Repository navigation
fix(ci): run release jobs on hosted runners and gate the PyPI publish (ENG-2000) - #90
Open
lucas-koontz wants to merge 2 commits into
Open
lucas-koontz wants to merge 2 commits into
lucas-koontz wants to merge 2 commits into
Conversation
The release integration tests and the PyPI publish run on ubuntu-latest instead of mdb-dev. GitHub recommends GitHub-hosted runners for public repositories. Both jobs keep the secrets and variables they use today. deploy_to_pypi publishes only when the triggering run of "Run Integration Tests on Release" succeeded, came from a release event and has its head in this repository. It checks out that run's head_sha, so PyPI gets the commit the tests ran on, not the default branch's head. The release test step passes MINDS_API_TOKEN and MINDS_API_BASE_URL, the names tests/integration/config.py reads. With MINDS_API_KEY and BASE_URL, config.py fails at import and pytest exits 4 before any test runs, so the new gate could never pass. Both release workflows pin actions/checkout and actions/setup-python to commit SHAs with version comments, and their checkouts set persist-credentials: false. The clean step globs ./*.egg-info, and the publish step's comment says what it builds. The workflow_run trigger carries an inline zizmor ignore for dangerous-triggers. tests/unit/test_workflows.py checks the publish conditions, the checkout ref and that workflow_run stays the only trigger. It also checks that no workflow names a self-hosted runner label, that a failing test fails the release run, the env names, the pins and persist-credentials. requirements_test.txt gains pyyaml for it. Part of Lucas Koontz's ticket "Take the public repos off the credentialed runner group and require devops to release a privileged run". Refs: ENG-2000
|
I have read the CLA Document and I hereby sign the CLA You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot. |
This was referenced Oct 4, 2026
Draft
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User story
As a maintainer who publishes minds-sdk releases
I want the release tests and the PyPI upload to run on GitHub-hosted runners, with the upload waiting for the tests to pass
So that PyPI gets only versions whose integration tests passed, built from a commit that
mainholdsWhy this matters
When a maintainer publishes a minds-sdk release, PyPI gets it whether or not its release tests pass, so users can install a version that failed them. Versions 2.0.0 and 2.0.1 both reached PyPI after their release test runs failed. The 2.0.1 run could not have passed: the workflow sets
MINDS_API_KEYandBASE_URL, buttests/integration/config.pyreadsMINDS_API_TOKENandMINDS_API_BASE_URL, so pytest exits 4 at import. Both jobs also run on a self-hosted runner, and GitHub recommends GitHub-hosted runners for public repositories. A release tag can also point at a branch commit that never merged, so the publish now checks thatmainholds the commit it builds.Test plan
Each line is a test in
tests/unit/test_workflows.pyunless it says otherwise.ubuntu-latest, and no workflow names a self-hosted runner in any letter case.releaserun from this repository, anddeploy.ymlhas no other trigger.maindoes not hold fails before the upload. The test runs the check against a real git history.MINDS_API_TOKENandMINDS_API_BASE_URL, and with thempytest tests/integration --collect-onlycollects 5 tests (run by hand)..git/config.Part of ENG-2000. This PR depends on no other change.