From e2857f1eeb12f9c6946977fd1bd62813ccc705ca Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 27 Jul 2026 16:21:57 +0000 Subject: [PATCH] fix(release): publish only verified wheel --- .gitea/workflows/package-release.yml | 7 ++++--- docs/prds/0083-packaged-infra-artifacts.md | 6 ++++-- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/package-release.yml b/.gitea/workflows/package-release.yml index beefe37e..7d621847 100644 --- a/.gitea/workflows/package-release.yml +++ b/.gitea/workflows/package-release.yml @@ -51,17 +51,18 @@ jobs: - name: Build package with assigned infrastructure pins env: BOT_BOTTLE_RELEASE_MANIFEST: ${{ github.workspace }}/release-manifest.json - run: python3 -m build + run: python3 -m build --wheel - name: Verify packaged manifest run: | + test "$(find dist -maxdepth 1 -name '*.whl' -type f | wc -l)" -eq 1 python3 -m venv verify-venv verify-venv/bin/pip install --no-deps dist/*.whl verify-venv/bin/python -c \ 'from bot_bottle.release_manifest import load_manifest; print(load_manifest())' - - name: Upload release package + - name: Upload verified release wheel uses: actions/upload-artifact@v3 with: name: bot-bottle-release - path: dist/ + path: dist/*.whl diff --git a/docs/prds/0083-packaged-infra-artifacts.md b/docs/prds/0083-packaged-infra-artifacts.md index 90f2839e..ed10ee21 100644 --- a/docs/prds/0083-packaged-infra-artifacts.md +++ b/docs/prds/0083-packaged-infra-artifacts.md @@ -127,10 +127,12 @@ The release job operates on one tested commit: 4. Publish both generic-package artifacts and retain their versions and compressed-file checksums. 5. Generate `release-manifest.json` from those published identities. -6. Build the wheel/sdist with that manifest. +6. Build the wheel with that manifest. Do not produce a source distribution: + rebuilding an sdist outside this release boundary could replace the pins + with the development manifest. 7. Install the wheel in a clean environment and assert that every manifest identity is valid and retrievable. -8. Publish the Python distribution. +8. Publish only that verified wheel. The build hook receives the manifest as a file input. It must not query a registry or choose versions itself: package builds stay deterministic and