[REFACTOR](ci) Remove the real-PyPI priming dispatch path - #699
Open
John McCall (lowlydba) wants to merge 2 commits into
Open
[REFACTOR](ci) Remove the real-PyPI priming dispatch path#699John McCall (lowlydba) wants to merge 2 commits into
John McCall (lowlydba) wants to merge 2 commits into
Conversation
All 12 packages are primed on both pypi.org and test.pypi.org (see #653), so the workflow_dispatch arget: pypi option has no remaining use and is standing attack surface: a compromised or careless dispatch could put a .dev0 on the real index. Drops the arget input entirely since test-pypi is now the only choice, and simplifies every conditional in release-publish.yaml that branched on inputs.target == 'pypi'. The Test PyPI dispatch path stays; it has no production blast radius and stays useful for ongoing pipeline verification. Also fixes docs/versioning.md's release-flow table, which described real-PyPI dispatches as requiring a pypi-dispatch-<package> approval environment. That gate never existed: dispatch reuses pypi-release-<package>. Fixes #688 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org>
John McCall (lowlydba)
force-pushed
the
remove-pypi-priming-dispatch
branch
from
August 26, 2026 21:07
e69b062 to
ad73210
Compare
John McCall (lowlydba)
temporarily deployed
to
staging
August 26, 2026 21:08 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
John McCall (lowlydba)
marked this pull request as ready for review
August 26, 2026 21:08
🗺️ Schema reference docs preview is live!
Note ♻️ This preview updates automatically with each push to this PR. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR removes the workflow_dispatch path that could publish priming .dev0 builds to real PyPI, leaving workflow_dispatch as a Test PyPI-only publish for pipeline verification, and updates the versioning documentation accordingly.
Changes:
- Removes the
targetinput fromrelease-publish.yamland simplifies all logic that branched on real-PyPI vs Test PyPI dispatches. - Updates the
release-publish.yamlheader/comments and publish step labeling to reflect the remaining Test PyPI dispatch behavior. - Fixes the release-flow documentation to remove references to a non-existent approval-gated “pypi-dispatch-” environment.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.github/workflows/release-publish.yaml |
Drops real-PyPI priming dispatch option and simplifies dispatch conditionals to Test PyPI only. |
docs/versioning.md |
Updates release-flow table to reflect Test PyPI-only dispatch and correct environment-gating description. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There is no separate automated Test PyPI path; workflow_dispatch is the only one. Per review feedback on PR #699. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of Branching Strategy Phase 3, closing out the last open item on that phase's definition of done.
release-publish.yamlshipped in #638. #653 then set up PyPI Trusted Publishing and added a temporary real-PyPI dispatch path to prime it; all 12 packages are now primed on both pypi.org and test.pypi.org (see #653's latest status comment), so this PR tears that path back out, leaving the publish pipeline in its permanent shape.workflow_dispatch'starget: pypioption is standing attack surface with no remaining use: a compromised or careless dispatch could put a.dev0on the real index, gated by nothing beyond repo write access. Drops thetargetinput entirely sincetest-pypiis now the only choice, and simplifies every conditional that branched oninputs.target == 'pypi'(job name, environment selection, publish step name,repository-url). The Test PyPI dispatch path stays; it has no production blast radius and remains useful for ongoing pipeline verification.Also fixes
docs/versioning.md's release-flow table, which described real-PyPI dispatches as requiring apypi-dispatch-<package>approval environment. That gate never existed: dispatch reusespypi-release-<package>, the same environment the automated release path uses.Fixes #688