so an error body is not parsed and cached as a key set; tests added (coverage 93% -> 96%). - types.py: OIDCConfig.signature_cache_ttl is int, not str. - Taskfile publish uses a PYPI_TOKEN; stop tracking .env, add .env.example. - Ignore .serena/; freshen .agents. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0d348a6cf7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| on: | ||
| release: | ||
| types: [published] | ||
| workflow_dispatch: |
There was a problem hiding this comment.
When this workflow is started through workflow_dispatch, the build job skips the version/tag guard because that step only runs for release events, but the publish job still uploads to PyPI unconditionally. A maintainer can therefore select any branch or ref and create an irreversible PyPI release without a corresponding validated tag; remove the manual trigger or require and validate a release tag before allowing the publish job to run.
Useful? React with 👍 / 👎.
1 participant
Stacked on #107 (base branch is
feat/switch-to-pyjwt; GitHub retargets tomasteronce that merges).Release process
Releaseworkflow: builds with Poetry and publishes to PyPI via Trusted Publishing when a GitHub release is published. No token stored anywhere. Refuses to publish if the release tag doesn't matchpyproject.toml.HarryMWinters, repofastapi-oidc, workflowrelease.yaml, environmentpypi) and create thepypienvironment in this repo's settings. Steps are in CONTRIBUTING.md.task publishnow takes aPYPI_TOKEN(PyPI no longer accepts username/password)..envis untracked;.env.exampleadded.CI
permissions: contents: read,concurrencyto cancel superseded runs, andrepo-tokenpassed toarduino/setup-task(the anonymous rate limit is what failed the mypy Dependabot PR's 3.13 job).Dependencies
pre-commit autoupdate: black 26.5.1, isort 9.0.1, mypy v2.3.1, flake8 7.3.0, bandit 1.9.4, pre-commit-hooks v6, poetry 2.4.1. Hook versions now match the Poetry-managed ones, so local formatting agrees with CI.poetry-lock --check→poetry-check --lock(Poetry 2 syntax).pre-commit/pylintallow 4.x,uvicorn >=0.49,types-cachetools <8) and refreshed the lock. Notable: cryptography 46.0.7 → 50.0.1 (clears the four remaining cryptography advisories), fastapi 0.141.1, starlette 1.6.0, pydantic 2.13.5, requests 2.34.2, cachetools 7.1.8.httpx2replaceshttpxas theTestClientbackend; the Starlette deprecation warning is gone.Fixes
discovery.py: JWKS fetch now callsraise_for_status(). Previously a 4xx/5xx body would be.json()-parsed and cached as a key set for the TTL.types.py:OIDCConfig.signature_cache_ttlwas typedstr; it is anint.Housekeeping
.serena/ignored,.agentsversion/dev-deps text no longer hardcodes stale values.Deliberately not done
38 tests pass, all pre-commit hooks pass on the new pins.
🤖 Generated with Claude Code