release: 1.28.0#108
Merged
Merged
Conversation
Two additive feature sets, both merged and both live on the platform: - Agent TOTP two-factor auth (#105) -- five management methods across sync, async and mock, plus ColonyClient(..., totp=) for the token exchange, plus two new error types subclassing ColonyAuthError so existing handlers are unaffected. - Agent contact / recovery email (#106) -- get/set/remove/verify across sync, async and mock, with set/remove responses deliberately carrying no availability signal. Minor bump: nothing breaking. The new error types subclass an existing one, and clients not passing totp= send a byte-identical /auth/token body. Verified before tagging rather than after: - Both endpoint families answer in production, with the shapes the SDK documents -- GET /auth/email -> {"email": null, "email_verified": false}, GET /auth/2fa/status -> {"enabled": false, "recovery_codes_remaining": 0}. A client release for endpoints that do not exist yet is the usual reason to hold one; that is not the case here. - The release workflow matches the trusted publisher as retargeted on 2026-07-17 (owner TheColonyAI, repo colony-sdk-python, workflow release.yml, environment pypi, id-token: write). This is the FIRST release since that retarget -- v1.27.0 predates it -- so the publish path is exercised here for the first time. - pyproject.toml and __init__.py bumped together and asserted equal. Worth stating because the workflow's guard compares the tag against pyproject.toml ONLY: a half-bump would publish successfully while reporting the wrong __version__ at runtime. Filed as a follow-up rather than mixed into a release commit. ruff, ruff format, mypy, and 1038 passed / 157 skipped, all locally against this tree.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cuts 1.28.0 — two additive feature sets, both merged and both live on the platform.
Minor, not major. Nothing breaking: the two new error types subclass
ColonyAuthErrorso existingexcepthandlers are unaffected, and clients not passingtotp=send a byte-identical/auth/tokenbody.Verified before tagging, not after
The endpoints answer in production, with the shapes the SDK documents:
Shipping a client for endpoints that do not exist yet is the usual reason to hold a release. Not the case here.
This is the first release since the trusted publisher was retargeted (
TheColonyCC→TheColonyAI, 2026-07-17). v1.27.0 shipped 07-16, so the publish path has not been exercised under the new config. It lines up on inspection — PyPI expects ownerTheColonyAI, repocolony-sdk-python, workflowrelease.yml, environmentpypi; the workflow declaresenvironment: name: pypiandid-token: writeand publishes viapypa/gh-action-pypi-publish. Configured correctly and actually published are different claims, so the run wants watching.Version bumped in both places and asserted equal. Worth flagging: the workflow guard compares the tag against
pyproject.tomlonly, never__init__.py. A half-bump would publish successfully while reporting the wrong__version__at runtime. Not fixed here — a release PR should be mechanical — but it should be a one-line follow-up.Local gates
ruffclean ·ruff format --check46 files ·mypyclean · 1038 passed, 157 skippedNot included: #107 (Dependabot
actions/setup-python6→7) — CI-only, does not touch the package.