Set up PyPI publishing via trusted publishing#4
Merged
Conversation
- .github/workflows/release.yml: on v* tag push, verify the tag matches the package version, uv build, uv publish with OIDC trusted publishing (environment: pypi). One-time PyPI-side setup documented in the workflow header and README. - Exclude node_modules from sdist and wheel — the wheel was silently 66 MB / 14k files before; it is now 2 MB with the built viewer bundle and frontend sources intact. - README: release procedure; .copier-answers.yml: publish_to_pypi true. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LLg5cbBcfNyyrRGJVPfsA6
LICENSE file plus PEP 639 metadata (license = "MIT", license-files); the wheel now carries License-Expression: MIT and bundles the license text. Copier answers updated to match. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LLg5cbBcfNyyrRGJVPfsA6
Add workflow concurrency (one release at a time, no cancel-in-progress), name the publish job, and disable setup-uv cache restore in the publish job so a poisoned cache cannot tamper with what gets uploaded to PyPI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LLg5cbBcfNyyrRGJVPfsA6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishes
inspect-datasetto PyPI onv*tag pushes via trusted publishing (OIDC — no API tokens stored).What's included
.github/workflows/release.yml— on tag push: verify the tag matches the pyproject version,uv build,uv publish --trusted-publishing alwaysunder apypienvironment withid-token: write. Actions are hash-pinned per the zizmor policy; the workflow has concurrency limits and disables setup-uv cache restore in the publish job (cache-poisoning hardening).LICENSEfile plus PEP 639 metadata (license = "MIT",license-files); the wheel carriesLicense-Expression: MITand bundles the license text.node_moduleswas being swept into both sdist and wheel. Excluded via the uv build backend; the wheel is now 2 MB with the built viewer bundle and frontend sources intact (verified by inspecting the archives)..copier-answers.ymlrecordspublish_to_pypi: true,license: MIT.One-time manual step (owner only)
Register a Trusted Publisher at https://pypi.org/manage/account/publishing/ — repository
Generality-Labs/inspect_dataset, workflowrelease.yml, environmentpypi. Theinspect-datasetname is currently unclaimed on PyPI, so this can be a pending publisher.🤖 Generated with Claude Code
https://claude.ai/code/session_01LLg5cbBcfNyyrRGJVPfsA6