From 08f625b0dfa984335c463414635d749275f65523 Mon Sep 17 00:00:00 2001 From: Emmanuel De Freitas Date: Mon, 10 Aug 2026 12:53:50 -0700 Subject: [PATCH] chore: drop the PyPI publishing scaffolding MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit corpora-docs is a documentation site. It has no pyproject.toml and ships no Python package, but publish.yml still fires on every v* tag and tries to build a wheel and publish it to PyPI as corpora-py — a different repo's package. That is not dormant. release.yml pushes the release tag with an App token specifically so downstream tag workflows fire ("everything downstream hangs off the tag"), so the first release cut from this repo would have run it. Removes publish.yml and the two composite actions only it used. Keeps .github/actions/setup, which release.yml still needs. Also drops the pip dependabot ecosystem, which has no manifests to scan here. Co-Authored-By: Claude Opus 5 --- .github/actions/build-dist/action.yml | 27 ------- .github/actions/publish-pypi/action.yml | 26 ------- .github/dependabot.yml | 5 -- .github/workflows/publish.yml | 95 ------------------------- 4 files changed, 153 deletions(-) delete mode 100644 .github/actions/build-dist/action.yml delete mode 100644 .github/actions/publish-pypi/action.yml delete mode 100644 .github/workflows/publish.yml diff --git a/.github/actions/build-dist/action.yml b/.github/actions/build-dist/action.yml deleted file mode 100644 index 8726863..0000000 --- a/.github/actions/build-dist/action.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: 'Build Distribution' -description: 'Installs uv, builds all workspace packages, and uploads artifacts' -runs: - using: "composite" - steps: - - name: Install uv - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 - with: - enable-cache: true - - - name: Build the corpora-py wheel - shell: bash - run: | - # corpora-py is the only published package: its wheel bundles the - # source of every workspace member (see the root pyproject's - # [tool.hatch.build.targets.wheel]), so a single self-contained wheel - # is all that goes to PyPI. - uv build --wheel --out-dir dist/ - echo "Built wheels:" - ls -lh dist/*.whl - - - name: Upload artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: dist - path: dist/ - if-no-files-found: error diff --git a/.github/actions/publish-pypi/action.yml b/.github/actions/publish-pypi/action.yml deleted file mode 100644 index bb97d8e..0000000 --- a/.github/actions/publish-pypi/action.yml +++ /dev/null @@ -1,26 +0,0 @@ -name: "Publish to PyPI" -description: "Download the corpora-py wheel artifact and publish it to PyPI" -runs: - using: "composite" - steps: - - name: Install uv - uses: astral-sh/setup-uv@v5 # v5 - with: - enable-cache: true - - - name: Download artifact - uses: actions/download-artifact@v8 # v4 - with: - name: dist - path: dist/ - - - name: List wheels to publish - shell: bash - run: ls -lh dist/*.whl dist/*.tar.gz 2>/dev/null || true - - - name: Publish all distributions to PyPI - shell: bash - # `uv publish dist/` passes a directory, which matches no files ("No - # files found to publish"); uv expects file globs. Bare `uv publish` - # defaults to the `dist/*` glob and uploads every built wheel. - run: uv publish diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c1b3a17..d248fee 100755 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,10 +1,5 @@ version: 2 updates: - - package-ecosystem: "pip" # See documentation for possible values. - directory: "/" # Location of package manifests. - schedule: - interval: "weekly" - # Maintain dependencies for GitHub Actions. - package-ecosystem: "github-actions" directory: "/" diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml deleted file mode 100644 index 467166f..0000000 --- a/.github/workflows/publish.yml +++ /dev/null @@ -1,95 +0,0 @@ -# Ships the corpora-py wheel to PyPI - -# - -# Tag-driven only. Versioning used to happen here — a `bump` job incremented - -# the patch on every PR merge and pushed a tag — but under the release-branch - -# model the version is chosen once, when `make release-branch` cuts - -# release/vX.Y.Z and writes X.Y.Z into all four pyproject.toml files. By the - -# time a tag exists, `make tag-release` (release.yml) has already created it - -# from that version. Nothing here needs to bump anything - -# - -# The tag MUST be pushed with the automation App's token, which is what - -# release.yml does: events raised by GITHUB_TOKEN do not start workflow runs - -# so a GITHUB_TOKEN-created tag would leave this workflow — and - -# build-sidecar.yml — silently dead - -# - -# The filename is load-bearing: PyPI trusted publishing is bound to the - -# workflow file `publish.yml` plus the `pypi` environment. Renaming this file - -# breaks OIDC until the publisher is re-pointed on PyPI - -name: Publish - -on: - push: - tags: - - "v[0-9]+.[0-9]+.[0-9]+" # e.g. v1.2.3 - - "v[0-9]+.[0-9]+.[0-9]+-*" # e.g. v1.2.3-rc1 - - workflow_dispatch: - inputs: - publish: - description: "Publish to PyPI (otherwise this only builds the wheel)" - required: false - type: boolean - default: false - -permissions: - contents: read - -# ── jobs ────────────────────────────────────────────────────────────────────── - -jobs: - -# Builds the single self-contained corpora-py wheel, which bundles every - -# workspace member's source - - build: - name: Build distributions - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - - name: Build - uses: ./.github/actions/build-dist - -# Publishes the corpora-py wheel to PyPI (the only published package; it - -# bundles corpora-common/-mcp/-admin). Uses OIDC trusted publishing — no - -# stored token - - publish: - name: Publish Python 🐍 distributions 📦 to PyPI - needs: [ build ] - if: | - startsWith(github.ref, 'refs/tags/v') || - (github.event_name == 'workflow_dispatch' && inputs.publish == true) - runs-on: ubuntu-latest - environment: - name: pypi - url: - permissions: - actions: read - id-token: write # mandatory for OIDC trusted publishing - contents: read - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - - name: Publish - uses: ./.github/actions/publish-pypi