Repository navigation
release: Qualify packages before publishing - #52
BenWestgate wants to merge 3 commits into
Conversation
This comment has been minimized.
This comment has been minimized.
BenWestgate
added
ci
BenWestgate
left a comment
BenWestgate
left a comment
There was a problem hiding this comment.
AI-generated review (Claude), posted at the maintainer's request.
Concept ACK f4f9a48. Two things before merge:
- Trigger: it still runs on
release: published, so the GitHub release and tag are public before any gate runs, and a failed qualification leaves a public release with no assets. For "qualify before publish", trigger onpush: tags: ['v*']and havepublishcreate the release, or publish a draft from the workflow. - 3.15 with #36: the matrix comes from classifiers, so once #36 lands it includes 3.15.
setup-pythonhere lacksallow-prereleases: true, so a release cut before 3.15.0 final fails that leg.
Smaller:
BenWestgate
left a comment
BenWestgate
left a comment
There was a problem hiding this comment.
AI-generated review, posted at the maintainer's request.
Concept ACK a653876. The release now qualifies on tag push, Core tests the built wheel, prerelease Python is supported, and GitHub stays draft until PyPI publication succeeds.
No remaining code blocker from my review. First tag remains the required end-to-end validation of the release workflow.
|
Release-gate sequencing: defer final review of this publication workflow until the prerequisite runtime/CI gates settle. In particular, merge #7 then #51 (wallet/Core qualification) and #50 then refreshed #47 (active test-workflow hardening/assurance), then refresh #52 once on the resulting |
|
Release-monitor refresh (2026-09-27/28): upstream |
|
Agent release-gate review at current head |
a653876 to
9cf9f44
Compare
BenWestgate
left a comment
BenWestgate
left a comment
There was a problem hiding this comment.
Codex current-head re-review: ACK 9cf9f44 for the release-qualification design.
The workflow builds distributions once, derives the supported Python matrix from package metadata, permits prerelease interpreters, verifies wheel and sdist in isolated environments, runs optimized/static/differential checks, installs the qualified wheel for the real-Core job, records hashes/provenance, and only publishes after those jobs succeed. Both prior inline findings are resolved. Exact-head Python-package run 645 and Bitcoin Core wallet-fixture run 31 succeeded.
The tag-triggered publication path itself cannot be exercised by this PR; the first real release tag remains the required end-to-end proof. No review blocker found.
BenWestgate
left a comment
BenWestgate
left a comment
There was a problem hiding this comment.
Codex current-head review at 9cf9f44: no findings. Release publication is gated on the supported matrix, optimized/static checks, real-Core integration, and a final SHA-256 check of the exact downloaded build artifacts before PyPI/GitHub publication.
BenWestgate
left a comment
BenWestgate
left a comment
There was a problem hiding this comment.
AI-assisted current-head review: ACK 9cf9f44. The workflow builds the wheel/sdist once, records their hashes, qualifies those exact artifacts across supported interpreters/OSes, runs optimized/static/differential checks, installs the built wheel for the real-Core job, rechecks hashes immediately before publication, stages a draft GitHub release, publishes the qualified distributions to PyPI, then makes the GitHub release public. Installed-package verification runs in a clean temporary venv with PYTHONPATH removed and rejects importing the source checkout. The available official Core rc2 binary remains pinned by an explicit SHA-256 rather than substituting an unavailable rc3 archive. Exact-head Python/Core CI is green and all review threads are resolved. No release-blocking defect found.
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
9cf9f44 to
9ed60fa
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9ed60fa01a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
c4952c9 to
cbecf9c
Compare
Build distributions once, qualify the exact wheel and sdist across the supported Python/OS matrix, run optimized/static/differential and real-Core checks, and publish only after those jobs pass. Record source SHA, dependency environments, Bitcoin Core version, artifact hashes, and qualification results in a release provenance bundle. Scrub PYTHONPATH and user-site imports in installed-artifact checks so the source checkout cannot satisfy the test accidentally. Security: release qualification uses pinned Bitcoin Core v32.0rc2 bytes and read-only permissions until the final publication job. Validation: 865 normal and 865 optimized tests passed; mypy, Ruff check/format, build and Twine passed; exact wheel and sdist both passed isolated installed-package verification with PYTHONPATH deliberately contaminated; workflow YAML parses successfully. Fixes #5.
cbecf9c to
446df19
Compare
Require successful source CI for the tagged commit, then build the wheel and sdist once. Install and smoke-test the exact distributions across supported Python versions and operating systems. Recheck hashes before uploading those same bytes to PyPI and a draft GitHub release. Set GH_REPO explicitly and derive prerelease status from package metadata. Keep stable-version publication disabled until #207 wires in the stable-Core job; the existing PyPI environment has no approval rules. Remove the RC-specific download and duplicate source/static test jobs. Validated the workflow's shell blocks and YAML; exercised release metadata, source-CI rejection, draft retries, prerelease flags and hash failure with local mocks. Built both distributions and passed their isolated install/smoke checks, Twine and focused Ruff checks on Linux Python 3.14. Publishing and the hosted OS matrix were not executed. Refs #5, #52, #207.
446df19 to
7dd36e3
Compare
BenWestgate
changed the title
Retain the tested package qualification workflow, explicit GH_REPO, prerelease classification and stable-publication guard from the proposed reduction. Remove RC-specific release integration and duplicate source checks; #207 tracks stable Core qualification and #164 its binary pin. Keep #52 on its existing native-stack base because GitHub rejects base retargeting while it is part of a stack. This replacement retains only the three intended release-file changes and does not carry unrelated integration-base changes into the PR. Build, isolated wheel/sdist checks, Twine, focused Ruff, metadata cases, source-CI refusal, hash-tampering rejection and mocked release creation passed on Linux Python 3.14. No actual release publication was performed. Refs #5, #52, #207.
7dd36e3 to
cac1544
Compare
Build the wheel and source distribution once, install and smoke-test those exact files across the supported Python/OS matrix, and publish the same bytes only after qualification.
Require successful normal CI for the tagged source commit, record package hashes and the source SHA, stage a draft GitHub release, publish the packages to PyPI, then publish the GitHub release. GH_REPO is explicit and the GitHub prerelease flag comes from the package version, fixing both review findings.
Removed duplicated source/static/differential jobs, the RC-specific Core download/job, and dependency/provenance bundles. Normal CI remains required rather than being repeated here.
Stable-version tags build and qualify packages but cannot publish them yet. #207 tracks the required installed-wheel integration job with official stable Core binaries and removal of the temporary prerelease-only publication guard. #164 owns the stable fixture/tutorial pin. The pypi environment currently has no approval rules, so this condition prevents accidental stable publication. This PR does not close #5's production v1 gate.
The reduced diff changes only three release files. GitHub rejects retargeting #52 while it belongs to a native stack, so its existing base is retained; the tested reduction is
cac1544, without unrelated integration changes.Validation: built wheel and normalized sdist; both passed isolated offline installation/smoke tests on Linux Python 3.14. Twine and focused Ruff lint/format checks passed. Local workflow exercises covered rc/alpha/dev/stable/post metadata, mismatched tags, missing/failed source CI, draft retries, correct repository/prerelease flags, refusal to modify public releases, and hash-tampering rejection. YAML and all shell blocks parse. The same reduced release files also passed against current reviewability-v1. No release was published during testing; fresh hosted CI/review and the real tag publication path remain to be qualified.
AI assistance was used for this maintainer-directed reduction. Refs #5, #207.