Skip to content

ci: inline beta release jobs to fix PyPI trusted publishing#1875

Merged
vdusek merged 2 commits intomasterfrom
fix/inline-beta-release-for-pypi
May 7, 2026
Merged

ci: inline beta release jobs to fix PyPI trusted publishing#1875
vdusek merged 2 commits intomasterfrom
fix/inline-beta-release-for-pypi

Conversation

@vdusek
Copy link
Copy Markdown
Collaborator

@vdusek vdusek commented May 6, 2026

Summary

PyPI's Trusted Publishing rejects OIDC tokens issued from reusable workflows:

The claims in this token suggest that the calling workflow is a reusable workflow. Reusable workflows are not currently supported by PyPI's Trusted Publishing.

on_master.yaml was invoking manual_release_beta.yaml via uses:, which made the OIDC token reflect a reusable workflow call. The same fix was applied in apify/apify-shared-python#63.

Changes

  • on_master.yaml: inline the four beta release jobs (release_prepare, changelog_update, pypi_publish, doc_release_post_publish) directly, instead of calling manual_release_beta.yaml as a reusable workflow.
  • manual_release_beta.yaml: remove the workflow_call trigger (no longer invoked from another workflow) and add a comment explaining why the duplication exists.
  • Drop the unused tag_name output from release_prepare in both files.

Follow-up

The PyPI Trusted Publisher for crawlee is currently configured for manual_release_beta.yaml. After this is merged, an entry for on_master.yaml needs to be added on PyPI so the automatic beta release passes verification.

See: https://docs.pypi.org/trusted-publishers/troubleshooting/#reusable-workflows-on-github

PyPI's Trusted Publishing rejects OIDC tokens issued from reusable workflows,
so the beta release jobs are inlined into on_master.yaml instead of being
invoked via `uses:` from manual_release_beta.yaml.
@vdusek vdusek added t-tooling Issues with this label are in the ownership of the tooling team. adhoc Ad-hoc unplanned task added during the sprint. labels May 6, 2026
@vdusek vdusek self-assigned this May 6, 2026
@vdusek vdusek requested a review from janbuchar May 6, 2026 08:02
@github-actions github-actions Bot added this to the 140th sprint - Tooling team milestone May 6, 2026
@vdusek vdusek changed the title fix: inline beta release jobs to fix PyPI Trusted Publishing ci: inline beta release jobs to fix PyPI trusted publishing May 6, 2026
@codecov
Copy link
Copy Markdown

codecov Bot commented May 6, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.54%. Comparing base (65bf68d) to head (5b702f5).

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1875      +/-   ##
==========================================
- Coverage   92.57%   92.54%   -0.03%     
==========================================
  Files         158      158              
  Lines       11078    11078              
==========================================
- Hits        10255    10252       -3     
- Misses        823      826       +3     
Flag Coverage Δ
unit 92.54% <ø> (-0.03%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@vdusek
Copy link
Copy Markdown
Collaborator Author

vdusek commented May 7, 2026

merging it, as I have a feat PR in the pipeline that I can use for testing it

@vdusek vdusek merged commit b723b58 into master May 7, 2026
32 checks passed
@vdusek vdusek deleted the fix/inline-beta-release-for-pypi branch May 7, 2026 08:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

adhoc Ad-hoc unplanned task added during the sprint. t-tooling Issues with this label are in the ownership of the tooling team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants