pinecrew / pined-django / 33416001761

95%

push

github

repo: publish to PyPI on a tag

`release.yml` runs on `v*`. The tag is the version: `uv version --frozen`
writes it into `pyproject.toml` before the build, so a tag that is not a PEP
440 version fails there rather than halfway through an upload, and the version
committed in `pyproject.toml` only matters to a local `uv build`. The version
is read back after being set, since PEP 440 normalizes — `v1.2.3-rc1` builds
files named `1.2.3rc1` — and the artifacts are checked to carry it.

Nothing is uploaded until `lint` and every cell of the matrix has passed on
that exact tag, which `ci.yml` now offers through `workflow_call`. Its
concurrency group loses `github.workflow`: called from another workflow that
expands to the caller's name, which would put the called run in the same group
as the run waiting on it and cancel the one it belongs to.

The upload uses PyPI's trusted publishing, so the repository holds no token —
`id-token: write` is what makes the workflow's own identity available, and what
signs the attestations. It needs a pending publisher configured on PyPI before
the first tag.

`CONTRIBUTING.md` takes the release procedure, that setup, and the development
section the README used to carry. `readme = "README.md"` is the package's
long description, so all of it was rendering on a PyPI page for people who only
wanted to install the thing. The sdist ships the README and the LICENSE, and
not this.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

201 of 246 branches covered (81.71%)

Branch coverage included in aggregate %.

1113 of 1302 relevant lines covered (85.48%)

0.85 hits per line