Skip to content

Fix auto-release: dispatch publish instead of a reusable-workflow call - #26

Merged
aersam merged 1 commit into
mainfrom
fix-auto-release-oidc
Sep 7, 2026
Merged

Fix auto-release: dispatch publish instead of a reusable-workflow call#26
aersam merged 1 commit into
mainfrom
fix-auto-release-oidc

Conversation

@aersam

@aersam aersam commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

No description provided.

The just-merged fix (calling python-publish.yml's deploy job directly
via workflow_call) avoided needing a PAT, but broke PyPI's OIDC
trusted publishing: PyPI does not support trusted publishing from
reusable/called workflows and rejected the token, confirmed by
gh-action-pypi-publish's own warning annotation on the run
(https://docs.pypi.org/trusted-publishers/troubleshooting/#reusable-workflows-on-github).

Fix: python-publish.yml goes back to being a plain, directly-triggered
top-level workflow (workflow_call trigger removed). auto-release.yml
instead dispatches it via `gh workflow run` (workflow_dispatch) using
the default GITHUB_TOKEN -- workflow_dispatch is the documented
exception to GitHub Actions' "GITHUB_TOKEN can't trigger other
workflows" rule, so this needs no PAT either.

Also: gate the "already done" check on whether the version is
actually on PyPI (not just whether a GitHub Release exists for it) --
today's v0.4.0 already has a release from the earlier partial
failure, but never reached PyPI, and the old exists-check would have
skipped it forever.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FPDh1XcpTJT48Tw27fD7Ms
@aersam
aersam merged commit 5dbef5d into main Sep 7, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant